joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e8a50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6e8a58
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6e8c0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6e8c28
call fcn.0040b134
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0x1c]
call fcn.006e672c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6e8c3c
call fcn.0069726c
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6e8ad3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6e8b14
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.006e672c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6e8ca4
call fcn.0069726c
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b0dc
mov eax, esi
mov edx, 0x6e8cd0
call fcn.0040b0dc
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6e8b2c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6e8b9a
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6e8ce4
call fcn.0069726c
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b0dc
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6e8b63
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6e8b8e
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6e8d14
call fcn.0069726c
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b0dc
mov eax, esi
mov edx, 0x6e8cd0
call fcn.0040b0dc
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6e8ba6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6e8bd1
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6e8d40
call fcn.0069726c
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b0dc
mov eax, esi
mov edx, 0x6e8cd0
call fcn.0040b0dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e8c14
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00409ff0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409ff0
lea eax, [ebp - 4]
call fcn.00409f90
ret
Function at 0x70dbac
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
add ebx, ebx
inc ebx
test ebx, ebx
js 0x70dbca
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x70dbc3
mov edx, esp
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x70dc19
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, esi
mov ecx, edi
mov eax, ebx
call fcn.004286c4
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70dc20
lea eax, [ebp - 4]
call fcn.00409f90
ret

Function at 0x70faac
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x70fb6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.005030dc
test al, al
je 0x70fb4e
mov eax, dword [ebp - 0x24]
inc eax
mov edx, eax
add edx, edx
lea eax, [ebp - 4]
call fcn.0040b05c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x70fb4e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
add eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aec8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x70fb4a
mov eax, dword [ebp - 4]
call fcn.0040aec8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040af30
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x70fb01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70fb73
lea eax, [ebp - 0x2c]
call fcn.00409f90
lea eax, [ebp - 4]
call fcn.00409f90
ret
Function at 0x70fb84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x70fc3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.005030dc
test al, al
je 0x70fc1c
mov edx, dword [ebp - 0x1c]
inc edx
lea eax, [ebp - 4]
call fcn.0040b05c
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x70fc1c
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aec8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueW_1
mov eax, dword [ebp - 4]
call fcn.0040aec8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040af30
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x70fbd5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70fc41
lea eax, [ebp - 0x2c]
call fcn.00409f90
lea eax, [ebp - 4]
call fcn.00409f90
ret

Function at 0x70fc48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x70fd3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409f90
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.0040afd4
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.007103d4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
shr eax, 1
test eax, eax
jbe 0x70fd17
mov edx, eax
mov eax, ebx
call fcn.0040b05c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040aec8
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.0040aec8
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x70fd17
lea edx, [ebp - 0x10]
mov eax, dword [ebx]
call fcn.00425c48
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0040a370
mov eax, dword [ebp - 4]
dec eax
sub eax, 2
jb 0x70fd17
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0x11
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x79bbd0]
call fcn.0040e210
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x501628]
call fcn.0042cdcc
call fcn.00409610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70fd44
lea eax, [ebp - 0x1c]
call fcn.00409f90
lea eax, [ebp - 0x10]
call fcn.00409f90
lea eax, [ebp - 0xc]
call fcn.00409fd8
ret
Function at 0x7106ec
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x71088e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov ecx, esi
mov eax, dword [ebp - 0xc]
call fcn.00710d5c
test al, al
je 0x71086b
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040a3b8
mov eax, dword [ebp - 4]
call fcn.0070eb4c
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x710759
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b34c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00503b28
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x71082e
xor eax, eax
push ebp
push 0x710827
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00502adc
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.005030dc
test al, al
je 0x710805
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a118
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x710805
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040aec8
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x7107ff
mov eax, dword [ebp - 8]
call fcn.0040aec8
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040af30
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.007106ec
dec ebx
cmp ebx, 0xffffffff
jne 0x7107b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x71082e
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00502adc
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ebx, dword [0x795ecc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, dword [0x795ec8]
jbe 0x710848
mov ebx, dword [0x795ec8]
push 0
push ebx
mov eax, dword [ebp - 4]
call fcn.0040aec8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00502ac8
push eax
call fcn.0070ec6c
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x710895
lea eax, [ebp - 0x3c]
call fcn.00409f90
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409ff0
ret
Function at 0x710980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, esi
dec eax
sub eax, 2
jb 0x7109aa
mov ecx, 0x741
mov edx, 0x7109f8
mov eax, 0x710ad4
call fcn.00409ddc
mov eax, dword [ebp + 8]
test eax, eax
je 0x7109b8
sub eax, 4
mov eax, dword [eax]
shr eax, 1
inc eax
mov edi, eax
add edi, edi
push edi
mov eax, dword [ebp + 8]
call fcn.0040ac70
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.0040ac70
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x710b40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 8
push 0
push 0
dec ecx
jne 0x710b49
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov esi, edx
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x710cc9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0040dbf8
lea eax, [ebp - 4]
call fcn.0040dbf8
push eax
push 0x710cdc
push 4
push 0
mov eax, dword [str.i_b1_]
push eax
call sub.ole32.dll_CoCreateInstance
cmp dword [ebp - 4], 0
je 0x710c8c
mov dword [ebp - 0x1c], edi
fild dword [ebp - 0x1c]
fdiv dword [0x710cec]
call fcn.00407204
mov ecx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp + 0x10]
call fcn.0040a118
lea eax, [ebp - 0x20]
push eax
cmp byte [ebp + 8], 1
cmc
sbb eax, eax
push eax
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.0040afd4
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
call fcn.0040afd4
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
mov edx, esi
call fcn.0040afd4
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
call fcn.0040dd94
cmp word [ebp - 0x20], 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0xc]
mov edx, 0x710cfc
call fcn.0040a3b8
push esi
push 0x710d3c
lea ecx, [ebp - 0x30]
mov dl, 1
mov eax, ebx
call fcn.00426ae0
push dword [ebp - 0x30]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040b1bc
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0x11
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0x11
lea edx, [ebp - 0x44]
mov ecx, 1
mov eax, 0x710d50
call fcn.004286c4
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
call fcn.0040aec8
push eax
call sub.kernel32.dll_OutputDebugStringW
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040b05c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x710cd0
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00409ff0
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040a050
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00409ff0
lea eax, [ebp - 4]
call fcn.0040dbf8
ret
Function at 0x71a350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x71a359
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x71a4b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push 0x71a4c4
call sub.kernel32.dll_CreateFileW_1
mov edi, eax
cmp edi, 0xffffffff
je 0x71a481
lea eax, [ebp - 4]
call fcn.00409fb4
test bl, bl
je 0x71a3f2
call fcn.0042a2d0
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 8]
mov eax, dword [0x79c3d0]
call fcn.0042b25c
push 0x71a530
push dword [ebp - 8]
push 0x71a540
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040b1bc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040ab78
cmp byte [ebp - 9], 0
je 0x71a42a
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.0040afa0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00406b1c
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040b0dc
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 0
call fcn.0040ab78
cmp dword [ebp - 4], 0
je 0x71a43d
lea eax, [ebp - 4]
mov edx, 0x71a558
call fcn.0040a818
lea eax, [ebp - 0x28]
mov edx, esi
mov ecx, 0
call fcn.0040ab78
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.0040a818
lea eax, [ebp - 4]
call fcn.0040a558
mov edx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x71a46d
sub eax, 4
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
push edx
push edi
call sub.kernel32.dll_WriteFile_1
push edi
call sub.kernel32.dll_CloseHandle_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x71a4bb
lea eax, [ebp - 0x28]
call fcn.00409fb4
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00409ff0
lea eax, [ebp - 8]
call fcn.00409f90
lea eax, [ebp - 4]
call fcn.00409fb4
ret
Function at 0x725ff4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00725f1c
add esp, 0xc
test eax, eax
je 0x726051
push 0
lea edx, [ebp - 0x10]
push edx
push 8
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0x7405c
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x726051
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0072d2f6
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, 1
jmp 0x726053
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x726af8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov esi, eax
test esi, esi
jne 0x726b25
xor eax, eax
jmp 0x726bb5
cmp word [ebp + esi*2 - 0x20e], 0x5c
jne 0x726b47
push 0x3d6
push 0x797d16
push 0x797cf4
call fcn.00724ad4
add esp, 0xc
test edi, edi
je 0x726b54
push edi
call fcn.00724c48
pop ecx
jmp 0x726b56
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, esi
add edx, edx
add edx, 4
push edx
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x726b74
xor eax, eax
jmp 0x726bb5
mov edx, esi
lea ecx, [ebp - 0x20c]
add edx, edx
push edx
push ecx
push ebx
call fcn.00724bdc
add esp, 0xc
test edi, edi
je 0x726bad
mov word [ebx + esi*2], 0x5c
inc esi
mov eax, dword [ebp - 4]
mov edx, esi
add eax, eax
add edx, edx
push eax
push edi
add edx, ebx
push edx
call fcn.00724bdc
add esp, 0xc
add esi, dword [ebp - 4]
mov word [ebx + esi*2], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7277f8
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa14
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
or esi, 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x72781a
mov eax, dword [ebp + 0xc]
mov word [eax], 0
push 0
lea edx, [ebp - 0x2d4]
push 0x64
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00726d38
add esp, 0x10
test eax, eax
je 0x72796c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebx, eax
call sub.kernel32.dll_GetLastError_2
test eax, eax
jne 0x72796c
add ebx, 5
lea eax, [ebx + 9]
cmp eax, 0x104
jbe 0x727875
push 0x54f
call sub.kernel32.dll_SetLastError
jmp 0x72796c
push str.infoem.inf
lea edx, [ebp - 0x20c]
push edx
call fcn.00725138
add esp, 8
lea ecx, [ebp - 0x5ec]
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
cmp esi, 0xffffffff
je 0x72796c
lea eax, [ebp - 0x5c0]
push eax
call fcn.00724c48
pop ecx
mov edi, eax
lea eax, [edi + ebx]
inc eax
cmp eax, 0x104
ja 0x727957
mov edx, edi
mov eax, ebx
add edx, edx
lea ecx, [ebp - 0x5c0]
add edx, 2
add eax, eax
push edx
lea edx, [ebp - 0x20c]
add eax, edx
push ecx
push eax
call fcn.00724bdc
add esp, 0xc
lea ecx, [ebp - 0x39c]
lea eax, [ebp - 0x20c]
push 0
push 0x64
push ecx
push eax
call fcn.00726d38
add esp, 0x10
test eax, eax
je 0x727957
lea edx, [ebp - 0x39c]
push edx
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00724e48
add esp, 8
test eax, eax
jne 0x727957
lea eax, [edi + ebx + 1]
cmp eax, dword [ebp + 0x10]
jbe 0x727933
push 0x7a
call sub.kernel32.dll_SetLastError
jmp 0x72796c
add edi, ebx
lea eax, [ebp - 0x20c]
add edi, edi
add edi, 2
push edi
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.00724bdc
mov dword [ebp - 4], 1
add esp, 0xc
jmp 0x72796c
lea ecx, [ebp - 0x5ec]
push ecx
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x7278a7
cmp esi, 0xffffffff
je 0x727978
push esi
call fcn.00728474
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x727984
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
xor esi, esi
push 0x5c
push edi
call fcn.00725178
add esp, 8
add eax, 2
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00724fcc
add esp, 8
push 0x2e
lea edx, [ebp - 0x64]
push edx
call fcn.00725178
mov word [eax], 0
add esp, 8
lea ecx, [ebp - 0xc8]
lea eax, [ebp - 0x64]
push 0
push 0x32
push ecx
push 0
push ebx
push eax
call fcn.007285e0
test eax, eax
jne 0x727a86
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x727a20
push 1
call sub.kernel32.dll_GetLastError_2
push eax
push 0x797f5a
call fcn.0072d860
add esp, 8
push eax
push 0x86a
push 0x797f30
push 0x797f24
push 1
call fcn.0072d754
jmp 0x727b36
cmp dword [ebp + 0x14], 0
je 0x727a73
push 0
lea edx, [ebp - 0xc8]
push 0x32
push edx
push ebx
lea ecx, [ebp - 0x64]
push ecx
call fcn.007284bc
add esp, 0x14
test eax, eax
jne 0x727a86
push 1
call sub.kernel32.dll_GetLastError_2
push eax
push 0x797f96
call fcn.0072d860
add esp, 8
push eax
push 0x87b
push 0x797f6c
push 0x797f60
push 1
call fcn.0072d754
jmp 0x727b36
lea eax, [ebp - 0x64]
push eax
lea edx, [ebp - 0xc8]
push edx
call fcn.00724fcc
add esp, 8
cmp dword [ebp + 8], 0
je 0x727ae7
mov ecx, dword [ebp + 0x1c]
push ecx
mov eax, dword [ebp + 0x18]
push eax
push 0
push 0
push 1
push 1
push 1
push 0
mov edx, dword [ebp + 0x14]
push edx
push edi
push ebx
lea ecx, [ebp - 0xc8]
push ecx
call fcn.007260a4
add esp, 0x30
test eax, eax
jne 0x727b31
push 1
call sub.kernel32.dll_GetLastError_2
push eax
push 0x797fd2
call fcn.0072d860
add esp, 8
push eax
push 0x894
push 0x797fa8
push 0x797f9c
push 1
call fcn.0072d754
jmp 0x727b36
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xc8]
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push ecx
call fcn.007266c8
add esp, 0x10
test eax, eax
jne 0x727b31
push 1
call sub.kernel32.dll_GetLastError_2
push eax
push 0x79800e
call fcn.0072d860
add esp, 8
push eax
push 0x89f
push 0x797fe4
push 0x797fd8
push 1
call fcn.0072d754
jmp 0x727b36
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x727b40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
push esi
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebx, eax
test ebx, ebx
jbe 0x727b6e
lea eax, [ebx + 0xa]
cmp esi, eax
jae 0x727b85
push 0x8d1
push 0x798056
push str.pathLength___0__pathLength__sizeof__SysWOW64_____bufferSize
call fcn.00724ad4
add esp, 0xc
push str.SysWOW64
lea edx, [ebp - 0x208]
push edx
call fcn.00725138
add esp, 8
add ebx, 9
test ebx, ebx
jbe 0x727ba4
cmp esi, ebx
ja 0x727bbb
push 0x8d6
push 0x7980be
push str.pathLength___0__pathLength___bufferSize
call fcn.00724ad4
add esp, 0xc
test edi, edi
je 0x727bc8
push edi
call fcn.00724c48
pop ecx
jmp 0x727bca
xor eax, eax
add eax, ebx
add eax, eax
add eax, 4
push eax
call fcn.00724b84
pop ecx
mov ebx, eax
test ebx, ebx
je 0x727c0a
lea edx, [ebp - 0x208]
push edx
push ebx
call fcn.00724fcc
add esp, 8
test edi, edi
je 0x727c0a
push 0x7980e8
push ebx
call fcn.00725138
add esp, 8
push edi
push ebx
call fcn.00725138
add esp, 8
call sub.kernel32.dll_GetLastError_2
push eax
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret