joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a0f0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.e113c4b9fa3f839d8797
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41a197
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41a197
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x41a1b0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x41a197
test al, 1
jne 0x41a175
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a142
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41a197
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.b8274bd160fff857578b4
call fcn.00437e92
add esp, 4
jmp 0x41a197

Function at 0x41a1c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0x62
idiv ecx
inc esi
add dl, 0x68
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41a1f6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a277
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41a277
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret
Function at 0x41c900
Capabilities:
Check mutex on windows

Disassembly:
push ecx
cmp dword [esi + 0x198], 0x10
jb 0x41c912
mov eax, dword [esi + 0x184]
jmp 0x41c918
lea eax, [esi + 0x184]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x17c], eax
test eax, eax
jne 0x41c93b
mov dword [esi + 0x308], 1
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41c937
mov dword [esi + 0x308], 0
call fcn.00435140
mov ecx, eax
mov eax, 0x5397829d
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x62
jle 0x41c981
push 0x62
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00418580
call fcn.00418650
push 0
call fcn.00439899
int3

Function at 0x41cd30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x24], esi
jae 0x41cd45
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
call fcn.004179a0
cmp ebx, 0xffffffff
jne 0x41cd75
cmp dword [esp + 0x24], esi
jb 0x41cd6b
mov eax, dword [esp + 0x10]
push eax
call fcn.00437f8b
add esp, 4
pop esi
mov eax, 0x80004005
pop ebx
ret 0x1c
test bl, 0x10
je 0x41cd94
cmp dword [esp + 0x24], esi
jb 0x41cda7
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00437f8b
add esp, 4
pop esi
xor eax, eax
pop ebx
ret 0x1c
cmp dword [esp + 0x24], esi
jb 0x41cda7
mov edx, dword [esp + 0x10]
push edx
call fcn.00437f8b
add esp, 4
pop esi
xor eax, eax
pop ebx
ret 0x1c

Function at 0x41cdb0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004468f0
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x1000], eax
push 0xfff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.0043e780
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x41ce0e
mov eax, 0x80004005
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00437983
add esp, 0x1004
ret
cmp eax, 0x1000
jae 0x41cdf4
lea eax, [esp]
lea edx, [eax + 1]
jmp 0x41ce20
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ce20
sub eax, edx
push eax
lea edx, [esp + 4]
push edx
lea ecx, [esi + 0x19c]
call fcn.00403090
mov ecx, dword [esp + 0x1000]
xor ecx, esp
xor eax, eax
call fcn.00437983
add esp, 0x1004
ret
Function at 0x41e540
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x44bc08
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.004468f0
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x1000], eax
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x100c]
mov dword fs:[0], eax
push 0xfff
lea eax, [esp + 0xd]
push 0
mov dword [esp + 0x101c], 0
push eax
mov byte [esp + 0x14], 0
call fcn.0043e780
mov eax, dword [esp + 0x102c]
mov edi, pe_nt_image_headers32
add esp, 0xc
cmp dword [esp + 0x1034], edi
jae 0x41e5bc
lea eax, [esp + 0x1020]
push 0x1000
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x41e5f1
cmp dword [esp + 0x1034], edi
jb 0x41e5ea
mov edx, dword [esp + 0x1020]
push edx
call fcn.00437f8b
add esp, 4
mov eax, 0x80004005
jmp 0x41e651
cmp eax, 0x1000
jb 0x41e618
cmp dword [esp + 0x1034], edi
jb 0x41e5ea
mov eax, dword [esp + 0x1020]
push eax
call fcn.00437f8b
add esp, 4
mov eax, 0x80004005
jmp 0x41e651
lea eax, [esp + 8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e620
sub eax, edx
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00403090
cmp dword [esp + 0x1034], edi
jb 0x41e64f
mov edx, dword [esp + 0x1020]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x100c]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00437983
add esp, 0x1010
ret 0x1c
Function at 0x41eef0
Capabilities:
Delete file

Disassembly:
sub esp, 0x14
cmp dword [eax + 0x29c], 0
push esi
push edi
jne 0x41ef09
mov eax, 0x80004005
pop edi
pop esi
add esp, 0x14
ret
cmp dword [eax + 0x2a0], 0x10
jb 0x41ef1a
mov eax, dword [eax + 0x28c]
jmp 0x41ef1f
add eax, 0x28c
push 0
push 0x80
push 3
push 0
push 0
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41eefe
push 0
call fcn.00439283
add esp, 4
cdq
push 0
add eax, 0xb6109100
push 0x989680
adc edx, 2
push edx
push eax
call fcn.00446700
lea ecx, [esp + 0x10]
push ecx
push 0
mov dword [esp + 0x18], eax
push 0
mov eax, edx
push esi
sar eax, 0x1f
mov dword [esp + 0x24], edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edi, eax
lea eax, [esp + 0xb]
mov byte [esp + 0xb], 0
lea edx, [eax + 1]
jmp 0x41ef90
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ef90
sub eax, edx
je 0x41efa0
call fcn.00401440
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x41efb5
sub eax, 2
je 0x41efb5
sub eax, 4
jne 0x41efbd
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x41efc8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
neg eax
sbb eax, eax
and eax, 0x7fffbffb
pop edi
add eax, 0x80004005
pop esi
add esp, 0x14
ret
Function at 0x421eb0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x44cf00
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov eax, dword [ebp + 0x74]
lea ebx, [esi + 0x2c0]
mov ecx, ebx
call fcn.0042a010
cmp dword [eax + 0x3c], 0
je 0x4220b0
mov edi, pe_nt_image_headers32
cmp dword [ebp + 0x70], edi
jb 0x421f11
mov ecx, dword [ebp + 0x5c]
jmp 0x421f14
lea ecx, [ebp + 0x5c]
cmp dword [esi + 0x25c], edi
jb 0x421f24
mov eax, dword [esi + 0x248]
jmp 0x421f2a
lea eax, [esi + 0x248]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov eax, dword [ebp + 0x74]
mov ecx, ebx
jne 0x4220b7
call fcn.0042a010
inc dword [eax + 0x38]
add eax, 0x38
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042a010
cmp dword [eax + 0x38], 3
jle 0x4220b0
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042a010
cmp dword [eax + 0x18], edi
jb 0x421f74
mov eax, dword [eax + 4]
jmp 0x421f77
add eax, 4
push eax
lea eax, [esp + 0x20]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, 0x10
jb 0x421fa6
mov ecx, dword [edi]
jmp 0x421fa8
mov ecx, edi
cmp ecx, 0x455914
ja 0x421fe3
cmp eax, 0x10
jb 0x421fb9
mov ecx, dword [edi]
jmp 0x421fbb
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x455914
jbe 0x421fe3
cmp eax, 0x10
jb 0x421fcf
mov edi, dword [edi]
push 0x3b
mov eax, 0x455914
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x422027
cmp eax, 0x3b
jae 0x421ff5
mov ecx, dword [esi + 0x14]
push ecx
push 0x3b
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x422001
mov eax, dword [edi]
jmp 0x422003
mov eax, edi
push 0x3b
push 0x455914
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x3b
jb 0x422023
mov edi, dword [edi]
mov byte [edi + 0x3b], 0
lea esi, [esp + 0x5c]
call fcn.004014c0
xor edi, edi
mov dword [esp + 0xa0], edi
call fcn.00401770
mov esi, pe_nt_image_headers32
mov byte [esp + 0x9c], 1
cmp dword [eax + 0x18], esi
jb 0x422055
mov eax, dword [eax + 4]
jmp 0x422058
add eax, 4
mov edx, dword [esp + 0xa4]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x10
cmp dword [esp + 0x34], esi
jb 0x42207e
mov eax, dword [esp + 0x20]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x38]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], edi
mov byte [esp + 0x20], 0
mov dword [esp + 0x98], 0xffffffff
call fcn.00429620
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042a010
mov dword [eax + 0x3c], edi
mov eax, 0x80004005
jmp 0x4220c5
call fcn.0042a010
mov dword [eax + 0x38], 0
xor eax, eax
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret 8
Function at 0x42d250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44fe59
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
mov byte [edi + 4], dl
mov dword [esp + 0x24], edx
mov eax, dword [esi + 0x18]
mov dword [esp + 0x14], 1
lea ebp, [esi + 4]
cmp eax, 0x10
jb 0x42d2b0
mov ecx, dword [ebp]
jmp 0x42d2b2
mov ecx, ebp
mov ebx, dword [esi + 0x14]
add ecx, ebx
mov dword [esp + 0x10], ecx
cmp ecx, edx
je 0x42d2e1
cmp eax, 0x10
jb 0x42d2c9
mov edx, dword [ebp]
jmp 0x42d2cb
mov edx, ebp
cmp edx, ecx
ja 0x42d2e1
cmp eax, 0x10
jb 0x42d2d9
mov eax, dword [ebp]
jmp 0x42d2db
mov eax, ebp
add ebx, eax
cmp ecx, ebx
jbe 0x42d2e6
call fcn.00437e82
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x42d2f3
mov ebx, dword [ebp]
jmp 0x42d2f5
mov ebx, ebp
test ebx, ebx
je 0x42d31a
cmp ecx, 0x10
jb 0x42d303
mov eax, dword [ebp]
jmp 0x42d305
mov eax, ebp
cmp eax, ebx
ja 0x42d31a
cmp ecx, 0x10
jb 0x42d311
mov ebp, dword [ebp]
mov ecx, dword [esi + 0x14]
add ecx, ebp
cmp ebx, ecx
jbe 0x42d31f
call fcn.00437e82
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0x30]
push esi
push ebx
push esi
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0042d800
add esp, 0x24
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x42f9b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00437c5b
push str.11c17a05c2593965ea070529
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00437e92
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.ff3f781da4bdeb097d
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x42fa28
add edi, 0x1000
push edi
push esi
call fcn.00438068
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.981d48e591e7f031c7471
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x42f9f5
test eax, eax
jne 0x42fa3f
push edi
push str.f6e10de7bfe18c37aa_d
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.51e547d9b341c8214795c4d__d_
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x42fa60
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.d91176a32e99c10b15a1c377c90
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x42fb07
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42fb07
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x42fb20
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x42fb07
test al, 1
jne 0x42fae5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42fab2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x42fb07
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.4f75b057ec3b03cd26c59eb1bac9e7c
call fcn.00437e92
add esp, 4
jmp 0x42fb07
Function at 0x42fb30
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x85
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x42fbb1
cmp eax, 0x2f
jbe 0x42fb73
push eax
push str.fe73e47f65414d9fca77d0756dcf99
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.4e59451f34a564e3e89b6d7b46ab3c0
call esi
test eax, eax
jne 0x42fba9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x42fbc0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.06cfd46f0d3fb5a99
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x42fc67
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42fc67
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x42fc80
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x42fc67
test al, 1
jne 0x42fc45
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42fc12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x42fc67
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.daedb1f94a9350f3d1250af9511bbb
call fcn.00437e92
add esp, 4
jmp 0x42fc67
Function at 0x42fc90
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00437c5b
push str.cf67f9d3b047e0a3f5c55fa3d2
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00437e92
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.6de1c67578130e9330e7e0c5
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x42fd08
add edi, 0x1000
push edi
push esi
call fcn.00438068
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.9ea9b133aaf3dd7f
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x42fcd5
test eax, eax
jne 0x42fd1f
push edi
push str.6f6de7bbe4859265_d
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.75c14e2fb10768f3312fd45__d_
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x42fd40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00437c5b
push str.d97f9a192c390d6fe8e38
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00437e92
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.5a2b7217772d10b91b957ee52a2b061
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x42fdb8
add edi, 0x1000
push edi
push esi
call fcn.00438068
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.fcf39fb796adfa57c291a9
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x42fd85
test eax, eax
jne 0x42fdcf
push edi
push str.193528678d3fe9cfebb1f4ab2dc_d
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.6709677b3da959733c753c2bdf37ba__d_
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x42fdf0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x7c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x42fe6e
cmp eax, 0x4e
jbe 0x42fe30
push eax
push str.44b5e087dc3921033adf0503
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.c72ff5f3b7c9e3bb77f7ade
call esi
test eax, eax
jne 0x42fe66
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
Function at 0x42fef0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x90
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x42ff71
cmp eax, 0x57
jbe 0x42ff33
push eax
push str.93c92a33f01dd1c9a5e1043107d7
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.f3a7fe21d8fb2b6f95739
call esi
test eax, eax
jne 0x42ff69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x42fff0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x81
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x430071
cmp eax, 0x4b
jbe 0x430033
push eax
push str.ba39212544f9bc9b65bd8e2b2
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.d191a09fd3f14de1443d
call esi
test eax, eax
jne 0x430069
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x430080
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00437c5b
push str.b9271f052f6bd51308ed82d1
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00437e92
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.5cd1b68f6f0dd9c7ace30a
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4300f8
add edi, 0x1000
push edi
push esi
call fcn.00438068
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.c2c990994e2141fb7ceb34fd4d035
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x4300c5
test eax, eax
jne 0x43010f
push edi
push str.b6ff047df71d5659_d
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.aef53abf9eff0f4f4b9541ffe46f__d_
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret