joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4177b0
Capabilities:
Delete file

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x4177c8
sub eax, 2
je 0x4177c8
sub eax, 4
je 0x4177c8
xor eax, eax
ret
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
ret

Function at 0x417880
Capabilities:
Delete file

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043af41
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
pop esi
jbe 0x4178ac
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4179d0
Capabilities:
Set uefi variable

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x4179e9
fadd qword [0x4583f0]
call fcn.00448e60
fstp qword [esp + 4]
push 0
call fcn.0043af41
add esp, 4
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x417a0c
fadd qword [0x4583f0]
fcomp qword [esp + 4]
fnstsw ax
test ah, 5
jp 0x417a2e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x417ab0
Capabilities:
Set uefi variable

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043af41
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
pop esi
jbe 0x417ae2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x417b30
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x417b49
fadd qword [0x4583f0]
call fcn.00448e60
fstp qword [esp + 4]
push 0
call fcn.0043af41
add esp, 4
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x417b6c
fadd qword [0x4583f0]
fcomp qword [esp + 4]
fnstsw ax
test ah, 5
jp 0x417b88
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x417d20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0xa2
idiv ecx
inc esi
add dl, 0x33
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x417d56
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x417dd7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x417dd7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x417df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.dac7d219f763de1f3d05226f39c1b3
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.be219ed95cfbb9233ae365
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x417e68
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.757928adf0e7a61bc2bf0673035776
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x417e35
test eax, eax
jne 0x417e7f
push edi
push str.2567a483dcd3bd4f0079867f8dc7943_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.ffc50ef9acf9297d0449074337__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x417ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.3f03784f2c5b6747ccb787b18b
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.66b9895378c73c0df72f
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x417f18
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.3a6f194de881cadff9bb19a3a9
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x417ee5
test eax, eax
jne 0x417f2f
push edi
push str.a0affe4fe29d900f02fd194b_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.15f550f9ae15d2adfdf74a37af0508__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x417fc0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x77
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41803e
cmp eax, 0x63
jbe 0x418000
push eax
push str.d8d961759e2916cf896de13d7aaf3c1
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.bf8de6d10dd7c3b39
call esi
test eax, eax
jne 0x418036
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x418050
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.f7d576c33bf706c335fd
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.943f35d5dac7cb3766f9abe3f6
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4180c8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.0e2162f3548166b7d6d700114df1e
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x418095
test eax, eax
jne 0x4180df
push edi
push str.ef71a3c513011a8d96_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.36eb22e5fe9760076401__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x418130
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.ab29015d6c434be79163c38d959114e
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4181d7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4181d7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4181f0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4181d7
test al, 1
jne 0x4181b5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418182
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4181d7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.99a1ca3b5019f3557779f
call fcn.00439b50
add esp, 4
jmp 0x4181d7

Function at 0x418200
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.0b65e5f712edad61f3e5f113d0335
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4182a7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4182a7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4182c0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4182a7
test al, 1
jne 0x418285
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418252
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4182a7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.3eb3868b9beb83750ac31c
call fcn.00439b50
add esp, 4
jmp 0x4182a7
Function at 0x4182d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0xd7
idiv ecx
inc esi
sub dl, 0x11
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418306
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418387
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418387
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x418410
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.950f2ac386055b07f40bf
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4184b7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4184b7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4184d0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4184b7
test al, 1
jne 0x418495
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418462
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4184b7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.069d3fcf76bdb25346d57a5f
call fcn.00439b50
add esp, 4
jmp 0x4184b7
Function at 0x4184e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x46
idiv ecx
inc esi
add dl, 0x7f
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418516
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418597
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418597
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x4185b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.94bbcef70d21d267b0270
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.df5336e527351399
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x418628
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.025fac879d2953cd149d28d9597fa
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x4185f5
test eax, eax
jne 0x41863f
push edi
push str.108f238bec9b7c35ba65b0bf_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.e635154101673a75daabcc43e3a7__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x418660
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.4949c477065f1fb7ca55aaef9ab1f
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418707
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418707
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418720
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418707
test al, 1
jne 0x4186e5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4186b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418707
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.8d9f33a38a958b27581568c
call fcn.00439b50
add esp, 4
jmp 0x418707

Function at 0x418730
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.4c538d2b51ff7a45f67f16911c81e
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4187d7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4187d7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4187f0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4187d7
test al, 1
jne 0x4187b5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418782
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4187d7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.706f8dff1b3f818f64
call fcn.00439b50
add esp, 4
jmp 0x4187d7
Function at 0x418800
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.199b3313bf51fc0fdf5
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.cd8fc01d0ba3f265c9896bb
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x418878
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.922bd04dd60f632bc4135e8956039fe
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x418845
test eax, eax
jne 0x41888f
push edi
push str.fc19e9632575c75139_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.e20ba7893cad27c3__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4188b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x13
idiv ecx
inc esi
sub dl, 0x11
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4188e6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418967
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418967
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x418980
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.4f49a1c3d59ddd93eb09a2ff6
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.53e113f5717b5b7982351acb7a0173
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4189f8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.f35b6b0b68e5a7758ed18d7519c96
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x4189c5
test eax, eax
jne 0x418a0f
push edi
push str.8803512119c77db11ab9_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.fe85afe173a3d6c1809dee4d34__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x418a30
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x3f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x418aae
cmp eax, 0x7b
jbe 0x418a70
push eax
push str.7a51e2b3d29715adea83
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.5e9d267552695df3bf79f75bff
call esi
test eax, eax
jne 0x418aa6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x418ac0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xe0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x418b43
cmp eax, 0xe1
jbe 0x418b05
push eax
push str.6f99d051df3d35a1e5d784
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.484960d986df37ffe3e3a7d37513f2
call esi
test eax, eax
jne 0x418b3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x418b60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0xeb
idiv ecx
inc esi
add dl, 0x64
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418b96
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418c17
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418c17
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret