joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416660
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
push 0x5b50a0
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 8
call fcn.0045337b
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4166bd
mov dword [edi], vtable.CErisDLL.0
mov dword [edi + 4], ebx
cmp dword [0x5f3868], ebx
jne 0x4166b3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5f3868], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004165a0
mov dword [edi + 4], eax
jmp 0x4166bf
xor edi, edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x5b50e0
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
mov eax, esi
pop ebx
pop ebp
ret 4

Function at 0x4166f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c6c0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push str.CErisProbe::CErisProbe__Start__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor edi, edi
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.004167f0
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x41674b
push eax
mov dword [eax], vtable.CErisDLL.0
call fcn.004533aa
add esp, 4
mov dword [esi + 0xc], edi
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CErisProbe::CErisProbe__Exit__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416780
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.CErisProbe::Initialize__Start__n
call ebx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x41679b
cmp dword [eax + 4], 0
jne 0x4167a6
push str.CErisProbe::Initialize__Exit_with_false__n
call ebx
xor eax, eax
pop ebx
ret
push esi
mov esi, 0xffffff9b
call dword [0x5f386c]
mov dword [edi + 4], eax
test eax, eax
je 0x4167df
push 0
push eax
call dword [0x5f3870]
mov esi, eax
add esp, 8
test esi, esi
je 0x4167df
mov eax, dword [edi + 4]
push eax
call dword [0x5f388c]
add esp, 4
mov dword [edi + 4], 0
push str.CErisProbe::Initialize__Exit__n
call ebx
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
ret
Function at 0x41ac40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58025a
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0045dfd3
push 0xf
lea eax, [esp + 0x18]
push eax
mov ecx, 0x5f38c8
call fcn.00432310
push 0x5b65c8
push eax
lea ecx, [esp + 0x18]
xor esi, esi
push ecx
mov dword [esp + 0x44], esi
call fcn.004024e0
add esp, 0xc
mov byte [esp + 0x38], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41acc1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
lea ecx, [edi + 0xf8]
call fcn.0045abb2
mov edx, dword [edi + 0xc4]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0045cd7d
push 0xc8
call fcn.0045337b
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x38], 3
cmp eax, esi
je 0x41ad1d
push eax
call fcn.0040ef10
mov esi, eax
mov byte [esp + 0x38], 2
push edi
lea eax, [esp + 0x20]
mov dword [edi + 0xa0], esi
call fcn.0040f0d0
mov ecx, dword [edi + 0xa0]
push 5
call fcn.0045abb2
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [edi + 0xa0]
call fcn.0040f460
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ad77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421ba0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57da36
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x5eb6e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
push str.CFirmwareChecker::GetIPAddressbyHostName_this__d__r_n
mov eax, 0x5f38b8
mov esi, ecx
call fcn.004053d0
add esp, 8
push 0x5b25a8
lea ecx, [ebp - 0x1ac]
call fcn.00403320
mov dword [ebp - 4], 0
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x1a8]
call fcn.00422fd0
lea eax, [ebp - 0x1a4]
push eax
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [ebp - 0x1a8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x421c3c
push eax
push 0x5b25a8
mov ecx, edi
call fcn.004036a0
jmp 0x421c7b
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
jne 0x421c52
xor ecx, ecx
jmp 0x421c60
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x421c57
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0x1a8]
call fcn.004231a0
mov ecx, dword [ebp - 0x1a8]
push ecx
mov ecx, edi
call fcn.00416f70
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1a8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x421ca7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1ac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421cd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055064f
mov esp, ebp
pop ebp
ret 4
Function at 0x42def0
Capabilities:
Log keystrokes via polling
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x57bc98
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call edi
xor ecx, ecx
xor esi, esi
cmp cx, ax
jle 0x42dffb
push 0x11
call edi
xor edx, edx
cmp dx, ax
jle 0x42dffb
mov dword [esp + 0x14], vtable.Registry.0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREEPSONInstallNavi
push SysReAllocStringLen
mov dword [esp + 0x54], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0xf003f
mov dword [esp + 0xc], 1
cmp eax, esi
je 0x42dfb3
mov eax, dword [esp + 0x18]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push esi
push 0x5b44ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x42dfc8
push eax
call edi
mov dword [esp + 0x18], esi
push esi
push esi
push str.Set_Evaluation_Setting_Successfully
mov dword [esp + 0x28], esi
call fcn.0045e837
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], vtable.Registry.0
cmp eax, esi
je 0x42dff7
push eax
call edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00457553
mov eax, dword [eax + 0x20]
push esi
push esi
push 0x2b18
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42f110
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5eb6e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x114
xor esi, esi
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00553a60
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jb 0x42f167
cmp dword [ebp - 0x114], 6
lea eax, [esi + 1]
jae 0x42f169
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0055064f
mov esp, ebp
pop ebp
ret
Function at 0x42f4c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f47c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push eax
push 0x90
mov ecx, esi
call fcn.0045c3b7
xor edi, edi
mov ebx, 1
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], ebx
push edi
push edi
push edi
mov dword [ebp - 4], edi
push edi
lea ecx, [esi + 0xa8]
mov dword [esi], vtable.CPrinterListPanel.0
call fcn.004617a2
mov byte [ebp - 4], bl
call fcn.00453e50
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x42f540
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], vtable.CArray_struct_tagSearchResult__struct_tagSearchResult__.0
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc0], edi
lea ebx, [esi + 0xcc]
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.00455ee7
mov dword [ebx], vtable.CStatic.0
lea ebx, [esi + 0x120]
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.00455ee7
mov dword [ebx], vtable.CListCtrl.0
lea ebx, [esi + 0x174]
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.00455ee7
mov dword [ebx], vtable.CStatic.0
lea ebx, [esi + 0x1c8]
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00455ee7
mov dword [ebx], vtable.CStatic.0
lea ebx, [esi + 0x220]
mov byte [ebp - 4], 7
mov ecx, ebx
mov dword [esi + 0x21c], edi
call fcn.00455ee7
mov dword [ebx], vtable.CButton.0
lea ebx, [esi + 0x274]
mov ecx, ebx
mov byte [ebp - 4], 8
call fcn.00455ee7
mov dword [ebx], vtable.CButton.0
lea ebx, [esi + 0x2c8]
mov ecx, ebx
call fcn.00419e90
mov dword [ebx], vtable.CMyImage.0
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
lea ebx, [esi + 0x300]
mov ecx, ebx
call fcn.00419e90
mov dword [ebx], vtable.CMyImage.0
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
lea ebx, [esi + 0x338]
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.00455ee7
mov dword [ebx], vtable.CStatic.0
lea ebx, [esi + 0x38c]
mov ecx, ebx
mov byte [ebp - 4], 0xc
call fcn.00455ee7
mov dword [ebx], vtable.CStatic.0
lea ebx, [esi + 0x3e0]
mov ecx, ebx
mov byte [ebp - 4], 0xd
call fcn.00455ee7
mov dword [ebx], vtable.CAnimateCtrl.0
lea ecx, [esi + 0x434]
push ecx
mov byte [ebp - 4], 0xe
call fcn.00424020
mov dword [esi + 0xa0], 0xffffffff
mov dword [esi + 0xa4], edi
mov dword [esi + 0xb0], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4306d0
Capabilities:
Resume thread

Disassembly:
push str.Exit_Printer_Serach_Tread_Enter_r_n
mov eax, 0x5f38b8
call fcn.004053d0
add esp, 4
cmp dword [esi + 0xa4], 0
je 0x43074a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xa4]
mov eax, dword [eax + 0x2c]
push eax
call edi
cmp eax, 1
jg 0x4306f2
mov ecx, dword [esi + 0xac]
push ecx
mov dword [esi + 0xb0], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0xa4]
mov eax, dword [edx + 0x2c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0xa4]
pop edi
test ecx, ecx
je 0x430740
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov dword [esi + 0xa4], 0
push str.Exit_Printer_Serach_Tread_Leave_r_n
mov eax, 0x5f38b8
call fcn.004053d0
pop ecx
ret

Function at 0x430da0
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push 1
mov esi, ecx
call fcn.00456dbc
cmp dword [esi + 0x21c], 1
jne 0x430e55
mov eax, dword [esi + 0x400]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffff0000
push 0xffffffffffffffff
push 0x465
push eax
call ebx
lea edi, [esi + 0x120]
push 1
mov ecx, edi
call fcn.0045abf4
mov ecx, dword [esi + 0x140]
push 0
push 0
push 0x1004
push ecx
call ebx
cmp eax, 1
jne 0x430e07
push 3
push 3
push 0
mov ecx, edi
call fcn.0045f7d3
mov ecx, edi
call fcn.0045ac1b
xor edi, edi
cmp dword [esi + 0xa4], edi
jne 0x430eb9
push edi
push 4
push edi
push edi
push esi
push 0x430490
call fcn.0046172b
mov dword [esi + 0xa4], eax
cmp eax, edi
je 0x430eb9
mov dword [esi + 0xb0], edi
mov dword [eax + 0x28], edi
mov edx, dword [esi + 0xa4]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x430eb9
mov ecx, dword [esi + 0x140]
push 0
push 0
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x430e88
push 3
push 0
push edi
lea ecx, [esi + 0x120]
call fcn.0045f7d3
inc edi
cmp edi, ebx
jl 0x430e73
push 0
lea ecx, [esi + 0x120]
call fcn.0045abf4
mov edx, dword [esi + 0x400]
push 0
push 0
push 0x466
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0xa4], 0
je 0x430eb9
call fcn.004306d0
push 1
mov ecx, esi
mov bl, 0x20
call fcn.00456dbc
cmp dword [esi + 0x21c], 0
jne 0x430ecf
mov bl, 0x10
cmp dword [esi + 0xa0], 0xffffffff
je 0x430eda
mov bl, 0x10
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00457553
mov edx, dword [eax + 0x20]
movzx ecx, bl
push 0
or ecx, 0x14001201
push ecx
push 0x2b1b
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
ret
Function at 0x432170
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57d76b
mov eax, dword fs:[0]
push eax
sub esp, 0x94
push ebx
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x170]
cmp eax, ecx
jl 0x432307
cmp eax, dword [esi + 0x164]
jge 0x432307
mov edx, dword [esi + 0x160]
lea ecx, [eax*8]
sub ecx, eax
lea eax, [edx + ecx*4]
push 0x5b23c8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004024e0
add esp, 0xc
lea edi, [ebp - 0xa0]
call fcn.00401eb0
add esi, 0xd4
push esi
mov ebx, edi
mov byte [ebp - 4], 2
call fcn.00401000
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.0040ab90
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
xor ebx, ebx
add esp, 0xc
xor esi, esi
cmp ecx, ebx
je 0x432234
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x432234
test al, 0x10
je 0x432234
lea esi, [ebx + 1]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x432253
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
je 0x4322db
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00403760
mov edi, dword [ebp + 8]
add esp, 4
add eax, 0x10
mov dword [edi], eax
lea esi, [ebp - 0xa0]
call fcn.00401f50
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43229f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4322c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test dword [ebp - 0x68], 0x100000
mov edi, dword [ebp + 8]
mov ecx, edi
je 0x4322f8
push 0x5bb100
call fcn.00403320
jmp 0x432272
push 0x5bb108
call fcn.00403320
jmp 0x432272
call fcn.00453d3c
int3
Function at 0x436af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f068
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push str.IS_EXECUTE_:___s____s__r_n
mov eax, 0x5f38b8
mov edi, 1
call fcn.004053d0
add esp, 0xc
cmp dword [0x5f3994], 0
jne 0x436b51
call fcn.004117a0
test eax, eax
je 0x436bf6
call fcn.00453e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x436b6b
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax - 0xc], esi
je 0x436b9d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436b9d
test al, 0x10
jne 0x436b9d
mov esi, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push ecx
push edx
lea eax, [ebp - 0x10]
push str.Exe__s__r_nParameter__s__r_nExist__d_
push eax
call fcn.00404130
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
add esp, 0x14
push 0x40004
push str.Execute_
push esi
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x436bd6
xor edi, edi
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x436bf6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436c19
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436c3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436f00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f028
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esi
call fcn.00453e50
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x436f49
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], esi
cmp edi, esi
je 0x436fb9
push esi
push esi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, esi
jle 0x436fb9
lea ebx, [eax + 1]
lea ecx, [ebx + ebx]
push ecx
call fcn.004533b5
mov esi, eax
add esp, 4
test esi, esi
je 0x436fb9
push ebx
push esi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x436fb0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x436f97
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004036a0
push esi
call fcn.004533aa
add esp, 4
mov esi, dword [ebp - 0x10]
push ecx
add esi, 0xfffffff0
mov dword [ebp - 0x14], esp
mov edi, esp
push esi
call fcn.00403760
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 8]
add esp, 4
call fcn.00411e80
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x436ffe
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x437020
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cb61
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5eb6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.00453e50
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43706d
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x22
mov esi, 1
push str._windir__twain_32escndvescfg.exe
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004036a0
call fcn.00453e50
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4370ad
push 0x80004005
call fcn.004038e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, dword [ebp - 0x10]
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ecx
mov dword [ebp - 0x14], esi
call ebx
mov esi, eax
test esi, esi
jle 0x43712f
mov eax, dword [edi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, esi
or eax, ecx
jge 0x4370f0
push esi
mov ecx, edi
call fcn.00403620
mov eax, dword [edi]
mov edx, dword [ebp - 0x10]
push esi
push eax
push edx
call ebx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x437111
push ecx
push eax
call fcn.00551122
add esp, 8
test eax, eax
jl 0x437125
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x437125
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x43713a
push 0x80070057
call fcn.004038e0
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.004037d0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43715d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x439330
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x439343
lea eax, [esi + 0xd]
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
xor edi, edi
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x439350
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
push eax
mov eax, dword [edx]
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc