joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058f6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40594a
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10001
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x4059e3
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4059a1
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x4059e3
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4059dc
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10002
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x4059e3
xor eax, eax
jmp 0x4059e3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4059e8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a3c
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10001
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x405adb
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a99
cmp dword [ebp - 4], 2
je 0x405a99
cmp dword [ebp - 4], 3
je 0x405a99
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10004
call fcn.0040435c
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x405adb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405ad4
push 0x2002007
call fcn.004042f8
add esp, 4
push 0x10002
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x405adb
xor eax, eax
jmp 0x405adb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405ae0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.0041c5f0
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x475218
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x405b60
push 0x10001
call fcn.0040435c
add esp, 4
push 0x2002012
call fcn.004042f8
add esp, 4
mov eax, 0xffffffff
jmp 0x405d5b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x475250
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x405bc7
push 0x10006
call fcn.0040435c
add esp, 4
push 0x2002012
call fcn.004042f8
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x405d5b
mov eax, dword [ebp - 0x810]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x2f28]
test ecx, ecx
je 0x405c99
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.0041c544
add esp, 4
push 0x475254
lea eax, [ebp - 0x808]
push eax
call fcn.0041c320
add esp, 8
test eax, eax
jne 0x405c6f
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x405bc7
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x475260
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x405d10
push 0x10006
call fcn.0040435c
add esp, 4
push 0x2002012
call fcn.004042f8
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x405d5b
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x405d54
push 0x10002
call fcn.0040435c
add esp, 4
push 0x2002012
call fcn.004042f8
add esp, 4
mov eax, 0xffffffff
jmp 0x405d5b
xor eax, eax
jmp 0x405d5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405d60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2f28
call fcn.0041c5f0
push ebx
push esi
push edi
mov dword [ebp - 8], 0x1388
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x814]
push eax
push 0xf003f
push 0
push 0x475264
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x405de0
push 0x10001
call fcn.0040435c
add esp, 4
push 0x2002011
call fcn.004042f8
add esp, 4
mov eax, 0xffffffff
jmp 0x405ff1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f28]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x47529c
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x405e1d
mov byte [ebp - 0x2f28], 0
mov eax, dword [ebp - 0x810]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x2f28]
test ecx, ecx
je 0x405eef
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
lea eax, [ebp - 0x808]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 0x808]
push eax
call fcn.0041c544
add esp, 4
push 0x4752a0
lea eax, [ebp - 0x808]
push eax
call fcn.0041c320
add esp, 8
test eax, eax
jne 0x405ec5
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x810]
lea eax, [ebp + eax - 0x2f28]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x810]
add ecx, eax
inc ecx
mov dword [ebp - 0x810], ecx
jmp 0x405e1d
push 0x4752ac
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x818]
lea eax, [ebp + eax - 0x1ba0]
push eax
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x818]
add ecx, eax
inc ecx
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp - 0x818]
mov byte [ebp + eax - 0x1ba0], 0
mov eax, dword [ebp - 0x818]
inc eax
push eax
lea eax, [ebp - 0x1ba0]
push eax
push 7
push 0
push 0x4752b8
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x405fa6
push 0x10006
call fcn.0040435c
add esp, 4
push 0x2002011
call fcn.004042f8
add esp, 4
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xffffffff
jmp 0x405ff1
mov eax, dword [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x405fea
push 0x10002
call fcn.0040435c
add esp, 4
push 0x2002011
call fcn.004042f8
add esp, 4
mov eax, 0xffffffff
jmp 0x405ff1
xor eax, eax
jmp 0x405ff1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406151
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x406172
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406177
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4061ab
push 0x20
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 4]
jmp 0x4061b3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40665d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a1178
push 0x5a6480
call fcn.0041bfb0
add esp, 8
mov dword [0x5a3050], 0
jmp 0x40669d
inc dword [0x5a3050]
cmp dword [0x5a3050], 0x3000
jge 0x4066ca
mov eax, dword [0x5a3050]
mov byte [eax + 0x5a68c0], 0
mov eax, dword [0x5a3050]
mov byte [eax + 0x5a3060], 0
jmp 0x406697
lea eax, [ebp - 4]
push eax
push 0x5a3060
push 0x5a6480
call fcn.00409b53
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4066f3
mov eax, 0xffffffff
jmp 0x406901
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x5a3060
push 0x4a1184
call fcn.00407518
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x406721
xor eax, eax
jmp 0x406901
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x5a3060
push 0x4a1190
call fcn.00407518
add esp, 0x10
test eax, eax
jne 0x40681a
mov ebx, dword [ebp - 4]
and ebx, 0xffff
mov eax, dword [ebp - 0xc]
and eax, 0xffff
sub ebx, eax
push 0x4a1198
call fcn.0041bdf0
add esp, 4
add ebx, eax
push ebx
push 0x4a11a4
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push ecx
push 0x5a68c0
call fcn.0041c620
add esp, 0xc
push 0x4a11b0
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
mov edx, dword [ebp - 0xc]
and edx, 0xffff
sub ecx, edx
add eax, ecx
push eax
push 0x5a68c0
push 0x4a11bc
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push ecx
call fcn.0041c620
add esp, 0xc
push 0x4a11c4
call fcn.0041bdf0
add esp, 4
push eax
push 0x4a11cc
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041c620
add esp, 0xc
push 0x4a11d4
call fcn.0041bdf0
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
lea ebx, [ecx + eax]
push 0x4a11dc
call fcn.0041bdf0
add esp, 4
sub ebx, eax
mov word [ebp - 4], bx
jmp 0x4068e0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 0x4a11e8
call fcn.00407518
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4068d1
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x5a68c0
call fcn.0041c620
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
push 0x5a68c0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041c620
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 8]
and ecx, 0xffff
inc ecx
sub eax, ecx
mov word [ebp - 4], ax
jmp 0x4068e0
mov eax, dword [ebp - 0xc]
and eax, 0xffff
sub eax, 2
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
push 0x5a3060
push 0x5a6480
call fcn.00409c9c
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x406901
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4070e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a126c
push 0x5a6480
call fcn.0041bfb0
add esp, 8
push 0x4a1270
push 0x5a6480
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x4071c0
mov eax, dword [ebp + 8]
push eax
push 0x5a66a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a1280
push 0x5a66a0
call fcn.0041bfb0
add esp, 8
push 0x4a1284
push 0x5a66a0
call fcn.0041bfb0
add esp, 8
push 0
push 0x5a66a0
call fcn.00422bd5
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4071c0
mov eax, dword [ebp - 8]
push eax
call fcn.0042095d
add esp, 4
push 0
push 0x5a6480
push 0x5a66a0
call fcn.0040aa6d
add esp, 0xc
test eax, eax
jne 0x4071b9
push 0x4000c
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x407240
xor eax, eax
jmp 0x407240
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a1294
push 0x5a6480
call fcn.0041bfb0
add esp, 8
push 0x4a1298
push 0x5a6480
call fcn.0041bfb0
add esp, 8
push 0
push 0x5a6480
push 0
call fcn.0041851c
add esp, 4
push eax
push 0x53b708
call fcn.004181c4
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x5a6480
push 1
call fcn.0041851c
add esp, 4
push eax
push 0x54b708
call fcn.004181c4
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x407240
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407245
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a12a8
push 0x5a6480
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x4072fd
mov eax, dword [ebp + 8]
push eax
push 0x5a66a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a12b8
push 0x5a66a0
call fcn.0041bfb0
add esp, 8
push 0
push 0x5a66a0
call fcn.00422bd5
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4072fd
mov eax, dword [ebp - 8]
push eax
call fcn.0042095d
add esp, 4
push 0
push 0x5a6480
push 0x5a66a0
call fcn.0040aa6d
add esp, 0xc
test eax, eax
jne 0x4072f6
push 0x4000c
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x407321
xor eax, eax
jmp 0x407321
push 0
push 0x5a6480
push 0xbc00
push 0x495568
call fcn.004181c4
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x407321
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407326
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a12c8
push 0x5a6480
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x4073de
mov eax, dword [ebp + 8]
push eax
push 0x5a66a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a12d4
push 0x5a66a0
call fcn.0041bfb0
add esp, 8
push 0
push 0x5a66a0
call fcn.00422bd5
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4073de
mov eax, dword [ebp - 8]
push eax
call fcn.0042095d
add esp, 4
push 0
push 0x5a6480
push 0x5a66a0
call fcn.0040aa6d
add esp, 0xc
test eax, eax
jne 0x4073d7
push 0x4000c
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40741e
xor eax, eax
jmp 0x40741e
push 0
push 0x5a6480
push 0xffff
push 0x4832c0
call fcn.004181c4
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x5a6480
push 0x22a3
push 0x4932c0
call fcn.004181c4
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40741e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407423
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.0040613c
test eax, eax
jne 0x407440
xor eax, eax
jmp 0x407513
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a12e0
push 0x5a6480
call fcn.0041bfb0
add esp, 8
cmp dword [ebp + 8], 0
je 0x4074ef
mov eax, dword [ebp + 8]
push eax
push 0x5a66a0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a12f0
push 0x5a66a0
call fcn.0041bfb0
add esp, 8
push 0
push 0x5a66a0
call fcn.00422bd5
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4074ef
mov eax, dword [ebp - 8]
push eax
call fcn.0042095d
add esp, 4
push 0
push 0x5a6480
push 0x5a66a0
call fcn.0040aa6d
add esp, 0xc
test eax, eax
jne 0x4074e8
push 0x4000c
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x407513
xor eax, eax
jmp 0x407513
push 0
push 0x5a6480
push 0xe000
push 0x4752c0
call fcn.004181c4
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x407513
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407603
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [0x5a3050], 0
jmp 0x407621
inc dword [0x5a3050]
cmp dword [0x5a3050], 0x3000
jge 0x407642
mov eax, dword [0x5a3050]
mov byte [eax + 0x5a3060], 0
jmp 0x40761b
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a1300
push 0x5a6480
call fcn.0041bfb0
add esp, 8
push 0x5a98c0
push 0x5a3060
push 0x5a6480
call fcn.00409b53
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40768e
mov eax, 0xffffffff
jmp 0x4077ed
mov ax, word [0x5a98c0]
mov word [ebp - 4], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x40778a
push 0x4a130c
push 0x5a98d0
call fcn.0041bfa0
add esp, 8
test byte [ebp + 0xc], 2
je 0x4076e4
push 0x5a98c0
push 0x5a3060
call fcn.00407ac7
add esp, 8
cmp eax, 0xffffffff
jne 0x4076e4
mov eax, 0xffffffff
jmp 0x4077ed
test byte [ebp + 0xc], 1
je 0x407713
push 0x5a98c0
push 0x5a3060
call fcn.00407ccb
add esp, 8
cmp eax, 0xffffffff
jne 0x407713
mov eax, 0xffffffff
jmp 0x4077ed
jmp 0x4077a3
mov ax, word [0x5a98c0]
mov word [ebp - 4], ax
test byte [ebp + 0xc], 1
je 0x407751
push 0x5a98c0
push 0x5a3060
call fcn.00407fc6
add esp, 8
cmp eax, 0xffffffff
jne 0x407751
mov eax, 0xffffffff
jmp 0x4077ed
test byte [ebp + 0xc], 2
je 0x407780
push 0x5a98c0
push 0x5a3060
call fcn.004077f2
add esp, 8
cmp eax, 0xffffffff
jne 0x407780
mov eax, 0xffffffff
jmp 0x4077ed
jmp 0x4077a3
cmp dword [ebp - 8], 1
je 0x407718
cmp dword [ebp - 8], 2
je 0x4076a3
jmp 0x4077a3
mov eax, dword [ebp - 4]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x5a98c0]
cmp eax, ecx
je 0x4077e6
push 0x5a98c0
push 0x5a3060
push 0x5a6480
call fcn.00409c9c
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4077e6
mov eax, 0xffffffff
jmp 0x4077ed
xor eax, eax
jmp 0x4077ed
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4088cf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a14fc
push 0x5a6480
call fcn.0041bfb0
add esp, 8
push 0x5a6480
call fcn.0040aa40
add esp, 4
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a1508
push 0x5a6480
call fcn.0041bfb0
add esp, 8
push 0x5a6480
call fcn.0040aa40
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408995
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov dword [ebp - 0x204], 0
push 0x200
push 0x5a6060
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test byte [ebp + 8], 2
je 0x408a71
push 0x5a6060
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x4a1518
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00408938
add esp, 4
test eax, eax
je 0x408a1b
push 0x200400b
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x5a6060
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x4a1524
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00408938
add esp, 4
test eax, eax
je 0x408a71
push 0x200400a
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
test byte [ebp + 8], 1
je 0x408b3b
push 0x5a6060
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x4a1534
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
push 0x4a1538
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00408938
add esp, 4
test eax, eax
je 0x408ae5
push 0x2004017
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x5a6060
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfa0
add esp, 8
push 0x4a1548
lea eax, [ebp - 0x200]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00408938
add esp, 4
test eax, eax
je 0x408b3b
push 0x2004015
call fcn.004042f8
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
mov eax, dword [ebp - 0x204]
jmp 0x408b46
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408b4b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5a6480
push 0x5a98e0
call fcn.0041bfa0
add esp, 8
push 0x4a1558
push 0x5a6480
call fcn.0041bfb0
add esp, 8
push 2
push 0x5a6480
call fcn.00424e7d
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408c08
cmp dword [0x5a1a4c], 2
je 0x408be4
cmp dword [ebp - 4], 0
je 0x408bdf
push 0x2010003
call fcn.004042f8
add esp, 4
push 0x80005
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x408c7e
jmp 0x408c08
push 0x2010003
call fcn.004042f8
add esp, 4
push 0x80006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x408c7e
push 0x200
push 0x5a6480
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a1564
push 0x5a6480
call fcn.0041bfb0
add esp, 8
push 2
push 0x5a6480
call fcn.00424e7d
add esp, 8
mov dword [ebp - 4], eax
cmp dword [0x5a1a4c], 2
je 0x408c77
cmp dword [ebp - 4], 0
je 0x408c77
push 0x2010004
call fcn.004042f8
add esp, 4
push 0x80005
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x408c7e
xor eax, eax
jmp 0x408c7e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409b53
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x180
push 0x8002
mov eax, dword [ebp + 8]
push eax
call fcn.00422bd5
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x409b96
push 0x40006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x409c97
mov eax, dword [ebp - 8]
push eax
call fcn.00424ec1
add esp, 4
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0xffff
jne 0x409bdf
mov eax, dword [ebp - 8]
push eax
call fcn.0042095d
add esp, 4
push 0x40008
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x409c97
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00420d0a
add esp, 0xc
cmp eax, 0xffffffff
jne 0x409c1b
push 0x40009
call fcn.0040435c
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.0042095d
add esp, 4
mov eax, 0xffffffff
jmp 0x409c97
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00420b14
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x409c64
push 0x4000a
call fcn.0040435c
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.0042095d
add esp, 4
mov eax, 0xffffffff
jmp 0x409c97
mov eax, dword [ebp - 8]
push eax
call fcn.0042095d
add esp, 4
cmp eax, 0xffffffff
jne 0x409c90
push 0x40005
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x409c97
xor eax, eax
jmp 0x409c97
pop edi
pop esi
pop ebx
leave
ret