joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b780
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x57d088
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
lea esi, [eax + eax*4]
add esi, esi
mov edx, dword [esi + esi + 0x5e0060]
mov ecx, dword [esi + esi + 0x5e005c]
add esi, esi
lea eax, [esp + 0x24]
push eax
call fcn.0041a440
add esp, 4
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
jne 0x41b811
or edi, 0xffffffff
mov dword [esp + 0x1c], edi
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x41b7fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, 0x5c
lea ebx, [esp + 0x24]
call fcn.004149d0
mov ecx, ebx
mov ebx, dword [esi + 0x5e0064]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0041a8a0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b862
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x24]
je 0x41b7e3
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x41b88b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x41b8a0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push esi
xor eax, eax
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocStringLen
push ebx
push ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebx
je 0x41b915
push ebp
push edi
push 4
push str.kxescore
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
cmp edi, ebx
je 0x41b910
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41b90d
cmp dword [esp + 0x14], 4
jne 0x41b90d
mov bl, 1
push edi
call ebp
push esi
call ebp
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
add esp, 0x1c
ret
Function at 0x41b920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0x2001f
push 0
push str.SOFTWAREkingsoftKWifi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [edi], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b99b
push esi
mov esi, dword [esp + 4]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
push 0
push str.installtime
push esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b989
cmp dword [esp + 0x10], 4
je 0x41b9a1
test esi, esi
je 0x41b994
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
add esp, 0x10
ret
xor al, al
add esp, 0x10
ret
test esi, esi
mov ecx, dword [esp + 8]
mov dword [edi], ecx
je 0x41b9b2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
add esp, 0x10
ret

Function at 0x41b9c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SOFTWAREkingsoftKwifiKSetting
push reloc.OLEAUT32.dll_SysReAllocString
mov bl, 1
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ba42
mov eax, dword [esp + 4]
push esi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.nolancard
push eax
mov esi, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41ba36
cmp dword [esp + 0x14], 4
jne 0x41ba36
cmp dword [esp + 0xc], 1
jne 0x41ba36
xor bl, bl
test esi, esi
je 0x41ba41
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
add esp, 0x10
ret
Function at 0x41ba90
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x57c008
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
mov dword [esp + 0x18], esi
mov edx, dword [esi + 0x5e0060]
mov ecx, dword [esi + 0x5e005c]
lea eax, [esp + 0x14]
push eax
call fcn.0041a440
add esp, 4
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jne 0x41bb08
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x41bb87
lea ecx, [esp + 0x14]
push ecx
call fcn.0041bee0
mov eax, 0x5c
lea ebx, [esp + 0x14]
call fcn.004149d0
mov edx, ebx
mov ebx, dword [esi + 0x5e0064]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0041a8a0
mov eax, dword [eax]
add esp, 8
push eax
call ebp
mov edi, eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bb5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x41bb6b
mov ecx, dword [esi + 0x5e0068]
or dword [esp + 0x18], ecx
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41bb93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0x14
cmp esi, 0xf0
jb 0x41bac3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x41bbc0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5758b1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov edx, str.Install_Path
mov ecx, str.SOFTWAREkingsoft_shoujizhushou
mov dword [esp + 0x18], ebx
mov byte [esp + 0x13], bl
call fcn.0041a440
add esp, 4
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], ebx
jne 0x41bc4b
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bc37
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
mov eax, 0x5c
lea ebx, [esp + 0x10]
call fcn.004149d0
mov ecx, ebx
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, str.krapidservice.dll
call fcn.0041a8a0
add esp, 8
mov byte [esp + 0x28], 1
mov eax, dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, 1
push eax
mov dword [esp + 0x18], ebx
call esi
test eax, eax
je 0x41bcb5
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, str.krapidtrans.dll
call fcn.0041a8a0
mov eax, dword [eax]
add esp, 8
push eax
mov ebx, 3
call esi
test eax, eax
mov byte [esp + 0xe], 1
jne 0x41bcba
mov byte [esp + 0xe], 0
test bl, 2
je 0x41bce6
mov eax, dword [esp + 0x18]
and ebx, 0xfffffffd
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41bce6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, 1
mov dword [esp + 0x28], 0
je 0x41bd13
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bd13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0xe], 0
je 0x41bd71
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, str._appdataphonecfg.dat
call fcn.0041a8a0
mov eax, dword [eax]
add esp, 8
push eax
push 0
push 0x58de60
push str.LBWifi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
mov eax, dword [esp + 0x1c]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bd6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
mov bl, 1
jne 0x41bd75
mov bl, byte [esp + 0xf]
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bd9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x41bdc0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x57d5fa
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5d7050]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
call fcn.00413cc0
xor edi, edi
lea ebx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.004125d0
push eax
lea ecx, [esp + 0x14]
push ecx
mov ebx, str.kwifi.ini
mov byte [esp + 0x38], 1
call fcn.0041a8a0
add esp, 8
mov byte [esp + 0x30], 2
mov eax, dword [eax]
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00413e50
mov esi, eax
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41be56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x30], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41be7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x41beb0
lea ecx, [esp + 0x18]
push ecx
call fcn.00414860
lea edx, [esp + 0x18]
test eax, eax
push edx
setne bl
mov dword [esp + 0x34], edi
call fcn.00413d40
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x34], edi
call fcn.00413d40
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x4227d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x4227df
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x4228c7
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x58b1e0]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58b1e0]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x58b1e0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58b1e0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58b1e0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58b1e0]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58b1e0]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x58b1e0]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x4227f0
pop ebp
test edi, edi
je 0x4228ec
jmp 0x4228d0
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x58b1e0]
add ecx, 1
sub edi, 1
jne 0x4228d0
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x422900
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x58b1e0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x58b1e0]
mov dword [edx + 8], ecx
ret

Function at 0x422950
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
xor al, bl
movzx ebx, al
xor ebx, edx
shr edx, 8
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x58b1e0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
add edx, 1
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x58b1e0]
pop ebx
mov dword [esi + 8], ecx
ret

Function at 0x423140
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x423172
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x423168
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x423185
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call sub.MSVCR80.dll_memcpy
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x423350
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x423395
cmp byte [esi + 1], 0
je 0x42339d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x4233b2
cmp byte [esi + 1], 0
je 0x4233a4
mov eax, dword [esi + 4]
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, dword [esi + 0xc]
mov ebp, eax
mov dword [esp + 4], ebp
jmp 0x4233bb
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x42336e
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x4233bb
mov edx, dword [esi + 0x1c]
mov dword [esp + 4], edx
mov ebp, edx
push edi
mov edi, 0xffff
cmp ebp, edi
mov dword [esp + 0xc], edi
jae 0x4233cf
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4233ee
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
cmp edi, eax
mov dword [esp + 0x18], 0xffffffff
jbe 0x423513
jmp 0x42341c
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
cmp eax, edi
mov dword [esp + 0x14], edi
ja 0x42342d
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
cmp ebp, 0x404
mov dword [esp + 0x20], eax
jbe 0x423446
mov ebp, 0x404
cmp byte [esi], 0
je 0x42346b
cmp byte [esi + 1], 0
je 0x423513
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x42346e
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x423496
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x423490
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x4234bc
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x4234a7
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x423513
lea eax, [ebp - 3]
test eax, eax
jl 0x4234fe
lea esp, [esp]
sub eax, 1
cmp byte [eax + ebx], 0x50
jne 0x4234ee
cmp byte [eax + ebx + 1], 0x4b
jne 0x4234ee
cmp byte [eax + ebx + 2], 5
jne 0x4234ee
cmp byte [eax + ebx + 3], 6
je 0x4234f4
test eax, eax
jge 0x4234d0
jmp 0x4234fe
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x423513
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x423410
push ebx
call dword [sym.imp.MSVCR80.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x423c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
cmp ebp, ebx
jne 0x423c5a
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [ebp + 0x18], ebx
je 0x423c4f
cmp dword [ebp + 0x7c], ebx
je 0x423c6d
mov ebx, ebp
call fcn.00424030
xor ebx, ebx
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
mov edi, ebp
call fcn.00423a60
add esp, 0xc
test eax, eax
je 0x423c97
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push esi
mov esi, dword [sym.imp.MSVCR80.dll_malloc]
push 0x84
call esi
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x423cd9
push 0x4000
call esi
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
mov dword [edi], eax
mov dword [edi + 0x44], ecx
mov dword [edi + 0x48], edx
mov dword [edi + 0x4c], ebx
jne 0x423ce6
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
mov dword [edi + 0x40], ebx
mov ecx, dword [ebp + 0x3c]
xor eax, eax
cmp dword [ebp + 0x34], ebx
mov dword [edi + 0x54], ecx
mov dword [edi + 0x50], ebx
mov edx, dword [ebp + 0x34]
sete al
mov dword [edi + 0x64], edx
mov ecx, dword [ebp]
mov dword [edi + 0x60], ecx
mov edx, dword [ebp + 0xc]
mov dword [edi + 0x68], edx
mov dword [edi + 0x18], ebx
cmp eax, ebx
jne 0x423d2f
lea esi, [edi + 4]
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
call fcn.00422bc0
test eax, eax
jne 0x423d2f
mov dword [edi + 0x40], 1
mov eax, dword [ebp + 0x40]
mov dword [edi + 0x58], eax
mov ecx, dword [ebp + 0x44]
mov dword [edi + 0x5c], ecx
mov dl, byte [ebp + 0x30]
and dl, 1
mov byte [edi + 0x6c], dl
mov eax, dword [ebp + 0x30]
shr eax, 3
test al, 1
je 0x423d59
mov cl, byte [ebp + 0x39]
mov byte [edi + 0x80], cl
jmp 0x423d62
mov dl, byte [ebp + 0x3f]
mov byte [edi + 0x80], dl
mov al, byte [edi + 0x6c]
mov esi, dword [esp + 0x20]
neg al
lea edx, [edi + 0x70]
mov dword [edx], 0x12345678
mov dword [edi + 0x74], 0x23456789
mov dword [edi + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp esi, ebx
mov dword [edi + 0x7c], eax
je 0x423da0
mov edi, edi
mov cl, byte [esi]
cmp cl, bl
je 0x423da0
call fcn.00422900
add esi, 1
jne 0x423d90
mov ecx, dword [ebp + 0x78]
mov edx, dword [esp + 0x14]
lea eax, [ecx + edx + 0x1e]
mov dword [edi + 0x3c], eax
mov dword [edi + 8], ebx
pop esi
mov dword [ebp + 0x7c], edi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x424120
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [esi], 0
push ebp
mov ebp, dword [esp + 0x10]
push edi
jne 0x4241e6
cmp dword [esi + 4], 0xffffffff
jne 0x4241e6
lea edi, [esi + 0x244]
push edi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x424151
sub eax, edx
sar eax, 1
movzx ecx, word [esi + eax*2 + 0x242]
cmp cx, 0x5c
je 0x424188
cmp cx, 0x2f
je 0x424188
mov word [esi + eax*2 + 0x244], 0x2f
mov word [esi + eax*2 + 0x246], 0
cmp ebp, 1
jne 0x4241a9
push ebp
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4241a9
mov eax, 0x2000000
pop edi
pop ebp
pop ecx
ret 8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ebp
push ecx
push ebx
call fcn.00423020
add esp, 0x10
test eax, eax
jne 0x4241cb
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ecx
ret 8
call fcn.00423530
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
pop ebp
pop ecx
ret 8
pop edi
mov eax, 0x1000000
pop ebp
pop ecx
ret 8
Function at 0x4247b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x414
mov eax, dword [0x5d7050]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x41c]
push ebp
xor ebp, ebp
cmp ebx, ebp
push edi
mov edi, dword [esp + 0x428]
je 0x42484c
push 0x104
lea eax, [esp + 0x218]
push ebx
push eax
call dword [sym.imp.MSVCR80.dll_wcsncpy]
lea eax, [esp + 0x220]
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x424800
sub eax, edx
sar eax, 1
je 0x42482a
lea ecx, [esp + eax*2 + 0x212]
movzx eax, word [ecx]
cmp ax, 0x2f
je 0x424827
cmp ax, 0x5c
jne 0x42482a
mov word [ecx], bp
lea ecx, [esp + 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42484c
push ebp
lea edx, [esp + 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [edi]
cmp ax, bp
je 0x42492a
mov ecx, edi
mov edx, edi
movzx eax, ax
nop
cmp ax, 0x2f
je 0x42486c
cmp ax, 0x5c
jne 0x42486e
mov ecx, edx
movzx eax, word [edx + 2]
add edx, 2
cmp ax, bp
jne 0x424860
cmp ecx, edi
je 0x4248b0
sub ecx, edi
sar ecx, 1
push esi
add ecx, ecx
mov esi, ecx
push esi
lea eax, [esp + 0x21c]
push edi
push eax
call sub.MSVCR80.dll_memcpy
lea ecx, [esp + 0x224]
push ecx
push ebx
mov word [esp + esi + 0x22c], bp
call fcn.004247b0
add esp, 0x14
pop esi
cmp ebx, ebp
mov word [esp + 0xc], bp
je 0x4248cd
push 0x104
lea edx, [esp + 0x10]
push ebx
push edx
call dword [sym.imp.MSVCR80.dll_wcsncpy]
add esp, 0xc
lea eax, [esp + 0xc]
mov word [esp + 0x212], bp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4248e0
sub eax, edx
sar eax, 1
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax*2 + 0x10]
push edi
push edx
call dword [sym.imp.MSVCR80.dll_wcsncpy]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov word [esp + 0x216], bp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42492a
push ebp
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x41c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00569ed6
add esp, 0x414
ret