joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b4a0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
test edx, edx
je 0x4087b5
xor eax, eax
mov al, byte [esp + 8]
test al, al
jne 0x40876c
cmp edx, 0x100
jb 0x40876c
cmp dword [0x451d24], 0
je 0x40876c
jmp 0x40b4fa
push edi
mov edi, ecx
cmp edx, 4
jb 0x4087a5
neg ecx
and ecx, 3
je 0x408787
sub edx, ecx
mov byte [edi], al
add edi, 1
sub ecx, 1
jne 0x40877d
mov ecx, eax
shl eax, 8
add eax, ecx
mov ecx, eax
shl eax, 0x10
add eax, ecx
mov ecx, edx
and edx, 3
shr ecx, 2
je 0x4087a5
rep stosd dword es:[edi], eax
test edx, edx
je 0x4087af
mov byte [edi], al
add edi, 1
sub edx, 1
jne 0x4087a5
mov eax, dword [esp + 8]
pop edi
ret
mov eax, dword [esp + 4]
ret
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40b4a4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
add byte [eax - 0x15], ah
push ds
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40b520
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40b507
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40b510
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40b51a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40b4fc
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40b486
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40b56d
dec eax
je 0x40b564
sub eax, 3
je 0x40b55b
mov dword [ebp - 4], 0x40
jmp 0x40b58a
mov dword [ebp - 4], 4
jmp 0x40b570
mov dword [ebp - 4], 0x20
jmp 0x40b570
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40b5bc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40b53c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040adcd
dec esp
pop ds
mov ebp, 0x1475ff6d
push 1
push esi
call edi
mov eax, esi
jmp 0x40b5c8
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040addd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
invalid
adc al, 0xf7
Function at 0x40b6b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
cld
invalid
jmp dword [ecx]
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
shufps xmm0, xmmword [ebp - 0x3b5], 0xa
Function at 0x40d108
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call fcn.0040d06a
mov ebx, eax
cmp ebx, edi
jge 0x40d144
push 0x43c268
push ebx
call fcn.004315b6
pop ecx
pop ecx
jmp 0x40d1b1
push esi
xor esi, esi
mov dword [ebp + 0x14], edi
cmp dword [ebp - 4], edi
jbe 0x40d1b0
push edi
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
sub eax, esi
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d174
add esi, dword [ebp + 0x14]
cmp esi, dword [ebp - 4]
jb 0x40d14f
jmp 0x40d1b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x40d188
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, edi
jl 0x40d193
mov ebx, 0x80004005
push ebx
push 0x2f5
push 0x43c0ac
call fcn.004315ca
push 0x43c242
push ebx
call fcn.004315b6
pop ecx
pop ecx
pop esi
cmp dword [ebp - 8], edi
je 0x40d1be
push dword [ebp - 8]
call fcn.00431962
pop edi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x40d1c6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
mov ebx, eax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, esi
push eax
lea eax, [ebp + esi - 0x10]
push eax
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40d22f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40d215
and dword [ebp - 4], 0
jmp 0x40d22f
cmp eax, 0x6d
je 0x40d27d
test eax, eax
jle 0x40d228
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
test eax, eax
jl 0x40d296
add esi, dword [ebp - 8]
cmp esi, 8
jb 0x40d1e8
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
xor esi, esi
mov dword [ebx + 4], eax
cmp eax, esi
je 0x40d30d
push esi
push eax
call fcn.004317d2
mov dword [ebx + 0xc], eax
cmp eax, esi
jne 0x40d2af
mov esi, 0x8007000e
push esi
push 0x328
push 0x43c0ac
mov dword [ebp - 4], esi
call fcn.004315ca
push 0x43c2d2
push esi
jmp 0x40d2fd
push 8
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00408740
add esp, 0xc
mov dword [ebp - 4], 1
jmp 0x40d237
push dword [ebp - 4]
push 0x31d
push 0x43c0ac
call fcn.004315ca
push 0x43c2b0
jmp 0x40d2fa
push esi
lea ecx, [ebp - 8]
push ecx
push dword [ebx + 4]
push eax
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40d306
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x40d2d5
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, esi
jl 0x40d2e3
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x32c
push 0x43c0ac
call fcn.004315ca
push 0x43c28e
push dword [ebp - 4]
call fcn.004315b6
pop ecx
pop ecx
jmp 0x40d30d
mov dword [ebx + 8], 1
cmp dword [ebx + 8], 0
jne 0x40d320
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x40d320
push ebx
call fcn.00431962
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40d32a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
jne 0x40d3a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d37d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x40d388
mov edi, 0x80004005
push edi
push 0x34c
push 0x43c0ac
call fcn.004315ca
push 0x43c464
jmp 0x40d514
mov eax, dword [ebp - 8]
shr eax, 1
cmp eax, 0xff
jbe 0x40d3d0
mov esi, 0x8007000d
push esi
push 0x352
push 0x43c0ac
mov edi, esi
call fcn.004315ca
push 0x43c438
push esi
jmp 0x40d515
inc eax
push eax
lea eax, [ebp - 4]
push eax
call fcn.0042eb9e
mov edi, eax
cmp edi, ebx
jge 0x40d3eb
push 0x43c404
jmp 0x40d514
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40d438
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d413
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x40d41e
mov edi, 0x80004005
push edi
push 0x35a
push 0x43c0ac
call fcn.004315ca
push 0x43c3ce
jmp 0x40d514
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x40d470
mov esi, 0x8007000d
push esi
push 0x361
push 0x43c0ac
mov edi, esi
call fcn.004315ca
push 0x43c39e
jmp 0x40d3ca
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40d4ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d498
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x40d4a3
mov edi, 0x80004005
push edi
push 0x367
push 0x43c0ac
call fcn.004315ca
push 0x43c364
jmp 0x40d514
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp eax, ebx
jne 0x40d532
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d51c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d4f4
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x40d4ff
mov edi, 0x80004005
push edi
push 0x378
push 0x43c0ac
call fcn.004315ca
push 0x43c32c
push edi
call fcn.004315b6
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x40d529
push dword [ebp - 4]
call fcn.0042ecb2
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp eax, dword [ebp - 0x10]
je 0x40d4c8
mov esi, 0x8007000d
push esi
push 0x372
push 0x43c0ac
mov edi, esi
call fcn.004315ca
push 0x43c2f8
jmp 0x40d3ca
Function at 0x40d74e
Capabilities:
Create pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
or dword [ebp - 0x14], 0xffffffff
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
cmp dword [ebp + 0xc], ebx
jne 0x40d7de
push ebx
lea eax, [ebp - 0xc]
push eax
push 1
push 0x43c6a0
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x40d7ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d79a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x40d7a8
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x11e
push 0x43c0ac
call fcn.004315ca
push 0x43c654
push dword [ebp - 4]
call fcn.004315b6
pop ecx
pop ecx
jmp 0x40d8d2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
push esi
mov esi, dword [ebp + 8]
push dword [esi]
lea eax, [ebp - 8]
push 0x402764
push eax
call fcn.004300a2
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x40d811
push dword [esi]
push 0x43c62a
push eax
call fcn.004315b6
add esp, 0xc
jmp 0x40d8d1
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x20]
and eax, ecx
push eax
push 1
mov esi, 0x10000
push esi
push esi
push 1
push ebx
mov ebx, 0x80003
push ebx
push dword [ebp - 8]
call edi
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x40d88c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40d857
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
test eax, eax
jl 0x40d865
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x12e
push 0x43c0ac
call fcn.004315ca
push dword [ebp - 8]
push 0x43c60e
push dword [ebp - 4]
call fcn.004315b6
add esp, 0xc
jmp 0x40d8cf
cmp dword [ebp + 0xc], 0
je 0x40d94f
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 8]
push 0x40273c
push eax
call fcn.004300a2
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jns 0x40d8f6
mov ecx, dword [ebp + 8]
push dword [ecx]
push 0x43c5de
push eax
call fcn.004315b6
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
pop esi
cmp dword [ebp - 8], ebx
je 0x40d8df
push dword [ebp - 8]
call fcn.0042ecb2
cmp dword [ebp - 0xc], ebx
pop edi
pop ebx
je 0x40d8ef
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
leave
ret 0xc
push 0
push 1
push esi
push esi
push 1
push 0
push ebx
push dword [ebp - 8]
call edi
cmp eax, 0xffffffff
jne 0x40d952
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40d91f
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
test eax, eax
jl 0x40d92d
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x13a
push 0x43c0ac
call fcn.004315ca
push dword [ebp - 8]
push 0x43c60e
push dword [ebp - 4]
jmp 0x40d8be
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
jmp 0x40d8cf
Function at 0x410742
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [ebp + 8], ebx
je 0x41079d
push dword [ebp + 0xc]
push 0x43dd32
push dword [ebp + 8]
call fcn.0043267c
mov esi, eax
cmp esi, ebx
jge 0x410778
push 0x43e0e0
jmp 0x41087f
cmp dword [ebp + 0xc], 3
jne 0x41079d
push 1
push 0x402b60
push dword [ebp + 8]
call fcn.0043267c
mov esi, eax
cmp esi, ebx
jge 0x4107a3
push 0x43e0be
jmp 0x41087f
cmp dword [ebp + 0xc], 1
je 0x41081d
cmp dword [ebp + 0x10], ebx
jne 0x41081d
lea eax, [ebp - 4]
push eax
push 0x20006
push 0x402cb8
push dword [edi + 0x48]
call fcn.004327e4
mov esi, eax
cmp esi, 0x80070002
je 0x410819
cmp esi, 0x80070003
je 0x410819
push dword [edi + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x4107e3
xor eax, eax
cmp eax, ebx
je 0x410887
jle 0x4107f7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x410802
mov esi, 0x80004005
push esi
push 0x4d7
push 0x43de8c
call fcn.004315ca
push 0x43e09e
jmp 0x41087f
xor esi, esi
jmp 0x410887
push 0x4026ac
push dword [edi + 0x54]
lea eax, [ebp - 8]
push 0x43e08c
push eax
call fcn.004300a2
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x410843
push 0x43e05a
jmp 0x41087f
lea eax, [ebp - 4]
push eax
push 0x20006
push 0x402cb8
push dword [edi + 0x48]
call fcn.00432720
mov esi, eax
cmp esi, ebx
jge 0x410866
push 0x43e040
jmp 0x41087f
push dword [ebp - 8]
push dword [edi + 0xc]
push dword [ebp - 4]
call fcn.00432d9e
mov esi, eax
cmp esi, ebx
jge 0x410887
push 0x43e020
push esi
call fcn.004315b6
pop ecx
pop ecx
cmp dword [ebp - 8], ebx
je 0x410894
push dword [ebp - 8]
call fcn.0042ecb2
cmp dword [ebp - 4], ebx
je 0x4108a2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x411666
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
xor esi, esi
neg eax
sbb eax, eax
and eax, 7
add eax, 0x1c
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.00430914
mov ebx, eax
cmp ebx, esi
jge 0x4116b8
mov eax, 0x43ea24
cmp dword [ebp + 8], esi
jne 0x4116a7
mov eax, 0x43ea1a
push eax
push 0x43e9ee
push ebx
call fcn.004315b6
add esp, 0xc
jmp 0x411722
mov dword [ebp - 0x10], esi
cmp dword [edi + 4], esi
jbe 0x411722
mov dword [ebp + 8], esi
mov esi, dword [edi]
add esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
push dword [ebp - 0xc]
call fcn.0043094a
mov ebx, eax
test ebx, ebx
js 0x411713
lea eax, [ebp - 8]
push eax
push dword [esi]
push dword [ebp - 4]
call fcn.0043094a
mov ebx, eax
test ebx, ebx
js 0x411713
push dword [ebp - 8]
call fcn.0043506c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp + 8], 0xc
cmp eax, dword [edi + 4]
jb 0x4116c3
jmp 0x411720
push 0x43e9c8
push ebx
call fcn.004315b6
pop ecx
pop ecx
xor esi, esi
cmp dword [ebp - 8], esi
je 0x41172f
push dword [ebp - 8]
call fcn.0042ecb2
cmp dword [ebp - 4], esi
je 0x41173c
push dword [ebp - 4]
call fcn.0042ecb2
cmp dword [ebp - 0xc], esi
je 0x411749
push dword [ebp - 0xc]
call fcn.0042ecb2
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x412ab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call fcn.00413ff2
mov esi, eax
cmp esi, ebx
jge 0x412ade
push 0x43f656
jmp 0x412b57
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412b16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x412b00
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
je 0x412b12
cmp esi, 0x80070003
jne 0x412b21
xor esi, esi
jmp 0x412b21
test al, 0x10
je 0x412b21
mov dword [ebp - 8], 1
cmp esi, ebx
jge 0x412b3a
push dword [ebp - 4]
push dword [edi]
push 0x43f61a
push esi
call fcn.004315b6
add esp, 0x10
jmp 0x412b5f
mov eax, dword [ebp - 8]
push ebx
cdq
push edx
push eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.0041598e
mov esi, eax
cmp esi, ebx
jge 0x412b5f
push 0x43f602
push esi
call fcn.004315b6
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x412b6c
push dword [ebp - 4]
call fcn.0042ecb2
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x412b74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 8]
call fcn.00413ff2
mov esi, eax
test esi, esi
jns 0x412b9d
push 0x43f656
jmp 0x412be2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412bc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x412bbf
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x412bf1
test al, 0x10
je 0x412bec
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 8]
call fcn.004159d0
mov esi, eax
test esi, esi
jns 0x412bf1
push 0x43f6b4
push esi
call fcn.004315b6
pop ecx
pop ecx
jmp 0x412c31
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x412c1a
cmp esi, 0x80070003
je 0x412c1a
test esi, esi
jns 0x412c31
push dword [ebp - 4]
push dword [edi]
push 0x43f61a
push esi
call fcn.004315b6
add esp, 0x10
jmp 0x412c31
push esi
push dword [ebp - 4]
push dword [edi]
push 0x43f678
push 1
call fcn.00431206
add esp, 0x14
xor esi, esi
cmp dword [ebp - 4], 0
je 0x412c3f
push dword [ebp - 4]
call fcn.0042ecb2
mov eax, esi
pop esi
leave
ret 4
Function at 0x412c46
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00413ff2
mov esi, eax
test esi, esi
jns 0x412c73
push 0x43f656
jmp 0x412d0c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412ce5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x412ccf
cmp eax, 3
je 0x412ccf
test eax, eax
je 0x412cef
jle 0x412ca1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x412cac
mov esi, 0x80004005
push esi
push 0x27a
push 0x43f732
call fcn.004315ca
push dword [edi + 0x14]
push 0x43f70c
push esi
call fcn.004315b6
add esp, 0xc
jmp 0x412d14
push dword [ebp - 4]
push dword [edi]
push 0x43f6e2
push 1
call fcn.00431206
add esp, 0x10
jmp 0x412cef
and eax, 0x10
cmp al, 0x10
je 0x412cef
xor ebx, ebx
inc ebx
push 0
mov eax, ebx
cdq
push edx
push eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.0041598e
mov esi, eax
test esi, esi
jns 0x412d14
push 0x43f602
push esi
call fcn.004315b6
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x412d22
push dword [ebp - 4]
call fcn.0042ecb2
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x412ddc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 8]
call fcn.00413ff2
mov esi, eax
test esi, esi
jns 0x412e05
push 0x43f656
jmp 0x412e71
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412e52
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x412e27
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
je 0x412e7b
cmp esi, 0x80070003
je 0x412e7b
test esi, esi
jns 0x412e91
push dword [ebp - 4]
push dword [edi]
push 0x43f7cc
push esi
call fcn.004315b6
add esp, 0x10
jmp 0x412e91
test al, 0x10
jne 0x412e7b
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 8]
call fcn.004159d0
mov esi, eax
test esi, esi
jns 0x412e29
push 0x43f7a0
push esi
call fcn.004315b6
pop ecx
pop ecx
jmp 0x412e91
push dword [ebp - 4]
push dword [edi]
push 0x43f6e2
push 1
call fcn.00431206
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], 0
je 0x412e9f
push dword [ebp - 4]
call fcn.0042ecb2
mov eax, esi
pop esi
leave
ret 4
Function at 0x412ea6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], 1
cmp dword [edi + 0x24], ebx
je 0x412ed1
mov dword [ebp - 0xc], 0x101
push ebx
lea eax, [ebp - 4]
push eax
push dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.00413ff2
mov esi, eax
cmp esi, ebx
jge 0x412ef1
push 0x43f900
jmp 0x412ff5
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [edi + 0x18]
call fcn.004327e4
mov esi, eax
cmp esi, ebx
jl 0x412f39
mov eax, dword [edi + 0x20]
mov dword [ebp - 0xc], 1
cmp eax, ebx
je 0x412fd8
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
call fcn.00413ff2
mov esi, eax
cmp esi, ebx
jge 0x412f68
push 0x43f8e0
jmp 0x412ff5
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x412f55
push 0x43f8bc
push 1
call fcn.00431206
add esp, 0xc
jmp 0x412fcc
push 0x43f892
push esi
call fcn.004315b6
add esp, 0xc
jmp 0x412ffd
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub ecx, ebx
je 0x412fd1
dec ecx
dec ecx
je 0x412fb7
cmp eax, ebx
je 0x412fd8
jle 0x412f95
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x412fa0
mov esi, 0x80004005
push esi
push 0x30c
push 0x43f732
call fcn.004315ca
push 0x43f86e
jmp 0x412ff5
push dword [ebp - 8]
push dword [ebp - 4]
push 0x43f838
push 1
call fcn.00431206
add esp, 0x10
mov dword [ebp - 0xc], ebx
jmp 0x412fd8
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
push ebx
cdq
push edx
push eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.0041598e
mov esi, eax
cmp esi, ebx
jge 0x413014
push 0x43f602
push esi
call fcn.004315b6
pop ecx
pop ecx
cmp esi, ebx
jge 0x413014
push esi
push dword [ebp - 4]
push 0x43f804
push 1
call fcn.00431206
add esp, 0x10
cmp dword [ebp - 4], ebx
je 0x413021
push dword [ebp - 4]
call fcn.0042ecb2
cmp dword [ebp - 8], ebx
je 0x41302e
push dword [ebp - 8]
call fcn.0042ecb2
cmp dword [ebp - 0x10], ebx
je 0x41303c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret 4