joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b88
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov esi, 0x4b6
push esi
mov edi, ecx
call fcn.00407346
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
add eax, 2
push esi
mov ecx, edi
mov dword [edi + 0x58], eax
call fcn.00408a45
push 1
inc esi
push esi
mov ecx, edi
call fcn.00408a45
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea eax, [ebp - 0x4d0]
push eax
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4d0]
push esi
push dword [edi + 4]
mov dword [edi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x406cb3
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, edi
mov dword [edi + 0x54], eax
call fcn.00407625
mov ecx, edi
mov esi, eax
call fcn.00408568
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x4090e6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
shr ecx, 1
xor ecx, eax
dec esi
jne 0x4090ee
mov dword [edx*4 + 0x432720], ecx
inc edx
cmp edx, 0x100
jb 0x4090e9
mov esi, 0x800
jmp 0x409135
mov ecx, dword [edx*4 + 0x432320]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x432720]
inc edx
mov dword [edx*4 + 0x43271c], ecx
cmp edx, esi
jb 0x409119
mov eax, 0x423d50
mov esi, 0x423c70
mov dword [0x432700], eax
mov dword [0x4326f8], eax
mov dword [0x4326fc], esi
call fcn.0040eb14
mov ecx, dword [0x4326f8]
test eax, eax
cmove ecx, esi
mov dword [0x4326f8], ecx
pop esi
ret

Function at 0x40b852
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push dword [0x42e6d8]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x42e6f4]
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x104
mov esi, eax
push esi
push edi
invalid
invalid

Function at 0x40b889
Capabilities:
Terminate process

Disassembly:
loopne 0x40b8db
inc edx
add byte [esi - 0x18], dl
jge 0x40b890
invalid
invalid
inc edx
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_HeapAlloc

Function at 0x40b8b8
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
invalid
pop ecx
jmp 0x40b8b1
Function at 0x40b8ed
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
or al, 0x11
or al, 0x11
mov dword [edx + eax], ecx
add edx, 4
cmp edx, 0x20
jl 0x40b8e6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40b8b1
mov esi, dword [0x42e6fc]
lea eax, [esp + 0x10]
push eax
push dword [0x42e6ec]
push 0x6000
add byte [eax], ah
add byte [esi - 1], dl
xlatb
mov edx, dword [0x42e6d4]
lea ecx, [esi + 8]
add edx, ebp
mov ebx, 0x17fe
mov eax, dword [edx + 4]
sub edx, esi
mov dword [esp + 0x14], eax
mov eax, dword [edx + ecx]
add eax, dword [esp + 0x14]
adc al, 0x89
add dword [ebp - 0x147cfbb7], ecx
add dword [ebp - 0x11], esi

Function at 0x40b91a
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
or al, 0x11
or al, 0x11
mov dword [edx + eax], ecx
add edx, 4
cmp edx, 0x20
jl 0x40b8e6
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40b8b1
mov esi, dword [0x42e6fc]
lea eax, [esp + 0x10]
push eax
push dword [0x42e6ec]
push 0x6000
add byte [eax], ah
add byte [esi - 1], dl
xlatb
mov edx, dword [0x42e6d4]
lea ecx, [esi + 8]
add edx, ebp
mov ebx, 0x17fe
mov eax, dword [edx + 4]
sub edx, esi
mov dword [esp + 0x14], eax
mov eax, dword [edx + ecx]
add eax, dword [esp + 0x14]
adc al, 0x89
add dword [ebp - 0x147cfbb7], ecx
add dword [ebp - 0x11], esi

Function at 0x40b940
Capabilities:
Terminate process

Disassembly:
adc al, 0x89
add dword [ebp - 0x147cfbb7], ecx
add dword [ebp - 0x11], esi
mov eax, dword [0x42e6f0]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6000
push esi
call edi
mov eax, dword [0x42e6dc]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x42e6dc]
add ecx, esi
add esi, eax
push esi
call ecx

Function at 0x40b97a
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
invalid
pop ecx
jmp 0x40b8b1
Function at 0x40ee78
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40ee9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40ee9e
xor al, al
jmp 0x40eeb2
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
xor ecx, ecx
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x4120cc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
xor esi, esi
mov dword [ebp - 0xc], ecx
test edi, edi
je 0x412102
mov eax, dword [edx]
mov dword [ebx + esi*4], eax
inc esi
lea edx, [edx + 4]
cmp esi, edi
jb 0x4120f5
cmp esi, ecx
jae 0x4121ee
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div edi
mov ecx, dword [ebx + esi*4 - 4]
mov dword [ebp + 8], ecx
mov dword [ebp - 8], eax
test edx, edx
jne 0x412180
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shr eax, 0x10
and eax, 0xff
shl edx, 8
movzx eax, byte [eax + str.cw]
shr ecx, 8
or edx, eax
mov eax, dword [ebp - 8]
and ecx, 0xff
movzx eax, byte [eax + 0x427218]
movzx ecx, byte [ecx + str.cw]
shl edx, 8
xor ecx, eax
or ecx, edx
jmp 0x4121d4
cmp edi, 6
jbe 0x4121d4
cmp edx, 4
jne 0x4121d4
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
xor eax, ecx
mov dword [ebx + esi*4], eax
inc esi
add edx, 4
mov dword [ebp - 4], edx
cmp esi, dword [ebp - 0xc]
jb 0x412114
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x412d0a
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x41301a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
push edi
xor edi, edi
and edx, 7
cmp eax, 5
jae 0x413038
xor eax, eax
jmp 0x41314f
add dword [ebp + 0x10], 5
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [eax - 4]
add ecx, ebx
push esi
mov dword [ebp + 0xc], ecx
lea esi, [edi + ebx]
jmp 0x413057
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x41305b
inc esi
cmp esi, ecx
jb 0x41304e
mov ecx, esi
sub ecx, edi
mov edi, esi
sub ecx, ebx
sub edi, ebx
cmp esi, dword [ebp + 0xc]
jae 0x41313c
cmp ecx, 2
jbe 0x4130b4
xor edx, edx
movzx ebx, byte [esi + 4]
lea eax, [ebx + 1]
test al, 0xfe
jne 0x413131
movzx eax, byte [esi + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
mov eax, dword [ebp + 0x10]
add eax, edi
add edi, 5
cmp dword [ebp + 0x18], 0
mov dword [ebp - 4], eax
je 0x4130e0
add ebx, eax
jmp 0x4130e2
shr edx, cl
test edx, edx
je 0x413075
cmp edx, 4
ja 0x4130d2
cmp edx, 3
je 0x4130d2
mov eax, edx
shr eax, 1
movzx eax, byte [eax + esi + 1]
inc eax
test al, 0xfe
jne 0x413075
or edx, 8
shr edx, 1
inc edi
mov ecx, dword [ebp + 0xc]
jmp 0x413049
sub ebx, eax
test edx, edx
je 0x413111
and edx, 6
shl edx, 2
mov eax, ebx
mov ecx, edx
shr eax, cl
inc eax
test al, 0xfe
jne 0x41310f
mov eax, 0x100
shl eax, cl
dec eax
xor ebx, eax
cmp dword [ebp + 0x18], 0
je 0x41310c
add ebx, dword [ebp - 4]
jmp 0x41310f
sub ebx, dword [ebp - 4]
xor edx, edx
mov eax, ebx
shr eax, 8
mov byte [esi + 1], bl
mov byte [esi + 2], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
and bl, 1
neg bl
mov byte [esi + 3], al
mov byte [esi + 4], bl
jmp 0x413137
or edx, 8
shr edx, 1
inc edi
mov ebx, dword [ebp + 8]
jmp 0x4130d8
shr edx, cl
xor eax, eax
cmp ecx, 2
pop esi
cmova edx, eax
mov eax, dword [ebp + 0x14]
pop ebx
mov dword [eax], edx
mov eax, edi
pop edi
leave
ret
Function at 0x4210e6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42f0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041f441
mov dword [ebp - 0x14], eax
cmp dword [0x432354], edi
jne 0x4211d7
push 0x800
push edi
push 0x428a68
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x421164
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4212b7
push 0x428a68
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4212b7
push 0x428a80
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4212b7
push eax
call ebx
push 0x428a8c
push esi
mov dword [0x432354], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x428a9c
push esi
mov dword [0x432358], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x428ab0
push esi
mov dword [0x43235c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x432364], eax
test eax, eax
je 0x4211d4
push 0x428acc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x432360], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4211fc
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4211ef
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x421211
push 4
pop eax
jmp 0x4212b9
cmp dword [ebp - 0x14], edi
je 0x421211
push dword [0x432354]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4211f6
mov eax, dword [0x432360]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x42126f
cmp dword [0x432364], esi
je 0x42126f
push eax
call ebx
push dword [0x432364]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42126f
test eax, eax
je 0x42126f
call ecx
test eax, eax
je 0x421264
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x421264
test byte [ebp - 8], 1
jne 0x42126f
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x42129f
mov eax, dword [0x432358]
cmp eax, esi
je 0x42129c
push eax
call ebx
test eax, eax
je 0x42129c
call eax
mov edi, eax
test edi, edi
je 0x42129c
mov eax, dword [0x43235c]
cmp eax, esi
je 0x42129c
push eax
call ebx
test eax, eax
je 0x42129c
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x432354]
call ebx
test eax, eax
je 0x4212b7
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4212b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f7dc
leave
ret
Function at 0x401613
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cd836
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4fe080]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 0x10]
lea ecx, [esp + 0x10]
call fcn.004018a0
and dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004015b2
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.00401b55
mov dword [esi], vtable.std::system_error.0
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402c71
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cd9f3
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4fe080]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x4fe080]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
cmp edi, ebx
jne 0x402cbf
xor eax, eax
jmp 0x402e3b
