joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dd90
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
test eax, eax
jne 0x41ddb9
push 0x24
push str.RoboForm_Setup
push str.Reboot_is_required_to_complete_RoboForm_Setup._nDo_you_want_to_reboot_now_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
je 0x41ddb9
cmp eax, 6
jne 0x41de0f
push 1
push 0
push 0
push str.AskForReboot_____rebooting
call fcn.00419330
add esp, 0x10
call fcn.0041de30
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41ddef
push 1
call esi
push eax
push 0
push str.Failed_to_get_reboot_priv
call fcn.00419330
add esp, 0x10
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x41de0f
call esi
push eax
push 0
push str.Reboot_Failed.
call fcn.0041cc40
add esp, 0xc
push 1
push 0
push 0
push str.AskForReboot_____cancelled
call fcn.00419330
add esp, 0x10
pop esi
pop ebp
ret

Function at 0x41e090
Capabilities:
Get file attributes
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x41e15d
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
push ebx
and eax, 0x40000000
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
mov edx, dword [ebp + 0x10]
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
xor eax, eax
push ecx
push edx
mov edx, dword [esi + 0x10]
push 0
test edx, edx
sete al
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop edi
mov dword [esi], eax
test eax, eax
pop ebx
je 0x41e15d
cmp eax, 0xffffffff
je 0x41e15d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x41e156
test eax, eax
je 0x41e156
mov ecx, dword [esi + 0x10]
mov edx, dword [esi]
neg ecx
sbb ecx, ecx
push 0
and ecx, 2
push 0
add ecx, 2
push 0
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x41e156
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
neg edx
sbb edx, edx
push ecx
and edx, 0xf001b
push 0
add edx, 4
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
je 0x41e156
mov eax, 1
pop esi
pop ebp
ret 0xc
mov ecx, esi
call fcn.0041e170
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x41e200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
push edi
je 0x41e26a
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x41e26a
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x41e26a
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push 0x20019
push 0
push eax
push edx
mov byte [esi], 0
mov dword [ebp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e26f
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
mov edi, eax
je 0x41e264
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, 0x57
pop edi
pop esi
pop ebp
ret

Function at 0x41e280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
je 0x41e2ea
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41e2ea
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push 0x20019
push 0
push eax
push edx
mov dword [ebp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e2ef
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 8], eax
lea eax, [ebp + 0x10]
push edi
push eax
lea edx, [ebp + 8]
push ecx
push edx
push 0
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0x10], 4
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
mov edi, eax
je 0x41e2e4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, 0x57
pop esi
pop ebp
ret

Function at 0x41e300
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
push edi
je 0x41e371
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x41e371
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x41e371
lea ecx, [ebp + 0x10]
lea edx, [ebp + 0xc]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41e376
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
mov esi, dword [ebp + 0xc]
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
mov edi, eax
je 0x41e36b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, 0x57
pop edi
pop esi
pop ebp
ret
Function at 0x41e380
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
je 0x41e3eb
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41e3eb
lea ecx, [ebp + 0x10]
lea edx, [ebp + 0xc]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41e3f0
mov ecx, dword [ebp + 0x14]
push edi
lea edx, [ebp + 0x10]
push 4
push edx
push 4
push eax
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp + 0x10], ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
mov edi, eax
je 0x41e3e5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, 0x57
pop esi
pop ebp
ret

Function at 0x41e400
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
je 0x41e452
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41e452
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push 0x20006
push 0
push eax
push edx
mov dword [ebp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e457
push edi
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
mov edi, eax
je 0x41e44c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, 0x57
pop esi
pop ebp
ret

Function at 0x41eea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440ac1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4472c0
mov dword [esi + 4], 0x4472b0
mov dword [esi + 8], 0x44729c
mov dword [esi + 0xc], 0x44728c
mov dword [esi + 0x10], 0x447278
mov eax, dword [esi + 0x1d30]
mov dword [ebp - 4], 1
push eax
call fcn.00421080
lea edi, [esi + 0x30]
add esp, 4
mov dword [esi + 0x1d30], 0
mov dword [ebp - 0x14], edi
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00420e00
mov edi, dword [edi + 0x18]
mov byte [ebp - 4], 0
test edi, edi
je 0x41ef26
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00420f50
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41f150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
mov eax, dword [edi]
jbe 0x41f18b
push ebx
xor ecx, ecx
mov ebx, eax
mov cl, byte [edx]
and ebx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x488840]
xor eax, ecx
inc edx
dec esi
jne 0x41f164
mov dword [edi], eax
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov dword [edi], eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x421410
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447a20
push 0x423b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
cmp dword [0x483d74], edi
jne 0x42157b
xor ebx, ebx
cmp dword [0x483d6c], edi
je 0x42145c
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x483d74], edi
jne 0x42154f
cmp dword [0x483d6c], edi
jne 0x42147d
call fcn.00407570
test eax, eax
je 0x421554
mov eax, dword [0x451140]
mov dword [ebp - 0x48], eax
mov eax, dword [0x48af10]
cmp eax, edi
jne 0x421541
xor esi, esi
cmp dword [0x48af14], edi
jne 0x4214ce
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x4214c4
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
cmp eax, edi
je 0x4214e9
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x421532
mov eax, dword [0x48af1c]
cmp eax, edi
jne 0x421524
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x42150e
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x4429b8]
jmp 0x42151b
mov edx, dword [0x4429c4]
push edx
call dword [0x4429bc]
cmp eax, edi
je 0x421532
mov dword [0x48af1c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af10], eax
cmp esi, edi
jne 0x421541
xor eax, eax
jmp 0x42154b
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x421554
mov ebx, 1
cmp ebx, edi
jne 0x42157b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x421568
cmp eax, 0x78
jne 0x421573
mov ebx, 1
mov dword [0x483d74], ebx
cmp ebx, edi
jne 0x42157b
xor eax, eax
jmp 0x421580
mov eax, 1
cmp eax, edi
jne 0x421599
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x34]
push eax
mov ecx, dword [ebp + 0x30]
push ecx
mov edx, dword [ebp + 0x2c]
push edx
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
call fcn.004215f9
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x4215f9
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x483d74], edi
jne 0x4216ed
xor ebx, ebx
cmp dword [ebp - 0x20], edi
sete bl
cmp ebx, edi
je 0x42161c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x42161f
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [0x48af20]
test eax, eax
jne 0x4216da
xor esi, esi
mov eax, dword [0x48af14]
test eax, eax
jne 0x42166c
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421662
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x421687
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x4216cf
mov eax, dword [0x48af1c]
test eax, eax
jne 0x4216c1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x4216ab
mov eax, dword [str.Kernel32.dll]
push eax
call dword [0x4429b8]
jmp 0x4216b8
mov ecx, dword [0x4429c4]
push ecx
call dword [0x4429bc]
test eax, eax
je 0x4216cf
mov dword [0x48af1c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af20], eax
test esi, esi
je 0x4216df
push edi
push 0
call eax
test ebx, ebx
je 0x4216ed
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x4216f0
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447a30
push 0x423b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [0x483d74], edi
jne 0x42185b
xor ebx, ebx
cmp dword [0x483d6c], edi
je 0x42173c
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x483d74], edi
jne 0x42182f
cmp dword [0x483d6c], edi
jne 0x42175d
call fcn.00407570
test eax, eax
je 0x421834
mov eax, dword [0x451140]
mov dword [ebp - 0x48], eax
mov eax, dword [0x48af10]
cmp eax, edi
jne 0x421821
xor esi, esi
cmp dword [0x48af14], edi
jne 0x4217ae
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x4217a4
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
cmp eax, edi
je 0x4217c9
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x421812
mov eax, dword [0x48af1c]
cmp eax, edi
jne 0x421804
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x4217ee
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x4429b8]
jmp 0x4217fb
mov edx, dword [0x4429c4]
push edx
call dword [0x4429bc]
cmp eax, edi
je 0x421812
mov dword [0x48af1c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af10], eax
cmp esi, edi
jne 0x421821
xor eax, eax
jmp 0x42182b
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x421834
mov ebx, 1
cmp ebx, edi
jne 0x42185b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x421848
cmp eax, 0x78
jne 0x421853
mov ebx, 1
mov dword [0x483d74], ebx
cmp ebx, edi
jne 0x42185b
xor eax, eax
jmp 0x421860
mov eax, 1
cmp eax, edi
jne 0x42187a
xor ax, ax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.004218af
mov ax, word [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4218af
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x483d74], edi
jne 0x4219a5
xor ebx, ebx
cmp word [ebp - 0x1c], di
sete bl
cmp ebx, edi
je 0x4218d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x4218d6
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [0x48af20]
test eax, eax
jne 0x421992
xor esi, esi
mov eax, dword [0x48af14]
test eax, eax
jne 0x421923
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421919
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x42193e
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x421987
mov eax, dword [0x48af1c]
test eax, eax
jne 0x421979
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421963
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x4429b8]
jmp 0x421970
mov edx, dword [0x4429c4]
push edx
call dword [0x4429bc]
test eax, eax
je 0x421987
mov dword [0x48af1c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af20], eax
test esi, esi
je 0x421997
push edi
push 0
call eax
test ebx, ebx
je 0x4219a5
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x4219b0
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447a90
push 0x423b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x20], esi
cmp dword [0x483d74], esi
jne 0x421b0f
xor edi, edi
cmp dword [0x483d6c], esi
je 0x4219f9
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x483d74], esi
jne 0x421ae3
cmp dword [0x483d6c], esi
jne 0x421a1a
call fcn.00407570
test eax, eax
je 0x421ae8
mov ebx, dword [0x451140]
mov eax, dword [0x48af10]
cmp eax, esi
jne 0x421ad6
mov eax, dword [0x48af14]
test eax, eax
jne 0x421a68
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421a5e
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x421a83
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x421acb
mov eax, dword [0x48af1c]
test eax, eax
jne 0x421abd
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421aa7
mov eax, dword [str.Kernel32.dll]
push eax
call dword [0x4429b8]
jmp 0x421ab4
mov ecx, dword [0x4429c4]
push ecx
call dword [0x4429bc]
test eax, eax
je 0x421acb
mov dword [0x48af1c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af10], eax
test esi, esi
je 0x421add
lea edx, [ebp - 0x20]
push edx
push ebx
call eax
xor esi, esi
cmp eax, esi
je 0x421ae8
mov edi, 1
cmp edi, esi
jne 0x421b0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x421afc
cmp eax, 0x78
jne 0x421b07
mov edi, 1
mov dword [0x483d74], edi
cmp edi, esi
jne 0x421b0f
xor eax, eax
jmp 0x421b14
mov eax, 1
cmp eax, esi
je 0x421b45
mov dword [ebp - 4], esi
mov eax, dword [0x48af30]
cmp eax, esi
jne 0x421b37
push str.InitCommonControls
call fcn.00421c30
mov dword [0x48af30], eax
cmp eax, esi
je 0x421b39
call eax
mov dword [ebp - 4], 0xffffffff
call fcn.00421b56
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421b56
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x483d74]
test eax, eax
jne 0x421c23
mov edi, dword [ebp - 0x20]
mov eax, dword [0x48af20]
test eax, eax
jne 0x421c1e
xor esi, esi
mov eax, dword [0x48af14]
test eax, eax
jne 0x421bb0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421ba6
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x421bcb
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x421c13
mov eax, dword [0x48af1c]
test eax, eax
jne 0x421c05
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421bef
mov eax, dword [str.Kernel32.dll]
push eax
call dword [0x4429b8]
jmp 0x421bfc
mov ecx, dword [0x4429c4]
push ecx
call dword [0x4429bc]
test eax, eax
je 0x421c13
mov dword [0x48af1c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af20], eax
test esi, esi
je 0x421c23
push edi
push 0
call eax
ret
Function at 0x421e97
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [0x483d74]
test eax, eax
jne 0x421f90
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x421f90
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x421ec0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x421ec2
xor ebx, ebx
mov edi, dword [ebp - 0x24]
mov eax, dword [0x48af20]
test eax, eax
jne 0x421f7d
xor esi, esi
mov eax, dword [0x48af14]
test eax, eax
jne 0x421f0f
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421f05
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
test eax, eax
je 0x421f2a
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x421f72
mov eax, dword [0x48af1c]
test eax, eax
jne 0x421f64
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x421f4f
mov edx, dword [str.Kernel32.dll]
push edx
call dword [0x4429b8]
jmp 0x421f5b
mov eax, dword [0x4429c4]
push eax
call dword [0x4429bc]
test eax, eax
je 0x421f72
mov dword [0x48af1c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af20], eax
test esi, esi
je 0x421f82
push edi
push 0
call eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x421f90
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x4229c0
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448558
push 0x423b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0xffffffff
xor edi, edi
mov dword [ebp - 0x20], edi
cmp dword [0x483d74], edi
jne 0x422b2f
xor ebx, ebx
cmp dword [0x483d6c], edi
je 0x422a10
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x483d74], edi
jne 0x422b03
cmp dword [0x483d6c], edi
jne 0x422a31
call fcn.00407570
test eax, eax
je 0x422b08
mov eax, dword [0x451140]
mov dword [ebp - 0x48], eax
mov eax, dword [0x48af10]
cmp eax, edi
jne 0x422af5
xor esi, esi
cmp dword [0x48af14], edi
jne 0x422a82
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x422a78
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x48af18], eax
mov dword [0x48af14], 1
mov eax, dword [0x48af18]
cmp eax, edi
je 0x422a9d
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x422ae6
mov eax, dword [0x48af1c]
cmp eax, edi
jne 0x422ad8
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x422ac2
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x4429b8]
jmp 0x422acf
mov edx, dword [0x4429c4]
push edx
call dword [0x4429bc]
cmp eax, edi
je 0x422ae6
mov dword [0x48af1c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x48af10], eax
cmp esi, edi
jne 0x422af5
xor eax, eax
jmp 0x422aff
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x422b08
mov ebx, 1
cmp ebx, edi
jne 0x422b2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x422b1c
cmp eax, 0x78
jne 0x422b27
mov ebx, 1
mov dword [0x483d74], ebx
cmp ebx, edi
jne 0x422b2f
xor eax, eax
jmp 0x422b34
mov eax, 1
cmp eax, edi
jne 0x422b4f
or ax, 0xffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], edi
mov eax, dword [0x48af28]
cmp eax, edi
jne 0x422b6e
push str.GetFileTitleA
call fcn.00422ca0
mov dword [0x48af28], eax
cmp eax, edi
je 0x422b7f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call fcn.00422ba4
mov ax, word [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc