joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c417c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4c4195
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4c418e
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4c41a9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004c3b38
test bl, bl
jne 0x4c4282
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4da1f8
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4c41e0
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4c41f4
push 0x3e7
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004c4054
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4c4229
add dword [ebp - 0x14], 0x3e8
dec dword [ebp - 8]
jne 0x4c41d5
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4c424f
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4c4260
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4c4274
jmp 0x4c4343
cmp bl, 1
jne 0x4c4343
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4ddc90
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4c42a2
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4c42b6
push 0x3e7
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004c4054
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4c42eb
sub ebx, 0x3e8
inc dword [ebp - 8]
jne 0x4c4297
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4c4315
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4c4326
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4c433a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004c3bbc
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4ca4f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x4ca50d
mov eax, dword [0x4d84d8]
mov eax, dword [eax]
call fcn.00469de0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp esi, eax
ja 0x4ca501
pop esi
pop ebx
ret
Function at 0x4d3160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404f50
xor eax, eax
push ebp
push 0x4d3208
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407a54
mov word [ebp - 0x18], bx
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x20], 0x18
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00409b50
mov eax, dword [ebp - 0x5c]
call fcn.00404f60
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f60
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4d31e7
mov ebx, dword [ebp - 0x50]
jmp 0x4d31ea
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d320f
lea eax, [ebp - 0x5c]
call fcn.00404aa0
lea eax, [ebp - 4]
call fcn.00404aa0
ret

Function at 0x4d36b8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd3c
push ebx
xor ecx, ecx
mov dword [ebp - 0x2a4], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f50
xor eax, eax
push ebp
push 0x4d381e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x4d37f6
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x2a0]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x2a0]
mov edx, dword [ebp - 4]
call fcn.00409d58
lea eax, [ebp - 0x2a0]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d37df
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4d37d9
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4d37d3
lea eax, [ebp - 0x2a4]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
mov dword [ebp - 0x2c4], eax
mov byte [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
lea edx, [ebp - 0x2c4]
mov ecx, 3
mov eax, 0x4d3838
call fcn.0040a3e0
mov edx, dword [ebp - 0x2a4]
mov eax, ebx
call fcn.00404af4
mov byte [ebp - 5], 1
jmp 0x4d37e3
mov byte [ebp - 5], 0
jmp 0x4d37e3
mov byte [ebp - 5], 0
jmp 0x4d37e3
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d37fd
call sub.wsock32.dll_WSACleanup
ret
Function at 0x403494
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x455214]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x402]
push eax
call fcn.004226a0
add esp, 0xc
push 0x200
lea eax, [ebp - 0x404]
push eax
push dword [edi + 0x68]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x404]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4034e3
sub eax, ecx
push esi
sar eax, 1
lea esi, [edi + 0x8c]
lea ecx, [ebp - 0x404]
call fcn.00401ef9
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0042064a
leave
ret
Function at 0x405d90
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x455214]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
or ecx, 0x2001f
push ecx
push eax
push dword [esi]
xor ebx, ebx
lea edi, [ebp - 0x218]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], ebx
call fcn.00405d49
mov edi, eax
cmp edi, ebx
je 0x405dfe
cmp dword [ebp - 0x218], ebx
je 0x405df7
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x405ec1
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x405e22
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
call fcn.00405d90
mov dword [ebp - 0x224], eax
cmp eax, ebx
jne 0x405e8b
lea eax, [ebp - 0x22c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x100
call edi
test eax, eax
je 0x405e06
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x218], ebx
je 0x405e6d
push dword [ebp - 0x218]
call edi
mov dword [ebp - 0x218], ebx
mov eax, dword [esi + 8]
push dword [ebp - 0x220]
mov dword [ebp - 0x214], ebx
push dword [esi]
cmp eax, ebx
je 0x405ea7
mov esi, eax
call fcn.00405f23
jmp 0x405ead
cmp dword [ebp - 0x218], ebx
je 0x405e9f
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x224]
jmp 0x405ec1
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
cmp dword [ebp - 0x218], ebx
je 0x405ebf
push dword [ebp - 0x218]
call edi
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042064a
leave
ret 4
Function at 0x4067de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x441e86
call fcn.004269eb
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, edx
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x406836
call fcn.00405290
mov esi, eax
jmp 0x406940
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x40684f
call fcn.00405290
jmp 0x406932
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x406845
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x40688c
mov esi, 0x8007000e
jmp 0x406934
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x4068a1
cmp eax, 0xffffffff
jbe 0x4068ab
push 0x80070216
call fcn.00402bf2
cmp eax, 0x400
jbe 0x4068d8
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0040526d
jmp 0x4068e4
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], esi
je 0x406882
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x406845
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.0040667e
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x406959
lea eax, [ebp - 0x418]
call fcn.004057fd
mov eax, esi
call fcn.00426a47
ret 0xc
Function at 0x408b2b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x455214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x10], edi
jne 0x408c66
push ebx
lea eax, [ebp - 0x220]
push eax
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x408c65
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408b71
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x220]
call fcn.00401ef9
push 8
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x408b97
mov eax, dword [esi]
jmp 0x408b99
mov eax, esi
push eax
call fcn.00421be1
pop ecx
test eax, eax
jne 0x408c65
push str.DoneEx
push 7
pop edi
mov eax, esi
call fcn.0040378a
cmp dword [esi + 0x14], ebx
jb 0x408bc0
mov eax, dword [esi]
jmp 0x408bc2
mov eax, esi
push eax
call fcn.00421be1
pop ecx
test eax, eax
je 0x408be3
cmp dword [esi + 0x14], ebx
jb 0x408bd6
mov eax, dword [esi]
jmp 0x408bd8
mov eax, esi
push eax
call fcn.00421d0d
pop ecx
test eax, eax
jne 0x408c59
push str.XCell_Compiler
push 0xf
pop edi
mov eax, esi
call fcn.0040378a
cmp dword [esi + 0x14], ebx
jb 0x408bfb
mov eax, dword [esi]
jmp 0x408bfd
mov eax, esi
push eax
call fcn.00421be1
pop ecx
test eax, eax
je 0x408c1e
cmp dword [esi + 0x14], ebx
jb 0x408c11
mov eax, dword [esi]
jmp 0x408c13
mov eax, esi
push eax
call fcn.00421d0d
pop ecx
test eax, eax
jne 0x408c59
push str.AddIns
push 7
pop edi
mov eax, esi
call fcn.0040378a
cmp dword [esi + 0x14], ebx
jb 0x408c36
mov eax, dword [esi]
jmp 0x408c38
mov eax, esi
push eax
call fcn.00421be1
pop ecx
test eax, eax
je 0x408c65
cmp dword [esi + 0x14], ebx
jb 0x408c4c
mov eax, dword [esi]
jmp 0x408c4e
mov eax, esi
push eax
call fcn.00421d0d
pop ecx
test eax, eax
je 0x408c65
xor eax, eax
mov ecx, 0x4482ac
call fcn.00401ef9
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042064a
leave
ret

Function at 0x408c76
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [eax + 0x14], 8
jb 0x408c81
mov eax, dword [eax]
push esi
push 0x44c944
push eax
call fcn.00421dfd
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x408cc9
cmp dword [edi + 0x14], 0x10
jb 0x408c9f
mov eax, dword [edi]
jmp 0x408ca1
mov eax, edi
add eax, dword [ebp + 8]
push esi
push 1
push dword [ebp + 0xc]
push eax
call fcn.00421f6b
add esp, 0x10
push esi
cmp eax, 1
je 0x408cc3
call fcn.00422052
pop ecx
xor eax, eax
jmp 0x408ccc
call fcn.00422052
pop ecx
xor eax, eax
inc eax
pop esi
pop ebp
ret 8
Function at 0x40cea0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, 0xb1
mov eax, esi
mov ecx, edi
mov byte [ebp - 1], 0
call fcn.0040d2da
mov ebx, dword [edi + 0x10]
cmp ebx, esi
jae 0x40cf4e
call fcn.004215a7
push 0x24
cdq
pop ecx
idiv ecx
cmp edx, 9
ja 0x40ced9
add dl, 0x30
jmp 0x40cedc
add dl, 0x57
lea eax, [edx - 0x30]
mov cl, 9
cmp cl, al
sbb al, al
inc al
mov byte [ebp - 5], dl
test ebx, ebx
jne 0x40cef6
test al, al
jne 0x40cf3f
test ebx, ebx
je 0x40cf08
cmp dword [edi + 0x14], 0x10
jb 0x40cf00
mov esi, dword [edi]
jmp 0x40cf02
mov esi, edi
cmp byte [esi + ebx - 1], dl
je 0x40cf3f
cmp byte [ebp - 1], 0
jne 0x40cf32
test al, al
je 0x40cf18
mov byte [ebp - 1], 1
jmp 0x40cf32
cmp dword [edi + 0x10], 0xb0
jne 0x40cf32
call fcn.004215a7
push 0xa
cdq
pop ecx
idiv ecx
add dl, 0x30
mov byte [ebp - 5], dl
push dword [ebp - 5]
xor ebx, ebx
inc ebx
mov esi, edi
call fcn.0040d283
mov ebx, dword [edi + 0x10]
cmp ebx, 0xb1
jb 0x40cec4
pop esi
mov eax, edi
pop ebx
leave
ret

Function at 0x40ecb5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov byte [ebp - 1], 1
cmp esi, ebx
je 0x40eceb
cmp word [esi], bx
je 0x40eceb
push ebx
push esi
call fcn.00422145
pop ecx
pop ecx
test eax, eax
jne 0x40eceb
cmp word [esi], bx
je 0x40ecee
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ecee
test al, 0x10
je 0x40ecee
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
pop ebx
leave
ret

Function at 0x40ed3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x455214]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x30], 0
push ebx
push esi
push edi
push 9
xor eax, eax
mov ebx, ecx
pop ecx
push dword [ebp + 8]
mov word [ebp - 0x2c], ax
lea edi, [ebp - 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push 0x44cd24
push eax
mov esi, edx
call fcn.004219f6
add esp, 0xc
push ebx
lea eax, [ebp - 0x2c]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x40edf2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x40edf2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x38], eax
cmp eax, ebx
je 0x40edf2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x40edf2
mov ecx, dword [esi + 0x10]
inc eax
cmp eax, ecx
ja 0x40edc8
or ecx, 0xffffffff
call fcn.00408020
jmp 0x40edd4
push ebx
mov ebx, eax
sub ebx, ecx
mov edi, esi
call fcn.0040f22a
or ecx, 0xffffffff
xor eax, eax
call fcn.00408020
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov edx, esi
call fcn.0040826f
mov dword [ebp - 0x30], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042064a
leave
ret
Function at 0x40ee04
Capabilities:
Get common file path

Disassembly:
push 0x85c
mov eax, 0x442311
call fcn.004269b5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x868], eax
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
xor edi, edi
lea eax, [ebp - 0x80e]
push edi
push eax
call fcn.004226a0
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x810]
push eax
lea esi, [ebp - 0x848]
call fcn.00406c2d
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], edi
mov word [ebp - 0x82c], ax