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x402ce9
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x402ce9
dec dword [edx]
mov edx, dword [esi + 0x20]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x402e3b
cmp dword [esi + 0x50], 0
je 0x402e39
mov ecx, esi
call fcn.00403754
xor ecx, ecx
cmp dword [esi + 0x40], ecx
jne 0x402d16
push dword [esi + 0x50]
push edi
call fcn.0040276d
test al, al
pop ecx
pop ecx
cmovne ebx, edi
jmp 0x402e39
mov eax, dword [ebp + 8]
push ecx
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
push 8
mov byte [esp + 0x2c], al
mov dword [esp + 0x44], 0xf
call fcn.0040382f
and dword [esp + 0x50], 0
lea eax, [esi + 0x48]
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x3c]
mov esi, dword [esi + 0x40]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x2c]
cmp edi, 0x10
lea edx, [esp + 0x2c]
mov edi, dword [esi]
cmovae ecx, dword [esp + 0x2c]
cmovae edx, dword [esp + 0x2c]
add eax, ecx
push eax
push edx
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
lea eax, [esp + 0x35]
push eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x30]
call dword [edi + 0x1c]
test eax, eax
js 0x402e2c
cmp eax, 1
jg 0x402e0f
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp edi, 0x10
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
cmovae eax, ecx
sub edx, eax
mov dword [esp + 0x14], edx
je 0x402ddc
push dword [esi + 0x50]
cmp edi, 0x10
lea eax, [esp + 0x2c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.0047c496
mov edx, dword [esp + 0x24]
add esp, 0x10
cmp edx, eax
jne 0x402e2c
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x24]
mov byte [esi + 0x45], 1
cmp dword [esp + 0x20], eax
jne 0x402e0a
test edx, edx
jne 0x402d49
cmp dword [esp + 0x38], 0x20
jae 0x402e2c
push edx
push 8
lea ecx, [esp + 0x30]
call fcn.00403486
jmp 0x402d45
mov ebx, dword [ebp + 8]
jmp 0x402e2c
cmp eax, 3
jne 0x402e2c
mov eax, dword [esp + 0x10]
push dword [eax + 0x50]
push dword [esp + 0x28]
call fcn.0040276d
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.00401b55
mov eax, ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 4
Function at 0x4035cf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cda23
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4fe080]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4fe080]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x403709
cmp byte [ebx + 0x45], 0
je 0x403709
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x40362f
xor al, al
jmp 0x40370b
xor eax, eax
mov dword [esp + 0x2c], 0xf
push eax
push 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
call fcn.0040382f
and dword [esp + 0x40], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x403694
dec eax
je 0x403698
dec eax
dec eax
je 0x4036f6
xor bl, bl
jmp 0x4036f8
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x4036d7
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0047c496
add esp, 0x10
cmp esi, eax
jne 0x403690
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp byte [ebx + 0x45], 0
je 0x4036f6
test esi, esi
jne 0x40365a
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00403486
jmp 0x403652
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.00401b55
mov al, bl
jmp 0x40370b
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x413bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdee6
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x40], 0
jne 0x413d0d
xor eax, eax
mov dword [ebp - 0x94], 7
mov dword [ebp - 0x98], 0
mov word [ebp - 0xa8], ax
push 0x64
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x74]
push eax
call fcn.0047bb20
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
push 0x20019
push 0
call fcn.0040df50
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413cd2
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0x64
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
call fcn.0040e1b0
push eax
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413cc6
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
call fcn.004018a0
cmp dword [ebp - 0x7c], 0x10
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 0x80]
cmovae ecx, dword [ebp - 0x90]
add eax, ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x7c], 0x10
lea ecx, [ebp - 0x90]
push eax
cmovae ecx, dword [ebp - 0x90]
push ecx
lea ecx, [ebp - 0xa8]
call fcn.004136f0
cmp dword [ebp - 0x7c], 0x10
mov byte [ebp - 4], 0
jb 0x413cc6
push dword [ebp - 0x90]
call fcn.0047a557
add esp, 4
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x98], 0
jbe 0x413cf6
lea ecx, [edi + 0x10]
mov byte [edi + 0x40], 1
lea eax, [ebp - 0xa8]
cmp ecx, eax
je 0x413cf6
push 0xffffffffffffffff
push 0
push eax
call fcn.004114e0
cmp dword [ebp - 0x94], 8
jb 0x413d0d
push dword [ebp - 0xa8]
call fcn.0047a557
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret
Function at 0x416b70
Capabilities:
Check if file exists
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce148
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
mov word [edi], ax
push 0xfffe
mov byte [ebp - 4], 1
call fcn.004780a0
add esp, 4
mov esi, eax
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x7fff
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x416c5c
push 0x16
push str.Failed_to_expand_path:
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
call fcn.004116f0
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call fcn.004112e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
push esi
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 1
jb 0x416c9d
push dword [ebp - 0x28]
call fcn.0047a557
add esp, 4
jmp 0x416c9d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416c9d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x416c9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_path_directory
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
push esi
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp word [esi], 0
jne 0x416ca7
xor ecx, ecx
jmp 0x416cbf
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416cb0
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.004116f0
push esi
call fcn.0047b041
add esp, 4
cmp dword [ebp + 0x1c], 8
jb 0x416ce2
push dword [ebp + 8]
call fcn.0047a557
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 0x18