joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2ef77b58
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x63be2c07
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0xa01058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a011a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa0107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0106a
add dl, dl
jne 0xa01089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa010dc
xor eax, eax
add dl, dl
jne 0xa01096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0117d
add dl, dl
jne 0xa010a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa010b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa010bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa010c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa010d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa01075
mov eax, 1
add dl, dl
jne 0xa010ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa010f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa010e1
sub eax, ebx
mov ebx, 1
jne 0xa01128
mov ecx, 1
add dl, dl
jne 0xa0110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa01119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa01105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa01075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa0113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa0114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa01136
cmp eax, 0x7d00
jae 0xa0116d
cmp eax, 0x500
jb 0xa01168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa01075
cmp eax, 0x7f
ja 0xa01170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa01075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa0119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa01075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x418735
Capabilities:
Query environment variable

Disassembly:
push 0x210
mov eax, 0x613f4f
call fcn.005b83bf
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, ebx
test esi, esi
je 0x4187fa
cmp word [esi], bx
je 0x4187fa
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x41878a
push esi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005c1f86
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.0041fcd3
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.004186db
test eax, eax
jne 0x4187fa
push 0x38
call fcn.00525a5d
mov esi, eax
pop ecx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 4]
mov byte [esi], 1
call fcn.0041b35f
mov byte [ebp - 4], 1
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], ebx
call fcn.00416b07
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x21c]
push eax
lea ecx, [edi + 0x40]
mov dword [ebp - 0x21c], esi
call fcn.0041b0c7
mov eax, dword [ebp - 0x21c]
call fcn.005b8369
ret 4
Function at 0x4197d4
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x61426a
call fcn.005b83bf
mov ebx, ecx
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], esi
cmp dword [ebx + 0x2e4], esi
jle 0x4198b2
cmp eax, 0xffffffff
je 0x4198b2
push str.____Queued_Lines_End_____r_n
lea ecx, [ebp - 0x2c]
call fcn.0041b35f
mov dword [ebp - 4], 1
lea edi, [ebx + 0x2d4]
push eax
mov ecx, edi
call fcn.0041af5d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041660a
jmp 0x4198a9
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0041cf23
mov edx, eax
mov ecx, dword [edx]
test ecx, ecx
jne 0x419849
xor eax, eax
jmp 0x41984b
mov eax, dword [ecx]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
mov esi, dword [eax + ecx*4]
mov ecx, esi
call fcn.00416b80
push 0
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [eax]
mov ecx, esi
add eax, eax
push eax
call fcn.00416aea
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [ebp - 0x30]
test eax, eax
je 0x419888
add esi, dword [ebp - 0x38]
mov dword [ebp - 0x30], esi
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
dec ecx
and ecx, dword [edi + 0xc]
mov ecx, dword [eax + ecx*4]
call fcn.0041660a
sub dword [edi + 0x10], 1
jne 0x4198a6
and dword [edi + 0xc], 0
jmp 0x4198a9
inc dword [edi + 0xc]
cmp dword [ebx + 0x2e4], 0
ja 0x419832
mov eax, esi
call fcn.005b8369
ret 8
Function at 0x41a2c1
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x8d600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
xor esi, esi
mov ebx, ecx
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x41a349
lea eax, [ebp - 0x408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x41a342
test dword [ebp - 0x408], 0xfffffffc
jbe 0x41a342
add ebx, 0xbc
push 0x104
push ebx
push dword [ebp + esi*4 - 0x404]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 0x408]
inc esi
shr eax, 2
cmp esi, eax
jb 0x41a321
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00525a3e
mov esp, ebp
pop ebp
ret 4
Function at 0x41a5f5
Capabilities:
Get common file path

Disassembly:
push 0x248
mov eax, 0x6143d5
call fcn.005b83bf
mov ebx, ecx
mov dword [ebp - 0x250], ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x41a81d
mov eax, dword [edi + 0x14]
test eax, eax
je 0x41a622
mov al, byte [eax]
jmp 0x41a625
mov al, byte [edi + 0x18]
test al, al
je 0x41a81d
mov ecx, edi
call fcn.0041ffb1
lea ecx, [ebp - 0x248]
mov esi, eax
call fcn.00416b07
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00416b07
mov byte [ebp - 4], 1
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
add ebx, 0xbc
test eax, eax
je 0x41a69b
push ebx
xor eax, eax
push eax
push eax
push 0x8023
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ebx
call fcn.004160c0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x248]
call fcn.0041bf96
push esi
call fcn.004160c0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
jmp 0x41a6dd
push esi
push 0x104
push ebx
call fcn.005c1f86
add esp, 0xc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push esi
call fcn.004160c0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0041bf96
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
call fcn.004160c0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x248]
call fcn.0041bf96
test dword [edi + 0x10], 0x20000
je 0x41a74b
push ebx
push 0
lea ecx, [ebp - 0x230]
call fcn.00416aea
push eax
lea ecx, [ebp - 0x248]
call fcn.00416aea
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x41a74b
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x41a74b
mov esi, dword [edi + 0x14]
test esi, esi
je 0x41a74b
lea eax, [ebp - 0x218]
push eax
call fcn.004160c0
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 4]
call fcn.0041bf96
mov ecx, edi
call fcn.0041ffb1
mov esi, eax
push esi
mov dword [ebp - 0x24c], esi
call fcn.005c1b54
pop ecx
test eax, eax
je 0x41a7c1
xor eax, eax
test dword [edi + 0x10], 0x10000
push eax
push 0x80
je 0x41a77a
push 2
jmp 0x41a77c
push 4
push eax
push eax
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41a7c1
lea eax, [ebp - 0x254]
push eax
push ebx
push 0x104
push 0
push dword [ebp - 0x24c]
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x41a7ba
push ebx
mov ecx, edi
call fcn.0041ffc6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test dword [edi + 0xc], 0x40000000
je 0x41a7ef
mov esi, dword [ebp - 0x250]
mov ecx, esi
push edi
call fcn.0041a35c
test dword [edi + 0x10], 0x100000
je 0x41a7ef
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, esi
call fcn.0041a2c1
mov eax, dword [edi + 0x14]
test eax, eax
je 0x41a7fb
mov byte [eax], 0
jmp 0x41a7ff
mov byte [edi + 0x18], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.0041660a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.0041660a
call fcn.005b8369
ret 4
Function at 0x41dd0c
Capabilities:
Check mutex on windows

Disassembly:
push 0x54
mov eax, 0x614833
call fcn.005b83bf
mov esi, ecx
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x60], esi
call fcn.00416b07
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x41dd98
lea ecx, [ebp - 0x28]
call fcn.00416b07
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, str.RegValues
call fcn.0041fed0
push str.Lock
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041eb14
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.0041d4ea
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0041660a
lea ecx, [ebp - 0x28]
call fcn.00416aea
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.0041660a
push 0x32
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41de41
push str.MappedFile
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041eb14
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00416aea
push eax
mov edi, 0x88
push edi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x41de2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 0xf001f
push dword [esi + 4]
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x41de2b
test ebx, ebx
je 0x41de26
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.00418494
mov byte [ebp - 4], 3
mov eax, dword [esi + 0xc]
inc dword [eax]
xor ebx, ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.0041660a
