joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402650
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push ebx
lea ecx, [eax + 0x210]
mov dword [ebp - 0x10], eax
push esi
mov esi, dword [ecx]
xor bl, bl
push edi
mov byte [ebp - 1], bl
mov dword [ebp - 0x14], ecx
cmp esi, dword [eax + 0x214]
je 0x402752
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add ecx, 0xa8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edi
push ecx
call ebx
push 0x619470
call ebx
sub edi, 0xffffff80
push edi
call ebx
push 0x619470
call ebx
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0x28]
push eax
call ebx
push 0x619470
call ebx
push dword [ebp - 8]
call ebx
push 0x619470
call ebx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x4026e8
test cl, cl
je 0x4026e4
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x4026e8
add eax, 2
add edi, 2
test cl, cl
jne 0x4026c8
xor eax, eax
jmp 0x4026ed
sbb eax, eax
or eax, 1
mov edi, dword [ebp - 8]
test eax, eax
jne 0x402729
mov edx, dword [ebp + 8]
mov ecx, edi
lea eax, [edx + 0x28]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402720
test dl, dl
je 0x40271c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402720
add eax, 2
add ecx, 2
test dl, dl
jne 0x402700
xor eax, eax
jmp 0x402725
sbb eax, eax
or eax, 1
test eax, eax
je 0x40274b
mov eax, dword [ebp - 0x10]
add esi, 0x1b0
add edi, 0x1b0
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x40274f
mov ecx, dword [ebp - 0xc]
jmp 0x402692
mov bl, 1
jmp 0x402752
mov bl, byte [ebp - 1]
call fcn.00436160
test al, al
je 0x40276b
add eax, 0x3664409e
adc dword [esi], esi
fidivr word [ebx + esi*8 - 0x42]
mov ebx, 0x9724de69
test bl, bl
jne 0x40279f
mov ecx, dword [ebp + 8]
lea edx, [ecx + 0xa8]
lea esi, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x402780
sub edx, esi
je 0x40279f
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00402830
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405460
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.00435f30
test al, al
je 0x405493
imul edx, dword [ebx], 0xa75f68fa
adc byte [ebx + 0x22], 0x94
mov dl, 0xfd
invalid
call fcn.00436550
test al, al
je 0x4054bb
imul edi, dword [eax + 0x48], 0x4214238f
sbb dword [ebp - 0x37], edi
sti
push edx
push ebx
sti
out dx, al
push esi
sbb dl, byte [ebp + 0x42da7894]
daa
pop edi
mov edi, 0x3358af09
sbb al, 0x78
call fcn.004362b0
test al, al
je 0x4054da
nop
and al, 0x3b
or dword [ebp + ebp + 0x6c], esi
add al, 0xb2
jg 0x405546
pop ecx
push ebx
fcmovb st(0), st(2)
sub al, 0x9f
iretd
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
test eax, eax
jne 0x4054ec
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6194fc
push eax
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.00436550
test al, al
je 0x40555f
xchg ecx, eax
push ds
and dword [ecx + 0x22436410], esp
mov cl, 0x8f
daa
ljmp 0x3406
call fcn.00436390
test al, al
je 0x405586
sahf
mov ch, 0xf
pop eax
mov cl, 0x73
mov bl, byte [edx - 0x68]
mov al, 0x4a
invalid
mov esi, dword [ebp - 4]
mov eax, dword [esi + 4]
test eax, eax
je 0x4054e3
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
mov dword [esi + 0x1c], eax
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407e90
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x20
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1c]
push str.bea7c6963deb46f081eaf1a0607baba0
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x407f08
cmp eax, 0x10
jb 0x407eeb
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
sub eax, 0xc07f23f2
daa
pop edx
scasb al, byte es:[edi]
test al, 0x21
mov ch, 0xe4
scasb al, byte es:[edi]
and al, 0x30
inc esi
push ecx
push cs
xchg edx, eax
aas
invalid
cmp eax, 0x10
jb 0x407f1a
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push 0x20
push str.a33466410fea7987d8e4508243907c45
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x407f79
cmp eax, 0x10
jb 0x407f59
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
int 0x6f
adc byte [edi + 0x7b], bl
xchg edx, ebx
mov ecx, 0x4fc44c4b
cli
cmc
or ah, dh
inc eax
pop ecx
daa
xlatb
xlatb
push edx
push ebp
or bh, byte [edx + esi - 0x74]
aad 0x67
jmp 0x407f8b
cmp eax, 0x10
jb 0x407f8b
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push dword [ebp - 0x20]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp - 0x24]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
pop edi
sete cl
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret 4
Function at 0x412ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov dword [esp + 0xc], ecx
test edi, edi
jle 0x412ff9
lea eax, [ecx + 0x80]
mov dword [esp + 0x1c], eax
lea edx, [ebx + 2]
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edx
lea esi, [eax + 2]
sub eax, ebx
lea ecx, [eax - 2]
lea eax, [edi - 1]
mov dword [esp + 0x18], ecx
shr eax, 3
inc eax
mov dword [esp + 0x14], eax
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
mov edx, ecx
mov ecx, dword [esp + 0x20]
call fcn.004125a0
mov ecx, dword [esp + 0x10]
lea esi, [esi + 8]
mov edx, dword [esp + 0x14]
add esp, 4
movzx eax, byte [ecx + 0x100]
mov ecx, dword [esp + 0x18]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [esp + 0x14], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [esp + 0x18]
jne 0x412f28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41bf90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e548
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x627a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call int.00405460
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.004055c0
test eax, eax
lea eax, [ebp - 0x10]
push eax
je 0x41c052
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c0c1
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf013f
jmp 0x41c079
push 0xf003f
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c0c1
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41c09a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41c0c1
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x41c0d1
push eax
call esi
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x41c0db
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41d8f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e630
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
cmp dword [edi + 8], 0
je 0x41d988
cmp byte [edi + 1], 0
je 0x41d988
call fcn.0041ee00
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
nop dword [eax]
cmp esi, 0x14
jl 0x41d94b
cmp byte [edi + 3], 0
je 0x41d95b
cmp byte [edi + 2], 0
jne 0x41d988
push 0x1f4
inc esi
call ebx
jmp 0x41d940
cmp byte [edi + 2], 0
jne 0x41d988
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x2c]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 8], 0
mov eax, dword [edi + 8]
test eax, eax
je 0x41d996
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [edi + 0x2c]
mov dword [edi + 8], 0
push ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov esi, dword [edi + 0xf8]
mov edi, dword [edi + 0xfc]
cmp esi, edi
je 0x41da5d
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00407370
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0041eb30
test eax, eax
jne 0x41da09
push 0x61ba44
jmp 0x41da0e
push str.Exit
push 2
call fcn.004223f0
mov byte [ebp - 4], 0
add esp, 8
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x41da52
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x1000
jb 0x41da49
test cl, 0x1f
jne 0x41da80
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x41da80
sub ecx, eax
cmp ecx, 4
jb 0x41da80
cmp ecx, 0x23
ja 0x41da80
mov ecx, eax
push ecx
call fcn.00570ea4
add esp, 4
add esi, 0x18
cmp esi, edi
jne 0x41d9c5
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
call fcn.0057d383
int3
Function at 0x41f5f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20
push str.cae04bc49778d3ec4522cef1584bb459
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
call fcn.00407270
cmp dword [ebp - 0x218], 0x100
mov eax, dword [ebp - 0x214]
jbe 0x41f67a
cmp eax, 0x10
jb 0x41f65d
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.00407760
popal
or al, 1
mov dh, 0xc6
inc edi
retf 0x4f1a
cmp eax, 0x10
jb 0x41f692
inc eax
lea ecx, [ebp - 0x228]
push eax
push dword [ebp - 0x228]
call fcn.00407760
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x619710
push str.C:log_s.log
push eax
call fcn.00408f60
add esp, 0xc
call fcn.00436160
test al, al
je 0x41f6da
adc byte [ebx], ah
sbb ah, byte [edi]
dec esp
pop edx
inc ecx
adc ch, al
invalid
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41f6fe
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
dec ebp
cld
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
call fcn.00436320
test al, al
je 0x41f727
cli
cmc
in al, dx
jb 0x41f6f1
neg dword [edx + 0x503bdbb1]
adc ecx, dword [edi - 0xd3a370b]
push ebx
cmp esp, dword [ebp + 0x7b]
and eax, 0x6712171c
xchg ecx, eax
add byte [edx + 0x28], al
mov bh, 0xe8
add al, 0x68
add dword [eax], eax
call fcn.00435f30
test al, al
je 0x41f74c
sub edx, dword [edx + 0x417c8bce]
call 0x6339e045
hlt
mov edx, 0x270f
xor ecx, ecx
call fcn.00426820
cmp eax, 0x64
jle 0x41f6eb
call fcn.00435de0
test al, al
je 0x41f777
scasd eax, dword es:[edi]
pushal
mov bh, 0x2e
loopne 0x41f727
push ss
lea edi, [ecx + 0x54cd5f85]
in al, dx
or esp, dword [ebx]
invalid
call fcn.00436400
test al, al
je 0x41f796
lcall 0x547b, 0x5c8cddde
mov ah, 0x29
adc esp, esi
imul eax, dword [edx - 0x2b], 0xd6dc8b36
add eax, 0x8b52902a
dec ebp
cld
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x420d20
Capabilities:
Write file on windows

Disassembly:
or byte [ebp - 0x6c17f7b3], cl
xor edi, esi
dec dword [ebx - 0xbb2743d]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ecx
mov dword [ebp - 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x420e0c
call fcn.00435ec0
test al, al
je 0x420d71
pushal
inc ecx
pushfd
jecxz 0x420cf4
add edi, dword [esi]
loop 0x420dd1
or dword [edx - 0x5e2d0873], 0x1f
add ah, byte [edi]
mov ebx, dword [ebp - 8]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00436860
test al, al
je 0x420db9
retf
call fcn.004365c0
test al, al
je 0x420dd7
jmp 0x420d5a
dec esp
sub byte [ebp + ecx*4 + 0x14e80c54], bh
pop edx
add dword [eax], eax
call fcn.004367f0
test al, al
je 0x420df2
and eax, 0x6a6fbc0
and eax, 0xf200643
fsubr qword [ebx + eax*8]
sbb bl, dl
fistp word [ecx - 0xb827c22]
add byte [esp + edx - 0x75], dh
inc ebp
or byte [ebx], bh
inc ebp
cld
cmp dword [ebp - 0xc], 0
je 0x420e0c
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jne 0x420e0c
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4214f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cae6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x627a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00570eba
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00436d01
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421fa0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00576f50
push 0x619710
lea eax, [ebp - 0x210]
push str.C:log_s.log
push eax
call fcn.00408f60
add esp, 0x18
call fcn.00436160
test al, al
je 0x421ffa
test byte [0x50b7891f], ah
fcom dword [ebx - 0x2ac192e6]
push ss
invalid
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x422610
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2228
call fcn.00571b70
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov dword [ebp - 0x2214], ecx
mov edi, edx
push 0
push eax
mov dword [ebp - 0x2218], edi
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x619710
push str.C:log_s.log
push eax
call fcn.00408f60
add esp, 0xc
call fcn.00436160
test al, al
je 0x422686
sti
sar byte [esi - 0x21], 0x6d
adc al, 0x69
in al, dx
mov ah, 0x37
pop ebx
dec ecx
test dword [edx - 0x17427466], esi
invalid
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x210]
push eax
call ebx
test eax, eax
je 0x422811
push 0
call fcn.0057e959
add esp, 4
mov dword [ebp - 0x2228], eax
lea eax, [ebp - 0x2228]
mov dword [ebp - 0x2224], edx
push eax
call fcn.00585006
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x2210]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.004228b0
add esp, 0x28
call fcn.00436710
test al, al
je 0x422714
in al, dx
sar byte [esi], cl
mov esp, 0x932a162f
lodsb al, byte [esi]
aam 0xe
push 0x1e11b68
jge 0x422722
push dword [ebp - 0x2214]
xor edi, edi
call ebx
test eax, eax
mov ecx, 1
cmovne edi, ecx
add byte [eax], al
add byte [edi], cl
inc ebp
stc
call fcn.00436010
test al, al
je 0x422741
stc
pop ebx
mov esi, 0x66e3c2b9
fcomp qword [edi]
push ecx
test byte [esi], dl
stosb byte es:[edi], al
cmp dword [ebx - 0x42cf978f], ebp
popal
add bh, bh
mov ch, 0xec
invalid
push 0x61bd30
push dword [ebp - 0x2214]
call fcn.0057d560
mov ebx, eax
add esp, 8
mov dword [ebp - 0x221c], ebx
test ebx, ebx
je 0x422811
test edi, edi
jne 0x422786
push ebx
push 2
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2218], 0xfeff
push 1
push eax
call fcn.0057d8bc
add esp, 0x10
inc edi
test eax, ebp
invalid
call fcn.00435ec0
test al, al
je 0x4227a7
adc dword ds:[esi + ebp*2], ecx
scasb al, byte es:[edi]
jle 0x422770
sub al, 0x49
inc eax
imul ecx, dword [ebx], 0xa3f9def4
dec ebp
mov ebx, dword [ebp - 0x221c]
lea ecx, [ebp - 0x2210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4227b0
sub ecx, edx
sar ecx, 1
push ebx
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x2210]
push 1
push eax
call fcn.0057d8bc
push ebx
push 2
lea eax, [ebp - 0x2214]
mov dword [ebp - 0x2214], 0xd
push 1
push eax
call fcn.0057d8bc
push ebx
push 2
lea eax, [ebp - 0x2214]
mov dword [ebp - 0x2214], 0xa
push 1
push eax
call fcn.0057d8bc
push ebx
call fcn.0057d604
add esp, 0x34
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
Function at 0x4240c0
Capabilities:
Get common file path

Disassembly:
add dword [edi + 0x2d614da0], 0x42
fidivr word [eax - 0x4b2b0fad]
stosd dword es:[edi], eax
pop esi
movsb byte es:[edi], byte [esi]
pushfd
adc byte [eax - 0x3f], dl
or dword [ebp - 0x35], ecx
dec ebp
ror dword [ecx], 0x32
rcr byte [edi + 0x5e], 0x5b
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x62d77b], 0
push ebx
push esi
push edi
je 0x424148
call fcn.00436470
test al, al
je 0x4240fc
fst qword [ebx]
jl 0x42414c
mov dword [0x3b9b2489], eax
sbb ebx, ecx
cld
mov dh, 0x33
mov esi, fs
jle 0x42407f
mov dword [0x1275fe8], eax
add byte [eax + eax*8 + 0x29d71c74], al
mov ah, 0x3f
loopne 0x42408f
call fcn.00436860
test al, al
je 0x424121
xlatb
sub dword [edi + edi + 0x781484e0], esi
adc al, 0x78
jnp 0x4240dd
int 0xe4
mov byte [ebp + 0x56dbe11], bl
and dh, byte [edx]
hlt
call fcn.004360f0
test al, al
je 0x42423f
insb byte es:[edi], dx
invalid
call fcn.004360f0
test al, al
je 0x42416c
add byte [eax + eax*8 - 0x2fd2e48c], al
jg 0x424174
sub eax, 0x981f7fd0
cwde
push edi
not dword [eax - 0x7a]
mov byte [0x34810bd1], al
shr dword [ebp - 0x11], 1
sbb eax, 0xd8b8da9e
push edx
sub byte ds:[eax + 0x3a], bl
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4241dc
std
invalid
lea eax, [ebp - 0x210]
push eax
call fcn.00583ca6
lea eax, [ebp - 0x210]
push 0x61b944
push eax
call fcn.0057612d
add esp, 0xc
test eax, eax
jne 0x4241d5
lea eax, [ebp - 0x210]
push str.documents_and_settingslocalservice
push eax
call fcn.0057612d
add esp, 8
test eax, eax
je 0x4241dc
mov byte [0x62d77b], 1
call fcn.004368d0
test al, al
je 0x4241f7
add byte [eax + eax*8 - 0x157ded8c], al
test byte [esi + eax*4 - 0x47], bl
cmp eax, 0x16003313
sub dl, 0x84
pop esp
xchg byte [ecx + 0x33133d64], bh
add byte [esi], dl
movsb byte es:[edi], byte [esi]
sub dword [ebx], edi
js 0x42426f
jns 0x4241e0
call fcn.00436470
je 0x42421c
add dword [eax], eax
test al, al
je 0x42421b
rcr byte [0x919e15d0], 0x34
fld xword [eax]
sbb al, dh
je 0x424285
clc
hlt
call fcn.00436470
test al, al
je 0x42423f
push eax
and al, byte [ecx]
add byte [eax + eax*8 + 0x5111b74], al
not byte [esi - 0x6bea4f63]
and eax, 0xbb58369c
mov byte [ebx + ebp*2 + 0x1b], bh
out 0xee, eax
adc dword [0xb09d96f6], eax
adc eax, 0x369c2594
pop eax
mov ebx, 0x6b7c8866
sbb esp, edi
out dx, al
push edx
fsubr qword [ebx - 0x74302ba2]
dec ebp
cld
mov ecx, dword [ebp - 4]
mov al, byte [0x62d77b]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
cld
xchg byte [eax], al
add byte [eax], al
Function at 0x427360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f0eb
mov eax, dword fs:[0]
push eax
sub esp, 0x844