joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437c90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2d90
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x47c], esi
test edi, edi
jne 0x437ced
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 0xf
mov byte [esi], dl
push edx
push 0x50102d
call fcn.00404000
mov eax, esi
jmp 0x437d7f
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x478]
call fcn.004384b0
nop
push edi
push 0x400
push 1
lea eax, [ebp - 0x418]
push eax
call fcn.004c8773
add esp, 0x10
test eax, eax
jle 0x437d30
push eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x478]
call fcn.004386a0
jmp 0x437d00
push edi
call fcn.004c4051
add esp, 4
push esi
lea ecx, [ebp - 0x478]
call fcn.00438500
mov eax, esi
jmp 0x437d7f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret

Function at 0x4384b0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.CMD5Checksum.0
push eax
call fcn.004c05c0
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret
Function at 0x4388a0
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.360base.dll
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x4389df
lea ecx, [ebp - 0x228]
call fcn.00438760
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
call edi
test eax, eax
je 0x438961
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x210]
push 0
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x214]
cmp edx, 8
jb 0x4389a1
mov ecx, dword [ebp - 0x228]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x438997
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438a30
push edx
push ecx
call fcn.004bdd39
add esp, 8
lea eax, [ebp - 0x210]
push eax
call edi
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 7
mov word [esi], cx
test eax, eax
jne 0x4389c9
push eax
push 0x5010a0
jmp 0x438a17
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4389d2
jmp 0x438a0b
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x210]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438a00
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00403e30
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
int3
Function at 0x438a40
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xc], 0
push eax
mov ebx, ecx
mov dword [ebp - 8], 7
push 0x5010a0
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x1c], ax
call fcn.00403e30
cmp dword [ebp - 0xc], 0
jne 0x438be5
lea eax, [ebp - 0x1c]
mov edx, str.Software360360huabao
push eax
push str.InstallPath
mov ecx, SysReAllocString
call fcn.0040ffe0
mov edx, dword [ebp - 8]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edx
sub eax, ecx
cmp eax, 0xb
jb 0x438ad6
cmp edx, 8
lea esi, [ebp - 0x1c]
push 0x16
cmovae esi, dword [ebp - 0x1c]
lea edi, [ecx + 0xb]
push str.360base.dll
mov dword [ebp - 0xc], edi
lea eax, [esi + ecx*2]
push eax
call fcn.004c0040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x438aee
push 0xb
push str.360base.dll
mov byte [ebp - 0x38], 0
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x38]
push 0xb
call fcn.00404fc0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x438be5
lea ecx, [ebp - 0x34]
call fcn.00438760
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call esi
test eax, eax
je 0x438b44
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x1c]
push 0
cmovae ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
push ecx
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x438b7e
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x438b74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438c09
push edx
push ecx
call fcn.004bdd39
add esp, 8
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x438be5
push 0x5010a0
mov ecx, ebx
call fcn.00402f10
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x438bf6
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x438bc8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438c0e
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [ebp - 0x1c]
movups xmmword [ebx], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ebx + 0x10], xmm0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
call fcn.004c8da3
int3
Function at 0x439250
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x16c]
mov ebx, edx
push 0
push eax
mov esi, ecx
call fcn.004c05c0
push esi
push 0x5096ec
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x1d0], 0
push 0x104
push eax
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1cc], 0x67452301
mov dword [ebp - 0x1c8], 0xefcdab89
mov dword [ebp - 0x1c4], 0x98badcfe
mov dword [ebp - 0x1c0], 0x10325476
call fcn.00439140
lea ecx, [ebp - 0x16c]
add esp, 0x1c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4392e0
sub ecx, edx
lea edx, [ebp - 0x16c]
push ecx
lea ecx, [ebp - 0x1d4]
call fcn.0042b740
lea ecx, [ebp - 0x1d4]
call fcn.0042b800
lea ecx, [ebp - 0x1d4]
call fcn.0042b800
movups xmm0, xmmword [ebp - 0x17c]
push 0x40
lea eax, [ebp - 0x64]
push 0
push eax
movups xmmword [ebp - 0x20], xmm0
call fcn.004c05c0
add esp, 0x10
xor esi, esi
nop
movzx eax, byte [ebp + esi - 0x20]
xorps xmm0, xmm0
push eax
push str._02x
lea eax, [ebp - 0x10]
movlpd qword [ebp - 0x10], xmm0
push 8
push eax
call fcn.00439140
lea eax, [ebp - 0x64]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439357
sub eax, edx
lea ecx, [ebp - 0x10]
mov edx, 0x40
lea edi, [ecx + 1]
sub edx, eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x439370
sub ecx, edi
lea eax, [ebp - 0x10]
cmp edx, ecx
cmovl ecx, edx
push ecx
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.004ced30
inc esi
add esp, 0xc
cmp esi, 0x10
jl 0x439330
test ebx, ebx
je 0x4393c1
mov esi, dword [ebp + 8]
push esi
push 0
push ebx
call fcn.004c05c0
lea eax, [ebp - 0x64]
push eax
push 0x5096ec
lea eax, [esi - 1]
push eax
push ebx
call fcn.00439140
push ebx
call fcn.004cefe1
add esp, 0x20
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
Function at 0x43a5d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, ecx
xor ebx, ebx
mov esi, eax
mov cl, byte [ebp + 0xb]
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
jle 0x43a72a
nop
mov eax, 0xaaaaaaab
mul ebx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ebx
sub edx, eax
sub edx, 0
je 0x43a6ed
sub edx, 1
je 0x43a694
sub edx, 1
jne 0x43a720
mov al, byte [edi]
shr al, 6
or al, cl
and al, 0x3f
cmp al, 0x1a
jae 0x43a62c
add al, 0x41
jmp 0x43a646
cmp al, 0x34
jae 0x43a634
add al, 0x47
jmp 0x43a646
cmp al, 0x3e
jae 0x43a63c
sub al, 4
jmp 0x43a646
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
cmp al, 0x1a
jae 0x43a65d
add al, 0x41
mov byte [esi + 1], al
add esi, 2
jmp 0x43a71f
cmp al, 0x34
jae 0x43a66e
add al, 0x47
mov byte [esi + 1], al
add esi, 2
jmp 0x43a71f
cmp al, 0x3e
jae 0x43a67f
sub al, 4
mov byte [esi + 1], al
add esi, 2
jmp 0x43a71f
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi + 1], al
add esi, 2
jmp 0x43a71f
mov al, byte [edi]
shr al, 4
or al, cl
and al, 0x3f
cmp al, 0x1a
jae 0x43a6b0
add al, 0x41
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x43a71f
cmp al, 0x34
jae 0x43a6c3
add al, 0x47
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x43a71f
cmp al, 0x3e
jae 0x43a6d6
sub al, 4
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x43a71f
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x43a71f
mov al, byte [edi]
shr al, 2
cmp al, 0x1a
jae 0x43a6fa
add al, 0x41
jmp 0x43a714
cmp al, 0x34
jae 0x43a702
add al, 0x47
jmp 0x43a714
cmp al, 0x3e
jae 0x43a70a
sub al, 4
jmp 0x43a714
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 3
shl cl, 4
inc edi
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x43a5f0
mov ebx, dword [ebp + 8]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
sub ebx, eax
je 0x43a77d
and cl, 0x3f
cmp cl, 0x1a
jae 0x43a74f
add cl, 0x41
jmp 0x43a76d
cmp cl, 0x34
jae 0x43a759
add cl, 0x47
jmp 0x43a76d
cmp cl, 0x3e
jae 0x43a763
sub cl, 4
jmp 0x43a76d
setne cl
lea ecx, [ecx*4 + 0x2b]
mov byte [esi], cl
inc esi
cmp ebx, 1
jne 0x43a779
mov byte [esi], 0x3d
inc esi
mov byte [esi], 0x3d
inc esi
mov byte [esi], 0
sub esi, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a790
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov ebx, ecx
lea esi, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x43a7a3
sub edi, esi
xor esi, esi
test edi, edi
jle 0x43a864
mov ah, byte [ebp - 1]
nop dword [eax]
mov al, byte [edx]
cmp al, 0x3d
je 0x43a861
nop word [eax + eax]
test al, al
je 0x43a861