mov byte [ebp - 4], 1
or eax, 0xffffffff
xor ecx, ecx
lea esi, [ebp - 0x82c]
call fcn.00401c0b
push 0xa
mov eax, esi
pop ebx
call fcn.0040cf54
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x864]
push eax
mov ebx, esi
call fcn.0040f2a7
cmp dword [eax + 0x14], 8
pop ecx
pop ecx
jb 0x40eeb9
mov eax, dword [eax]
push 0
push eax
call fcn.00422145
pop ecx
mov ebx, eax
pop ecx
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0x864]
call fcn.0040202e
inc bl
jne 0x40ee80
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x864]
push eax
lea ebx, [ebp - 0x82c]
call fcn.0040f2a7
pop ecx
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0x868]
mov byte [ebp - 4], 2
call fcn.00403680
push 1
lea esi, [ebp - 0x864]
call fcn.0040202e
mov eax, dword [ebp - 0x868]
cmp dword [eax + 0x14], 8
jb 0x40ef25
mov ebx, dword [eax]
jmp 0x40ef27
mov ebx, eax
push 1
xor edi, edi
lea esi, [ebp - 0x82c]
call fcn.0040202e
push 1
lea esi, [ebp - 0x848]
call fcn.0040202e
mov eax, ebx
call fcn.00426a38
ret
Function at 0x40ef4b
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x455214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x808], edi
call fcn.00401c0b
lea eax, [ebp - 0x808]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push edi
push eax
call fcn.004226a0
add esp, 0xc
mov dword [ebp - 0x80c], 0x400
cmp dword [ebp - 0x808], edi
je 0x40f065
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push str.TEMP
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f059
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40eff9
sub eax, edx
push ebx
sar eax, 1
lea ecx, [ebp - 0x804]
call fcn.00401ef9
push 0xc
mov edi, 0x44cd00
push edi
xor eax, eax
mov ecx, esi
call fcn.00409002
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f058
push 0x400
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40f058
lea eax, [ebp - 0x804]
push eax
push edi
call fcn.004243a2
pop ecx
push eax
push ebx
push esi
call fcn.0040d66f
pop ebx
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042064a
leave
ret
Function at 0x40f073
Capabilities:
Get common file path

Disassembly:
push 0x87c
mov eax, 0x4422bc
call fcn.004269b5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x884], eax
xor eax, eax
xor ebx, ebx
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push ebx
push eax
mov dword [ebp - 0x888], ebx
call fcn.004226a0
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x810]
push eax
lea esi, [ebp - 0x848]
call fcn.00406c2d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x834], 8
mov eax, dword [ebp - 0x848]
jae 0x40f0e9
mov eax, esi
mov ecx, dword [ebp - 0x838]
lea eax, [eax + ecx*2]
cmp word [eax - 2], 0x5c
je 0x40f10c
xor edi, edi
push 0x44c94c
inc edi
lea eax, [ebp - 0x848]
call fcn.0040378a
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x854], ebx
mov word [ebp - 0x864], cx
mov dword [ebp - 0x818], eax
xor eax, eax
mov dword [ebp - 0x81c], ebx
mov word [ebp - 0x82c], ax
push 8
lea eax, [ebp - 0x864]
pop ebx
mov byte [ebp - 4], 2
call fcn.0040cf54
lea ecx, [ebp - 0x848]
push ecx
lea ecx, [ebp - 0x880]
push ecx
mov ebx, eax
call fcn.0040f2a7
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x82c]
mov byte [ebp - 4], 3
call fcn.00403680
push 1
xor edi, edi
lea esi, [ebp - 0x880]
mov byte [ebp - 4], 2
call fcn.0040202e
cmp dword [ebp - 0x818], 8
mov eax, dword [ebp - 0x82c]
jae 0x40f19b
lea eax, [ebp - 0x82c]
push 0
push eax
call fcn.00422145
pop ecx
pop ecx
test eax, eax
jne 0x40f1cc
push 1
xor edi, edi
lea esi, [ebp - 0x82c]
call fcn.0040202e
push 1
lea esi, [ebp - 0x864]
call fcn.0040202e
xor ebx, ebx
jmp 0x40f10c
cmp dword [ebp - 0x818], 8
mov eax, dword [ebp - 0x82c]
jae 0x40f1e1
lea eax, [ebp - 0x82c]
push eax
call fcn.00421d0d
mov esi, dword [ebp - 0x884]
pop ecx
lea ebx, [ebp - 0x82c]
call fcn.004036d3
push 1
xor edi, edi
mov esi, ebx
call fcn.0040202e
push 1
lea esi, [ebp - 0x864]
call fcn.0040202e
push 1
lea esi, [ebp - 0x848]
call fcn.0040202e
mov eax, dword [ebp - 0x884]
call fcn.00426a38
ret