joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430910
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.3259c41d2c314039b
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.cdc5d9b5ecf14df11b35218787a31
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x430988
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.d86bf7cd0dc7da638
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x430955
test eax, eax
jne 0x43099f
push edi
push str.80411819421567f921a_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.e56fdf7bbc51e8c52edf3d1728__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4309c0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x26
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x430a3e
cmp eax, 0x41
jbe 0x430a00
push eax
push str.8f6f289102f349cd1d21aded540d6d7
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.4631e635de8b4abdeb6
call esi
test eax, eax
jne 0x430a36
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x430a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0x2b
idiv ecx
inc esi
sub dl, 0x59
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x430a86
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x430b07
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x430b07
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret
Function at 0x430b20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 6
idiv ecx
inc esi
add dl, 0x7e
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x430b56
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x430bd7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x430bd7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x430bf0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 6
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x430c70
cmp eax, 0x91
jbe 0x430c32
push eax
push str.f6d1b13ff4c5f7a19
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.9a2f15e9482db0612c9f03c1dba7f
call esi
test eax, eax
jne 0x430c68
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x430c80
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xa4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x430d01
cmp eax, 0x5a
jbe 0x430cc3
push eax
push str.d65b94913ba96c91852d
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.e2577af18a8b16dfea6188c55bb
call esi
test eax, eax
jne 0x430cf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
Function at 0x430d10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0xf5
idiv ecx
inc esi
add dl, 0x2a
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x430d46
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x430dc7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x430dc7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x430de0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44de02
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov dword [esi + 0x88], eax
mov dword [esi + 0x84], ebx
mov byte [esi + 0x74], bl
lea eax, [esi + 0x90]
push eax
mov byte [esp + 0x20], 4
call fcn.0042af60
mov byte [esp + 0x1c], 5
mov dword [esi + 0xac], ebx
call fcn.00435460
test eax, eax
je 0x430e75
call fcn.00430190
call fcn.00418fd0
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb0], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
shr edi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp edi, eax
jbe 0x430eae
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 1
jmp 0x430eb0
xor ecx, ecx
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x16
jle 0x430ed8
push 0x16
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00430240
call fcn.00418970
push esi
call fcn.00432f40
call fcn.004354c0
test eax, eax
je 0x430ef1
call fcn.00419840
call fcn.004302d0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x430f06
sub eax, 2
je 0x430f06
sub eax, 4
jne 0x430f12
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00419f30
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x431060
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x44cf08
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push 0x3c
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x5c], 0
call fcn.0043fbd0
mov eax, 0x2800
mov edi, 0x10
add esp, 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], 0x3c
cmp dword [esp + 0x70], edi
jae 0x4310d2
lea eax, [esp + 0x5c]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x43111b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x70], edi
jb 0x431102
mov eax, dword [esp + 0x5c]
push eax
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
cmp dword [esp + 0x20], 0
jne 0x43114e
cmp dword [esp + 0x70], edi
jb 0x431102
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
mov ebx, dword [esp + 0x14]
test ebx, ebx
jne 0x431182
cmp dword [esp + 0x70], edi
jb 0x431102
mov edx, dword [esp + 0x5c]
push edx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
mov dx, word [esp + 0x24]
test dx, dx
jne 0x4311ae
lea ecx, [esp + 0x58]
call fcn.00402bd0
mov eax, 0x80004005
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x43118c
mov eax, ecx
sub eax, 1
je 0x4311d3
sub eax, 2
je 0x4311c7
sub eax, 1
jne 0x43118c
mov dword [esi + 0x94], 3
jmp 0x4311dd
mov dword [esi + 0x94], 1
mov eax, dword [esp + 0x10]
push ebx
mov dword [esi + 0x1c], ecx
push eax
mov ecx, esi
mov word [esi + 0x3c], dx
call fcn.004030c0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
lea ecx, [esi + 0x20]
call fcn.004030c0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
lea ecx, [esi + 0x40]
call fcn.004030c0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
lea ecx, [esi + 0x5c]
call fcn.004030c0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
lea ecx, [esi + 0x78]
call fcn.004030c0
lea ecx, [esp + 0x58]
call fcn.00402bd0
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x48
ret 0x1c
Function at 0x432640
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x44da28
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
cmp dword [esi + 0xc4], 0
jne 0x432699
cmp dword [esp + 0x38], 0x10
jb 0x432680
mov eax, dword [esp + 0x24]
push eax
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret 0x1c
mov eax, dword [esp + 0x24]
mov ebx, 0x10
cmp dword [esp + 0x38], ebx
jae 0x4326ac
lea eax, [esp + 0x24]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4326f8
cmp dword [esp + 0x38], ebx
jb 0x432680
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret 0x1c
mov ecx, dword [esi + 0x84]
mov dword [esp + 0xc], 0
cmp dword [esi + 0x88], ebx
jb 0x432713
mov eax, dword [esi + 0x74]
jmp 0x432716
lea eax, [esi + 0x74]
push 0
lea edx, [esp + 0x10]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x432733
cmp dword [esp + 0x38], ebx
jmp 0x432671
mov ecx, dword [esp + 0xc]
cmp ecx, dword [esi + 0x84]
je 0x43274d
lea ecx, [esp + 0x20]
call fcn.00402bd0
jmp 0x432680
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x20]
call fcn.00402bd0
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret 0x1c
Function at 0x433240
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44dbf0
mov eax, dword fs:[0]
push eax
mov eax, 0x284c
call fcn.00447d40
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x2844], eax
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x285c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28a4]
mov edi, 1
mov dword [esp + 0x2864], edi
call fcn.004393a7
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
add esi, edi
call fcn.004393a7
cdq
idiv esi
cmp edx, esi
jg 0x4332b7
mov eax, esi
cdq
idiv esi
test edx, edx
je 0x4332bc
call fcn.00419900
cmp dword [esp + 0x2880], 0
jne 0x433325
mov esi, 0x10
cmp dword [esp + 0x2884], esi
jb 0x4332e4
mov edx, dword [esp + 0x2870]
push edx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x2884], 0xf
mov dword [esp + 0x2880], 0
mov byte [esp + 0x2870], 0
cmp dword [esp + 0x28a0], esi
jb 0x43331b
mov eax, dword [esp + 0x288c]
push eax
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
jmp 0x433481
push 0
call fcn.0043a6c4
add esp, 4
call fcn.004176c0
mov dword [esp + 0x2864], edi
mov edi, dword [esp + 0x289c]
test edi, edi
jne 0x433368
lea ecx, [esp + 0x286c]
call fcn.00402bd0
lea ecx, [esp + 0x2888]
call fcn.00402bd0
mov eax, 0x80004005
jmp 0x433481
push 0x3c
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.0043fbd0
mov edx, dword [esp + 0x288c]
mov esi, 0x10
add esp, 0xc
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2884], esi
jb 0x4333a7
mov eax, dword [esp + 0x2870]
mov dword [esp + 0x28], eax
jmp 0x4333b2
lea ecx, [esp + 0x2870]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x48], edi
cmp dword [esp + 0x28a0], esi
jb 0x4333cc
mov edx, dword [esp + 0x288c]
mov dword [esp + 0x44], edx
jmp 0x4333d7
lea eax, [esp + 0x288c]
mov dword [esp + 0x44], eax
push 0x27ff
lea edx, [esp + 0x59]
mov ecx, 0x50
push 0
push edx
mov dword [esp + 0x30], 3
mov word [esp + 0x3c], cx
mov byte [esp + 0x60], 0
call fcn.0043fbd0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x433417
sub eax, 2
je 0x433417
sub eax, 4
jne 0x433424
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00430910
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x58]
push ecx
push 0
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x20], 0x2800
call dword [sym.imp.WININET.dll_InternetCreateUrlA]
mov esi, eax
call fcn.00417580
test eax, eax
je 0x433453
call fcn.00436210
test esi, esi
je 0x433346
lea eax, [esp + 0x54]
push eax
mov ecx, ebp
call fcn.00402c00
lea ecx, [esp + 0x286c]
call fcn.00402bd0
lea ecx, [esp + 0x2888]
call fcn.00402bd0
xor eax, eax
mov ecx, dword [esp + 0x285c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2844]
xor ecx, esp
call fcn.00438dc1
add esp, 0x2858
ret 0x3c
Function at 0x433a60
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44d490
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
xor ebp, ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
mov byte [esp + 0x44], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x433acb
sub eax, 2
je 0x433acb
sub eax, 4
jne 0x433adc
push ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.00418970
call fcn.00435810
mov eax, dword [esp + 0x60]
cmp eax, ebp
jbe 0x433b6e
mov esi, ebp
and esi, 3
cmp eax, ebp
ja 0x433af6
call fcn.00438391
cmp dword [esp + 0x64], 0x10
mov eax, dword [esp + 0x50]
jae 0x433b05
lea eax, [esp + 0x50]
mov edx, dword [esp + 0x68]
lea ecx, [esi*8]
shr edx, cl
lea edi, [esp + 0x1c]
xor dl, byte [eax + ebp]
movzx eax, dl
push eax
mov eax, 1
call fcn.00412590
call fcn.004393a7
cdq
mov ecx, 3
idiv ecx
xor edi, edi
mov esi, edx
inc esi
test esi, esi
jle 0x433b61
mov ebx, esi
nop
call fcn.004393a7
cdq
idiv esi
sub ebx, 1
lea edi, [edi + edx + 1]
jne 0x433b40
test edi, edi
jge 0x433b61
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00430b20
mov eax, dword [esp + 0x60]
inc ebp
cmp ebp, eax
jb 0x433ae8
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x24]
push edx
call fcn.00402d80
mov esi, 0x10
cmp dword [esp + 0x34], esi
jb 0x433b98
mov eax, dword [esp + 0x20]
push eax
call fcn.004393c9
add esp, 4
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
cmp dword [esp + 0x64], esi
jb 0x433bc0
mov ecx, dword [esp + 0x50]
push ecx
call fcn.004393c9
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00438dc1
add esp, 0x34
ret 0x24
Function at 0x435590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0x67
idiv ecx
inc esi
sub dl, 0xa
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4355c6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x435647
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x435647
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x435660
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x6e
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4356e0
cmp eax, 0x9c
jbe 0x4356a2
push eax
push str.d023f6efa731ecdb4b6d885
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.7377069d842546f72b27d
call esi
test eax, eax
jne 0x4356d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x435760
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.dfd99461b96f853be85385778
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.bc21fa8bd9d1dfcf
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4357d8
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.baeb54f9cc4970cd5341edb
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x4357a5
test eax, eax
jne 0x4357ef
push edi
push str.e51bea5ba54f9b353099c90b3_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.bf6175515ef3e713c979545bb__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret