joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421e00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x421fa5
cmp dword [esi + 0xc], 1
jne 0x421e24
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x421e40
mov ebx, dword [esp + 0x34]
jmp 0x421e40
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x421e94
xor edi, edi
test ebx, ebx
jbe 0x421eb9
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x421e64
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x421eb9
add edi, 0x4000
cmp edi, ebx
jb 0x421e54
jmp 0x421eb1
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x421f9f
cmp byte [esi + 0x14], 0
je 0x421f9f
cmp dword [esi + 0xc], 0
jne 0x421f9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov ebx, eax
lea eax, [esi + 0x1e]
push eax
mov dword [esp + 0x24], edx
call fcn.00422810
push edi
mov dword [esp + 0x18], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x421f44
ja 0x421f0c
cmp dword [esp + 0x14], ebp
jbe 0x421f44
mov edi, dword [esp + 0x20]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x421f44
jl 0x421f23
cmp edx, 0xffffffff
ja 0x421f44
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x28], eax
js 0x421f44
jg 0x421f36
cmp ecx, 0xffffffff
jbe 0x421f44
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x47f1a0
call fcn.0041d1c0
push 0
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x47f1a0
call fcn.0041d220
test al, al
je 0x421f8f
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x421e30
test eax, eax
jbe 0x421e30
mov edi, dword [esi]
mov edx, dword [edi + 0xc]
push 0
mov ecx, esi
call edx
mov ecx, dword [esp + 0x14]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
push edx
mov edx, dword [edi + 8]
push eax
mov ecx, esi
call edx
jmp 0x421e30
lea eax, [esi + 0x1e]
push eax
push 0
mov ecx, 0x47f1a0
call fcn.0041d3f0
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x4221b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 1
push edi
mov edi, dword [esp + 0x18]
cmp dword [esi + 0xc], ebp
jne 0x4221dc
cmp edi, 0x4e20
jbe 0x4221d1
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42227e
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x422230
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x422214
cmp eax, 3
jne 0x422230
cmp edi, 0x4e20
jbe 0x422230
push 0x4e20
push ebx
mov ecx, esi
call fcn.004221b0
pop edi
pop esi
pop ebp
pop ebx
ret 8
cmp dword [esi + 0xc], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x42224b
call ebp
cmp eax, 0x6d
jne 0x42224b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
cmp dword [esi + 0xc], 0
jne 0x422274
cmp edi, 0x8000
jbe 0x422274
call ebp
cmp eax, 0x21
jne 0x422274
push 0x8000
push ebx
mov ecx, esi
call fcn.004221b0
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x422780
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push 0x800
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00432020
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4227e6
cmp eax, 5
je 0x4227e6
xor eax, eax
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004538da
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
xor ecx, esp
mov eax, 1
call fcn.004538da
add esp, 0x1004
ret 4

Function at 0x422810
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
push esi
push 0x800
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.00431990
lea edx, [esp + 0xc]
push edx
movzx edx, word [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x18]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x24]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4228a7
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
ja 0x4228a7
push 1
push esi
push esi
push eax
call fcn.00453b90
mov ecx, dword [esp + 4]
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004538da
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x101c]
pop esi
xor ecx, esp
xor eax, eax
xor edx, edx
call fcn.004538da
add esp, 0x101c
ret 4
Function at 0x4228d0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
push 0x800
lea ecx, [esp + 0x210]
push ecx
push eax
call fcn.00432020
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4229d4
mov ecx, 0x464c44
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42295a
test dx, dx
je 0x422956
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42295a
add eax, 4
add ecx, 4
test dx, dx
jne 0x422934
xor eax, eax
jmp 0x42295f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4229b8
mov ecx, 0x464c38
lea eax, [esp]
jmp 0x422970
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x422996
test dx, dx
je 0x422992
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x422996
add eax, 4
add ecx, 4
test dx, dx
jne 0x422970
xor eax, eax
jmp 0x42299b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4229b8
xor eax, eax
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004538da
add esp, 0x1210
ret 4
mov eax, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004538da
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor ecx, esp
xor al, al
call fcn.004538da
add esp, 0x1210
ret 4

Function at 0x422a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push edi
mov edi, dword [esp + 0x1014]
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x422aa1
push 0x800
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00432950
test al, al
je 0x422a9f
lea ecx, [esp + 0xc]
push ecx
call ebx
jmp 0x422aa1
mov eax, esi
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004538da
add esp, 0x1004
ret 4

Function at 0x422ac0
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
mov esi, dword [esp + 0x1014]
push edi
mov edi, dword [esp + 0x101c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x422b20
push 0x800
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00432950
test al, al
je 0x422b20
push edi
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
setne al
jmp 0x422b22
mov al, bl
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004538da
add esp, 0x1004
ret 8
Function at 0x422b40
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x201c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x422bbe
push 0x800
lea eax, [esp + 0x1014]
push eax
push esi
call fcn.00432950
test al, al
je 0x422bbe
push 0x800
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.00432950
test al, al
je 0x422bbe
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1014]
push eax
call ebp
test eax, eax
setne al
jmp 0x422bc0
mov al, bl
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004538da
add esp, 0x2004
ret 8

Function at 0x422be0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x422c36
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00432950
test al, al
je 0x422c36
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x422c38
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004538da
add esp, 0x1004
ret 4

Function at 0x422c60
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x422cb6
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00432950
test al, al
je 0x422cb6
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x422cb8
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004538da
add esp, 0x1004
ret 4

Function at 0x4233d0
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0x10], eax
jbe 0x423428
mov dword [ecx + 0x10], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x423790
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x1004
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x4237ec
push esi
call fcn.00422a50
cmp eax, 0xffffffff
jne 0x423808
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00432950
test al, al
je 0x423808
push 0
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
je 0x423808
cmp byte [esp + 0x1014], 0
je 0x423804
mov edx, dword [esp + 0x1018]
push edx
push esi
call fcn.00422ac0
xor eax, eax
jmp 0x423822
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x42381d
cmp eax, 3
mov eax, 1
jne 0x423822
mov eax, 2
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004538da
add esp, 0x1004
ret 0xc
Function at 0x4247b0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
push ebp
push esi
mov esi, dword [esp + 0x126c]
push edi
mov edi, dword [esp + 0x1268]
cmp edi, 0xffffffff
jne 0x42485f
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x424893
push 0x800
lea ecx, [esp + 0x264]
push ecx
push ebx
call fcn.00432950
test al, al
je 0x42482c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x424893
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x424848
cmp eax, 3
je 0x424848
cmp eax, 0x12
je 0x424848
mov eax, 1
jmp 0x42484a
xor eax, eax
mov byte [esi + 0x1044], al
mov dword [esi + 0x1040], 0
jmp 0x424951
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x424893
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne dl
mov byte [esi + 0x1044], dl
mov dword [esi + 0x1040], 0
jmp 0x424951
push 0x800
push ebx
push esi
call fcn.00446010
push 0x800
lea eax, [esp + 0x40]
push eax
push esi
call fcn.004318c0
mov ecx, dword [esp + 0x2c]
push 1
push 0
push 0
push ecx
call fcn.00453b90
mov ecx, dword [esp + 0x30]
xor ebx, ebx
add eax, ecx
mov ecx, dword [esp + 0x18]
adc edx, ebx
mov dword [esi + 0x1000], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1004], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1028], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1008], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x102c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1034], eax
mov dword [esi + 0x1030], edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x24]
mov dword [esi + 0x1038], ecx
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x103c], edx
call fcn.004471b0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x1018]
call fcn.004471b0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0x1020]
call fcn.004471b0
mov dword [esi + 0x1040], ebx
mov ecx, dword [esp + 0x1260]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004538da
add esp, 0x1254
ret 0xc
Function at 0x4298a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd4]
push 0x4000
push 0
push eax
call fcn.00453e70
add esp, 0xc
cmp byte [esp + 8], 0
je 0x429991
cmp byte [esi + 0x6135], 0
jne 0x429991
mov ecx, dword [esi + 0xe8]
mov eax, dword [esi + 0x6130]
shr ecx, 2
cmp eax, ecx
ja 0x429991
xor edx, edx
test eax, eax
jbe 0x4299d3
push ebx
push edi
jmp 0x429900
mov eax, dword [esi + 0xd0]
movzx edi, byte [eax + edx + 1]
lea ecx, [eax + edx]
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 2]
imul eax, eax, 0x2773
xor eax, edi
mov edi, dword [esi + 0xd8]
imul eax, eax, 0x2773
xor eax, ecx
mov ecx, eax
imul eax, eax, 0x2773
and ecx, 0x3ffff
xor ebx, ebx
mov word [edi + ecx*2], bx
mov ecx, dword [esi + 0xd0]
movzx ecx, byte [ecx + edx + 3]
mov edi, dword [esi + 0xdc]
xor ecx, eax
mov eax, ecx
imul ecx, ecx, 0x2773
and eax, 0x3ffff
mov dword [edi + eax*4], ebx
mov eax, dword [esi + 0xd0]
movzx eax, byte [eax + edx + 4]
xor eax, ecx
and eax, dword [esi + 0xec]
mov ecx, dword [esi + 0xe0]
inc edx
mov dword [ecx + eax*4], ebx
cmp edx, dword [esi + 0x6130]
jb 0x429900
pop edi
pop ebx
pop esi
ret 4
mov edx, dword [esi + 0xd8]
push 0x80000
push 0
push edx
call fcn.00453e70
mov eax, dword [esi + 0xdc]
push 0x100000
push 0
push eax
call fcn.00453e70
mov ecx, dword [esi + 0xe8]
mov edx, dword [esi + 0xe0]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call fcn.00453e70
add esp, 0x24
pop esi
ret 4
Function at 0x42c1d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
xor edx, edx
push esi
add ebx, 0xffffff88
push edi
add eax, 2
lea edi, [esp + 0x20]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov edi, edi
cmp edx, ebx
jge 0x42c333
lea eax, [esp + 0x48]
sub eax, 2
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x48]
sub ecx, eax
add ecx, 0xfffffffd
mov dword [esp + 0x3c], ecx
mov ecx, eax
neg ecx
lea esi, [esp + ecx + 0x48]
mov dword [esp + 0x44], esi
lea esi, [esp + ecx + 0x49]
mov dword [esp + 0x30], esi
lea esi, [esp + 0x48]
sub esi, eax
lea eax, [esp + ecx + 0x4a]
mov ecx, dword [esp + 0x14]
sub ebx, edx
mov dword [esp + 0x40], eax
dec ebx
mov eax, 0x88888889
mul ebx
dec esi
mov ebp, edx
shr ebp, 0xa
mov dword [esp + 0x2c], esi
mov esi, dword [edi]
mov dword [esp + 0x10], ecx
inc ebp
mov eax, dword [esp + 0x10]
xor edi, edi
lea ebx, [ebx]
movzx edx, byte [eax - 2]
mov cl, byte [eax - 1]
sub dl, cl
mov byte [esp + edi + 0x48], dl
movzx edx, byte [eax]
sub dl, cl
mov byte [esp + edi + 0x49], cl
mov byte [esp + edi + 0x4a], dl
add edi, 3
add eax, 3
cmp edi, 0x78
jl 0x42c290
mov ecx, dword [esp + 0x34]
mov edi, 0x27
mov edi, edi
mov eax, dword [esp + 0x40]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
sub dl, byte [eax + ecx]
add ecx, 3
movsx eax, dl
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, dword [esp + 0x44]
mov al, byte [edx + ecx - 3]
mov edx, dword [esp + 0x3c]
sub al, byte [edx + ecx - 3]
movsx eax, al
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx - 3]
sub dl, byte [ecx - 3]
movsx eax, dl
cdq
xor eax, edx
sub eax, edx
add eax, esi
sub edi, 1
lea esi, [eax + ebx]
jne 0x42c2c0
add dword [esp + 0x10], 0x780
sub ebp, 1
jne 0x42c284
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [edi], esi
inc dword [esp + 0x14]
inc edx
add edi, 4
cmp edx, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
jle 0x42c220
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, ecx
ja 0x42c37d
cmp eax, edx
ja 0x42c37d
xor eax, eax
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.004538da
add esp, 0xb4
ret 8
cmp edx, ecx
mov ecx, dword [esp + 0xb0]
sbb eax, eax
neg eax
xor ecx, esp
inc eax
call fcn.004538da
add esp, 0xb4
ret 8
Function at 0x4319e0
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea edx, [esp + 4]
push edx
xor ecx, ecx
push 0x1a
push ecx
mov word [esi], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x431a54
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x431a54
cmp word [esi], 0
je 0x431a54
push edi
push esi
call fcn.00431270
push edi
push 0x465260
push esi
call fcn.00446050
push esi
call fcn.00423160
test al, al
jne 0x431a81
cmp byte [esp + 0x10], al
je 0x431a50
push 0
push 0
push esi
call fcn.00423790
test eax, eax
sete al
test al, al
jne 0x431a81
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.004316f0
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x431a7c
cmp word [esi + 2], 0x3a
jne 0x431a79
add esi, 8
cmp eax, esi
jb 0x431a7c
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4

Function at 0x431aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x10]
push ecx
push 1
xor eax, eax
push eax
push str.SoftwareWinRARPaths
push 0x80000001
mov word [esi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x431af8
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.AppData
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x431b08
push esi
call fcn.00423160
test al, al
jne 0x431b14
mov eax, dword [esp + 0x18]
push eax
mov eax, esi
call fcn.004319e0
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x432950
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [esp + 0x1010]
movzx eax, word [edi]
test ax, ax
jne 0x432987
xor al, al
jmp 0x432b85
push eax
call fcn.00445db0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432992
push ebx
sub eax, edx
sar eax, 1
push edi
mov ebx, eax
call fcn.00431fd0
test al, al
je 0x432a7c
movzx eax, word [edi]
push eax
call fcn.00445db0
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x432a0b
cmp word [edi + 2], 0x3a
jne 0x432a0b
add ebx, 4
cmp dword [esp + 0x101c], ebx
jbe 0x432b82
push 4
push 0x465328
push esi
call fcn.004550a4
add esp, 0xc
sub esi, edi
mov eax, edi
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4329f5
mov al, 1
jmp 0x432b84
cmp word [edi], 0x5c
jne 0x432b82
add edi, 2
cmp word [edi], 0x5c
jne 0x432b82
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x432b82
push 4
push 0x465328
push esi
call fcn.004550a4
mov eax, 0x465320
mov ecx, esi
add esp, 0xc
sub ecx, eax
lea edx, [ecx + 8]
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x432a50
sub esi, edi
mov eax, edi
lea edx, [esi + 0xe]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x432a66
mov al, 1
jmp 0x432b84
lea edx, [esp + 0xc]
push edx
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x432b82
cmp eax, 0x7ff
ja 0x432b82
movzx eax, word [edi]
push eax
call fcn.00431240
test al, al
je 0x432af9
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x432b82
push 4
push 0x465328
push esi
call fcn.004550a4
push 2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esi + 8]
push edx
call fcn.004550a4
add esp, 0x18
sub esi, edi
mov eax, edi
lea edx, [esi + 0xc]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x432ae3
mov al, 1
jmp 0x432b84
push 0x800
lea eax, [esp + 0x10]
push eax
call fcn.00431270
lea eax, [esp + 0xc]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432b10
sub eax, edx
sar eax, 1
lea ecx, [eax + ebx + 4]
mov ebx, dword [esp + 0x101c]
cmp ebx, ecx
jbe 0x432b82
push 4
push 0x465328
push esi
call fcn.004550a4
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
sub edx, ecx
add esp, 0xc
add edx, 8
jmp 0x432b50
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x432b50
cmp word [edi], 0x2e
jne 0x432b76
movzx edx, word [edi + 2]
push edx
call fcn.00431240
test al, al
je 0x432b76
add edi, 4
push ebx
push edi
push esi
call fcn.00446050
mov al, 1
jmp 0x432b84
xor al, al
pop ebx
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004538da
add esp, 0x1004
ret 0xc