joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413470
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44faab
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], edi
mov dword [ebp - 4], edi
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0x218]
mov eax, dword [eax]
or ebx, 0x2001f
mov dword [ebp - 0x228], edi
cmp esi, edi
je 0x4134f3
push ebx
push ecx
push eax
lea edi, [ebp - 0x228]
call fcn.00413390
xor edi, edi
jmp 0x413504
lea edx, [ebp - 0x228]
push edx
push ebx
push edi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x4135fd
mov ecx, dword [ebp - 0x220]
xor eax, eax
cmp ecx, edi
je 0x413527
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x220], edi
mov ecx, dword [ebp - 0x228]
and ebx, 0x300
mov dword [ebp - 0x21c], edi
mov esi, eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ebx
cmp eax, edi
jne 0x4135fd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x238]
push eax
push edi
push edi
push edi
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x214]
push eax
push edi
push ecx
mov dword [ebp - 0x224], 0x100
call esi
test eax, eax
jne 0x4135cc
nop
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00413470
mov ebx, eax
cmp ebx, edi
jne 0x413641
lea edx, [ebp - 0x238]
push edx
mov edx, dword [ebp - 0x220]
push edi
push edi
push edi
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x214]
push ecx
push edi
push edx
mov dword [ebp - 0x224], 0x100
call esi
test eax, eax
je 0x413580
mov eax, dword [ebp - 0x220]
cmp eax, edi
je 0x4135e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x220], edi
mov eax, dword [ebp - 0x230]
push eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x21c], edi
call fcn.004136e0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x220]
cmp eax, edi
je 0x41361b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x220], edi
mov eax, esi
mov dword [ebp - 0x21c], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00431de5
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x220]
cmp eax, edi
je 0x41365f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x220], edi
mov eax, ebx
jmp 0x41361d
Function at 0x414390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451a26
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edi, ecx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x418], ecx
mov byte [ebp - 4], 1
push 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x420], esi
test esi, esi
jne 0x41440c
call fcn.00412520
mov edi, eax
jmp 0x414533
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x414425
call fcn.00412520
jmp 0x41452a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x414443
call fcn.00412520
jmp 0x41452a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x414464
mov edi, 0x8007000e
jmp 0x41452c
mov byte [ebp - 4], 2
xor ecx, ecx
shld ecx, eax, 1
mov dword [ebp - 0x434], ecx
add eax, eax
mov dword [ebp - 0x438], eax
test ecx, ecx
jne 0x414485
cmp eax, 0xffffffff
jbe 0x41448f
push 0x80070216
call fcn.0040ecf0
cmp eax, 0x400
jbe 0x4144ab
lea ecx, [ebp - 0x418]
push ecx
call fcn.004124f0
mov dword [ebp - 4], 1
jmp 0x4144df
lea edx, [ebp - 0x414]
mov dword [ebp - 0x418], edx
mov dword [ebp - 4], 1
jmp 0x4144df
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x4144f0
mov edi, 0x8007000e
jmp 0x41452c
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x414509
call fcn.00412520
jmp 0x41452a
xor ecx, ecx
mov edx, dword [ebp - 0x418]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.004141f0
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x414]
cmp dword [ebp - 0x418], ecx
je 0x414550
lea eax, [ebp - 0x418]
call fcn.004124d0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00431de5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4151a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x46d5f4
call fcn.00431ab8
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x41523d
test esi, esi
jne 0x41523d
push esi
push 7
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x415225
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41521f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41521f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
mov ecx, 5
nop
cmp esi, eax
jae 0x415212
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x415200
cmp esi, eax
jb 0x415216
xor eax, eax
jmp 0x41521f
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x415246
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x46d5f4
call fcn.00431ab8
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x4151c1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x415266
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x415295
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
mov ecx, 5
cmp esi, eax
jae 0x415295
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x415283
cmp esi, eax
jb 0x41529b
pop esi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x416e20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x454314
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x46b664]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x46b664]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, edx
cmp dword [edi + 0x14], 8
mov esi, ecx
jb 0x416e65
mov eax, dword [edi]
jmp 0x416e67
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416f11
and al, 0x10
cmp al, 0x10
sete al
xor ebx, ebx
cmp al, bl
je 0x416f11
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.00415eb0
mov dword [esp + 0x58], ebx
lea ecx, [esp + 0x10]
push ecx
push edi
mov ecx, eax
call fcn.0040eab0
mov byte [esp + 0x58], 1
push esi
mov edi, eax
call fcn.004199d0
add esp, 4
mov byte [esp + 0x58], bl
mov esi, 8
cmp dword [esp + 0x24], esi
jb 0x416ed1
mov edx, dword [esp + 0x10]
push edx
call fcn.00431dda
add esp, 4
mov edi, 7
xor eax, eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], ax
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x40], esi
jb 0x416f00
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00431dda
add esp, 4
xor edx, edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], dx
jmp 0x416f1a
push esi
call fcn.004199d0
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00431de5
mov esp, ebp
pop ebp
ret

Function at 0x416f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44f9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x46b664]
xor eax, esp
