joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c397
Capabilities:
Set registry value

Disassembly:
push 0x21c
mov eax, 0x485889
call fcn.00458e5d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], eax
mov edi, str.SetWerReg__
push edi
push str._s_Success_opening_key.
push 0x141
push ecx
mov dword [ebp - 4], 1
call fcn.0041ef10
pop ecx
mov esi, str..WrpPlugin.cpp
push eax
mov ebx, 0x800040
mov ecx, esi
call fcn.0041f0d0
add esp, 0x10
push 4
lea eax, [ebp + 0x44]
push eax
push 4
push 0
push str.DumpType
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
test eax, eax
jne 0x41c40e
push str._s_Success_writing_to_Registry_DumpType.
push 0x14b
jmp 0x41c418
push str._s_Error_writing_to_Registry_DumpType.
push 0x14d
push ecx
call fcn.0041ef10
pop ecx
push eax
mov ecx, esi
call fcn.0041f0d0
add esp, 0x10
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.004504c0
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp dword [ebp + 0x24], 8
jae 0x41c454
lea eax, [ebp + 0x10]
push eax
push 0x49fc74
mov ecx, 0x104
lea edi, [ebp - 0x220]
call fcn.0041b259
pop ecx
pop ecx
mov eax, edi
push eax
mov edi, str.SetWerReg__
push edi
push str._s_szData__S_.
push 0x158
call fcn.0041ef10
push eax
mov ecx, esi
call fcn.0041f0d0
mov eax, dword [ebp + 0x20]
add esp, 0x14
add eax, eax
push eax
lea eax, [ebp - 0x220]
push eax
push 2
push 0
push 0x49fad4
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
test eax, eax
jne 0x41c4c2
push str._s_Success_writing_to_Registry_DumpFolder.
push 0x162
jmp 0x41c4cc
push str._s_Error_writing_to_Registry_DumpFolder.
push 0x164
push ecx
call fcn.0041ef10
pop ecx
push eax
mov ecx, esi
call fcn.0041f0d0
add esp, 0x10
push 0
push 1
lea esi, [ebp + 0xc]
call fcn.004019bb
push 0
push 1
lea esi, [ebp + 0x28]
call fcn.004019bb
call fcn.00458ee0
ret 0x40

Function at 0x41c4fe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x4aeda0]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a0]
push esi
push edi
xor edi, edi
mov esi, 0x402
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x70]
push edi
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], edi
call fcn.004504c0
push esi
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.004504c0
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push 0x49fad4
add esi, 0xfffffffe
push ebx
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c594
cmp dword [ebp - 0x78], 2
jne 0x41c594
lea eax, [ebp - 0x70]
push eax
call fcn.00450a1d
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x80]
call fcn.00454aba
add esp, 0x14
mov dword [ebp - 0x74], 1
mov ecx, dword [ebp + 0x394]
mov eax, dword [ebp - 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.004504a7
add ebp, 0x398
leave
ret 4
Function at 0x41d210
Capabilities:
Write file on windows

Disassembly:
push 0x7c
mov eax, 0x48706c
call fcn.00458e5d
mov eax, dword [ebp + 8]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 0x5c], eax
mov eax, dword [esi + 0x14]
mov edi, ecx
mov dword [ebp - 0x58], edi
test eax, eax
jbe 0x41d35e
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x41d24b
mov eax, dword [edi]
jmp 0x41d24d
mov eax, edi
call fcn.00426200
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x50], eax
jb 0x41d25f
mov eax, dword [edi]
jmp 0x41d261
mov eax, edi
push eax
push str.CreateTaskImpl__:_LogFile_S
push 0x24a
push ecx
call fcn.0041ef10
pop ecx
push eax
mov ebx, 0x800008
mov ecx, str..WrpPlugin.cpp
call fcn.0041f0d0
push 0xc
pop ebx
push ebx
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004504c0
and dword [ebp - 0x64], 0
xor eax, eax
inc eax
add esp, 0x1c
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x60], eax
jb 0x41d2ac
mov esi, dword [edi]
jmp 0x41d2ae
mov esi, edi
push 4
lea ecx, [ebp - 0x68]
push ecx
push eax
push 4
mov edi, 0x80
call fcn.00425c10
add esp, 0x10
cmp dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], eax
je 0x41d35b
push dword [ebp - 0x54]
lea eax, [ebp - 0x84]
push str._n_n_n_n
push eax
call fcn.0040b3d6
add esp, 0xc
push str._n________________________________n_n_n
push eax
lea eax, [ebp - 0x48]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00401e38
add esp, 0xc
push ebx
push 1
lea esi, [ebp - 0x84]
mov byte [ebp - 4], 2
call fcn.004019bb
push ebx
lea edi, [ebp - 0x48]
lea esi, [ebp - 0x2c]
call fcn.004265b0
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x41d341
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x41d32f
lea eax, [ebp - 0x28]
push ebx
lea ecx, [ebp - 0x50]
push ecx
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040230d
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.004019bb
mov edi, dword [ebp - 0x58]
call fcn.0042c2d0
cmp dword [edi + 0x18], 8
mov ebx, eax
jb 0x41d370
mov edi, dword [edi + 4]
jmp 0x41d373
add edi, 4
mov ecx, dword [ebp - 0x4c]
push ebx
push edi
push dword [ebp - 0x54]
call fcn.0042c470
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41d3c4
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x5c]
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test ebx, ebx
je 0x41d3ac
push ebx
call esi
cmp dword [ebp - 0x4c], 0
je 0x41d3bf
push dword [ebp - 0x4c]
call esi
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
jmp 0x41d3d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
xor eax, eax
call fcn.00458ee0
ret
Function at 0x41ee60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, eax
lea eax, [esi + 4]
mov dword [0x4b31b0], esi
mov dword [esi], ebx
mov byte [eax], 0
test edi, edi
je 0x41ee99
push 0x200
push edi
push 0x104
push eax
call fcn.004577cc
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test dword [esi], 0x80000000
je 0x41eed3
push 0x4b31a0
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 1
push 0x49d110
push 0
push 0x41ed60
mov dword [esp + 0x28], 0x49d120
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
test dword [ebp + 8], ebx
je 0x41eefd
push edi
push 0x4a01f4
push 0x49b088
push 0x4a01fc
push str.___s._s._s___s__LOG_START_
push 0
push esi
mov ecx, 0x49b010
call fcn.0041f0d0
add esp, 0x1c
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41ef90
Capabilities:
Write file on windows

Disassembly:
test byte [0x4b33b0], 1
jne 0x41efc2
or dword [0x4b33b0], 1
push 0x4b3398
mov dword [0x4b3394], 0x4a0284
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x48a150
call fcn.00450ed1
add esp, 4
push esi
mov esi, dword [esp + 8]
add esi, 4
cmp byte [esi], 0
je 0x41f036
mov eax, dword [0x4b3394]
mov edx, dword [eax + 4]
mov ecx, 0x4b3394
call edx
push 0
push 0
push 4
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41f027
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4b3394]
mov edx, dword [eax + 8]
mov ecx, 0x4b3394
call edx
pop esi
ret 0xc
Function at 0x41f0d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2048
call fcn.004575f0
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x2044], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ecx
mov ecx, dword [eax]
mov dword [esp], eax
mov eax, ecx
and eax, ebx
push esi
push edi
test eax, 0xffff000
je 0x41f29c
test eax, 0xfff
je 0x41f29c
test ecx, ecx
jns 0x41f1ec
cmp dword [0x4b319c], 0
je 0x41f1ec
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
push edx
push eax
push 0xffe
lea ecx, [esp + 0x1054]
push 0xfff
push ecx
call fcn.00457f18
mov esi, eax
add esp, 0x14
cmp esi, 0xffd
jae 0x41f29c
push 0x1036
lea edx, [esp + 0x16]
push 0
push edx
call fcn.004504c0
mov ecx, dword [0x49d120]
mov edx, dword [0x49d124]
mov eax, 0x1038
mov word [esp + 0x1c], ax
mov eax, dword [0x49d128]
mov dword [esp + 0x34], ecx
mov ecx, dword [0x49d12c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
add esp, 0xc
lea eax, [esp + 0x1048]
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], edx
mov byte [esp + 0x14], bl
mov dword [esp + 0x3c], 0x20000
mov dword [esp + 0x40], esi
call fcn.0041ed10
mov eax, dword [0x4b31ac]
mov ecx, dword [0x4b31a8]
lea edx, [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_TraceEvent]
pop edi
pop esi
mov ecx, dword [esp + 0x2044]
xor ecx, esp
call fcn.004504a7
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x1048]
push ebx
push edx
call fcn.0041f040
mov ecx, dword [ebp + 0x10]
mov esi, eax
lea eax, [ebp + 0x14]
push eax
push ecx
mov edx, 0xffe
sub edx, esi
push edx
mov eax, 0xfff
sub eax, esi
push eax
lea ecx, [esp + esi + 0x1060]
push ecx
call fcn.00457f18
mov edx, dword [ebp + 0xc]
add esp, 0x1c
mov edi, eax
mov eax, dword [esp + 0xc]
push edx
push eax
mov ecx, 0xfff
sub ecx, edi
push str.__S__d___n
sub ecx, esi
lea edx, [edi + esi]
push ecx
lea eax, [esp + edx + 0x1058]
push eax
call fcn.00452d80
add eax, edi
add eax, esi
add esp, 0x14
mov ecx, 0xfff
cmp eax, 0xffe
jae 0x41f26b
mov byte [esp + eax + 0x1048], 0
mov ecx, eax
mov esi, dword [esp + 8]
test dword [esi], 0x20000000
je 0x41f286
push ecx
lea ecx, [esp + 0x104c]
push ecx
push esi
call fcn.0041ef90
test dword [esi], 0x40000000
je 0x41f29c
lea edx, [esp + 0x1048]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x204c]
pop edi
pop esi
xor ecx, esp
call fcn.004504a7
mov esp, ebp
pop ebp
ret
Function at 0x41fc60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004504c0
add esp, 0xc
lea edx, [esp + 8]
push edx
push 1
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x41fce6
push eax
push str.GETGUID:Error_get_cache_file_path_SHGetFolderPath_returns__d_
push 0x5c
push ecx
call fcn.0041ef10
add esp, 4
push eax
mov ebx, 0x2000002
mov ecx, str..GetGUIDInternal.cpp
call fcn.0041f0d0
add esp, 0x10
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004504a7
add esp, 0x214
ret
lea eax, [esp + 8]
push eax
call fcn.00450a1d
add esp, 4
lea ecx, [esp + 8]
call fcn.00401b92
push str.housecall.guid.cache
call fcn.00450a1d
add esp, 4
push eax
mov eax, str.housecall.guid.cache
mov ecx, esi
call fcn.00401880
mov ecx, dword [esp + 0x214]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004504a7
add esp, 0x214
ret

Function at 0x41fd40
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x486fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4aeda0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], eax
mov word [esp + 8], cx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], eax
call fcn.0041fc60
test eax, eax
jne 0x41fdac
cmp dword [esp + 0x1c], 8
jb 0x41fda8
mov edx, dword [esp + 8]
push edx
call fcn.0045061f
add esp, 4
xor eax, eax
jmp 0x41fe02
cmp dword [esp + 0x1c], 8
mov eax, dword [esp + 8]
jae 0x41fdbb
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41fde9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41fde9
cmp dword [esp + 0x1c], 8
jb 0x41fda8
mov eax, dword [esp + 8]
push eax
call fcn.0045061f
add esp, 4
xor eax, eax
jmp 0x41fe02
cmp dword [esp + 0x1c], 8
jb 0x41fdfd
mov ecx, dword [esp + 8]
push ecx
call fcn.0045061f
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004504a7
add esp, 0x2c
ret
Function at 0x420090
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x486f40
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov eax, dword [0x4aeda0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor eax, eax
push 0x49b010
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00450a1d
add esp, 4
mov ecx, 0x49b010
lea esi, [esp + 0x18]
call fcn.00401b92
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.0041fc60
test eax, eax
jne 0x42011b
cmp dword [esp + 0x30], 8
jb 0x42024b
mov ecx, dword [esp + 0x1c]
push ecx
jmp 0x420243
mov byte [esp + 0x40], 1
mov eax, dword [esp + 0x1c]
mov ebp, 8
cmp dword [esp + 0x30], ebp
jae 0x420133
lea eax, [esp + 0x1c]
push 0
push 0x80
push 4
push 0
push 1
push 2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x420158
test esi, esi
jne 0x4201b4
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x420166
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GETGUID:fail__lu__open_cache_for_write__S_
push 0xb8
call fcn.0041ef10
push eax
mov ebx, 0x2000002
mov ecx, str..GetGUIDInternal.cpp
call fcn.0041f0d0
add esp, 0x14
cmp esi, 0xffffffff
je 0x4201a0
test esi, esi
je 0x4201a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x30], ebp
jb 0x42024b
mov edx, dword [esp + 0x1c]
push edx
jmp 0x420243
push 0
lea eax, [esp + 0x14]
push eax
push 0x24
lea ecx, [esp + 0x54]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4201fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GETGUID:Error__lu__writing_GUID_cache
push 0xbf
push ecx
call fcn.0041ef10
add esp, 4
push eax
mov ebx, 0x2000002
mov ecx, str..GetGUIDInternal.cpp
call fcn.0041f0d0
add esp, 0x10
jmp 0x420199
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x42020a
lea eax, [esp + 0x1c]
push eax
push str.GETGUID:GUID_written_to_cache__S_
push 0xc3
push ecx
call fcn.0041ef10
add esp, 4
push eax
mov ebx, 0x2000040
mov ecx, str..GetGUIDInternal.cpp
call fcn.0041f0d0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x30], ebp
jb 0x42024b
mov eax, dword [esp + 0x1c]
push eax
call fcn.0045061f
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004504a7
add esp, 0x34
ret
Function at 0x4209f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push esi
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push ecx
xor esi, esi
push esi
push edi
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x420a84
cmp eax, 2
jne 0x420a4c
push edi
push reloc.WS2_32.dll_bind
push str.GetGUID:_registry___x__s__does_not_exist
push 0x181
call fcn.0041ef10
push eax
mov ebx, 0x2000008
mov ecx, str..GetGUIDInternal.cpp
call fcn.0041f0d0
add esp, 0x14
jmp 0x420b85
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push reloc.WS2_32.dll_bind
push str.GetGUID:_RegOpenKeyEx__x__s__failed:__lu
push 0x183
push ecx
call fcn.0041ef10
add esp, 4
push eax
mov ebx, 0x2000002
mov ecx, str..GetGUIDInternal.cpp
call fcn.0041f0d0
add esp, 0x18
jmp 0x420b85
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push esi
push esi
push esi
push ebx
push eax
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x420ad5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push edi
push reloc.WS2_32.dll_bind
push str.GetGUID:_query_data__x__s__s__length_failed:__lu
push 0x18c
call fcn.0041ef10
push eax
mov ebx, 0x2000002
mov ecx, str..GetGUIDInternal.cpp
call fcn.0041f0d0
add esp, 0x1c
jmp 0x420b85
mov eax, dword [esp + 0xc]
inc eax
push eax
mov dword [esp + 0x1c], eax
call fcn.004503d0
add esp, 4
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
mov eax, dword [esp + 0x14]
push esi
lea edx, [esp + 0x24]
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x420b20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push edi
push reloc.WS2_32.dll_bind
push str.GetGUID:_RegQueryValueExA__x__s__s__failed:__lu
push 0x195
jmp 0x420b3b
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x420b55
push eax
push ebx
push edi
push reloc.WS2_32.dll_bind
push str.GetGUID:_registry__x__s__s__type_mismatch:__lu
push 0x19b
call fcn.0041ef10
push eax
mov ebx, 0x2000002
mov ecx, str..GetGUIDInternal.cpp
call fcn.0041f0d0
add esp, 0x1c
jmp 0x420b78
mov ecx, dword [esp + 0xc]
push esi
mov byte [ecx + esi], 0
call fcn.004506f0
mov ecx, dword [ebp + 8]
add esp, 4
push eax
push esi
call fcn.00402246
mov dword [esp + 0x14], 1
test esi, esi
je 0x420b85
push esi
call fcn.004539c3
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x420b94
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425d30
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x486250
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4aeda0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x68]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], eax
mov word [esp + 0x3c], cx
mov dword [esp + 0x60], eax
mov dword [esp + 0x18], eax
or edi, 0xffffffff
push 0x49b0e0
call fcn.00450a1d
add esp, 4
push eax
lea ecx, [edi + 1]
push 0x49b0e0
mov eax, ebp
call fcn.004090b2
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
jne 0x425dc0
push eax
lea edx, [esp + 0x3c]
push edx
mov eax, ebp
call fcn.0040191e
mov ebx, 8
jmp 0x425dfa
push edi
push ebp
lea esi, [esp + 0x24]
call fcn.00407f24
push 0xffffffffffffffff
lea ecx, [esp + 0x3c]
push ecx
xor ebx, ebx
mov byte [esp + 0x68], 1
call fcn.0040191e
mov byte [esp + 0x60], bl
mov ebx, 8
cmp dword [esp + 0x34], ebx
jb 0x425dfa
mov edx, dword [esp + 0x20]
push edx
call fcn.0045061f
add esp, 4
cmp dword [esp + 0x18], 0
jne 0x425e36
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], 1
test eax, eax
jbe 0x425e36
lea esi, [eax - 1]
cmp eax, esi
ja 0x425e1d
call fcn.0044efcc
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x50], ebx
jae 0x425e2b
lea eax, [esp + 0x3c]
mov ecx, 0x3a
cmp cx, word [eax + esi*2]
je 0x425e9c
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x50], ebx
jae 0x425e44
lea eax, [esp + 0x3c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x425e9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x425e9c
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x50], ebx
jae 0x425e6c
lea ecx, [esp + 0x3c]
push eax
push ecx
push str.CreateDirectoryW__S__error_lu
push 0xbe
call fcn.0041ef10
push eax
mov ebx, 0x2000004
mov ecx, str..FileUtility.cpp
call fcn.0041f0d0
add esp, 0x14
cmp dword [esp + 0x6c], 0
je 0x425edc
mov ebx, 8
cmp edi, 0xffffffff
jne 0x425d86
cmp dword [esp + 0x50], ebx
jb 0x425eb8
mov eax, dword [esp + 0x3c]
push eax
call fcn.0045061f
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004504a7
add esp, 0x50
ret
cmp dword [esp + 0x50], 8
jb 0x425ef0
mov edx, dword [esp + 0x3c]
push edx
call fcn.0045061f
add esp, 4
xor eax, eax
jmp 0x425ebd
Function at 0x426200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x427350
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
mov ebp, ecx
call fcn.004503d0
mov edi, eax
add esp, 4
test edi, edi
jne 0x42736e
pop edi
pop esi
pop ebp
ret 0xc
mov eax, dword [esp + 0x10]
push esi
push eax
push esi
push edi
call fcn.004505a2
add esp, 0x10
test eax, eax
je 0x427395
push edi
xor esi, esi
call fcn.004539c3
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
mov ecx, esi
mov eax, edi
test esi, esi
je 0x4273ac
lea ecx, [ecx]
mov dl, byte [eax]
not dl
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x4273a0
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 0x20]
push 0
push eax
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call fcn.004539c3
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x42a110
Capabilities:
Read file on windows
Terminate process

Disassembly:
sub esp, 0x17c
mov eax, dword [0x4aeda0]
xor eax, esp
mov dword [esp + 0x178], eax
xor eax, eax
push ebp
mov ebp, dword [esp + 0x184]
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x40]
push eax
push ebx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42a195
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x32]
push ecx
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xffffffffffffffff
push 8
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
push ebx
push ebp
call fcn.0044c1ff
mov esi, eax
add esp, 0x28
mov dword [esp + 0x10], 0
test esi, esi
je 0x42a1dc
push ebx
push str.error_in_opening__s_in_zip_n
call fcn.00453cbb
add eax, 0x40
push eax
call fcn.00453b9f
add esp, 0xc
jmp 0x42a2a2
push 0x4a1798
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.004552b0
add esp, 0xc
test eax, eax
je 0x42a213
push edi
push eax
push str.error__d_opening__s_for_read_n
or esi, 0xffffffff
call fcn.00453cbb
add eax, 0x40
push eax
call fcn.00453b9f
add esp, 0x10
jmp 0x42a2a2
mov edx, dword [esp + 0x10]
mov eax, dword [0x4b31b8]
push edx
push 0x4000
push 1
push eax
xor esi, esi
call fcn.004555a3
mov edi, eax
add esp, 0x10
cmp edi, 0x4000
jge 0x42a264
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004557cb
add esp, 4
test eax, eax
jne 0x42a264
push ebx
push str.error_reading__s_n
call fcn.00453cbb
add eax, 0x40
push eax
call fcn.00453b9f
add esp, 0xc
or esi, 0xffffffff
test edi, edi
jle 0x42a296
mov edx, dword [0x4b31b8]
push edi
push edx
push ebp
call fcn.0044b89a
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x42a298
push ebx
push str.error_writing__s_in_zip_n
call fcn.00453cbb
add eax, 0x40
push eax
call fcn.00453b9f
add esp, 0xc
test esi, esi
jne 0x42a2a2
test edi, edi
jg 0x42a213
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42a2b3
push eax
call fcn.00453868
add esp, 4
test esi, esi
jl 0x42a2db
push ebp
call fcn.0044bb47
add esp, 4
test eax, eax
je 0x42a2db
push ebx
push str.error_closing__s_in_the_zip_n
call fcn.00453cbb
add eax, 0x40
push eax
call fcn.00453b9f
add esp, 0xc
mov ecx, dword [esp + 0x184]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.004504a7
add esp, 0x17c
ret