joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42eab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x894
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
cmp dword [eax + 4], 0xffffffff
jne 0x42eba3
mov ebx, dword [ebp + 8]
xor edi, edi
nop word [eax + eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x894]
mov dword [ebp - 0x894], 0x7f
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x42ec0a
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x88c], 0x800
push eax
lea eax, [ebp - 0x888]
push eax
lea eax, [ebp - 0x890]
push eax
push 0
lea eax, [ebp - 0x88]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42eb9d
cmp dword [ebp - 0x88c], eax
jle 0x42eb9d
mov eax, dword [esi + 0x20]
test eax, eax
je 0x42eb5b
push eax
call fcn.005fa0fb
add esp, 4
lea eax, [ebp - 0x88]
push eax
call fcn.00628843
add esp, 4
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x88]
mov dword [esi + 8], 2
lea edx, [ebp - 0x888]
mov dword [esi + 0x14], eax
mov ecx, esi
push dword [ebp - 0x88c]
push dword [ebp - 0x890]
push dword [ebp + 0xc]
push ebx
call fcn.0042e210
add esp, 0x10
inc edi
jmp 0x42eae0
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x88c]
push ecx
lea ecx, [ebp - 0x888]
mov dword [ebp - 0x88c], 0x800
push ecx
lea ecx, [ebp - 0x890]
push ecx
push 0
push dword [eax + 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42ec0a
mov ecx, dword [ebp - 0x88c]
test ecx, ecx
jle 0x42ec0a
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x888]
push ecx
push dword [ebp - 0x890]
mov dword [esi + 8], 2
mov ecx, esi
push dword [ebp + 0xc]
mov eax, dword [eax + 4]
push edi
mov dword [esi + 0x14], eax
call fcn.0042e210
add esp, 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret

Function at 0x42ec60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
xor edi, edi
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0x7f
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x42ece4
lea eax, [ebp - 0x88]
mov dword [esi + 8], 2
mov dword [esi + 0x14], eax
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ecc0
sub eax, edx
mov ecx, esi
inc eax
lea edx, [ebp - 0x88]
push eax
push 1
push dword [ebp + 0xc]
push ebx
call fcn.0042e210
add esp, 0x10
inc edi
jmp 0x42ec80
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x42ee00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
test esi, esi
je 0x42ef4f
push dword [ebp + 0xc]
lea edx, [ebp - 0x98]
mov dword [ebp - 0x8c], 0x80
push dword [ebp + 8]
mov ecx, esi
call fcn.00416ec0
add esp, 8
test eax, eax
js 0x42efdb
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x42ee5a
push eax
call fcn.005fa0fb
add esp, 4
push esi
call fcn.00628843
add esp, 4
mov dword [ebx + 0x20], eax
mov edx, esi
mov ecx, str.____________________________________
push 0
push 0
call fcn.0045b7d0
mov edi, dword [ebp - 0x98]
add esp, 8
cmp eax, 1
je 0x42eeac
mov edx, dword [ebx + 0x20]
mov ecx, ebx
call fcn.0042dde0
test eax, eax
jns 0x42ef1d
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push 0
jmp 0x42eef5
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push str.DisplayString
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42eede
cmp dword [ebp - 0x8c], eax
jle 0x42eede
cmp byte [ebp - 0x88], al
jne 0x42ef10
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push str.Layout_Text
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42ef1d
cmp dword [ebp - 0x8c], eax
jle 0x42ef1d
cmp byte [ebp - 0x88], al
je 0x42ef1d
lea edx, [ebp - 0x88]
mov ecx, ebx
call fcn.0042dca0
push dword [ebp - 0x94]
mov edx, esi
mov dword [ebx + 0x10], esi
push edi
mov ecx, ebx
call fcn.0042ed80
add esp, 8
mov ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0xc]
xor edx, edx
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0042ed00
test eax, eax
lea edx, [ebp - 0x98]
mov ecx, 0
cmovs ecx, eax
mov dword [ebp - 0x8c], ecx
mov ecx, str.SysdiagDisabledAutoruns
push edi
push esi
call fcn.00416ec0
add esp, 0x10
test eax, eax
js 0x42efd3
push dword [ebp - 0x94]
mov esi, dword [ebp - 0x98]
xor edx, edx
push esi
mov ecx, ebx
mov dword [ebx + 0xc], 1
call fcn.0042ed00
add esp, 8
mov dword [ebx + 0xc], 0
mov ebx, dword [ebp - 0x8c]
test eax, eax
cmovs ebx, eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x8c]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x42eff0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], edi
mov eax, dword [edx]
cmp eax, 0xffffffff
jne 0x42f122
xor eax, eax
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x158], eax
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x154], 0x104
push ecx
lea ecx, [ebp - 0x150]
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x42f132
lea eax, [ebp - 0x150]
push str.SysdiagDisabledAutoruns
push eax
call fcn.00628761
add esp, 8
push edi
push ebx
test eax, eax
je 0x42f08e
lea edx, [ebp - 0x150]
mov ecx, esi
call fcn.0042ee00
mov eax, dword [ebp - 0x158]
add esp, 8
inc eax
jmp 0x42f020
lea edx, [ebp - 0x160]
mov ecx, str.SysdiagDisabledAutoruns
call fcn.00416ec0
add esp, 8
test eax, eax
js 0x42f116
mov ebx, dword [ebp - 0x160]
xor edi, edi
nop dword [eax]
lea eax, [ebp - 0x170]
mov dword [ebp - 0x154], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x150]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x42f109
push dword [ebp - 0x15c]
lea edx, [ebp - 0x150]
mov dword [esi + 0xc], 1
push ebx
mov ecx, esi
call fcn.0042ee00
add esp, 8
mov dword [esi + 0xc], 0
inc edi
jmp 0x42f0b0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x158]
inc eax
jmp 0x42f020
test eax, eax
jne 0x42f132
push edi
push ebx
xor edx, edx
call fcn.0042ee00
add esp, 8
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x18]
test eax, eax
je 0x42f14c
push eax
call fcn.005fa0fb
add esp, 4
mov dword [esi + 0x20], 0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
mov dword [esi + 0x10], 0
xor ecx, ebp
mov dword [esi + 0x14], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x18], 0
pop esi
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x42f310
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
mov eax, dword [0x70e00c]
xor eax, esp
mov dword [esp + 0x1a0], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
push edi
test edx, edx
jle 0x42f3e5
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [eax]
mov eax, dword [ecx]
push 0x30
mov dword [esp + 0x14], eax
push 0
mov esi, dword [eax]
lea eax, [esp + 0x30]
push eax
call fcn.005f46f0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x50], eax
mov eax, 0x6e9c10
mov dword [esp + 0x4c], fcn.004206e0
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x42f3a6
test cl, cl
je 0x42f3a2
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x42f3a6
add esi, 2
add eax, 2
test cl, cl
jne 0x42f386
xor eax, eax
jmp 0x42f3ab
sbb eax, eax
or eax, 1
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x28]
push 0
push reloc.OLEAUT32.dll_SysReAllocString
test eax, eax
jne 0x42f3fc
add edx, 4
call fcn.0042f1f0
add esp, 8
test eax, eax
jle 0x42f3cf
add ebx, eax
mov ecx, dword [esp + 0x14]
add ecx, 0x14
sub dword [esp + 0x1c], 1
mov dword [esp + 0x14], ecx
jne 0x42f350
mov ecx, dword [esp + 0x1ac]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
call fcn.0042f1f0
add esp, 8
test eax, eax
jle 0x42f40a
add ebx, eax
xor esi, esi
nop dword [eax]
lea eax, [esp + 0x58]
mov dword [esp + 0x24], 0x104
push eax
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x74]
push eax
push esi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x42f3cf
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x71701c]
or eax, 0xf003f
push eax
push 0
lea eax, [esp + 0x6c]
push eax
push reloc.WS2_32.dll_closesocket
call edi
cmp eax, 5
jne 0x42f47e
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x71701c]
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x6c]
push eax
push reloc.WS2_32.dll_closesocket
call edi
test eax, eax
jne 0x42f4ab
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x28]
mov edx, dword [esp + 0x10]
push eax
push edi
call fcn.0042f1f0
add esp, 8
test eax, eax
jle 0x42f49e
add ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
inc esi
jmp 0x42f410
Function at 0x4301d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x424], edx
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0x420], xmm0
mov al, byte [esi]
test al, al
je 0x43020c
nop
cmp al, 0x7b
je 0x43020c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x430200
push 0
lea edx, [ebp - 0x420]
mov ecx, str.HKCRCLSID
call fcn.00416da0
mov ebx, dword [ebp - 0x420]
mov edi, eax
add esp, 4
test edi, edi
js 0x430397
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [0x71701c]
or eax, 0xf003f
push eax
push 0
push esi
push ebx
call edi
cmp eax, 5
jne 0x43026c
lea eax, [ebp - 0x40c]
push eax
mov eax, dword [0x71701c]
or eax, 0x20019
push eax
push 0
push esi
push ebx
call edi
test eax, eax
jne 0x430392
mov esi, dword [ebp - 0x40c]
lea eax, [ebp - 0x410]
push eax
mov eax, dword [0x71701c]
or eax, 0xf003f
push eax
push 0
push str.InprocServer32
push esi
call edi
cmp eax, 5
jne 0x4302b7
lea eax, [ebp - 0x410]
push eax
mov eax, dword [0x71701c]
or eax, 0x20019
push eax
push 0
push str.InprocServer32
push esi
call edi
test eax, eax
jne 0x4302c3
mov ebx, dword [ebp - 0x410]
jmp 0x43030e
lea eax, [ebp - 0x414]
push eax
mov eax, dword [0x71701c]
or eax, 0xf003f
push eax
push 0
push str.Shellopencommand
push esi
call edi
cmp eax, 5
jne 0x430300
lea eax, [ebp - 0x414]
push eax
mov eax, dword [0x71701c]
or eax, 0x20019
push eax
push 0
push str.Shellopencommand
push esi
call edi
test eax, eax
jne 0x43038b
mov ebx, dword [ebp - 0x414]
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x400
push eax
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x430355
xor edi, edi
cmp dword [ebp - 0x418], edi
jbe 0x430367
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x408]
push eax
call fcn.0042f940
jmp 0x430367
cmp eax, 0xea
mov edi, 0xfffffff2
mov ecx, 0xffffffe4
cmove edi, ecx
mov eax, ebx
or eax, 0
je 0x430375
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x420]
mov eax, esi
or eax, 0
je 0x430397
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430397
mov edi, 0xfffffff2
jmp 0x43037b
mov edi, 0xfffffff2
mov eax, ebx
or eax, dword [ebp - 0x41c]
je 0x4303a8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x4317c0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x240]
mov dword [ebp - 0x214], 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
xor eax, eax
cmp word [ebp - 0x240], 9
push 0x6ea0a0
sete al
add eax, 0x3ea
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
jne 0x431823
lea eax, [esi - 2]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
jne 0x431846
lea eax, [edi - 0xc]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x21c], eax
test eax, eax
jne 0x431873
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
mov eax, 0xffffffe4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x431990
cmp eax, 0x104
ja 0x431990
push 0x73c670
push 0
push 0x6ed0a8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x431990
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.00404160
add esp, 4
mov esi, eax
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x73c670
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
test esi, esi
je 0x431917
push dword [ebp - 0x214]
call fcn.004041c0
add esp, 4
cmp ebx, 0xffffffff
jne 0x431939
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop ebx
pop edi
mov eax, 0xfffffffb
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 0x210]
test eax, eax
mov edx, 0xfffffff3
cmove ecx, edx
push ebx
mov dword [ebp - 0x210], ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [ebp - 0x210]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov ecx, dword [ebp - 4]
mov eax, 0xffffffe9
pop edi
xor ecx, ebp
pop esi
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x431cb0
Capabilities:
Delete file
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x746fa4
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov esi, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 0
push 0x73c668
call esi
push 0
push 0x73c66c
mov ebx, eax
call esi
push 0
push 0x73c8f8
mov edi, eax
call esi
mov esi, eax
test ebx, ebx
je 0x431cf2
push ebx
call fcn.0060b444
add esp, 4
test edi, edi
je 0x431cff
push edi
call fcn.0060b444
add esp, 4
test esi, esi
je 0x431d13
push 8
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp word [0x73c670], 0
pop edi
pop esi
pop ebx
je 0x431d2b
push 0x73c670
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0x746fa4
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
ret
Function at 0x431d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x818], eax
mov ebx, ecx
mov eax, dword [0x6eaad4]
push edi
mov dword [ebp - 0x810], eax
mov al, byte [0x6eaad8]
push 0x3ff
mov byte [ebp - 0x80c], al
lea eax, [ebp - 0x80b]
push 0
push eax
mov dword [ebp - 0x814], edx
call fcn.005f46f0
push 0x6ec314
push ebx
call fcn.005faab0
add esp, 0x14
test eax, eax
jne 0x431e5d
push 0x6ec318
push ebx
call fcn.005faab0
add esp, 8
test eax, eax
jne 0x431e5d
lea eax, [ebp - 0x408]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
test eax, eax
jne 0x431e14
pop edi
pop esi
mov eax, 0xfffffff2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x408]
dec edi
nop dword [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x431e20
mov ax, word [0x6e9fec]
mov esi, ebx
mov word [edi], ax
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x431e35
lea edi, [ebp - 0x408]
sub ebx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x431e45
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x431e7c
push 0x3fe
lea eax, [ebp - 0x408]
push ebx
push eax
call fcn.00601480
mov ax, word [0x6e9fec]
add esp, 0xc
mov byte [ebp - 0xa], 0
cmp dword [ebp - 0x814], 0
je 0x431ebd
lea edx, [ebp - 0x408]
lea esi, [edx + 1]
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x431e90
sub edx, esi
cmp byte [ebp + edx - 0x409], 0x5c
je 0x431ebd
lea edi, [ebp - 0x408]
dec edi
nop word [eax + eax]
mov cl, byte [edi + 1]
lea edi, [edi + 1]
test cl, cl
jne 0x431eb0
mov word [edi], ax
push 0
lea eax, [ebp - 0x80c]
push eax
push 0x3ff
push 0
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_SearchPathA]
test eax, eax
jne 0x431ef3
mov ecx, 0x100
lea esi, [ebp - 0x408]
lea edi, [ebp - 0x80c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x810]
mov byte [ebp - 0x40d], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431f03
sub ecx, edx
inc ecx
lea eax, [ecx + ecx*2]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
lea ebx, [edi + edi]
push ebx
call fcn.0060a1f7
mov esi, eax
add esp, 4
test esi, esi
jne 0x431f3d
pop edi
lea eax, [esi - 0xc]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
lea eax, [edi - 1]
push eax
lea eax, [ebp - 0x810]
push eax
push esi
call fcn.006013cf
add esp, 0xc
xor eax, eax
mov word [ebx + esi - 2], ax
push esi
push dword [ebp - 0x818]
call dword [0x72c4e0]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x431f80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.0065e090
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movq xmm0, qword [0x6ec31c]
push ebx
push esi
push edi
mov dword [ebp - 0x1018], eax
mov ebx, ecx
mov ax, word [0x6ec324]
push 0x7fe
mov word [ebp - 0x1008], ax
lea eax, [ebp - 0x1006]
push 0
push eax
mov dword [ebp - 0x1014], edx
movq qword [ebp - 0x1010], xmm0
call fcn.005f46f0
push 0x6ec328
push ebx
call fcn.005f91e9
add esp, 0x14
test eax, eax
jne 0x43208c
push 0x6ec330
push ebx
call fcn.005f91e9
add esp, 8
test eax, eax
jne 0x43208c
lea eax, [ebp - 0x804]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
jne 0x432033
pop edi
pop esi
mov eax, 0xfffffff2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x804]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x432040
mov eax, dword [0x6ea880]
mov esi, ebx
mov dword [edi], eax
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x432055
lea edi, [ebp - 0x804]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x432070
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4320ac
push 0x3fe
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.0060143b
add esp, 0xc
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [0x6ea880]
cmp dword [ebp - 0x1014], 0
je 0x4320f1
lea edx, [ebp - 0x804]
lea esi, [edx + 2]
nop
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4320c0
sub edx, esi
sar edx, 1
cmp word [ebp + edx*2 - 0x806], 0x5c
je 0x4320f1
lea edi, [ebp - 0x804]
add edi, 0xfffffffe
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x4320e3
mov dword [edi], eax
push 0
lea eax, [ebp - 0x1008]
push eax
push 0x3ff
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_SearchPathW]
test eax, eax
jne 0x432127
mov ecx, 0x100
lea esi, [ebp - 0x804]
lea edi, [ebp - 0x1008]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ecx, [ebp - 0x1010]
mov word [ebp - 0x80a], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432140
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
call fcn.0060a1f7
mov esi, eax
add esp, 4
test esi, esi
jne 0x432179
pop edi
lea eax, [esi - 0xc]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1010]
mov edx, esi
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x432185
push esi
push dword [ebp - 0x1018]
call dword [0x72c4e0]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret