joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418f21
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
call fcn.0042af76
test al, al
je 0x418f52
dec eax
push eax
rcl byte [ebp + 0x539e8e63], 0x8c
mov eax, dword ss:[0xe8d5b5ed]
pop ss
pop ebp
xchg ecx, eax
int3
call fcn.0042aeec
test al, al
je 0x418f76
and al, byte [0x470f8de1]
dec esi
movsb byte es:[edi], byte [esi]
xlatb
sti
popfd
and eax, 0x18c9c213
jecxz 0x418fc3
popal
fsubr dword [eax]
aad 0x13
mov edx, 0x2ce82975
pop ds
add dword [eax], eax
call fcn.0042aea7
test al, al
je 0x418f98
cmp edx, esi
aas
xchg ebp, eax
scasb al, byte es:[edi]
add ecx, edx
ret
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0xf013f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4190ed
call fcn.0042aea7
test al, al
je 0x418fe3
test al, 6
insb byte es:[edi], dx
outsb dx, byte [esi]
in al, 0x2e
or dword [esi + 0x5340dc43], ecx
jp 0x418f82
cdq
xchg ebp, eax
idiv dword [edi - 0x10]
push eax
mov esi, 0xc614a685
mov ebp, 0xdb3357bd
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41900f
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4190ed
call fcn.0042af76
test al, al
je 0x419035
pushfd
inc esp
lodsb al, byte [esi]
mov bl, 0x7f
inc bh
ret
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x419066
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x4190eb
call fcn.0042a9cd
test al, al
je 0x41908f
push ebx
ror byte [ebx + 0x7b], 0xef
insb byte es:[edi], dx
inc edx
sal dword [eax + ecx*4 - 0x8b1ff00], 1
arpl word [esi + 0x6cb8dada], ax
mov ebp, 0xddbd6cf9
pop ss
dec ecx
scasb al, byte es:[edi]
sub al, 0x3c
fmul st(4), st(0)
call fcn.0042ae62
test al, al
je 0x4190b4
inc edx
push cs
xor eax, 0xa14be470
aas
in eax, dx
cwde
fistp qword [ecx + 0x3deb9701]
stc
dec esi
adc ecx, dword [0x434e9c53]
or al, 0x49
add bh, byte [edi + edi*8 + 0x75]
adc al, 0xe8
dec edx
not byte [0x48d5900]
inc ebp
add al, byte [eax]
add byte [eax], al
push dword [ebp + 0x14]
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x120], esi
call fcn.0042acc4
test al, al

Function at 0x41b7a3
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0042ad4e
test al, al
je 0x41b816
clc
and cl, byte [eax + 0x6f68d6bc]
ror byte [esi - 0x1e378631], 1
dec esp
dec eax
cmp cl, bl
adc dword [esi + 0x64], 0xffffff92
xor ecx, ebp
invalid
call fcn.0042ae62
test al, al
je 0x41b83d
dec ebp
adc al, 0x8f
mov ecx, 0xa41d16a8
adc eax, 0x1e5caaa1
and cl, byte [edx - 0x6d]
invalid
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.0042aa12
test al, al
je 0x41b871
adc byte ds:[eax], al
popfd
invalid
cmp edi, 5
jg 0x41b880
cmp esi, 2
jg 0x41b880
xor eax, eax
inc eax
jmp 0x41b882
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x4229d0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
call fcn.0056936d
ret
push 0
push 1
mov ecx, esi
call fcn.00403628
pop esi
ret
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x422a06
pop es
xor al, al
jmp 0x422b46
call fcn.0042ab6b
test al, al
je 0x422a2a
inc edi
cmp ah, ch
stc
xor byte [esi + 0x21], dh
and edx, dword [eax + 0x10]
mov ah, 0xf
jge 0x4229c3
outsd dx, dword [esi]
outsd dx, dword [esi]
int1
das
jl 0x4229ab
and ch, dl
and edi, dword [esi - 0x178a9641]
jecxz 0x422aac
call fcn.0042aa12