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x43a7e4
sub al, 0x41
jmp 0x43a806
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x43a7f0
sub al, 0x47
jmp 0x43a806
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x43a7fc
add al, 4
jmp 0x43a806
cmp al, 0x2b
je 0x43a819
cmp al, 0x2f
je 0x43a815
mov al, 0x40
inc edx
cmp al, 0x40
jne 0x43a80f
mov al, byte [edx]
jmp 0x43a7d0
cmp al, 0x41
je 0x43a861
jmp 0x43a81c
mov al, 0x3f
jmp 0x43a81b
mov al, 0x3e
inc edx
mov ecx, esi
and ecx, 3
jmp dword [ecx*4 + 0x43a870]
mov ah, al
shl ah, 2
jmp 0x43a858
mov cl, al
shr cl, 4
or cl, ah
mov ah, al
mov byte [ebx], cl
inc ebx
shl ah, 4
jmp 0x43a858
mov cl, al
shr cl, 2
or cl, ah
mov ah, al
mov byte [ebx], cl
inc ebx
shl ah, 6
jmp 0x43a858
mov cl, ah
or cl, al
mov byte [ebx], cl
inc ebx
inc esi
cmp esi, edi
jl 0x43a7c0
mov ecx, dword [ebp - 8]
pop edi
sub ebx, ecx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a880
Capabilities:
Check if file exists

Disassembly:
push ecx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a8b3
push 0x505270
push edi
call fcn.004cd974
add esp, 8
test eax, eax
je 0x43a8b3
mov edx, eax
mov ecx, esi
call fcn.00437c90
mov eax, esi
pop edi
pop esi
pop ecx
ret
push 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x50102d
mov byte [esi], 0
call fcn.00404000
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x43a8e0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004c05c0
add esp, 0xc
mov dword [ebp - 0x218], 1
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push str.Path
push 0x5028c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43aabb
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43aabb
push 0xc
xor eax, eax
mov dword [ebp - 0x238], 0
push str.360Safe.exe
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
call fcn.00403e30
lea eax, [ebp - 0x248]
push eax
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x230]
call fcn.004046f0
mov edx, dword [ebp - 0x234]
add esp, 4
cmp edx, 8
jb 0x43a9ee
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43a9e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43aadf
push edx
push ecx
call fcn.004bdd39
add esp, 8
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x25
push str.base::Is360SafeRegExistEx
push str.__s__d___file_path_exe___s
call fcn.0041f720
add esp, 0x10
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x21c]
test eax, eax
je 0x43aa85
cmp edx, 8
jb 0x43aa72
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43aa68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43aae4
push edx
push ecx
call fcn.004bdd39
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
cmp edx, 8
jb 0x43aabb
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43aab1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43aae4
push edx
push ecx
call fcn.004bdd39
add esp, 8
push 0x29
push str.base::Is360SafeRegExistEx
push str.__s__d___Is360SafeRegExistEx_not_exist
call fcn.0041f720
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret
call fcn.004c8da3
call fcn.004c8da3
int3
Function at 0x43e800
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
cmp dword [ebx + 0x10], 0
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], 0
je 0x43e9b8
push 0x208
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.004c05c0
movzx eax, byte [ebp + 0x18]
add esp, 0xc
shl eax, 8
inc eax
mov dword [ebp - 0x424], 1
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x420], 0x206
jb 0x43e876
mov ebx, dword [ebx]
lea ecx, [ebp - 0x428]
push ecx
push eax
push 0
push ebx
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43e9a7
cmp dword [edi + 0x14], 8
jb 0x43e89d
mov edi, dword [edi]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push edi
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43e9a7
push 0x208
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.004c05c0
add esp, 0xc
cmp dword [esi + 0x10], 0
je 0x43e925
cmp dword [esi + 0x14], 8
jb 0x43e8ec
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x41c]
push eax
push str._s_s
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.00419550
add esp, 0x14
test eax, eax
jns 0x43e95a
push 0x268
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d____snwprintf_s_failed.
jmp 0x43e9c7
lea eax, [ebp - 0x41c]
push eax
push 0x505268
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.00419550
add esp, 0x10
test eax, eax
jns 0x43e95a
push 0x26d
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d____snwprintf_s_failed.
jmp 0x43e9c7
lea eax, [ebp - 0x214]
push eax
push 0x272
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d___file_path_is:__s
call fcn.0041f720
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43e9cf
push 0x276
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d___file_is_exist.
call fcn.0041f720
add esp, 0xc
mov ebx, 1
jmp 0x43e9d1
push 0x25f
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d___RegOpenKey_or_RegQueryValueEx_failed.
jmp 0x43e9c7
push 0x24e
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d___root__strSubKey_is_NULL.
call fcn.0041f720
add esp, 0xc
xor ebx, ebx
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x43e9e2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret 0x14
Function at 0x43edb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
cmp dword [ebx + 0x10], 0
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], 0
je 0x43ef31
cmp dword [edi + 0x10], 0
je 0x43ef31
cmp dword [eax + 0x10], 0
je 0x43ef31
cmp dword [esi + 0x10], 0
je 0x43ef31
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x208
push 0
push eax
call fcn.004c05c0
add esp, 0xc
mov dword [ebp - 0x41c], 1
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x420], 0x206
mov dword [ebp - 0x424], 0x206
jb 0x43ee5c
mov ebx, dword [ebx]
lea eax, [ebp - 0x428]
push eax
push 0x101
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ef20
cmp dword [edi + 0x14], 8
jb 0x43ee86
mov edi, dword [edi]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
push edi
push dword [ebp - 0x428]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
test eax, eax
jne 0x43ef20
mov eax, dword [ebp - 0x42c]
cmp dword [eax + 0x14], 8
jb 0x43eebe
mov eax, dword [eax]
lea ecx, [ebp - 0x424]
push ecx
lea ecx, [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x41c]
push ecx
push 0
push eax
push dword [ebp - 0x428]
call edi
test eax, eax
jne 0x43ef20
lea eax, [ebp - 0x210]
push eax
push 0x312
push str.base::RivalMonitor::CheckInstalledRegFile
push str.__s__d___installdir_is:__s
call fcn.0041f720
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x43ef08
mov esi, dword [esi]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.0043f110
mov bl, al
jmp 0x43ef4a
push 0x30e
push str.base::RivalMonitor::CheckInstalledRegFile
push str.__s__d___RegOpenKey_or_RegQueryValueEx_failed.
jmp 0x43ef40
push 0x2f9
push str.base::RivalMonitor::CheckInstalledRegFile
push str.__s__d___root__SubKey__value_name1__value_name2__value_filename_is_NULL.
call fcn.0041f720
add esp, 0xc
xor bl, bl
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x43ef5b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret 0x18
Function at 0x43ef70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x54c384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
cmp dword [ebx + 0x10], 0
mov edi, dword [ebp + 0x10]
je 0x43f0e0
cmp dword [esi + 0x10], 0
je 0x43f0e0
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004c05c0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x43efe5
push 0x332
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___SHGetSpecialFolderPath_error.
jmp 0x43f0ef
cmp dword [ebx + 0x14], 8
jb 0x43efed
mov ebx, dword [ebx]
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x43f013
push 0x339
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___PathAppend_error.
jmp 0x43f0ef
lea eax, [ebp - 0x210]
push eax
push 0x33d
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___installdir_is:__s
call fcn.0041f720
add esp, 0x10
cmp dword [edi + 0x10], 0
jne 0x43f0af
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.004c05c0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x43f055
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x43f0f7
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43f0f7
push 0x345
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___find_file_is_success.
call fcn.0041f720
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 0x14], 8
jb 0x43f0b7
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x43f0bf
mov esi, dword [esi]
push edi
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.0043f110
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret 0x10
push 0x329
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___SubKey__wstrAppendFile_is_NULL.
call fcn.0041f720
add esp, 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bdaf8
mov esp, ebp
pop ebp
ret 0x10