joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fd80
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4983cd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c63ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x41fdb6
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41fe3a
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41fdcc
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41fe3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41fe3a
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0041dc40
add esp, 8
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x41fe59
lea eax, [ebp - 0x28]
push eax
call fcn.0041fd80
add esp, 4
test eax, eax
je 0x41fe59
cmp dword [esi + 0x14], 8
jb 0x41fe18
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41fe32
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41fe59
lea ecx, [ebp - 0x28]
call fcn.004022a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x28]
call fcn.004022a0
xor eax, eax
jmp 0x41fe3f
Function at 0x421c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4c63ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x421c40
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x421c7c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x421c7c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x421d64
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x421ca4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x421cd7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0047d9ba
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x421d37
sub eax, 1
je 0x421d37
sub eax, 2
jne 0x421d64
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004192a0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x421d54
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0047e331
add esp, 0x10
cmp edi, eax
jne 0x421d64
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x421c67
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret 4
Function at 0x423160
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x423184
jl 0x423179
test ecx, ecx
jne 0x423184
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
push edi
mov edi, ecx
je 0x423252
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
jmp 0x4231a0
mov ecx, ebx
call fcn.0041f350
mov ecx, edx
mov esi, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jl 0x4231f2
jg 0x4231b8
test esi, esi
je 0x4231f2
mov eax, dword [ebp - 4]
cmp eax, ecx
jg 0x4231ca
jl 0x4231c5
cmp edi, esi
jae 0x4231ca
mov esi, edi
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push dword [ebp + 8]
call fcn.0046f400
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 4]
sub edi, esi
sbb ecx, dword [ebp - 8]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x423213
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x42323c
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
mov byte [eax], cl
mov ecx, dword [ebp - 4]
adc ecx, 0xffffffff
add eax, esi
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
test ecx, ecx
jg 0x4231a0
jl 0x42323f
test edi, edi
jne 0x4231a0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edx, dword [eax]
test edx, edx
je 0x42328d
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x42328d
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0046f400
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
mov esi, dword [ebp + 8]
je 0x4232fe
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4232b9
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov ecx, edi
cmp edi, 0xfff
jbe 0x4232e7
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0047dcaa
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x423312
cmp edi, eax
ja 0x4232c3
test ecx, ecx
je 0x4232fe
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0047dcaa
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x423400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x4234ce
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x4234bd
jg 0x423438
test edx, edx
je 0x4234bd
call fcn.0041f890
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x423486
jg 0x42344e
test esi, esi
je 0x423486
cmp ebx, eax
jg 0x42345d
jl 0x423458
cmp edi, esi
jae 0x42345d
mov esi, edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.0046f400
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4234aa
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x4234b7
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp + 8], esi
test ebx, ebx
jg 0x423438
jl 0x4234b7
test edi, edi
jne 0x423438
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x4234ed
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x4234ef
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x423568
jg 0x423501
test esi, esi
je 0x423568
test eax, eax
jl 0x42354c
jg 0x42350b
test ebx, ebx
je 0x42354c
cmp edi, eax
jg 0x42351a
jl 0x423515
cmp esi, ebx
jae 0x42351a
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0046f400
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [ebp + 0x10]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x423568
jg 0x42354f
test esi, esi
je 0x423568
jmp 0x42354f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x423568
push eax
push esi
push 1
push edx
call fcn.0047e331
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x423930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4c63ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4cbed0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x423967
push 0x3e9
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x4cbed0]
inc eax
mov dword [0x4cbed0], eax
call fcn.0041cf80
test eax, eax
je 0x423aba
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4cf398]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4cbf5c]
cmp eax, dword [ecx + 4]
jg 0x423add
push edi
push 0xa
push 0x10
push 0x4cbed4
push dword [0x4cbf58]
call fcn.0047a466
push 0xa
push 0x20
mov eax, esi
cdq
push 0x4cbf18
push edx
push eax
call fcn.0047a3f2
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xa
push 0x10
push 0x4cbef4
push eax
call fcn.0047a466
mov ecx, 8
mov dword [0x4cbf68], 1
mov esi, str.kcrashdumper.exe
mov dword [0x4cbf64], 0
lea edi, [ebp - 0x28]
mov dword [0x4cbf60], 0xc
rep movsd dword es:[edi], dword [esi]
add esp, 0x10
lea eax, [ebp - 0x28]
movsw word es:[edi], word [esi]
push eax
call fcn.0041cf80
push eax
push str._s_s
push 0x4cbf70
call fcn.00423650
call fcn.0041d250
push eax
push 0x4cbf18
push 0x4cbef4
push 0x4cbed4
push str._pid_s__tid_s__exp_s__callfrom1__module_s
push 0x4cc770
call fcn.00423680
push 0x4cd8b4
push 0x4cd870
push 0
push 0
push 1
push 0
mov eax, 0xa
mov dword [0x4cd870], 0x44
push 0x4cc770
push 0x4cbf70
mov dword [0x4cd89c], 1
mov word [0x4cd8a0], ax
call fcn.00463380
add esp, 0x48
mov dword [0x4cd8c4], eax
pop edi
test eax, eax
je 0x423aba
push 0xffffffffffffffff
push dword [0x4cd8b4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x4cd8b8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x4cd8b4]
call esi
call fcn.00423b20
push 0x3e9
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret
push 0x4cbf5c
call fcn.0046dee3
add esp, 4
cmp dword [0x4cbf5c], 0xffffffff
jne 0x42399a
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0x4cbf5c
mov dword [0x4cbf58], eax
call fcn.0046de99
add esp, 4
jmp 0x42399a
Function at 0x423b20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49873d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4c63ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0041cf80
test eax, eax
je 0x423c74
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403330
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x60], ecx
cmp eax, 8
jb 0x423c6c
add eax, 0xfffffff9
lea edx, [ecx + eax*2]
mov eax, ecx
mov dword [ebp - 0x5c], edx
sub edx, eax
mov esi, 0
sar edx, 1
je 0x423bb5
cmp word [eax], 0x2f
je 0x423bb3
cmp edx, 1
je 0x423bb5
add eax, 2
dec edx
cmp word [eax], 0x2f
jne 0x423ba4
mov esi, eax
mov eax, esi
test eax, eax
je 0x423c6c
movzx edx, word [eax]
mov edi, 0x2f
mov esi, 8
mov ecx, str._nativex
cmp edx, edi
jb 0x423bf4
mov ebx, eax
sub ebx, ecx
cmp dx, di
ja 0x423bf4
cmp esi, 1
je 0x423bfc
movzx edx, word [ebx + ecx + 2]
add ecx, 2
dec esi
movzx edi, word [ecx]
cmp dx, di
jae 0x423bdc
mov edx, dword [ebp - 0x5c]
add eax, 2
jmp 0x423b93
sub eax, dword [ebp - 0x60]
sar eax, 1
cmp eax, 0xffffffff
je 0x423c6c
lea eax, [ebp - 0x58]
push 1
push eax
call fcn.00461190
push str._addonsjsapi_nativex.dll
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00403130
add esp, 0x14
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.004022a0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x423c64
push str.ProcNativeXCrash
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x423c5d
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x40]
call fcn.004022a0
lea ecx, [ebp - 0x28]
call fcn.004022a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret
Function at 0x425650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4256a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4256a9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x42569a
cmp esi, edx
jae 0x4256a9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x425688
cmp esi, edx
jae 0x4256a9
cmp word [esi], 0
je 0x4256a9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4256f0
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498945
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4c63ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
cmp dword [edi + 0x10], 0
je 0x425825
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x42573b
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x425825
push edi
lea ecx, [ebp - 0x40]
call fcn.00401730
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00401730
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.enableetw
push eax
call fcn.0046fd08
add esp, 8
test eax, eax
je 0x42578e
push 0xb
push str.__enableetw
lea ecx, [ebp - 0x28]
call fcn.00402c30
xor eax, eax
mov dword [ebp - 0x94], 0x44
push 0x40
push eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x90]
push eax
call fcn.0046f980
add esp, 0xc
cmp dword [esi + 0x10], 0
jne 0x4257c2
xor esi, esi
jmp 0x4257ca
cmp dword [esi + 0x14], 8
jb 0x4257ca
mov esi, dword [esi]
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x50]
push edx
lea edx, [ebp - 0x94]
push edx
push 0
push 0
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push 0
cmovae eax, dword [ebp - 0x40]
push esi
push ecx
push eax
call fcn.00463380
add esp, 0x20
test eax, eax
je 0x42580e
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x42580e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x50]
lea ecx, [ebp - 0x28]
call fcn.004022a0
lea ecx, [ebp - 0x40]
call fcn.004022a0
mov eax, esi
jmp 0x425827
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret
Function at 0x427310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498c1d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x4c63ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0
je 0x42742f
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x10], 0
je 0x42742f
cmp dword [eax + 0x14], 8
jb 0x427359
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x14]
call fcn.00424080
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x427371
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x10]
call fcn.00424080
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push 0x2001f
push 0
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4273e4
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4273ce
cmp dword [ebp - 0x1c], 4
mov ecx, 0xd
cmovne eax, ecx
mov esi, dword [ebp + 0x14]
test eax, eax
cmove esi, dword [ebp - 0x20]
test edi, edi
je 0x4273e7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4273e7
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427404
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x42741c
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e9c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4997b5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4c63ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, word [ebp + 8]
mov edi, dword [ebp + 0xc]
add eax, 0xffffff96
cmp eax, 0xf
ja case.0x42ea03.107
movzx eax, byte [eax + 0x42eaf8]
jmp dword [eax*4 + 0x42eae0]
mov eax, dword [esi]
push edi
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x42ead6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret 8
push edi
call fcn.0042f0c0
jmp 0x42ea12
push edi
call fcn.0042eef0
jmp 0x42ea12
movzx eax, word [esi + 0xc]
lea ebx, [esi + 0xc]
test ax, ax
jne 0x42ea69
push 0
push 0x1a
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebx], 0
je case.0x42ea03.107
mov ecx, esi
call fcn.0042f6b0
push eax
lea ecx, [ebp - 0x58]
call fcn.00403330
push str.Kingsoft_
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.00403130
push edi
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.00411cc0
add esp, 0x18
mov ecx, edi
push eax
call fcn.00407120
lea ecx, [ebp - 0x28]
call fcn.004022a0
lea ecx, [ebp - 0x40]
call fcn.004022a0
lea ecx, [ebp - 0x58]
call fcn.004022a0
mov al, 1
jmp 0x42ea1c
push edi
call fcn.0042e6a0
test al, al
je case.0x42ea03.107
mov al, 1
jmp 0x42ea1c
Function at 0x42eef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499898
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4c63ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [ecx + 0x4bc], 0
lea esi, [ecx + 0x4bc]
mov edi, dword [ebp + 8]
je 0x42efe7
mov ecx, esi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ef51
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00402db0
push 0x5c
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0042da40
push edi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00411cc0
add esp, 0x18
mov ecx, edi
push eax
call fcn.00407120
lea ecx, [ebp - 0x40]
call fcn.004022a0
lea ecx, [ebp - 0x58]
call fcn.004022a0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x42f099
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42f08f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42f0b8
jmp 0x42f08f
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x42f00d
push 0x208
push eax
push esi
call fcn.0046f980
add esp, 0xc
xor al, al
jmp 0x42f09b
mov ecx, esi
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42f030
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00402db0
push 0x5c
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0042da40
push edi
push eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
call fcn.00411cc0
add esp, 0x18
mov ecx, edi
push eax
call fcn.00407120
lea ecx, [ebp - 0x70]
call fcn.004022a0
lea ecx, [ebp - 0x88]
jmp 0x42efa5
push edx
push ecx
call fcn.0046d9fd
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dc6a
mov esp, ebp
pop ebp
ret 4
call fcn.00478f8e
int3