add byte [eax], al
test al, al
je 0x422a51
mov ah, byte [0xb946a489]
pop ebp
js 0x4229fe
test al, 0xfe
push ss
cld
pushfd
inc ebx
fiadd word [ebx - 0x57]
pushal
mov al, 0x73
fsub st(1), st(0)
mov byte [0x3144a221], 0x48
push 0xf01ff
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x4229ff
call fcn.0042aa12
test al, al
je 0x422a93
dec ecx
rcr byte [edx - 0x1e26ab9a], 0x14
push ds
insb byte es:[edi], dx
jnp 0x422ad4
mov ah, 0xb2
test edx, ecx
sbb eax, 0xaedfec80
sub ah, 0xdf
scasb al, byte es:[edi]
xchg dword [edi - 0x1601a3f0], esi
cmpsd dword [esi], dword es:[edi]
add al, 0xb5
sbb dword [ebp + 0x5650e045], ecx
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4229ff
invalid
call fcn.0042acc4
test al, al
je 0x422acd
adc dword [edx], eax
out dx, al
dec esp
and byte [ebx + 0x5ffe723c], dl
and esp, dword [eax]
pop esi
and cl, bh
mov eax, dword [0x13a7bb51]
push esi
out dx, al
or eax, ebp
test dword [edi], edi
add byte [eax + eax*8 + 0x2c7e1874], al
call fcn.0042aa57
test al, al
je 0x422aee
jle 0x422b04
fistp word [eax - 0x23]
push ebx
add ebp, dword [esi - 0x70]
xor byte [ebx + 0x6c], bh
stc
push 0x1954c8da
adc byte [ebp + 0x46c9d897], al
call fcn.0042aae1
test al, al
je 0x422b0f
jecxz 0x422a85
sbb al, 0x8e
jecxz 0x422b68
xchg esi, eax
or dword [eax], 0xe17c3d20
push ecx
push edi
daa
call 0x293549b3
leave
bound ebx, qword [edi]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x4229ff
call fcn.0042ac7f
test al, al
je 0x422b3b
lahf
push ecx
ret
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
cld
Function at 0x422b59
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call fcn.0042ad4e
test al, al
je 0x422b93
je 0x422ba0
xchg ecx, eax
jecxz 0x422bed
adc eax, 0xa780ba45
movsd dword es:[edi], dword [esi]
pop esp
mov eax, dword [0x856189e2]
aad 0x6a
fcom qword [esi]
push ss
mov edx, 0x2e5dcfab
adc ebp, eax
sbb byte [eax - 0x3f7c0000], al
call fcn.0042abb0
test al, al
je 0x422bb1
xchg edx, eax
je 0x422c12
insb byte es:[edi], dx
cmp byte [bx], dh
sti
push 0x2ce23390
mov dl, 9
std
ficomp dword [esi - 0x17786cc9]
push ebx
add dword [eax], 0x74c08400
adc al, dh
les esp, [eax - 0x505ab3a2]
call fcn.0042ad09
test al, al
je 0x422bcc
mov ah, 0xa0
pop esi
dec esp
movsd dword es:[edi], dword [esi]
scasd eax, dword es:[edi]
test byte [edi + 0x64af9449], dh
pop esp
xchg ebx, eax
cmp al, 0x6c
adc ch, byte [eax + 0x3f]
add byte [edi], cl
add byte [edx], ch
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
add byte [ecx - 0x3f7a27bb], cl
jne 0x422be9
xor al, al
jmp 0x422c9a
push 0xf01ff
push ebx
push eax
add byte [ebx + 0x50], dl
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x422be2
call fcn.0042ae1d
test al, al
je 0x422c1d
mov ss, word [edi]
jns 0x422b8c
mov dl, 0x86
scasd eax, dword es:[edi]
jb 0x422ba3
or byte [ebx + esi*2 - 0x17ec8bf5], ah
lea eax, [ebp - 0x7223a275]
inc ebp
loopne 0x422c71
movsb byte es:[edi], byte [esi]
jae 0x422c20
je 0x422c2a
call 0x5dcdb1a9
fmul qword [ebp + 0x5350e045]
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
in al, 1
je 0x422c3b
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
call fcn.0042ab6b
test al, al
je 0x422c5f
push esi
xchg byte [esi], cl
out 0xe5, al
and bh, 0xef
jp 0x422bda
cmp dword [ebx], eax
mov byte [ebp + 0x75d313ea], ch
pop ebp
popal
cmc
lahf
or al, 0xf4
mov eax, dword [0xaee8d96a]
jge 0x422c63
call fcn.0042aa12
test al, al
je 0x422c86
add byte [eax + eax*8 - 0x5cabe18c], al
invalid
push esp
mov dword [0x7cff9db], eax
frstor dword [esi - 0x44]
and eax, 0x5f359ebf
rol dword [ebp + 0x7a2bd90a], 1
wait
test eax, 0x4db7ee74
salc
mov bl, 0xa5
insd dword es:[edi], dx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
Function at 0x422cad
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push edi
mov dword [ebp - 0x24], eax
call fcn.00422b59
test al, al
jne 0x422ce3
push edi
push 0x7d
call fcn.00413331
pop ecx
pop ecx
xor eax, eax
jmp 0x422d98
call fcn.0042ae1d
test al, al
je 0x422cfd
mov dh, 0x39
hlt
mov ecx, dword [ebp - 0x24]
push edi
call fcn.004229d0
test al, al
jne 0x422d0f
push edi
push 0x7e
jmp 0x422cd5
call fcn.0042a8b9
test al, al
je 0x422d28
pop es
bound eax, qword [edi]
mov ss, ecx
mov ch, 0xaa
wait
idiv dword [edx]
ret 0xd6e5
lea eax, [ebp - 0x20]
xor edi, edi
push eax
push 0xf003f
push edi
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionSvchost
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422d95
mov esi, str.LocalWorkSvc
mov dword [ebp - 8], 7
push esi
mov dword [ebp - 0xc], edi
mov word [ebp - 0x1c], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.00403772
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00403628
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret 4
Function at 0x422dab
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.0042ab6b
test al, al
je 0x422dd9
sub al, 0x99
daa
outsb dx, byte [esi]
and dword [eax - 0x47], ecx
dec edi
pop ebp
call 0x2ee805f
int 0x50
mov ecx, 0x6220c123
or eax, 0xe81c066a
xor al, 0x7c
add byte [eax], al
call fcn.0042aa12
test al, al
je 0x422e00
pop esi
jns 0x422e34
xchg byte [esi - 0x3f6eaa9a], dl
sbb cl, byte [ebx - 0x1c]
dec eax
xchg edi, eax
dec edi
test al, 0xa6
pop edi
pop ds
add ch, byte [eax + 0x56]
mov ch, 0xa1
or bh, 0xd2
add al, 0x16
enter 0x75ff, 8
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0040374b
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x79
call fcn.00413331
mov ecx, dword [ebp - 4]
add esp, 0xc
push dword [ebp + 0xc]
inc eax
or esi, edi
invalid
or al, 0xff
jne 0x422e2d
call fcn.00422cad
test eax, eax
setne byte [ebp + 0xb]
call fcn.0042ae62
test al, al
xor dword [eax - 0x3f7c0000], eax
je 0x422e46
adc dword [edi], ecx
sahf
movsb byte es:[edi], byte [esi]
adc edi, dword [edx - 0x38]
jnp 0x422dfd
setle byte [ebx + edx - 0x3f843786]
jecxz 0x422ebb
mov cl, 0x9d
not dword [edx - 0x1792c929]
and byte [ebp], bh
add byte [eax + eax*8 - 0x4984e08c], al
call fcn.0042ab6b
test al, al
je 0x422e6e
jnp 0x422e07
sub edi, dword [0xc6f88306]
pushfd
jno 0x422e5e
and al, byte [ebx - 0x3e152855]
push 0x59
xor eax, 0xdb96e12e
cwde
aas
dec ebp
jp 0x422e83
ljmp 0xe12e:0x35596ac1
mov eax, gs
adc eax, 0x8400007b
sal byte [esi + edx - 0x6e], 0xb4
push esi
call fcn.0042a988
test al, al
je 0x422e8d
xchg edx, eax
mov ah, 0x56
add dl, 0x2a
out dx, al
cmp eax, 0x70e20b89
xchg ebx, eax
jecxz 0x422e1d
xor byte [0xafb4fa64], ah
cmp byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
jne 0x422ea2
push 0xa2
call fcn.00413331
pop ecx
xor eax, eax
jmp 0x422ea5
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
add byte [ebx], dh
lds ecx, [ecx + 0x5653fc45]
Function at 0x422eae
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x210], ebx
call fcn.0056f390
add esp, 0xc
call fcn.0042aea7
test al, al
je 0x422f0d
add byte [eax - 0x77], dl
popfd
invalid
inc edi
cmc
pop es
sbb al, 4
xor al, 0x7e
jae 0x422ed2
dec edi
inc eax
pop ebp
xor eax, 0x68db53a0
bound ebx, qword [edx]
aam 0x79
and dh, bl
xor eax, 0x8b12ca73
popfd
invalid
push 0
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x422f32
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00423126
call fcn.0042af76
test al, al
je 0x422f56
popfd
mov edx, 0xb945c067
sub eax, 0xbbd35f18
and eax, 0x32f0264c
xor dword [edx], ebp
out dx, al
clc
adc eax, 0x9bce1f2d
dec edx
shr byte [edx], cl
push 0
push 0x19
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x422f7f
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00423126
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret

Function at 0x422f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x210], ebx
call fcn.0056f390
add esp, 0xc
call fcn.0042a9cd
test al, al
je 0x422fec
pushfd
jno 0x422f54
cmp eax, 0x12442d5f
sbb byte [edi + 0x1bc0c05a], bh
push esp
or edx, dword [esp + ebp*8]
mov ebx, 0xddc22531
sahf
add ecx, dword [ebx - 0x20f63]
jmp [edx]
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x423024
lea eax, [ebp - 0x20c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.00578f16
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00423126
call fcn.0042ab6b
test al, al
je 0x42304c
push 0xc88fd50
sbb al, 8
and dh, byte [edx]
retf
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x42305d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
push 0
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0042ae1d
test al, al
je 0x4230bb
ficomp word [ecx - 0x3a14fcad]
dec byte cs:[ebp + 0x68]
je 0x42305e
salc
insd dword es:[edi], dx
loop 0x423078
call fcn.0042ab6b
test al, al
je 0x4230db
push 0x6adc1cb1
dec ebx
sub eax, 0xf7699616
stc
aas
rcl dword [ecx + 0x6c8a2f95]
inc eax
ficomp word [ebp - 0x18]
ja 0x423157
call fcn.0042aa57
add byte [eax], al
test al, al
je 0x423103
mov eax, dword [0x3ebd97a1]
pop esi
inc edx
call 0xc17dbe0a
invalid
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00423126
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
fstp dword [edx - 2]
invalid

Function at 0x42305e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
push 0
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0042ae1d
test al, al
je 0x4230bb
ficomp word [ecx - 0x3a14fcad]
dec byte cs:[ebp + 0x68]
je 0x42305e
salc
insd dword es:[edi], dx
loop 0x423078
call fcn.0042ab6b
test al, al
je 0x4230db
push 0x6adc1cb1
dec ebx
sub eax, 0xf7699616
stc
aas
rcl dword [ecx + 0x6c8a2f95]
inc eax
ficomp word [ebp - 0x18]
ja 0x423157
call fcn.0042aa57
add byte [eax], al
test al, al
je 0x423103
mov eax, dword [0x3ebd97a1]
pop esi
inc edx
call 0xc17dbe0a
invalid
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00423126
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
fstp dword [edx - 2]
invalid
Function at 0x423240
Capabilities:
Get common file path

Disassembly:
push 0x430
mov eax, 0x59dc6f
call fcn.005693c7
mov ebx, ecx
mov dword [ebp - 0x43c], ebx
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
xor edi, edi
push edi
push eax
call fcn.0056f390
push esi
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.0056f390
add esp, 0x18
call fcn.0042aea7
test al, al
je 0x4232aa
iretd
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x218]
push edi
je 0x4232bb
push 0x17
jmp 0x4232bd
push 2
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x423361
xor eax, eax
mov dword [ebp - 0x424], 7
mov esi, 0x5a49e8
mov dword [ebp - 0x428], edi
push esi
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov dword [ebp - 4], edi
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x5a373c
push eax
call fcn.00408d5e
push ecx
push ecx
lea eax, [ebp - 0x420]
mov ecx, esp
push eax
call fcn.00402ac4
mov ecx, ebx
call fcn.00423777
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
push 1
lea ecx, [ebp - 0x438]
call fcn.00403628
call fcn.00569382
ret 4

Function at 0x423369
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
push 0
push eax
call fcn.0056f390
add esp, 0xc
call fcn.0042aae1
test al, al
je 0x4233b5
adc byte [ebx - 0xe77ee13], 0xea
and esi, ebp
cmp dword [ebp + 0x7b5deb15], ebp
jnp 0x423423
call fcn.0042aa57
test al, al
je 0x4233d4
pushal
fsubr qword [edx + 0x13]
jae 0x423413
pop ecx
adc bl, ch
xchg ebx, eax
pop es
or cl, byte [edx]
sub esi, eax
xor eax, 0x99bdba48
wait
push eax
push 0
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x423422
call fcn.0042aea7
test al, al
je 0x423410
inc ebp
inc esp
inc edi
pop esp
inc edx
mov dh, 0x30
out 1, al
das
out dx, al
loopne 0x423425
dec esp
mov edx, 0xcd3c78d7
adc byte [ebx + edi*4 - 0x47b2b4c5], al
int 0xd1
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00423126
std
invalid
mov ecx, dword [ebp - 4]
dec ebp
cld
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x423433
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.0042af76
test al, al
je 0x423459
invalid
call fcn.0042aeec
test al, al
je 0x42347d
adc ebx, ebp
pop edx
sbb eax, 0xdea7a58b
xor al, 0x4b
mov bl, byte [esi - 7]
pop es
mov dl, 0x4b
scasb al, byte es:[edi]
cmp dword [ebp - 0x3e], esp
push edi
add byte [ebx + 0x3f], bh
cmp eax, 0x7a25e8e6
add byte [eax], al
call fcn.0042aea7
test al, al
je 0x42349f
dec eax
aad 0xe0
in eax, dx
movsd dword es:[edi], dword [esi]
mov al, byte [0x253c4690]
mov ebx, 0xfc3c587e
lds edi, [edx + 0x657891e2]
pop ds
and eax, 0x5d8b69b1
cld
mov ebx, dword [ebp - 4]
mov ecx, ebx
push 0
call int.00423240
push 1
mov ecx, ebx
call int.00423240
call fcn.0042aea7
test al, al
je 0x4234dc
and eax, 0xbf9b330b
jns 0x423539
cmc
mov ah, 6
pop edx
popfd
inc ebp
test dword [eax], esp
mov al, 0xd8
sbb al, 0xfe
or dh, byte [ecx + 0xb6b613b]
leave
push edi
mov byte [ebx - 0x347403a3], cl
mov ecx, ebx
call fcn.00422eae
mov ecx, ebx
call fcn.00423369
mov ecx, ebx
call fcn.0042305d
call fcn.0042af76
test al, al
je 0x423518
add eax, 0xf9d6b972
mov edi, 0x947400eb
out dx, al
and eax, 0x904eaae6
xchg esi, eax
outsb dx, byte [esi]
leave
sub ebx, dword [eax + 0x48ceb548]
fst dword [eax - 0x7403a275]
retf
mov ecx, ebx
call fcn.00422f90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret