joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ef24
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov dword [esp + 4], ecx
mov esi, edx
mov dword [esp], eax
mov dword [esp + 0x1c], 0xffffffff
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0xc
mov eax, 3
and eax, esi
cmp eax, 2
ja 0x42ef68
mov edx, 1
and edx, esi
mov ecx, 8
and ecx, esi
and edx, ecx
je 0x42ef70
or eax, 0xffffffff
jmp 0x42f145
test eax, eax
je 0x42ef99
mov edi, 0x40000000
mov edx, 0x42f150
mov eax, dword [esp]
call fcn.00414c0c
test eax, eax
je 0x42ef92
mov dword [esp + 4], 1
mov ebp, 2
jmp 0x42efa3
mov edi, 0x80000000
mov ebp, 3
cmp esi, 0x10a
jne 0x42f024
push 0
push 0x80
push 3
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, 0x80000000
or eax, edi
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42f06d
push 0
push 0x80
push ebp
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
push edi
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42f06d
call sub.kernel32.dll_GetLastError_2
mov dword [0x4359c4], eax
cmp dword [0x4359c4], 0x6e
jne 0x42f01c
mov dword [0x4359c4], 2
or eax, 0xffffffff
jmp 0x42f145
push 0
push 0x80
push ebp
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push eax
push edi
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42f06d
call sub.kernel32.dll_GetLastError_2
mov dword [0x4359c4], eax
cmp dword [0x4359c4], 0x6e
jne 0x42f065
mov dword [0x4359c4], 2
or eax, 0xffffffff
jmp 0x42f145
push 8
push ebx
call sub.msvcrt.dll__open_osfhandle
add esp, 8
mov edi, eax
test esi, 8
je 0x42f13c
mov eax, edi
call fcn.0041dc14
test eax, eax
jne 0x42f13c
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
test eax, eax
je 0x42f13c
mov word [esp + 8], 0
mov dword [esp + 0x10], 0xffffffff
push 2
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov ebp, eax
call sub.kernel32.dll_GetLastError_2
mov dword [0x4359c4], eax
cmp ebp, 0xffffffff
jne 0x42f0ee
cmp dword [0x4359c4], 0
je 0x42f0ee
cmp edi, 0xffffffff
je 0x42f0e9
push edi
call sub.msvcrt.dll__close
pop ecx
or eax, 0xffffffff
jmp 0x42f145
push 0
lea eax, [esp + 0x10]
push eax
push 1
lea eax, [esp + 0x14]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
mov ebp, eax
test ebp, ebp
jne 0x42f11d
xor eax, eax
mov dword [esp + 0x10], eax
push 2
lea eax, [esp + 0x14]
push eax
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
cmp word [esp + 8], 0x1a
jne 0x42f13c
mov dword [esp + 0x10], 0xffffffff
push 2
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, edi
call fcn.0042f268
mov eax, edi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42f4d4
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffff8
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0x5c
mov word [esp + 6], 0
push esp
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
ja 0x42f500
xor eax, eax
pop ecx
pop edx
ret
mov al, 1
pop ecx
pop edx
ret

Function at 0x42f508
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffddc
mov word [esp + 8], ax
mov word [esp + 0xa], 0x3a
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
ja 0x42f53b
mov al, 1
jmp 0x42f580
cmp eax, 2
je 0x42f57e
cmp eax, 5
je 0x42f57e
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x10]
push eax
push 0x104
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
jne 0x42f57e
call sub.kernel32.dll_GetLastError_2
cmp eax, 5
jne 0x42f57e
mov al, 1
jmp 0x42f580
xor eax, eax
add esp, 0x224
ret

Function at 0x42fa58
Capabilities:
Set console window title

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
test ebx, ebx
je 0x42fb2a
mov eax, dword [0x435ab4]
cmp dword [eax], 0
jne 0x42fb2a
mov eax, dword [0x4359f8]
cmp byte [eax], 0
jne 0x42fb2a
mov eax, 0x20c
call fcn.00403f2c
mov dword [esp], eax
cmp dword [esp], 0
je 0x42fb2a
push 0x104
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetConsoleTitleW
mov esi, eax
test esi, esi
je 0x42fb2a
mov eax, ebx
call fcn.00419fe4
add eax, esi
add eax, dword [0x44e958]
add eax, 0xa
mov edx, eax
add edx, edx
mov eax, esp
call fcn.00403f60
cmp dword [esp], 0
je 0x42fb2a
mov eax, dword [0x435b30]
cmp byte [eax], 0
je 0x42faed
mov eax, dword [0x44e958]
add eax, eax
add eax, dword [esp]
mov edx, ebx
call fcn.00419ff4
jmp 0x42fb19
mov edx, 0x42fb30
mov eax, dword [esp]
call fcn.0041a008
mov eax, dword [esp]
call fcn.00419fe4
mov dword [0x44e958], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.0041a008
mov eax, dword [0x435b30]
mov byte [eax], 1
mov eax, dword [esp]
push eax
call sub.kernel32.dll_SetConsoleTitleW
mov eax, dword [esp]
call fcn.00403f48
pop edx
pop esi
pop ebx
ret
Function at 0x4300c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], edx
mov dword [esp], eax
mov edi, dword [esp]
movzx edi, word [edi]
mov eax, dword [esp]
movzx eax, word [eax + 2]
mov word [esp + 8], ax
mov eax, dword [esp]
movzx eax, word [eax + 4]
mov word [esp + 0xa], ax
mov ebp, dword [esp]
movzx ebp, word [ebp + 6]
mov ebx, dword [esp + 4]
mov dword [esp + 0xc], 8
movzx edx, word [ebx]
mov eax, edi
call fcn.00430080
mov edi, eax
add ebx, 2
movzx eax, word [ebx]
add word [esp + 8], ax
add ebx, 2
movzx eax, word [ebx]
add word [esp + 0xa], ax
add ebx, 2
movzx edx, word [ebx]
mov eax, ebp
call fcn.00430080
mov ebp, eax
add ebx, 2
mov esi, edi
xor si, word [esp + 0xa]
movzx edx, word [ebx]
mov eax, esi
call fcn.00430080
mov esi, eax
add ebx, 2
movzx eax, word [esp + 8]
xor ax, bp
add ax, si
movzx edx, word [ebx]
call fcn.00430080
add ebx, 2
add si, ax
xor di, ax
xor bp, si
xor si, word [esp + 8]
xor ax, word [esp + 0xa]
mov word [esp + 8], ax
mov word [esp + 0xa], si
dec dword [esp + 0xc]
jne 0x430103
movzx edx, word [ebx]
mov eax, edi
call fcn.00430080
mov edi, eax
add ebx, 2
mov eax, dword [esp]
mov word [eax], di
movzx eax, word [esp + 0xa]
add ax, word [ebx]
mov edx, dword [esp]
mov word [edx + 2], ax
add ebx, 2
movzx eax, word [esp + 8]
add ax, word [ebx]
mov edx, dword [esp]
mov word [edx + 4], ax
add ebx, 2
movzx edx, word [ebx]
mov eax, ebp
call fcn.00430080
mov ebp, eax
mov eax, dword [esp]
mov word [eax + 6], bp
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4304c8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00406a68
xor eax, eax
push ebp
push 0x43064a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 5
mov eax, dword [ebp - 4]
call fcn.00407044
push eax
mov eax, dword [0x438c4c]
push eax
call sub.kernel32.dll_FindResourceW
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
je 0x430634
push esi
mov eax, dword [0x438c4c]
push eax
call sub.kernel32.dll_LoadResource
mov dword [edi + 8], eax
cmp dword [edi + 8], 0
je 0x430634
mov eax, 0x430668
call fcn.0042ffc4
call fcn.0042ffb8
mov eax, dword [edi + 8]
push eax
call sub.kernel32.dll_LockResource
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
push eax
mov eax, dword [0x438c4c]
push eax
call sub.kernel32.dll_SizeofResource
xor edx, edx
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], edx
cmp byte [ebp - 5], 0
je 0x430609
mov eax, dword [edi + 0x28]
call fcn.00403f2c
mov dword [edi + 0x34], eax
mov eax, dword [edi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x34]
mov dword [edi + 0x14], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
jmp 0x4305c8
lea edx, [edi + 0x18]
mov eax, dword [edi + 0x10]
mov ecx, 8
call fcn.004040d0
lea eax, [edi + 0x18]
call fcn.004301e0
mov edx, dword [edi + 0x14]
lea eax, [edi + 0x18]
mov ecx, 8
call fcn.004040d0
add dword [edi + 0x20], 8
adc dword [edi + 0x24], 0
add dword [edi + 0x10], 8
add dword [edi + 0x14], 8
mov eax, dword [edi + 0x28]
mov edx, dword [edi + 0x2c]
sub eax, dword [edi + 0x20]
sbb edx, dword [edi + 0x24]
cmp edx, 0
jne 0x4305e0
cmp eax, 8
jae 0x430590
jmp 0x4305e2
jge 0x430590
call fcn.00430074
mov eax, dword [edi + 0x28]
mov ecx, eax
add ecx, dword [edi + 0x34]
dec ecx
mov dword [edi + 0x10], ecx
movzx eax, byte [ecx]
mov byte [edi + 0x30], al
mov bl, 1
movzx eax, al
mov edx, dword [edi + 0x28]
sub edx, eax
dec edx
mov dword [edi + 0x38], edx
jmp 0x43062b
mov eax, dword [edi + 0x28]
call fcn.00403f2c
mov ebx, eax
mov dword [edi + 0x34], ebx
mov edx, ebx
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x28]
call fcn.004040d0
mov bl, 1
mov eax, dword [edi + 0x28]
mov dword [edi + 0x38], eax
mov eax, dword [edi + 8]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430651
lea eax, [ebp - 4]
call fcn.00406984
ret
Function at 0x4063fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406422
xor eax, eax
test eax, eax
je 0x406434
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406434
xor ecx, ecx
jmp 0x406437
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406523
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232c4], 0
push esi
jne 0x40655a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406534
mov dword [ecx*4 + 0x4232c0], eax
inc ecx
cmp ecx, 0x100
jl 0x40652f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40658b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232c0]
xor eax, esi
inc ecx
dec edx
jne 0x40656d
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1ddd1637
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, str.88D
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x387828dc
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x403838
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x208
push 0
push eax
call fcn.0042f8e0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4038a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403898
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40390e
mov esi, 0x80004005
jmp 0x40390e
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x4038cd
push 1
push 0x44b7a0
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00403654
mov esi, eax
test esi, esi
js 0x40390e
mov esi, 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004036a3
mov esi, eax
test esi, esi
js 0x40390e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
je 0x403881
test edi, edi
je 0x40390e
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00402195
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e06f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404115
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4041df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404145
xor esi, esi
jmp 0x4041df
cmp eax, 3
je 0x404156
push 0
push edi
call fcn.004041e7
test eax, eax
jne 0x40413e
movzx ecx, word [edi]
mov eax, edi
push ebx
xor ebx, ebx
test cx, cx
je 0x4041cc
push 0x5c
pop edx
cmp cx, dx
jne 0x40416d
mov ebx, eax
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x404166
test ebx, ebx
je 0x4041cc
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.00404115
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x4041de
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4041c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x4041b9
xor esi, esi
inc esi
jmp 0x4041de
test esi, esi
jle 0x4041de
movzx esi, si
or esi, 0x80070000
jmp 0x4041de
xor esi, esi
jmp 0x4041de
mov esi, 0x80070003
push esi
push 0x72
push str.dirutil.cpp
call fcn.00403821
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x4041e7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40420b
test al, 0x10
je 0x40420b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x404208
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x409ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004072f8
mov esi, eax
test esi, esi
jns 0x409b0d
push str.Failed_to_format_variable_string.
jmp 0x409b7f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409b44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409b30
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409b40
cmp esi, 0x80070003
jne 0x409b4b
xor esi, esi
jmp 0x409b4b
test al, 0x10
je 0x409b4b
xor ebx, ebx
inc ebx
test esi, esi
jns 0x409b64
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.00440237
add esp, 0x10
jmp 0x409b87
push 0
push 0
push ebx
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040827b
mov esi, eax
test esi, esi
jns 0x409b87
push str.Failed_to_set_variable.
push esi
call fcn.00440237
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.00402782
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x409b9a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004072f8
mov esi, eax
test esi, esi
jns 0x409bd0
push str.Failed_to_format_variable_string.
push esi
call fcn.00440237
pop ecx
pop ecx
jmp 0x409c5b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409bf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409c1b
movzx esi, si
or esi, 0x80070000
jmp 0x409c1b
test al, 0x10
je 0x409c16
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040821f
mov esi, eax
test esi, esi
jns 0x409c1b
push str.Failed_to_set_directory_search_path_variable.
jmp 0x409bc3
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x409c44
cmp esi, 0x80070003
je 0x409c44
test esi, esi
jns 0x409c5b
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.00440237
add esp, 0x10
jmp 0x409c5b
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.00440726
add esp, 0x14
xor esi, esi
push dword [ebp - 4]
call fcn.00402782
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x409c6d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004072f8
mov esi, eax
test esi, esi
jns 0x409c9d
push str.Failed_to_format_variable_string.
jmp 0x409d30
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409d0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x409cf8
cmp esi, 3
je 0x409cf8
test esi, esi
je 0x409d15
jle 0x409cce
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x409cd5
mov esi, 0x80004005
push esi
push 0x28b
push str.search.cpp
call fcn.00403821
push dword [edi + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.00440237
add esp, 0xc
jmp 0x409d38
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.00440726
add esp, 0x10
jmp 0x409d15
test al, 0x10
jne 0x409d15
xor ebx, ebx
inc ebx
push 0
push 0
push ebx
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040827b
mov esi, eax
test esi, esi
jns 0x409d38
push str.Failed_to_set_variable.
push esi
call fcn.00440237
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.00402782
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x409d4b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.004072f8
mov esi, eax
test esi, esi
jns 0x409d81
push str.Failed_to_format_variable_string.
push esi
call fcn.00440237
pop ecx
pop ecx
jmp 0x409e04
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409dcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409da4
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409dee
cmp esi, 0x80070003
je 0x409dee
test esi, esi
jns 0x409e04
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.00440237
add esp, 0x10
jmp 0x409e04
test al, 0x10
jne 0x409dee
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040821f
mov esi, eax
test esi, esi
jns 0x409da4
push str.Failed_to_set_variable_to_file_search_path.
jmp 0x409d74
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.00440726
add esp, 0x10
xor esi, esi
push dword [ebp - 4]
call fcn.00402782
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40a28b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push eax
mov edi, dword [ebx + 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
push dword [ebp + 0xc]
call fcn.004072f8
mov esi, eax
test esi, esi
jns 0x40a2d0
push str.Failed_to_format_key_string.
push esi
call fcn.00440237
pop ecx
pop ecx
jmp 0x40a3d5
neg edi
lea eax, [ebp - 0xc]
push eax
sbb edi, edi
and edi, 0x100
inc edi
push edi
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.00440f6c
mov esi, eax
test esi, esi
js 0x40a38b
xor edi, edi
inc edi
cmp dword [ebx + 0x20], 0
je 0x40a3a7
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.004072f8
mov esi, eax
test esi, esi
jns 0x40a320
push str.Failed_to_format_value_string.
jmp 0x40a2c3
xor ecx, ecx
lea eax, [ebp - 0x10]
push ecx
push ecx
push eax
push ecx
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
sub eax, 0
je 0x40a3a7
dec eax
sub eax, 1
je 0x40a374
test esi, esi
je 0x40a3a7
jle 0x40a353
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40a35a
mov esi, 0x80004005
push esi
push 0x322
push str.search.cpp
call fcn.00403821
push str.Failed_to_query_registry_key_value.
jmp 0x40a2c3
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.00440726
add esp, 0x10
jmp 0x40a3a5
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x40a3c7
push str.Registry_key_not_found._Key___ls
push 2
call fcn.00440726
add esp, 0xc
xor edi, edi
push 0
push 0
push edi
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.0040827b
mov esi, eax
test esi, esi
jns 0x40a3ec
push str.Failed_to_set_variable.
jmp 0x40a2c3
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.00440237
add esp, 0xc
test esi, esi
jns 0x40a3ec
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.00440726
add esp, 0x10
push dword [ebp - 4]
call fcn.00402782
push dword [ebp - 8]
call fcn.00402782
cmp dword [ebp - 0xc], 0
je 0x40a40b
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8