joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434ae0
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push ebx
push esi
mov esi, dword [edx + 4]
push edi
mov edi, ecx
not edi
mov edx, esi
and esi, edi
and edx, ecx
mov ebx, eax
and ebx, edi
and eax, ecx
or esi, eax
or edx, ebx
mov ecx, esi
mov edi, esi
shr edi, 0x10
and edi, 0x7ff
movzx edi, byte [edi + 0x467960]
mov ebx, dword [edi*8 + 0x467160]
mov edi, dword [edi*8 + 0x467164]
shr ecx, 0x18
shr edi, 6
mov eax, edx
shl eax, 8
or ecx, eax
and ecx, 0x1fff
movzx ecx, byte [ecx + 0x468160]
mov eax, dword [ecx*8 + 0x467160]
mov ecx, dword [ecx*8 + 0x467164]
shr ecx, 7
or ecx, edi
mov edi, esi
shr edi, 8
and edi, 0x1fff
movzx edi, byte [edi + 0x468160]
shr eax, 7
shr ebx, 6
or eax, ebx
mov ebx, dword [edi*8 + 0x467160]
mov edi, dword [edi*8 + 0x467164]
shr edi, 5
or ecx, edi
mov edi, esi
and edi, 0x7ff
movzx edi, byte [edi + 0x467960]
shr ebx, 5
or eax, ebx
mov ebx, dword [edi*8 + 0x467160]
mov edi, dword [edi*8 + 0x467164]
shr edi, 4
or ecx, edi
shl esi, 8
mov edi, edx
shr edi, 0x18
or edi, esi
and edi, 0x7ff
movzx esi, byte [edi + 0x467960]
mov edi, dword [esi*8 + 0x467160]
mov esi, dword [esi*8 + 0x467164]
shr esi, 3
or ecx, esi
mov esi, edx
shr esi, 0x10
and esi, 0x1fff
movzx esi, byte [esi + 0x468160]
shr ebx, 4
shr edi, 3
or eax, ebx
or eax, edi
mov edi, dword [esi*8 + 0x467160]
mov esi, dword [esi*8 + 0x467164]
shr edi, 2
shr esi, 2
or eax, edi
or ecx, esi
mov esi, edx
and edx, 0x1fff
movzx edx, byte [edx + 0x468160]
shr esi, 8
and esi, 0x7ff
movzx esi, byte [esi + 0x467960]
mov edi, dword [esi*8 + 0x467160]
mov esi, dword [esi*8 + 0x467164]
shr edi, 1
or eax, edi
or eax, dword [edx*8 + 0x467160]
shr esi, 1
or ecx, esi
or ecx, dword [edx*8 + 0x467164]
mov edx, dword [ebp + 0x10]
mov esi, dword [edx + 4]
mov edi, esi
shr edi, 5
and edi, 0x700
mov edx, eax
shr edx, 0x18
or edx, edi
movzx edx, byte [edx + 0x467960]
mov ebx, eax
shr ebx, 0x10
movzx edi, bl
mov ebx, esi
shr ebx, 2
and ebx, 0x700
or edi, ebx
movzx edi, byte [edi + 0x467960]
shl edx, 8
or edx, edi
mov ebx, eax
shr ebx, 8
movzx edi, bl
mov ebx, esi
and ebx, 0x3e0
add ebx, ebx
add ebx, ebx
add ebx, ebx
or edi, ebx
movzx edi, byte [edi + 0x468160]
shl edx, 8
or edx, edi
and esi, 0x1f
movzx eax, al
shl edx, 8
shl esi, 8
or esi, eax
movzx eax, byte [esi + 0x468160]
mov esi, dword [ebp + 8]
or edx, eax
xor dword [esi], edx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
mov edi, eax
shr edi, 0x15
and edi, 0x700
mov edx, ecx
shr edx, 0x18
or edx, edi
movzx edx, byte [edx + 0x467960]
mov ebx, ecx
shr ebx, 0x10
movzx edi, bl
mov ebx, eax
shr ebx, 0x12
and ebx, 0x700
or edi, ebx
movzx edi, byte [edi + 0x467960]
shl edx, 8
or edx, edi
mov ebx, ecx
shr ebx, 8
movzx edi, bl
mov ebx, eax
shr ebx, 0xd
and ebx, 0x1f00
shl edx, 8
or edi, ebx
movzx edi, byte [edi + 0x468160]
shr eax, 8
and eax, 0x1f00
movzx ecx, cl
or edx, edi
or eax, ecx
movzx eax, byte [eax + 0x468160]
shl edx, 8
or edx, eax
xor dword [esi + 4], edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4398a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, 0x4606f8
dec eax
mov edi, 0x4606f8
mov word [0x4601f8], 0
mov word [0x4606f8], 0x301
mov byte [0x4601fb], 1
mov edx, 2
lea esi, [eax + 2]
sub edi, eax
mov bl, byte [esi]
mov al, bl
call fcn.00433dd0
xor al, bl
mov byte [edi + esi], al
movzx eax, al
mov byte [eax + 0x4601f8], dl
inc edx
inc esi
cmp edx, 0x100
jl 0x4398d5
mov byte [0x460970], 0x63
mov byte [0x4608d3], 0
mov ebx, 1
lea esp, [esp]
mov al, bl
call fcn.00439870
movzx ecx, al
mov byte [ebx + 0x460970], al
mov byte [ecx + 0x460870], bl
inc ebx
cmp ebx, 0x100
jl 0x439910
mov al, 1
mov edx, 0x4607f8
movzx ecx, al
mov dword [edx], ecx
call fcn.00433dd0
add edx, 4
cmp edx, 0x460870
jl 0x439936
xor esi, esi
lea ecx, [ecx]
mov dl, byte [esi + 0x460970]
mov al, dl
call fcn.00433dd0
mov cl, al
xor cl, dl
mov byte [ebp - 1], cl
lea ecx, [ebp - 4]
mov byte [ebp - 2], dl
mov byte [ebp - 3], dl
mov byte [ebp - 4], al
call fcn.00433d90
mov bl, byte [esi + 0x460870]
mov dword [esi*4 + 0x4602f8], eax
mov al, byte [0x45c9c0]
mov cl, bl
call fcn.00439720
mov byte [ebp - 1], al
mov al, byte [0x45c9c1]
mov cl, bl
call fcn.00439720
mov byte [ebp - 2], al
mov al, byte [0x45c9c2]
mov cl, bl
call fcn.00439720
mov byte [ebp - 3], al
mov al, byte [0x45c9c3]
mov cl, bl
call fcn.00439720
lea ecx, [ebp - 4]
mov byte [ebp - 4], al
call fcn.00433d90
mov dword [esi*4 + 0x460a70], eax
inc esi
cmp esi, 0x100
jl 0x439950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c100
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, eax
mov esi, ecx
cmp ebx, edi
jne 0x43c1d1
mov eax, dword [esi + 8]
mov ecx, dword [esi]
test eax, eax
jne 0x43c165
mov eax, dword [esi + 4]
push edi
push eax
push ecx
call fcn.00423990
mov edx, dword [esi]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [ebp + 0xc]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push edi
push ecx
push edx
call fcn.00423990
mov esi, dword [esi]
add esp, 0x20
test edi, edi
jle 0x43c29c
mov eax, dword [ebp + 0x10]
mov ecx, esi
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x43c155
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
sub ebx, eax
add ecx, eax
test ebx, ebx
jle 0x43c182
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov dword [ebp + 0x14], ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec dword [ebp + 0x14]
jne 0x43c177
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00423990
mov edx, dword [esi]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [ebp + 0xc]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push edi
push ecx
push edx
call fcn.00423990
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [esi]
add esp, 0x20
add eax, ebx
test ecx, ecx
jle 0x43c29c
mov edx, esi
sub edx, eax
mov esi, ecx
mov cl, byte [edx + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x43c1c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x43c223
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edi
push edx
push eax
call fcn.00423990
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push edi
push eax
push ecx
call fcn.00423990
mov ecx, dword [esi]
add esp, 0x20
test ebx, ebx
jle 0x43c219
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov edi, ebx
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x43c210
pop edi
mov dword [esi + 8], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, edx
cmp eax, ebx
jge 0x43c22b
mov ebx, eax
mov ecx, dword [esi]
add ecx, edx
test ebx, ebx
jle 0x43c24b
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov dword [ebp - 4], ebx
jmp 0x43c240
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec dword [ebp - 4]
jne 0x43c240
add dword [esi + 8], ebx
cmp ebx, dword [ebp + 0x14]
jge 0x43c29c
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00423990
mov edx, dword [esi]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [ebp + 0xc]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push edi
push ecx
push edx
call fcn.00423990
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov edi, dword [esi + 4]
sub ecx, ebx
add esp, 0x20
add eax, ebx
test ecx, ecx
jle 0x43c299
sub edi, eax
mov edx, ecx
nop
mov bl, byte [edi + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x43c290
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43cc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, eax
mov esi, ecx
cmp ebx, edi
jne 0x43cd18
mov eax, dword [esi + 8]
mov ecx, dword [esi]
test eax, eax
jne 0x43ccae
mov eax, dword [esi + 4]
push edi
push eax
push ecx
call fcn.00423990
mov edx, dword [esi]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [ebp + 0xc]
mov ecx, dword [esi]
add esp, 0x14
test edi, edi
jle 0x43cc9d
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov edx, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x43cc94
mov ecx, dword [esi + 4]
mov eax, edi
call fcn.0043cb30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
sub ebx, eax
add ecx, eax
test ebx, ebx
jle 0x43cccb
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov dword [ebp + 0x14], ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec dword [ebp + 0x14]
jne 0x43ccc0
mov ecx, dword [esi + 4]
mov eax, edi
call fcn.0043cb30
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00423990
mov edx, dword [esi]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [ebp + 0xc]
mov ecx, dword [esi + 8]
mov edx, dword [ebp + 0x10]
mov esi, dword [esi]
add esp, 0x14
lea eax, [ebx + edx]
test ecx, ecx
jle 0x43cdcc
mov edx, esi
sub edx, eax
mov esi, ecx
mov cl, byte [edx + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x43cd08
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 8]
test edx, edx
jne 0x43cd59
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edi
push edx
push eax
call fcn.00423990
mov ecx, dword [esi]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [ebp + 0xc]
mov ecx, dword [esi]
add esp, 0x14
test ebx, ebx
jle 0x43cd4f
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov edi, ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x43cd46
pop edi
mov dword [esi + 8], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, edx
cmp eax, ebx
jge 0x43cd61
mov ebx, eax
mov ecx, dword [esi]
add ecx, edx
test ebx, ebx
jle 0x43cd7c
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov dword [ebp - 4], ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec dword [ebp - 4]
jne 0x43cd71
add dword [esi + 8], ebx
cmp ebx, dword [ebp + 0x14]
jge 0x43cdcc
mov ecx, dword [esi + 4]
mov eax, edi
call fcn.0043cb30
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edi
push eax
push ecx
call fcn.00423990
mov edx, dword [esi]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edi, dword [esi]
lea eax, [ebx + ecx]
mov ecx, dword [ebp + 0x14]
sub ecx, ebx
add esp, 0x14
test ecx, ecx
jle 0x43cdc9
sub edi, eax
mov edx, ecx
lea ecx, [ecx]
mov bl, byte [edi + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x43cdc0
mov dword [esi + 8], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402740
Capabilities:
Get file version info

Disassembly:
sub esp, 0x510
lea eax, [esp + 0xc]
push 0x104
push eax
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
lea edx, [esp + 0xc]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edx, eax
test edx, edx
je 0x402816
mov al, byte [0x46833c]
push edi
mov byte [esp + 0x114], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x115]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x114]
push ecx
push edx
stosw word es:[edi], ax
lea edx, [esp + 0x18]
push 0
push edx
stosb byte es:[edi], al
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
pop edi
je 0x402816
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push ecx
lea edx, [esp + 0x118]
push 0x462140
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402816
mov eax, dword [esp + 4]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
mov eax, dword [esp + 0x51c]
shr edx, 0x10
push ecx
push edx
push str._d._d._d._d
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x18
mov eax, 1
add esp, 0x510
ret 4
xor eax, eax
add esp, 0x510
ret 4
Function at 0x402830
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x43ff90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x54]
mov dword [esp + 0x4c], 0
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4029d7
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x54]
push 0x46214c
lea edx, [esp + 0x14]
push ecx
push edx
mov byte [esp + 0x58], 1
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push 0
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 2
call sub.MFC42.DLL_CFileFind::FindFile
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0x4c], 1
call fcn.00422b90
test esi, esi
je 0x4029c0
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov edi, eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [eax]
push 0x462148
push eax
mov byte [esp + 0x54], 3
call esi
add esp, 8
test eax, eax
je 0x402918
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [eax]
push 0x462144
push eax
call esi
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
sete bl
call fcn.00422b90
test bl, bl
je 0x40291a
mov bl, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 1
call fcn.00422b90
test bl, bl
jne 0x4029b8
lea edx, [esp + 0x18]
lea ecx, [esp + 0x28]
push edx
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push 0x80
push eax
call ebp
lea ecx, [esp + 0x18]
call fcn.00422b90
mov eax, dword [esp + 0x28]
push 0x10
lea ecx, [esp + 0x2c]
call dword [eax + 0x40]
test eax, eax
je 0x402998
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ecx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CFileFind::GetFilePath
call fcn.00402830
add esp, 4
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x28]
push edx
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x1c]
jmp 0x4029b3
lea eax, [esp + 0x20]
lea ecx, [esp + 0x28]
push eax
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x20]
call fcn.00422b90
test edi, edi
jne 0x4028bc
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CFileFind::Close
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 0
call fcn.00422c44
lea ecx, [esp + 0x54]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00422b90
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret
Function at 0x403170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x70
mov eax, dword [0x4623a0]
push esi
push edi
mov dword [esp + 0x10], eax
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x14]
push 0x20019
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x80]
mov dword [esp + 0xc], 0x32
push ecx
mov dword [esp + 0x14], 1
stosw word es:[edi], ax
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov esi, eax
test esi, esi
je 0x403226
lea edx, [esp + 8]
lea eax, [esp + 0x44]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.Class
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x403226
push ebx
lea esi, [esp + 0x14]
lea eax, [esp + 0x48]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403211
test cl, cl
je 0x40320d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403211
add eax, 2
add esi, 2
test cl, cl
jne 0x4031e9
xor eax, eax
jmp 0x403216
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
jne 0x403226
pop edi
mov eax, 1
pop esi
add esp, 0x70
ret
pop edi
xor eax, eax
pop esi
add esp, 0x70
ret
Function at 0x403d00
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4400e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_CFileFind::CFileFind
lea eax, [esp + 0x3c]
lea ecx, [esp + 4]
push eax
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
push 1
push ecx
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], 2
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x462140
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
setne bl
call fcn.00422b90
test bl, bl
je 0x403d83
push 0x462140
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator
push str.Ref_TestCut_.CRM
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator
mov edx, dword [esp + 4]
push 0
push edx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x403e6d
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov bl, 3
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov ebp, eax
mov eax, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 0x20]
call dword [eax + 0x40]
test eax, eax
jne 0x403e62
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x403e62
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::GetFilePath
lea edx, [esp + 0x18]
lea ecx, [esp + 0x14]
push edx
mov byte [esp + 0x44], bl
call sub.MFC42.DLL_CString::CString_2
push 0x46833c
push str.Ref_TestCut_
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 4
call sub.MFC42.DLL_CString::Replace
push 0x4626d0
push 0x4626cc
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Replace
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x40], bl
call fcn.00422b90
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 2
call fcn.00422b90
test ebp, ebp
jne 0x403dba
pop edi
pop esi
pop ebp
lea ecx, [esp + 4]
mov byte [esp + 0x34], 1
call fcn.00422b90
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call fcn.00422c44
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], 0xffffffff
call fcn.00422b90
mov ecx, dword [esp + 0x2c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x403fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x440150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CStdioFile::CStdioFile
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x30]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x2c], 3
call fcn.00422ce0
mov ecx, dword [esi + 0x200]
lea edx, [esp + 4]
push ecx
push str._sprofileSerId.txt
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x10]
add esp, 0xc
lea ecx, [esp + 0xc]
push 0
push 1
push eax
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
pop esi
jne 0x4040c1
mov ecx, dword [esp]
push eax
push 0x1001
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
jne 0x4040c1
lea ecx, [esp]
mov byte [esp + 0x24], 2
call fcn.00422b90
lea ecx, [esp + 4]
mov byte [esp + 0x24], 1
call fcn.00422b90
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.00422d28
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.00422b90
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push edx
call sub.MFC42.DLL_CStdioFile::WriteString
lea ecx, [esp + 8]
call sub.MFC42.DLL_CStdioFile::Flush
lea ecx, [esp + 8]
call sub.MFC42.DLL_CStdioFile::Close
lea ecx, [esp]
mov byte [esp + 0x24], 2
call fcn.00422b90
lea ecx, [esp + 4]
mov byte [esp + 0x24], 1
call fcn.00422b90
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.00422d28
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.00422b90
mov ecx, dword [esp + 0x1c]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x409ca0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x440570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CFile::CFile
lea eax, [esp]
push str.d:_tempWL.log
push eax
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::Format
mov al, byte [esp + 0x2c]
add esp, 8
test al, al
je 0x409d2d
mov ecx, dword [esp]
push 0
push 0x8002
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x409d22
mov edx, dword [esp]
push eax
push 0x9002
push edx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x409d38
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFile::Close
jmp 0x409d38
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 4]
mov byte [esp + 0x1c], 0
call fcn.00422b78
lea ecx, [esp]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00422b90
mov ecx, dword [esp + 0x14]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x41d940
Capabilities:
Hash data with md5

Disassembly:
lea edx, [ecx + 0x10]
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x41e570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x440fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x48], ebx
call fcn.0041e9c0
mov ecx, esi
call fcn.0041e700
test al, al
je 0x41e5b5
mov ecx, esi
call fcn.0041e720
mov eax, dword [esp + 0x50]
mov dword [esi + 0x14], eax
push eax
lea eax, [esp + 0x10]
push str.Com_d
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
push ecx
call edi
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
jne 0x41e677
mov edx, dword [esi + 0x14]
lea eax, [esp + 0xc]
push edx
push str..Com_d
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
push ecx
call edi
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
jne 0x41e677
mov ecx, dword [esi + 8]
add ecx, 1
mov dword [esi + 8], ecx
mov eax, dword [esi + 0xc]
adc eax, ebx
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0xc]
push eax
push eax
push 0x4641ac
push esi
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call fcn.00422b90
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret 4
mov eax, 0xc8
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x10]
push edx
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov edx, dword [esi + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esi + 0x10]
lea eax, [esp + 0x24]
and edx, 0xfffffffd
push eax
push ecx
mov dword [esp + 0x30], 0x2580
mov dword [esp + 0x34], edx
mov byte [esp + 0x3e], 8
mov byte [esp + 0x40], bl
call dword [sym.imp.KERNEL32.dll_SetCommState]
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call fcn.00422b90
mov ecx, dword [esp + 0x40]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4