joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418dc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 6
jb 0x418e11
mov eax, 1
jmp 0x418fbb
call fcn.00419a90
cmp eax, 1
jne 0x418e3c
call fcn.00419a90
cmp eax, 1
jne 0x418e32
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x418e1b
mov eax, 1
jmp 0x418fbb
push 0x467b64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x418fb6
push 0x467b6c
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418fa9
push 0x467b84
call dword [ebp - 4]
cmp eax, 5
je 0x418ea0
push 0x467bac
call dword [ebp - 4]
cmp eax, 5
je 0x418ea0
push str.03ED71EA_F531_4927_AABD_1C31BCE8E187
call dword [ebp - 4]
cmp eax, 5
jne 0x418eaf
mov dword [ebp - 0xa4], 1
jmp 0x418f94
push str.7299_052B_02A4_4627_81F2_1818DA5D550D
call dword [ebp - 4]
cmp eax, 5
je 0x418ed6
push str.071C_9B48_7C32_4621_A0AC_3F809523288F
call dword [ebp - 4]
cmp eax, 5
je 0x418ed6
push str.0F8F_B34E_675E_42ED_850B_29D98C2ECE08
call dword [ebp - 4]
cmp eax, 5
jne 0x418ee5
mov dword [ebp - 0xa4], 1
jmp 0x418f94
push str.837B34E3_7C30_493C_8F6A_2B0F04E2912C
call dword [ebp - 4]
cmp eax, 5
je 0x418f0c
push str.6CE5BAE9_D3CA_4B99_891A_1DC6C118A5FC
call dword [ebp - 4]
cmp eax, 5
je 0x418f0c
push str.85025851_A784_46D8_950D_05CB3CA43A13
call dword [ebp - 4]
cmp eax, 5
jne 0x418f18
mov dword [ebp - 0xa4], 1
jmp 0x418f94
push str.710F4C1C_CC18_4C49_8CBF_51240C89A1A2
call dword [ebp - 4]
cmp eax, 5
je 0x418f32
push str.AD8A2FA1_06E7_4B0D_927d_6E54B3D31028
call dword [ebp - 4]
cmp eax, 5
jne 0x418f3e
mov dword [ebp - 0xa4], 1
jmp 0x418f94
push str.7299052B_02A4_4627_81F2_1818DA5D550D
call dword [ebp - 4]
cmp eax, 5
je 0x418f58
push str.071C9B48_7C32_4621_A0AC_3F809523288F
call dword [ebp - 4]
cmp eax, 5
jne 0x418f64
mov dword [ebp - 0xa4], 1
jmp 0x418f94
push str.A49F249F_0C91_497F_86DF_B2585E8E76B7
call dword [ebp - 4]
cmp eax, 5
je 0x418f7e
push str.6E8E85E8_CE4B_4FF5_91F7_04999C9FAE6A
call dword [ebp - 4]
cmp eax, 5
jne 0x418f8a
mov dword [ebp - 0xa4], 1
jmp 0x418f94
mov dword [ebp - 0xa4], 0
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xa4]
jmp 0x418fbb
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00418fd0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x418fd0
Capabilities:
Check os version
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1ac], 0
mov eax, dword [0x467ddc]
mov dword [ebp - 0x1cc], eax
mov ecx, dword [0x467de0]
mov dword [ebp - 0x1c8], ecx
mov edx, dword [0x467de4]
mov dword [ebp - 0x1c4], edx
mov eax, dword [0x467de8]
mov dword [ebp - 0x1c0], eax
mov ecx, dword [0x467dec]
mov dword [ebp - 0x1bc], ecx
mov dx, word [0x467df0]
mov word [ebp - 0x1b8], dx
mov al, byte [0x4673a7]
mov byte [ebp - 0x1a8], al
push 0x104
push 0
lea ecx, [ebp - 0x1a7]
push ecx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 5
jne 0x4190d1
cmp dword [ebp - 0x98], 0
jne 0x4190d1
push 0x467df4
lea eax, [ebp - 0x1cc]
push eax
call fcn.00445510
add esp, 8
jmp 0x4190e5
push 0x467e08
lea ecx, [ebp - 0x1cc]
push ecx
call fcn.00445510
add esp, 8
lea edx, [ebp - 0x320]
push edx
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xffffffff
je 0x419240
cmp dword [ebp - 0x1d0], 0
je 0x419240
lea ecx, [ebp - 0x2f4]
push ecx
lea edx, [ebp - 0x1a8]
push edx
call fcn.00445510
add esp, 8
lea eax, [ebp - 0x1a8]
push eax
call fcn.00418d70
add esp, 4
push str.X86_MICROSOFT.VC80.ATL
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x419160
mov dword [ebp - 0x1dc], 1
push str.X86_MICROSOFT.VC80.CRT
lea edx, [ebp - 0x1a8]
push edx
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x419182
mov dword [ebp - 0x1b4], 1
push str.X86_MICROSOFT.VC80.MFC_
lea eax, [ebp - 0x1a8]
push eax
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x4191a4
mov dword [ebp - 0x1b0], 1
push str.X86_MICROSOFT.VC80.MFCLOC
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x4191c6
mov dword [ebp - 0x1d4], 1
push str.X86_MICROSOFT.VC80.OPENMP
lea edx, [ebp - 0x1a8]
push edx
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x4191e8
mov dword [ebp - 0x1d8], 1
cmp dword [ebp - 0x1dc], 0
je 0x419221
cmp dword [ebp - 0x1b4], 0
je 0x419221
cmp dword [ebp - 0x1b0], 0
je 0x419221
cmp dword [ebp - 0x1d4], 0
je 0x419221
cmp dword [ebp - 0x1d8], 0
je 0x419221
mov dword [ebp - 0x1ac], 1
jmp 0x419240
lea eax, [ebp - 0x320]
push eax
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x1d0], eax
jmp 0x4190ff
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x4198c0
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x44
push 0
lea ecx, [ebp - 0x100]
push ecx
call fcn.004456b0
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0x100], 0x44
mov dword [ebp - 0xd4], 1
mov eax, 1
mov word [ebp - 0xd0], ax
mov ecx, dword [ebp + 8]
push ecx
push str.Install:__s
call fcn.0042aa10
add esp, 8
cmp dword [ebp - 0xac], 6
jb 0x419a08
lea edx, [ebp - 0xb4]
push edx
push 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41998d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallVCRuntime___OpenProcessToken___FAILED_ERROR:_d
call fcn.0042aa10
add esp, 8
lea eax, [ebp - 0x104]
push eax
push 1
push 2
push 0
push 0x2000000
mov ecx, dword [ebp - 0xb4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4199c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallVCRuntime___DuplicateTokenEx___FAILED_ERROR:_d
call fcn.0042aa10
add esp, 8
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x100]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x104]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x419a06
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallVCRuntime___CreateProcessAsUser___FAILED_ERROR:_d
call fcn.0042aa10
add esp, 8
jmp 0x419a43
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x419a43
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallVCRuntime___CreateProcess___FAILED_ERROR:_d
call fcn.0042aa10
add esp, 8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00419a90
cmp eax, 1
jne 0x419a65
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x419a4e
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x419db0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x35c], 1
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x368], 0
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x36c], 0
mov al, byte [0x4673cb]
mov byte [ebp - 0x358], al
push 0x104
push 0
lea ecx, [ebp - 0x357]
push ecx
call fcn.004456b0
add esp, 0xc
mov dl, byte [0x4673d7]
mov byte [ebp - 0x110], dl
push 0x104
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.004456b0
add esp, 0xc
cmp dword [0x4ba0c0], 0
je 0x419e75
push str.C:winntwinsxs.
lea ecx, [ebp - 0x110]
push ecx
call fcn.00445510
add esp, 8
jmp 0x419e89
push str.C:windowswinsxs.
lea edx, [ebp - 0x110]
push edx
call fcn.00445510
add esp, 8
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0xffffffff
je 0x41a02d
cmp dword [ebp - 0x35c], 1
jne 0x41a02d
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x358]
push eax
call fcn.00445510
add esp, 8
mov dword [ebp - 0x36c], 0
jmp 0x419eee
mov ecx, dword [ebp - 0x36c]
add ecx, 1
mov dword [ebp - 0x36c], ecx
lea edx, [ebp - 0x358]
push edx
call fcn.00445950
add esp, 4
cmp dword [ebp - 0x36c], eax
jge 0x419f2b
mov eax, dword [ebp - 0x36c]
movsx ecx, byte [ebp + eax - 0x358]
push ecx
call fcn.004490cf
add esp, 4
mov edx, dword [ebp - 0x36c]
mov byte [ebp + edx - 0x358], al
jmp 0x419edf
push str.X86_MICROSOFT.VC90.ATL
lea eax, [ebp - 0x358]
push eax
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x419f4d
mov dword [ebp - 0x378], 1
push str.X86_MICROSOFT.VC90.CRT
lea ecx, [ebp - 0x358]
push ecx
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x419f6f
mov dword [ebp - 0x368], 1
push str.X86_MICROSOFT.VC90.MFC_
lea edx, [ebp - 0x358]
push edx
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x419f91
mov dword [ebp - 0x364], 1
push str.X86_MICROSOFT.VC90.MFCLOC
lea eax, [ebp - 0x358]
push eax
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x419fb3
mov dword [ebp - 0x370], 1
push str.X86_MICROSOFT.VC90.OPENMP
lea ecx, [ebp - 0x358]
push ecx
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x419fd5
mov dword [ebp - 0x374], 1
cmp dword [ebp - 0x378], 0
je 0x41a00e
cmp dword [ebp - 0x368], 0
je 0x41a00e
cmp dword [ebp - 0x364], 0
je 0x41a00e
cmp dword [ebp - 0x370], 0
je 0x41a00e
cmp dword [ebp - 0x374], 0
je 0x41a00e
mov dword [ebp - 0x360], 1
jmp 0x41a02d
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x37c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x35c], eax
jmp 0x419ea3
mov ecx, dword [ebp - 0x37c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x360]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x41a6a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x46742d]
mov byte [ebp - 0x410], al
xor ecx, ecx
mov dword [ebp - 0x40f], ecx
mov dword [ebp - 0x40b], ecx
mov dword [ebp - 0x407], ecx
mov dword [ebp - 0x403], ecx
mov word [ebp - 0x3ff], cx
mov byte [ebp - 0x3fd], cl
mov dword [ebp - 0x3fc], 0
mov dword [0x48c16c], 0
mov dword [0x48c170], 0
push 0x64
lea edx, [ebp - 0x3f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x468f0c
lea eax, [ebp - 0x3f8]
push eax
push 0x468f1c
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x48c16c], eax
push 0x468f24
lea eax, [ebp - 0x3f8]
push eax
push 0x468f34
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x48c170], eax
cmp dword [0x48c16c], 0
je 0x41a78a
cmp dword [0x48c170], 0
jne 0x41a796
mov dword [ebp - 0x3fc], 0
jmp 0x41a7a0
mov dword [ebp - 0x3fc], 1
push 0x468e8c
lea eax, [ebp - 0x410]
push eax
call fcn.00445510
add esp, 8
lea ecx, [ebp - 0x410]
push ecx
push 0
call fcn.0041c730
mov eax, dword [ebp - 0x3fc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret

Function at 0x41a8c0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41a909
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41a8fe
xor eax, eax
jmp 0x41a923
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0
jne 0x41a920
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp eax, 0x3c
jl 0x41a8d4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x41b360
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46441f
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x374], ecx
mov ecx, dword [ebp + 8]
call fcn.0041bc90
mov eax, dword [ebp - 0x374]
movzx ecx, byte [eax + 4]
test ecx, ecx
je 0x41b487
push 0x200
lea edx, [ebp - 0x22c]
push edx
mov ecx, dword [ebp - 0x374]
call fcn.0041b190
movzx eax, al
test eax, eax
je 0x41b487
mov dword [ebp - 0x36c], 0
push 0x13c
push 0
lea ecx, [ebp - 0x368]
push ecx
call fcn.004456b0
add esp, 0xc
push 1
push 0x468f80
lea edx, [ebp - 0x22c]
push edx
call fcn.00449260
add esp, 0xc
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0xffffffff
je 0x41b487
mov edx, dword [ebp - 0x36c]
and edx, 0x10
je 0x41b462
lea eax, [ebp - 0x340]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404f80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00410ee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004058d0
lea edx, [ebp - 0x36c]
push edx
mov eax, dword [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41b426
mov ecx, dword [ebp - 0x370]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
call fcn.00410e90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret 4
Function at 0x41b9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x31], 0
mov ecx, 8
mov esi, str.SOFTWAREMicrosoft.NETFramework
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x30], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x30]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x28]
push edx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41ba61
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push str.InstallRoot
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41ba57
mov ecx, dword [ebp - 0x38]
cmp dword [ebp + 0xc], ecx
sbb edx, edx
add edx, 1
mov byte [ebp - 0x31], dl
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x31]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret 8
Function at 0x41cff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x469640
push str.C:medent_bin_system32RCache.ini
call fcn.00448c8e
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41d063
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x110]
push ecx
push str._sRCache.ini
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x469654
lea eax, [ebp - 0x218]
push eax
call fcn.00448c8e
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41d137
push 0x48c670
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041d1f0
add esp, 8
push 0x48ca50
mov edx, dword [ebp - 4]
push edx
call fcn.0041d1f0
add esp, 8
push 0x48cb58
mov eax, dword [ebp - 4]
push eax
call fcn.0041d1f0
add esp, 8
push 0x48c948
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041d1f0
add esp, 8
push 0x48c778
mov edx, dword [ebp - 4]
push edx
call fcn.0041d1f0
add esp, 8
push 0x48c248
mov eax, dword [ebp - 4]
push eax
call fcn.0041d1f0
add esp, 8
push 0x48c568
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041d1f0
add esp, 8
push 0x48cc60
mov edx, dword [ebp - 4]
push edx
call fcn.0041d1f0
add esp, 8
push 0x48c350
mov eax, dword [ebp - 4]
push eax
call fcn.0041d1f0
add esp, 8
push 0x48c460
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041d1f0
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.004484c1
add esp, 4
call fcn.0041d740
call fcn.0041d780
call fcn.0041d2b0
jmp 0x41d1de
push str.e:medentTodaysFiles
push 0x48c670
call fcn.00445510
add esp, 8
push str.e:medentVoiceNotes
push 0x48ca50
call fcn.00445510
add esp, 8
push str.e:medentImages
push 0x48cb58
call fcn.00445510
add esp, 8
push str.e:medentimage_cache
push 0x48c948
call fcn.00445510
add esp, 8
push str.e:medentMasterImages
push 0x48c778
call fcn.00445510
add esp, 8
push str.e:medentTemp
push 0x48c248
call fcn.00445510
add esp, 8
push str.e:medent_back.log
push 0x48c568
call fcn.00445510
add esp, 8
push str.e:medentTelephony
push 0x48cc60
call fcn.00445510
add esp, 8
push str.e:medentOtherTelephony
push 0x48c350
call fcn.00445510
add esp, 8
call fcn.0041d2b0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x41d7f0
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [0x4b9db0], 0
call fcn.00428d00
mov dword [0x4b9f8c], eax
call fcn.0043e2b0
mov dword [0x4b9f94], eax
call fcn.0041d9a0
call fcn.00429180
mov dword [0x48c458], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x9c], 5
jne 0x41d886
cmp dword [ebp - 0x98], 0
jne 0x41d871
mov dword [0x4ba0c0], 1
jmp 0x41d884
cmp dword [ebp - 0x98], 1
jne 0x41d884
mov dword [0x4ba0c4], 1
jmp 0x41d8df
cmp dword [ebp - 0x9c], 6
jne 0x41d8b8
mov dword [0x4ba0c8], 1
cmp dword [ebp - 0x98], 2
jb 0x41d8b6
mov dword [0x4ba0cc], 1
mov dword [0x4ba0d0], 1
jmp 0x41d8df
cmp dword [ebp - 0x9c], 0xa
jb 0x41d8df
mov dword [0x4ba0c8], 1
mov dword [0x4ba0cc], 1
mov dword [0x4ba0d0], 1
mov ecx, dword [ebp + 8]
mov dword [0x4b9f74], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0xa4], eax
mov edx, dword [ebp - 0xa4]
push edx
call fcn.00445950
add esp, 4
test eax, eax
je 0x41d977
push 0x469d20
mov eax, dword [ebp - 0xa4]
push eax
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x41d932
mov ecx, dword [0x4b9f74]
push ecx
call fcn.00429ea0
add esp, 4
xor eax, eax
jmp 0x41d98c
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0xa4]
push edx
call fcn.0041dba0
add esp, 4
test eax, eax
je 0x41d977
mov eax, dword [0x4b9f74]
push eax
call fcn.0041dad0
add esp, 4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [0x4b9f74]
push edx
call fcn.0041db50
add esp, 8
mov eax, dword [0x48d84c]
mov dword [0x490014], eax
mov ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042ec60
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4212c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x469fc3]
mov byte [ebp - 0x40c], al
xor ecx, ecx
mov dword [ebp - 0x40b], ecx
mov dword [ebp - 0x407], ecx
mov dword [ebp - 0x403], ecx
mov dword [ebp - 0x3ff], ecx
mov word [ebp - 0x3fb], cx
mov byte [ebp - 0x3f9], cl
mov dword [0x48c16c], 0
mov dword [0x48c170], 0
push 0x64
lea edx, [ebp - 0x3f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.ltkrn15u.dll
lea eax, [ebp - 0x3f8]
push eax
push 0x46afe8
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x48c16c], eax
push str.ltfil15u.dll
lea eax, [ebp - 0x3f8]
push eax
push 0x46b000
lea ecx, [ebp - 0x200]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x200]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x48c170], eax
cmp dword [0x48c16c], 0
je 0x4213a0
cmp dword [0x48c170], 0
jne 0x4213ac
mov dword [0x4b9f88], 0
jmp 0x4213b6
mov dword [0x4b9f88], 1
push str.xcRns97c3
lea eax, [ebp - 0x40c]
push eax
call fcn.00445510
add esp, 8
lea ecx, [ebp - 0x40c]
push ecx
push 0
call fcn.0041c730
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret