joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a185
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
push ebx
push edi
mov dword [ebp - 8], eax
cmp dword [ebp + 8], eax
je 0x42a263
cmp dword [ebp + 0x14], eax
je 0x42a263
lea edi, [esi + 2]
push edi
call fcn.0052f69b
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42a25e
push edi
push 0
push ebx
call fcn.00537010
push esi
push dword [ebp + 8]
push ebx
call fcn.00537090
add esp, 0x18
push esi
push ebx
call fcn.0042a37c
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
push esi
push ebx
call fcn.0042a35e
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push 0x10
pop edi
push 5
push dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push 0
push 0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
and dword [ebp - 4], 0
push 0x57fd5c
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call fcn.0053221d
add esp, 0xc
test eax, eax
jne 0x42a250
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push 1
push edi
push eax
call fcn.005303c1
push dword [ebp - 4]
push esi
push 1
push ebx
call fcn.005303c1
push dword [ebp - 4]
call fcn.0052fd5d
add esp, 0x24
push ebx
call fcn.00530cbd
pop ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x42a265
xor eax, eax
pop edi
pop ebx
leave
ret 0x10

Function at 0x42a26b
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42a357
push 0x57c6dc
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
call fcn.0053221d
add esp, 0xc
test eax, eax
jne 0x42a354
push 2
push esi
push dword [ebp - 4]
call fcn.00530734
push dword [ebp - 4]
call fcn.005327b7
push esi
push esi
push dword [ebp - 4]
mov ebx, eax
call fcn.00530734
add esp, 0x1c
cmp ebx, 0x10
jb 0x42a34b
push dword [ebp - 4]
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push 0x10
push eax
call fcn.005325fd
add esp, 0x10
cmp dword [ebp - 0x18], 0x10
jne 0x42a34b
mov edi, dword [ebp - 0x10]
lea eax, [edi + 0x10]
cmp ebx, eax
jne 0x42a34b
lea ebx, [edi + 2]
push ebx
call fcn.0052f69b
mov esi, eax
pop ecx
test esi, esi
je 0x42a34b
push ebx
push 0
push esi
call fcn.00537010
push dword [ebp - 4]
xor ebx, ebx
push edi
inc ebx
push ebx
push esi
call fcn.005325fd
add esp, 0x1c
push dword [ebp + 0xc]
push edi
push esi
call fcn.0042a35e
push edi
push esi
call fcn.0042a37c
cmp eax, dword [ebp - 0xc]
jne 0x42a34b
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call fcn.0052fd5d
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x42a35e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x42a378
mov eax, dword [ebp + 8]
mov dl, byte [ebp + 0x10]
add eax, ecx
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x42a368
pop ebp
ret 0xc

Function at 0x42a37c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x42a391
xor eax, eax
jmp 0x42a402
push 0x3fc
lea eax, [ebp - 0x3fc]
push esi
push eax
mov dword [ebp - 0x400], esi
call fcn.00537010
add esp, 0xc
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x42a3c0
shr eax, 1
xor eax, 0xedb88320
jmp 0x42a3c2
shr eax, 1
dec edx
jne 0x42a3b3
mov dword [ebp + ecx*4 - 0x400], eax
inc ecx
cmp ecx, 0x100
jb 0x42a3ae
or eax, 0xffffffff
xor ecx, ecx
cmp dword [ebp + 0xc], esi
jbe 0x42a400
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [ebp + edx*4 - 0x400]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x42a3df
not eax
pop esi
leave
ret 8

Function at 0x42a407
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
cdq
push 3
pop ecx
idiv ecx
lea eax, [ebx + 2]
xor esi, esi
mov dword [ebp - 8], edx
cdq
idiv ecx
lea eax, [eax*4 + 1]
push eax
call fcn.0052f69b
pop ecx
mov ecx, eax
test ecx, ecx
je 0x42a4f9
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
jle 0x42a4b6
cdq
push 3
pop ebx
idiv ebx
mov eax, dword [ebp - 4]
test edx, edx
jne 0x42a45b
movzx edx, byte [eax + edi]
shr edx, 2
jmp 0x42a4a1
cmp edx, 1
jne 0x42a47b
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 3
shl edx, 4
shr ebx, 4
mov dl, byte [edx + ebx + 0x5b1d68]
jmp 0x42a4a7
cmp edx, 2
jne 0x42a4ab
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 0xf
shr ebx, 6
mov dl, byte [ebx + edx*4 + 0x5b1d68]
mov byte [ecx + esi], dl
movzx edx, byte [eax + edi]
inc esi
and edx, 0x3f
mov dl, byte [edx + 0x5b1d68]
mov byte [ecx + esi], dl
inc esi
mov ebx, dword [ebp + 8]
inc eax
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x42a445
cmp dword [ebp - 8], 1
jne 0x42a4d7
movzx eax, byte [edi + ebx - 1]
and eax, 3
shl eax, 4
mov al, byte [eax + 0x5b1d68]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
jmp 0x42a4ef
cmp dword [ebp - 8], 2
jne 0x42a4f5
movzx eax, byte [edi + ebx - 1]
and eax, 0xf
mov al, byte [eax*4 + 0x5b1d68]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov byte [ecx + esi], 0
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x42b90e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp esi, edi
je 0x42b977
cmp word [esi], di
je 0x42b977
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.00537010
push 0x103
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0049739c
add esp, 0x18
test eax, eax
je 0x42b973
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b973
inc edi
mov eax, edi
jmp 0x42b979
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0052f7d0
leave
ret

Function at 0x42bff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edi
xor ebx, ebx
call fcn.0042c1dc
test eax, eax
je 0x42c0b6
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00537010
add esp, 0xc
lea eax, [edi + 0x61ac]
push eax
push 0x57cb68
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.00532a01
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42c08a
lea ebx, [ebp - 0x210]
call fcn.0049699b
mov esi, dword [edi + 0x63fc]
call fcn.004909e9
mov ebx, eax
test ebx, ebx
je 0x42c0b6
and dword [edi + 0x63f0], 0
mov dword [edi + 0x63cc], 2
mov dword [edi + 0x63f8], 1
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x42c0c6
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0042c3d1
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or eax, 0xffffffff
mov dword [esi + 0x63b8], eax
mov dword [esi + 0x63bc], eax
mov dword [esi + 0x63c0], eax
mov dword [esi + 0x63c4], eax
xor eax, eax
lea ebx, [esi + 0x61ac]
push ebx
mov dword [esi + 0x63d8], eax
mov dword [esi + 0x63dc], eax
mov dword [esi + 0x63f0], eax
mov dword [esi + 0x63f4], 1
call edi
test eax, eax
je 0x42c142
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00537010
add esp, 0xc
push 0x580020
push ebx
push 0x58002c
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.00532a01
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
je 0x42c1ab
push 0x80
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call edi
test eax, eax
jne 0x42c1bf
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
je 0x42c1c6
and dword [esi + 0x63c8], 0
mov edi, esi
call fcn.0042bff0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x42e075
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x20]
sub eax, dword [ebx + 0x1c]
add ebx, 0x10
push esi
push edi
xor edi, edi
sar eax, 2
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x214], edi
test eax, eax
jbe 0x42e1b4
mov esi, ebx
call fcn.004264b0
mov esi, dword [eax]
mov eax, dword [esi + 0x63e8]
cmp eax, dword [ebp + 8]
je 0x42e0dc
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc edi
sar eax, 2
mov dword [ebp - 0x214], edi
cmp edi, eax
jb 0x42e0af
jmp 0x42e1b4
call fcn.0042c3d1
cmp dword [esi + 0x63cc], 0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x42e14b
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00537010
add esp, 0xc
push 0x580020
lea eax, [esi + 0x61ac]
push eax
push 0x58002c
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.00532a01
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
je 0x42e14b
lea ecx, [ebp - 0x210]
call fcn.00496aa0
cmp dword [ebp + 0xc], 0
je 0x42e169
lea eax, [esi + 0x61ac]
push eax
call edi
test eax, eax
je 0x42e169
lea ecx, [esi + 0x61ac]
call fcn.00496aa0
push esi
call fcn.0052f7c5
mov edi, ebx
mov ebx, dword [ebx + 0xc]
pop ecx
lea esi, [ebp - 0x21c]
call fcn.00454fe1
push dword [ebp - 0x214]
lea ebx, [ebp - 0x22c]
mov eax, esi
call fcn.004d5ed2
push dword [eax + 4]
mov ecx, edi
push dword [eax]
lea eax, [ebp - 0x224]
call fcn.0042efb7
mov dword [ebp - 0x218], 1
call fcn.0042df6d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret 8

Function at 0x42e4a5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call fcn.0042e6b4
cmp eax, esi
je 0x42e4d8
push ebx
lea ebx, [eax + 0x61ac]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42e4d7
push 1
push esi
push 1
call fcn.0049a154
add esp, 0xc
inc esi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x42e4df
Capabilities:
Check if file exists

Disassembly:
push 0x418
mov eax, 0x55e660
call fcn.00539a44
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edi, edi
call fcn.0042e6b4
mov esi, eax
cmp esi, edi
je 0x42e630
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00537010
lea eax, [esi + 0x61ac]
push eax
push 0x57cb68
mov edi, 0x103
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00532a01
xor eax, eax
push ebx
mov word [ebp - 0x420], ax
xor ebx, ebx
lea eax, [ebp - 0x41e]
push ebx
push eax
call fcn.00537010
push 0x580020
lea eax, [esi + 0x61ac]
push eax
push 0x58002c
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.00532a01
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x3c
cmp dword [esi + 0x63cc], ebx
jne 0x42e59c
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x42e5a9
cmp dword [esi + 0x63cc], ebx
je 0x42e60a
lea eax, [ebp - 0x420]
push eax
call edi
test eax, eax
je 0x42e60a
mov eax, dword [0x5beb28]
mov ecx, 0x5beb28
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
cmp dword [esi + 0x63cc], ebx
je 0x42e5d6
lea eax, [ebp - 0x420]
push eax
push str._select____s_
lea eax, [ebp - 0x424]
call fcn.004167f4
mov esi, dword [ebp - 0x424]
xor edi, edi
inc edi
push edi
push esi
push edi
mov ebx, str.explorer.exe
call fcn.0049a154
add esp, 0x14
lea eax, [esi - 0x10]
call fcn.00407d09
jmp 0x42e630
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x218]
push eax
push edi
mov ebx, str.explorer.exe
call fcn.0049a154
add esp, 0xc
mov eax, edi
call fcn.00539ac7
ret 8
Function at 0x42ead7
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55fec5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5afee0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov eax, dword [0x5beb28]
mov ecx, 0x5beb28
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], ebx
cmp esi, ebx
jne 0x42eb2e
lea esi, [eax - 0x10]
jmp 0x42ec8d
mov eax, dword [esi + 0x63cc]
sub eax, ebx
je 0x42ec2c
dec eax
je 0x42ec1b
dec eax
je 0x42eb97
dec eax
jne 0x42ec86
push dword [esi + 0x63bc]
lea eax, [esp + 0x18]
push dword [esi + 0x63b8]
push eax
call fcn.0049ab8b
add esp, 0xc
mov byte [esp + 0x28], 4
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
je 0x42eb83
push eax
push 0x5801b8
lea eax, [esp + 0x18]
jmp 0x42ec6f
push 0x5801cc
lea eax, [esp + 0x14]
push eax
call fcn.004082ed
jmp 0x42ec76
push dword [esi + 0x63bc]
lea eax, [esp + 0x1c]
push dword [esi + 0x63b8]
push eax
call fcn.0049ab8b
add esp, 0xc
mov byte [esp + 0x28], 2
mov eax, dword [esi + 0x63f0]
cdq
push edx
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0049ab8b
add esp, 0xc
mov byte [esp + 0x28], 3
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x42ebf1
push eax
push dword [esp + 0x18]
lea eax, [esp + 0x18]
push str._s_S____s
call fcn.004167f4
add esp, 0xc
jmp 0x42ec05
push dword [esp + 0x14]
lea eax, [esp + 0x14]
push str._s_S
call fcn.004167f4
pop ecx
pop ecx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00407d09
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x18]
jmp 0x42ec7e
push 0x58018c
lea eax, [esp + 0x14]
push eax
call fcn.004082ed
jmp 0x42ec86
push dword [esi + 0x63bc]
lea eax, [esp + 0x18]
push dword [esi + 0x63b8]
push eax
call fcn.0049ab8b
add esp, 0xc
add esi, 0x61ac
push esi
mov byte [esp + 0x2c], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [esp + 0x14]
test eax, eax
lea eax, [esp + 0x14]
jne 0x42ec6a
push 0x580160
jmp 0x42ec6f
push 0x580178
call fcn.004167f4
pop ecx
pop ecx
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00407d09
mov esi, dword [esp + 0x10]
add esi, 0xfffffff0
mov eax, esi
call fcn.00416859
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.00407d09
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ed23
Capabilities:
Check if file exists
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x2c0], 0
cmp word [eax], 0
mov dword [ebp - 0x2bc], eax
jne 0x42ed53
xor eax, eax
jmp 0x42ee1c
push ebx
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebx, 0x2b0
lea edi, [ebx + 4]
test eax, eax
je 0x42eda9
and dword [ebp - 0x2b8], 0
push ebx
lea eax, [ebp - 0x2b4]
push 0
push eax
call fcn.00537010
add esp, 0xc
push pe_nt_image_headers32
push edi
lea eax, [ebp - 0x2b8]
push eax
push 0
push dword [ebp - 0x2bc]
call esi
mov eax, dword [ebp - 0x2b8]
test eax, eax
jne 0x42ee0d
push dword [ebp - 0x2bc]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 0x2bc], eax
test eax, eax
je 0x42ee13
push str..exe
push eax
call fcn.005320ad
pop ecx
pop ecx
test eax, eax
je 0x42ee13
and dword [ebp - 0x2b8], 0
push ebx
lea eax, [ebp - 0x2b4]
push 0
push eax
call fcn.00537010
add esp, 0xc
push 0x110
push edi
lea eax, [ebp - 0x2b8]
push eax
push 0x80
push dword [ebp - 0x2bc]
call esi
mov eax, dword [ebp - 0x2b8]
test eax, eax
je 0x42ee13
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052f7d0
leave
ret 4

Function at 0x42f8b8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push edi
mov esi, 0x5dba30
cmp ax, word [0x5dba30]
jne 0x42f955
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x5801e4
mov ebx, 0x5d824c
push ebx
push esi
call edi
push str.crash.dat
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 5
push esi
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
test eax, eax
je 0x42f919
xor eax, eax
mov word [0x5dba30], ax
jmp 0x42f957
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537010
add esp, 0xc
push 0x5801e4
push ebx
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x42f966
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp dword [0x5d297c], ebx
jne 0x42fa40
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
jne 0x42f98f
push 2
pop eax
jmp 0x42fa42
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push edi
call esi
push str.SymSetOptions
push edi
mov dword [0x5d297c], eax
call esi
push str.StackWalk
push edi
mov dword [0x5d2980], eax
call esi
push str.SymFunctionTableAccess
push edi
mov dword [0x5d2974], eax
call esi
push str.MiniDumpWriteDump
push edi
mov dword [0x5d2978], eax
call esi
push str.SymGetModuleBase
push edi
mov dword [0x5d2984], eax
call esi
push 0x580290
push 0x5802a8
mov dword [0x5d2988], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov ecx, dword [0x5d297c]
mov dword [0x5d298c], eax
pop esi
cmp ecx, ebx
je 0x42fa45
mov edx, dword [0x5d2980]
cmp edx, ebx
je 0x42fa45
cmp dword [0x5d2974], ebx
je 0x42fa45
cmp dword [0x5d2978], ebx
je 0x42fa45
cmp dword [0x5d2984], ebx
je 0x42fa45
cmp eax, ebx
je 0x42fa45
push 0x12
call edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5d297c]
xor eax, eax
pop edi
pop ebx
ret
mov dword [ecx], ebx
push 6
jmp 0x42f989
Function at 0x42fe1a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
mov esi, ecx
push eax
mov dword [ebp - 0x53c], esi
call fcn.00537010
and dword [ebp - 0x564], 0
mov esi, dword [esi + 0xc]
add esp, 0xc
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x560]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x564]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebx, 0x103
test eax, eax
je 0x42ff24
mov edi, dword [ebp - 0x560]
test edi, edi
je 0x42ff24
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x42ff24
sub esi, edi
mov dword [ebp - 0x53c], esi
mov esi, 0x5d3de8
lea edi, [ebp - 0x210]
call fcn.00496756
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
jne 0x42fed2
mov eax, edi
push eax
mov edi, 0x57cb68
push edi
push ebx
push 0x5d3be0
call fcn.00532a01
push dword [ebp - 0x53c]
push str.0x_08x
push ebx
push 0x5d41f8
call fcn.00532a01
mov eax, esi
add esp, 0x20
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x42ff02
sub eax, ecx
sar eax, 1
jne 0x42ff68
push 0x5802e0
push edi
push ebx
push esi
call fcn.00532a01
add esp, 0x10
jmp 0x42ff68
push str.unknown
push ebx
push 0x5d3be0
call fcn.00532a01
add esp, 0xc
push 0x5802e0
push 0x57cb68
push ebx
push 0x5d3de8
call fcn.00532a01
mov eax, dword [ebp - 0x53c]
push dword [eax + 0xc]
push str.0x_08x
push ebx
push 0x5d41f8
call fcn.00532a01
add esp, 0x20
mov esi, 0x104
push esi
push 0x5d4608
call fcn.004a480b
push 0x110
lea eax, [ebp - 0x534]
push 0
push eax
mov dword [ebp - 0x538], 0x114
call fcn.00537010
add esp, 0x14
lea eax, [ebp - 0x538]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ffce
push dword [ebp - 0x52c]
mov edi, 0x5d4400
push dword [ebp - 0x530]
push dword [ebp - 0x534]
push str._d._d._d
push esi
call fcn.00403d4f
add esp, 0x14
xor eax, eax
mov edi, 0x208
push edi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x540]
push eax
push 0x577458
push str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
push 0x80000000
mov dword [ebp - 0x548], edi
mov dword [ebp - 0x540], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x430040
mov esi, 0x5d4810
lea edi, [ebp - 0x420]
call fcn.00496756
mov esi, 0x104
push 0
push esi
push 0x5d4a18
call fcn.0049a6b7
add esp, 0xc
lea eax, [ebp - 0x544]
push eax
mov esi, 0x5d4c20
push esi
lea eax, [ebp - 0x540]
push eax
push 0x57d2d0
push str.Software_shouxin
push 0x80000001
mov dword [ebp - 0x540], 1
mov dword [ebp - 0x544], 0x206
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43009a
cmp word [0x5d4c20], ax
jne 0x4300af
push 0x57d2fc
push 0x57cb68
push 0x3c
push esi
call fcn.00532a01
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret