joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409f20
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40b080
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x409f59
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x40d304
push 1
push ebx
push 0x40d364
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
je 0x409fa8
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x409ff2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x40d354
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x40a007
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x409fdc
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x409ff2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x40a0c6
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x40d38c
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x40a09c
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x40a092
cmp esi, edi
jne 0x40a087
mov eax, dword [esp + 0x14]
push ebp
push 0x40d2f4
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x40a037
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x40a0d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x40a0ef
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x40a110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x40b098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x10], edi
mov eax, dword [ebx + 0x14]
lea edx, [esp + 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
mov ecx, dword [eax]
push edx
push eax
mov dword [esp + 0x3c], edi
call dword [ecx + 0x30]
test eax, eax
jl 0x40a1c8
mov eax, dword [esp + 0x18]
push ebp
lea edx, [esp + 0x18]
push edi
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40a1bd
mov ebp, dword [esp + 0x44]
mov eax, dword [esp + 0x18]
mov ecx, 4
mov edi, 0x40d344
xor edx, edx
lea esi, [eax + 0x2c]
repe cmpsd dword [esi], dword es:[edi]
jne 0x40a19e
mov ecx, dword [eax + 0x44]
cmp dword [ecx + 0x34], ebp
jne 0x40a196
mov edx, dword [esp + 0x48]
mov esi, dword [ecx + 0x38]
cmp esi, edx
je 0x40a1b7
push eax
mov ecx, ebx
call fcn.0040a450
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push 0
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x40a16c
jmp 0x40a1bb
mov dword [esp + 0x10], eax
xor edi, edi
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop ebp
mov eax, dword [ebx + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x40d2d4
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x40a22e
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x40a1fd
mov eax, dword [esp + 0x10]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, ebx
push eax
call fcn.0040a450
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
jl 0x40a22e
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax + 0x44]
mov edx, dword [ecx + 0x34]
mov dword [ebx + 0x20], edx
mov ecx, dword [eax + 0x44]
mov edx, dword [ecx + 0x38]
mov ecx, ebx
mov dword [ebx + 0x24], edx
call fcn.0040a450
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebx + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edi
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, edi
mov dword [esp + 0x34], 0xffffffff
je 0x40a265
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x40a310
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x40
push ebx
push ebp
mov ebp, ecx
call fcn.0040a4a0
lea eax, [esp + 0xc]
mov ecx, ebp
push eax
call fcn.0040a5b0
mov ecx, dword [esp + 0x4c]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40a356
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret 4
push esi
mov esi, dword [ebp + 0x20]
xor edx, edx
push edi
lea ecx, [esi + esi*2]
mov dword [esp + 0x18], edx
shl ecx, 3
mov dword [esp + 0x1c], edx
mov edi, dword [ebp + 0x24]
lea eax, [ecx + 0x1f]
mov dword [esp + 0x20], edx
and al, 0xe0
mov word [esp + 0x24], dx
cdq
and edx, 7
push 0
add edx, eax
mov eax, ecx
sar edx, 3
mov ecx, edx
mov word [esp + 0x1c], 0x4d42
mov dword [esp + 0x26], 0x36
cdq
and edx, 7
add eax, edx
lea edx, [esi + esi*2]
sar eax, 3
sub ecx, eax
xor eax, eax
add ecx, edx
mov word [esp + 0x22], ax
imul ecx, edi
add ecx, 0x36
lea edi, [esp + 0x2c]
mov dword [esp + 0x1e], ecx
mov ecx, 0xa
mov word [esp + 0x24], ax
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x24]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
push eax
push 0xe
mov dword [esp + 0x38], esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
push ebx
mov dword [esp + 0x3c], 0x28
mov word [esp + 0x48], 1
mov word [esp + 0x4a], 0x18
mov dword [esp + 0x4c], 0
call esi
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x30]
push 0x28
push eax
push ebx
call esi
mov edx, dword [ebp + 0x2c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
Function at 0x40a5d0
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40b0c6
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x828
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x40a5fe
or eax, 0xffffffff
jmp 0x40a7b9
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x834], ebx
push eax
push 0x40d304
push 1
push ebx
push 0x40d364
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
je 0x40a64a
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebx
je 0x40a69d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x40a7b9
mov dword [esp + 4], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 4]
push ebx
push ecx
mov edx, dword [eax]
push 0x40d354
push eax
mov byte [esp + 0x844], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x40a6a5
mov eax, dword [esp + 4]
mov byte [esp + 0x834], bl
cmp eax, ebx
je 0x40a684
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebx
je 0x40a69d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x40a7b9
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 4]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x40a787
push ebp
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push 0x40d38c
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x40a75c
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x28]
push ebx
mov word [esp + 0x2c], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40a752
mov ecx, dword [esp + 0x30]
push ebx
push ebx
lea eax, [esp + 0x40]
push 0x800
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call edi
lea edx, [esp + 0x38]
push eax
push edx
push esi
call dword [esp + 0x854]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
inc edx
push eax
mov dword [esp + 0x1c], edx
call ebp
mov eax, dword [esp + 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x20]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebx
je 0x40a6e3
pop edi
pop esi
pop ebp
mov eax, dword [esp + 4]
mov byte [esp + 0x834], bl
cmp eax, ebx
je 0x40a79c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebx
je 0x40a7b5
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x82c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x834
ret 8
Function at 0x406523
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push eax
push dword [ebx + 0x14]
push dword [ebp + 0xc]
call fcn.00403f11
mov esi, eax
test esi, esi
jns 0x406550
push str.Failed_to_format_variable_string.
jmp 0x4065c4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406586
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x406582
cmp esi, 0x80070003
jne 0x40658e
xor esi, esi
jmp 0x40658e
test al, 0x10
push 1
pop eax
cmovne edi, eax
test esi, esi
jns 0x4065a7
push dword [ebp - 4]
push dword [ebx]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043cb9d
add esp, 0x10
jmp 0x4065cc
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00404ccc
mov esi, eax
test esi, esi
jns 0x4065cc
push str.Failed_to_set_variable.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.00440a14
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4065df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00403f11
mov esi, eax
test esi, esi
jns 0x406615
push str.Failed_to_format_variable_string.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
jmp 0x4066a5
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, 0x80070003
cmp eax, 0xffffffff
jne 0x40663f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x406668
test al, 0x10
je 0x406666
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00404c77
mov esi, eax
test esi, esi
jns 0x406668
push str.Failed_to_set_directory_search_path_variable.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
jmp 0x4066a4
mov esi, ebx
cmp esi, 0x80070002
je 0x40668d
cmp esi, ebx
je 0x40668d
test esi, esi
jns 0x4066a4
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043cb9d
add esp, 0x10
jmp 0x4066a4
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.0043d088
add esp, 0x14
xor esi, esi
pop ebx
push dword [ebp - 4]
call fcn.00440a14
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4066b7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push eax
push dword [ebx + 0x14]
push dword [ebp + 0xc]
call fcn.00403f11
mov esi, eax
test esi, esi
jns 0x4066e7
push str.Failed_to_format_variable_string.
jmp 0x40677f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40675a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x406744
cmp eax, 3
je 0x406744
test eax, eax
je 0x406762
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x296
push str.search.cpp
call fcn.0043bd8c
push dword [ebx + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.0043cb9d
add esp, 0xc
jmp 0x406787
push dword [ebp - 4]
push dword [ebx]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0043d088
add esp, 0x10
jmp 0x406762
test al, 0x10
push 1
pop eax
cmove edi, eax
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00404ccc
mov esi, eax
test esi, esi
jns 0x406787
push str.Failed_to_set_variable.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.00440a14
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40679a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00403f11
mov esi, eax
test esi, esi
jns 0x4067d0
push str.Failed_to_format_variable_string.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
jmp 0x406850
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40681b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x40683a
cmp esi, 0x80070003
je 0x40683a
test esi, esi
jns 0x406850
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.0043cb9d
add esp, 0x10
jmp 0x406850
test al, 0x10
jne 0x40683a
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00404c77
mov esi, eax
test esi, esi
jns 0x4067f2
push str.Failed_to_set_variable_to_file_search_path.
jmp 0x4067c3
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0043d088
add esp, 0x10
xor esi, esi
push dword [ebp - 4]
call fcn.00440a14
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x406cda
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edx
inc edi
mov dword [ebp - 8], edx
cmp dword [ebx + 0x24], edx
mov ecx, 0x101
mov eax, edi
mov dword [ebp - 0xc], edx
cmovne eax, ecx
mov dword [ebp - 0x10], edx
push edx
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
push dword [ebp + 0xc]
call fcn.00403f11
mov esi, eax
test esi, esi
jns 0x406d2f
push str.Failed_to_format_key_string.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
jmp 0x406e2f
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.0043e767
mov esi, eax
test esi, esi
js 0x406de3
cmp dword [ebx + 0x20], 0
je 0x406dff
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.00403f11
mov esi, eax
test esi, esi
jns 0x406d73
push str.Failed_to_format_value_string.
jmp 0x406d22
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub ecx, 0
je 0x406dff
dec ecx
sub ecx, 1
je 0x406dcc
test eax, eax
je 0x406dff
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x32d
push str.search.cpp
call fcn.0043bd8c
push str.Failed_to_query_registry_key_value.
jmp 0x406d22
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.0043d088
add esp, 0x10
jmp 0x406dfd
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x406e21
push str.Registry_key_not_found._Key___ls
push 2
call fcn.0043d088
add esp, 0xc
xor edi, edi
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.00404ccc
mov esi, eax
test esi, esi
jns 0x406e46
push str.Failed_to_set_variable.
jmp 0x406d22
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.0043cb9d
add esp, 0xc
test esi, esi
jns 0x406e46
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.0043d088
add esp, 0x10
push dword [ebp - 4]
call fcn.00440a14
push dword [ebp - 8]
call fcn.00440a14
cmp dword [ebp - 0xc], 0
je 0x406e65
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b76e
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push esi
push edi
push eax
push 0x1c
pop eax
xor edi, edi
test ebx, ebx
push 0x23
pop ecx
cmovne eax, ecx
mov dword [ebp - 0xc], edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.0043df5b
mov esi, eax
test esi, esi
jns 0x40b7c0
mov eax, str.per_user
test ebx, ebx
mov ecx, str.per_machine
cmove ecx, eax
push ecx
push str.Failed_to_find_local__hs_appdata_directory.
push esi
call fcn.0043cb9d
add esp, 0xc
jmp 0x40b82f
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 4], edi
jbe 0x40b82f
mov eax, edi
mov dword [ebp + 8], edi
mov ecx, dword [ebx]
add ecx, eax
lea eax, [ebp - 4]
push eax
mov dword [ebp + 0xc], ecx
push dword [ecx + 4]
push dword [ebp - 0xc]
call fcn.0043d6f0
mov esi, eax
test esi, esi
js 0x40b822
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp - 4]
call fcn.0043d6f0
mov esi, eax
test esi, esi
js 0x40b822
push dword [ebp - 8]
call fcn.0044318c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp + 8]
inc edi
add eax, 0xc
mov dword [ebp + 8], eax
cmp edi, dword [ebx + 4]
jb 0x40b7cd
jmp 0x40b82f
push str.Failed_to_allocate_regid_folder_path.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
cmp dword [ebp - 8], 0
je 0x40b83d
push dword [ebp - 8]
call fcn.004408e7
cmp dword [ebp - 4], 0
je 0x40b84b
push dword [ebp - 4]
call fcn.004408e7
cmp dword [ebp - 0xc], 0
je 0x40b859
push dword [ebp - 0xc]
call fcn.004408e7
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41035c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x468004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push 0x208
xor esi, esi
push esi
push eax
call fcn.0042b200
add esp, 0xc
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4103fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x27e
push str.logging.cpp
call fcn.0043bd8c
push str.Failed_to_get_temp_folder.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
jmp 0x4104e7
lea eax, [ebp - 0x218]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0041050f
mov esi, eax
test esi, esi
jns 0x41041b
push str.Failed_to_get_length_of_temp_folder.
jmp 0x4103ed
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4104bf
push dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push 0x452834
push eax
call fcn.004401aa
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x41045f
push str.Failed_to_format_session_id_as_a_string.
jmp 0x4104de
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
push dword [ebp - 0x210]
call fcn.0041050f
mov esi, eax
test esi, esi
jns 0x410483
push str.Failed_to_get_length_of_session_id_string.
jmp 0x4104de
push dword [ebp - 0x214]
mov edi, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x210]
mov esi, edi
sub esi, dword [ebp - 0x214]
push dword [ebp - 0x214]
lea eax, [eax + esi*2]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
cmove edi, esi
jmp 0x4104c5
mov edi, dword [ebp - 0x218]
push edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0044042d
mov esi, eax
test esi, esi
jns 0x4104e6
push str.Failed_to_copy_temp_folder.
push esi
call fcn.0043cb9d
pop ecx
pop ecx
pop edi
cmp dword [ebp - 0x210], 0
je 0x4104fb
push dword [ebp - 0x210]
call fcn.004408e7
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a6d1
mov esp, ebp
pop ebp
ret 4