mov esi, dword [esi + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0041660a
mov eax, esi
call fcn.005b8369
ret 4
Function at 0x41de97
Capabilities:
Check mutex on windows

Disassembly:
push 0x54
mov eax, 0x61489f
call fcn.005b83bf
mov esi, ecx
mov dword [ebp - 0x5c], esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x60], esi
call fcn.00416b07
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
jne 0x41df23
lea ecx, [ebp - 0x28]
call fcn.00416b07
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, str.ExtMonitor
call fcn.0041fed0
push str.Lock
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041eb14
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.0041d4ea
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0041660a
lea ecx, [ebp - 0x28]
call fcn.00416aea
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 8], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.0041660a
push 0x32
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41e006
push str.MappedFile
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041eb14
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00416aea
push eax
push 0x48
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x41dff2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x48
push 0
push 0
xor ebx, ebx
cmp eax, 0xb7
push 0xf001f
push dword [esi + 4]
setne bl
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov dword [esi + 0xc], edi
test edi, edi
je 0x41dff0
test ebx, ebx
je 0x41dfde
mov dword [ebp - 0x5c], edi
mov byte [ebp - 4], 4
xor ebx, ebx
mov dword [edi + 4], ebx
lea ecx, [edi + 0x14]
mov dword [edi], vtable.NGLogging::CExtMonitorSettings.0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
call fcn.00416b07
mov byte [ebp - 4], 5
lea ecx, [edi + 0x2c]
call fcn.00416b07
mov byte [ebp - 4], 6
mov dword [edi + 0x44], ebx
mov byte [ebp - 4], 3
jmp 0x41dfe0
xor ebx, ebx
mov ecx, dword [esi + 0xc]
lea eax, [ecx + 4]
neg ecx
sbb ecx, ecx
and ecx, eax
inc dword [ecx]
jmp 0x41dff2
xor ebx, ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.0041660a
mov esi, dword [esi + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0041660a
mov eax, esi
call fcn.005b8369
ret 4
Function at 0x41fd8b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x41fe0d
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], ecx
push eax
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fe0d
cmp dword [ebp - 8], 1
jne 0x41fe0d
mov eax, dword [ebp - 4]
xor ecx, ecx
push esi
shr eax, 1
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005261a0
mov esi, eax
pop ecx
test esi, esi
je 0x41fe0c
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fe05
push esi
call fcn.004160c0
pop ecx
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.0041bf96
push esi
call fcn.00529880
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420e65
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x420ec0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x420eb1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x420ead
cmp esi, ecx
jae 0x420eb1
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x420e9b
cmp esi, ecx
jb 0x420eb5
xor eax, eax
jmp 0x420ebf
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42784f
Capabilities:
Get disk size
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xorps xmm0, xmm0
xor esi, esi
cmp byte [ebp + 0x10], 0
push edi
movsd qword [ebp - 8], xmm0
jne 0x4278c5
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x427891
mov eax, 0x80004005
jmp 0x42792e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x872950]
movsd qword [ebp - 8], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
comisd xmm0, xmmword [ebp - 8]
jb 0x4278f7
jmp 0x427887
lea edx, [ebp - 8]
add ecx, 4
push edx
lea edx, [ebp + 0x10]
push edx
mov eax, dword [ecx]
lea edx, [ebp + 8]
push edx
push esi
call dword [eax + 0x94]
movsd xmm1, qword [ebp - 8]
mulsd xmm1, qword [0x8726f0]
mulsd xmm1, qword [0x8726f0]
movsd qword [ebp - 8], xmm1
push esi
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x427887
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.00565be0
xor ecx, ecx
mov eax, 0x80070070
comisd xmm0, xmmword [ebp - 8]
cmova eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42823d
Capabilities:
Delete file

Disassembly:
push 0x94
mov eax, 0x616edb
call fcn.005b83bf
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x88]
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push 0xcd7
push str.HPXS::CScanAppBusinessLogic::SaveToPDF
push 0x1299318
push dword [0x12992f8]
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x94], eax
call fcn.0041f881
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], ebx
mov bl, byte [ebp + 0x18]
je 0x428294
test bl, bl
jne 0x4282b0
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0041b35f
mov ecx, dword [edi + 0x298]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
jne 0x428323
mov ecx, dword [edi + 0x204]
lea edx, [ebp - 0x98]
and dword [ebp - 0x8c], 0
push edx
lea edx, [ebp - 0x9c]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x90]
push edx
push 0
push 2
push dword [ebp - 0x94]
lea edx, [ebp - 0x8c]
push edx
call dword [eax + 0xb8]
mov esi, eax
test esi, esi
jne 0x428323
push dword [ebp - 0x98]
mov ecx, dword [edi + 0x298]
push dword [ebp - 0x9c]
push dword [ebp - 0x90]
mov eax, dword [ecx]
push esi
push dword [ebp - 0x8c]
call dword [eax + 0x10]
mov esi, eax
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x14]
je 0x42832f
test bl, bl
jne 0x428340
test esi, esi
jne 0x428344
mov ecx, dword [edi + 0x298]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov esi, eax
test esi, esi
je 0x42835b
mov ecx, dword [edi + 0x298]
mov eax, dword [ecx]
call dword [eax + 8]
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push str.HPXS::CScanAppBusinessLogic::SaveToPDF
push str._s_hr0x_x
push 0xd0b
lea eax, [ebp - 0x88]
push 0x200
push eax
call fcn.0041fc07
add esp, 0x18
lea ecx, [ebp - 0x88]
call fcn.0041f95a
mov eax, esi
call fcn.005b8369
ret 0x14
Function at 0x428394
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push 0xe28
mov eax, 0x616f19
call fcn.005b83bf
mov ebx, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2a8]
push 0
push 0
push 0xd11
push str.HPXS::CScanAppBusinessLogic::SaveToiDRS
push 0x1299318
push dword [0x12992f8]
mov dword [ebp - 0xe34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xe30], eax
call fcn.0041f881
and dword [ebp - 4], 0
xor esi, esi
cmp byte [ebx + 0x2a2], 0
jne 0x42846e
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push 0
push eax
call fcn.005b9760
add esp, 0xc
mov dword [ebp - 0xe2c], esi
lea eax, [ebp - 0xe2c]
xor esi, esi
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push str.ResourcePath
push dword [ebx + 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42843f
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
cmp dword [ebx + 0x444], esi
jne 0x428452
call fcn.0046ffc3
mov dword [ebx + 0x444], eax
mov ecx, dword [ebx + 0x444]
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
test esi, esi
jne 0x4285ef
mov byte [ebx + 0x2a2], 1
mov edi, dword [ebp + 0x14]
cmp edi, 1
je 0x42847c
cmp byte [ebp + 0x1c], 0
jne 0x428491
mov ecx, dword [ebx + 0x444]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, eax
test esi, esi
jne 0x428577
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push 1
mov byte [ebp - 4], 1
lea edx, [ebp - 0x230]
mov ecx, dword [ebx + 0x204]
push edx
push str..jpg
push edi
mov eax, dword [ecx]
push 0x7e71c8
call dword [eax + 0x1b8]
test al, al
je 0x428564
mov ecx, dword [ebx + 0x204]
lea edx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
push 0
cmovae edx, dword [ebp - 0x230]
mov eax, dword [ecx]
push edi
push 2
push dword [ebp - 0xe30]
push edx
call dword [eax + 0xc0]
mov esi, eax
test esi, esi
jne 0x428564
mov eax, dword [ebx + 0x444]
lea edi, [ebp - 0x230]
mov ecx, dword [0x1298dd0]
push dword [ebp + 0x10]
cmp dword [ebp - 0x21c], 8
mov esi, dword [eax]
mov eax, dword [ecx]
cmovae edi, dword [ebp - 0x230]
push 0x53
call dword [eax + 8]
mov ecx, dword [ebx + 0x444]
push eax
push edi
call dword [esi + 0xc]
cmp dword [ebp - 0x21c], 8
mov esi, eax
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 0x14]
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00416b1a
cmp edi, dword [ebp + 0x18]
je 0x428582
cmp byte [ebp + 0x1c], 0
jne 0x4285cb
mov ecx, dword [0x1298dd4]
lea edx, [ebp - 0xe28]
push edx
mov eax, dword [ecx]
call dword [eax + 0xb8]
test esi, esi
jne 0x4285cb
mov eax, dword [ebx + 0x444]
lea esi, [ebp - 0xe28]
sub esp, 0xb80
mov ecx, 0x2e0
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0x20]
push dword [ebp + 0x10]
push dword [ebp - 0xe34]
call dword [edx + 0x10]
mov esi, eax
push esi
push str.HPXS::CScanAppBusinessLogic::SaveToiDRS
push str._s_hr0x_x
push 0xd4a
lea eax, [ebp - 0x2a8]
push 0x200
push eax
call fcn.0041fc07
add esp, 0x18
lea ecx, [ebp - 0x2a8]
call fcn.0041f95a
mov eax, esi
call fcn.005b8369
ret 0x1c