mov dword [esp + 0x25c], eax
push ebx
push esi
mov eax, dword [0x46b664]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x416f8b
xor al, al
jmp 0x416ff8
lea eax, [esp + 0xc]
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0041a000
add esp, 8
mov dword [esp + 0x278], 0
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x416fcd
test eax, eax
je 0x416fcd
mov dword [esp + 0x278], 0xffffffff
lea esi, [esp + 0xc]
call fcn.00418590
mov al, 1
jmp 0x416ff8
cmp dword [esi + 0x14], 8
jb 0x416fd5
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov dword [esp + 0x278], 0xffffffff
lea esi, [esp + 0xc]
call fcn.00418590
mov al, bl
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.00431de5
mov esp, ebp
pop ebp
ret
Function at 0x417570
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45054e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x46b664]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [eax + 0x14], 8
jb 0x4175ab
mov eax, dword [eax]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edx, eax
xor eax, eax
mov dword [ebp - 0x14], edx
cmp edx, ebx
jne 0x4175eb
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], ebx
mov word [esi + 8], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
jmp 0x417700
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ebx
cmp edx, ebx
jbe 0x417625
lea ecx, [ebp - 0x30]
call fcn.00418280
mov edi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov eax, edi
sub eax, ecx
add eax, dword [ebp - 0x14]
je 0x41761c
push eax
push ebx
push ecx
call fcn.004397f0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
lea eax, [edi + ecx]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
sub eax, edi
cmp dword [ecx + 0x14], 8
jb 0x417639
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x1c]
push edi
push eax
push edx
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
cmp eax, ebx
jne 0x417669
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
xor ecx, ecx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], ebx
mov word [esi + 8], cx
jmp 0x4176dc
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x18]
push eax
push 0x45d1e4
push edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
cmp eax, ebx
jne 0x4176a3
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
xor edx, edx
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], ebx
mov word [esi + 8], dx
jmp 0x4176dc
mov eax, dword [ebp - 0x18]
movzx edx, word [eax + 0xe]
movzx ecx, word [eax + 0xc]
mov dword [ebp + 8], edx
movzx edx, word [eax + 8]
mov ax, word [eax + 0xa]
mov word [esi + 2], dx
mov dx, word [ebp + 8]
mov word [esi], ax
mov word [esi + 4], dx
mov word [esi + 6], cx
xor eax, eax
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], ebx
mov word [esi + 8], ax
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], bl
cmp edi, ebx
je 0x4176f7
push edi
call fcn.00431dda
add esp, 4
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x417790
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
push edi
mov ecx, esi
call fcn.00416f40
test al, al
je 0x4177e6
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edi, edi
nop
mov eax, esi
call fcn.00401500
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x4177e1
and eax, 0xfffffffe
push eax
mov eax, esi
call fcn.00401500
push eax
call ebx
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3e8
jl 0x4177b0
call fcn.00419780
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4177f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x453660
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x46b664]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x46b664]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.00419ed0
xor esi, esi
mov dword [esp + 0x58], esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
jne 0x41788d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], esi
xor edx, edx
push 0x1f
mov eax, 0x45d200
lea esi, [esp + 0x30]
mov dword [esp + 0x44], 7
mov word [esp + 0x30], dx
call fcn.0040eba0
mov byte [esp + 0x58], 0
push 0x462084
lea eax, [esp + 0x2c]
push eax
call fcn.00436362
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x58], 0xffffffff
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4178c3
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4178e4
test eax, eax
je 0x4178e4
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4178e4
dec dword [eax]
jne 0x4178e4
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4178d7
test eax, eax
je 0x4178d7
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00431dda
add esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov edx, ebx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00431de5
mov esp, ebp
pop ebp
ret
Function at 0x418da0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4530a2
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x48], eax
push 0x105
lea esi, [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
call fcn.0041ba10
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x44]
mov esi, edi
sub esi, ebx
push ebx
sar esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
jbe 0x418ec9
nop
lea ecx, [eax + 0xa]
mov dword [ebp - 0x50], ecx
cmp esi, ecx
jbe 0x418e36
lea esi, [ebx + ecx*2]
cmp esi, edi
je 0x418eb3
push 0
push edi
push esi
call fcn.00432040
add esp, 0xc
mov dword [ebp - 0x40], esi
jmp 0x418eb0
jae 0x418eb3
mov eax, ecx
sub eax, esi
mov edx, 0x7fffffff
sub edx, eax
cmp edx, esi
jb 0x418f09
add esi, eax
mov eax, dword [ebp - 0x3c]
sub eax, ebx
sar eax, 1
cmp esi, eax
jbe 0x418e84
mov ecx, eax
shr ecx, 1
mov edx, 0x7fffffff
sub edx, ecx
cmp edx, eax
jae 0x418e6b
xor eax, eax
jmp 0x418e6d
add eax, ecx
cmp eax, esi
cmovb eax, esi
push eax
lea ecx, [ebp - 0x44]
call fcn.0041bb00
mov ebx, dword [ebp - 0x44]
mov edi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x50]
mov eax, edi
sub eax, ebx
sar eax, 1
mov edx, ecx
sub edx, eax
je 0x418eaa
xor eax, eax
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 0x40]
lea ecx, [edi + edx*2]
mov dword [ebp - 0x40], ecx
mov edi, dword [ebp - 0x40]
mov esi, edi
sub esi, ebx
push ebx
sar esi, 1
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x418e10
xor edi, edi
cmp eax, edi
jne 0x418f13
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
xor edx, edx
push 0x1d
mov eax, str.WinAPI::getTempPath___failed.
lea esi, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], edi
mov word [ebp - 0x30], dx
call fcn.0040eba0
mov byte [ebp - 4], 1
push 0x462084
lea eax, [ebp - 0x34]
push eax
call fcn.00436362
push str.vector_T__too_long
call fcn.0042fac0
mov eax, ebx
cmp ebx, edi
jne 0x418f1e
mov eax, 0x45c490
mov esi, dword [ebp - 0x4c]
xor ecx, ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], cx
mov ecx, eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x418f35
sub ecx, edi
sar ecx, 1
push ecx
call fcn.0040eba0
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00416bf0
mov byte [ebp - 4], 1
mov dword [ebp - 0x48], 1
mov byte [ebp - 4], 0
xor edi, edi
cmp ebx, edi
je 0x418f73
push ebx
call fcn.00431dda
add esp, 4
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00431de5
mov esp, ebp
pop ebp
ret
Function at 0x418fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45358a
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 0x48], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
mov dword [ebp - 0x4c], eax
call edi
inc eax
push eax
lea esi, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call fcn.0041ba10
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
sub eax, esi
sar eax, 1
push esi
push eax
call edi
test eax, eax
jne 0x419046
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
xor ecx, ecx
push 0x38
mov eax, str.WinAPI::getCurrentDirectory:_GetCurrentDirectory_failed
lea esi, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], cx
call fcn.0040eba0
mov byte [ebp - 4], 1
push 0x462084
lea edx, [ebp - 0x34]
push edx
call fcn.00436362
mov edi, dword [ebp - 0x4c]
push esi
push edi
call fcn.004156f0
mov dword [ebp - 0x48], 1
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x419067
push esi
call fcn.00431dda
add esp, 4
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00431de5
mov esp, ebp
pop ebp
ret
Function at 0x419090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453538
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x11c], ebx
push 0x105
lea esi, [ebp - 0x12c]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x118], ecx
mov edi, edx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
call fcn.0041ba10
mov dword [ebp - 4], 1
mov edx, 8
cmp dword [edi + 0x14], edx
jb 0x419114
mov ecx, dword [edi]
jmp 0x419116
mov ecx, edi
mov eax, dword [ebp - 0x118]
cmp dword [eax + 0x14], edx
jb 0x419123
mov eax, dword [eax]
mov esi, dword [ebp - 0x12c]
push esi
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, ebx
jne 0x41923e
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x6c]
push eax
call fcn.00425640
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 2
xor ecx, ecx
push 0x18
mov eax, str.WinAPI::getTempFileName_
lea esi, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x50], cx
call fcn.0040eba0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x118]
push edx
lea eax, [ebp - 0x88]
push eax
mov ecx, esi
call fcn.004185e0
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xa4]
push ecx
mov edx, 0x45d378
call fcn.00418660
mov byte [ebp - 4], 5
lea edx, [ebp - 0xc0]
push edi
push edx
mov ecx, eax
call fcn.004185e0
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xf8]
push eax
mov edx, 0x45d378
call fcn.00418660
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x138]
lea ecx, [ebp - 0x114]
push ecx
mov ecx, eax
call fcn.0041bbd0
add esp, 0x24
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0xdc]
push edx
mov edx, 0x45d364
call fcn.00418660
add esp, 8
mov esi, eax
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
xor eax, eax
push ebx
mov word [ebp - 0x30], ax
push esi
or eax, 0xffffffff
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
call fcn.00401a90
mov byte [ebp - 4], 9
push 0x462084
lea ecx, [ebp - 0x34]
push ecx
call fcn.00436362
mov edi, dword [ebp - 0x134]
push esi
push edi
call fcn.004156f0
mov dword [ebp - 0x11c], 1
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x419265
push esi
call fcn.00431dda
add esp, 4
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00431de5
mov esp, ebp
pop ebp
ret