joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4372b2
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push 0x26c
mov eax, 0x54e2e6
call fcn.0051d3dc
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4372d7
xor eax, eax
inc eax
jmp 0x4373cb
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4372cf
push esi
lea ecx, [ebp - 0x248]
call fcn.00401b4a
lea eax, [ebp - 0x248]
xor edi, edi
push eax
lea eax, [ebp - 0x278]
mov dword [ebp - 4], edi
push eax
call fcn.00437d23
pop ecx
pop ecx
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.004036e0
push esi
lea ecx, [ebp - 0x260]
call fcn.00401b4a
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00437a1e
pop ecx
pop ecx
lea ecx, [ebp - 0x260]
call fcn.004036e0
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 1
lea eax, [ebp - 0x218]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
call esi
test eax, eax
je 0x4373b3
push 4
push edi
lea eax, [ebp - 0x218]
push eax
call esi
inc edi
lea ecx, [ebp - 0x230]
call fcn.004036e0
lea ecx, [ebp - 0x278]
call fcn.004036e0
mov eax, edi
call fcn.0051d386
ret

Function at 0x4373d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401b4a
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0051d360
leave
ret
Function at 0x43782b
Capabilities:
Read file on windows

Disassembly:
push 0x28
mov eax, 0x54e3d5
call fcn.0051d3dc
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], ebx
jb 0x437866
mov eax, dword [eax]
push 0x55e650
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.005316d9
add esp, 0xc
cmp dword [ebp - 0x2c], 0
je 0x43791d
push 2
push ebx
push dword [ebp - 0x2c]
call fcn.00531295
push dword [ebp - 0x2c]
call fcn.00531d0e
push 0
push 0
push dword [ebp - 0x2c]
mov ebx, eax
call fcn.00531295
add esp, 0x1c
test ebx, ebx
je 0x437914
lea eax, [ebx + 1]
push eax
call fcn.0051ce24
mov edi, eax
pop ecx
test edi, edi
je 0x437914
lea eax, [ebx + 1]
push eax
push 0
push edi
call fcn.00520800
push dword [ebp - 0x2c]
push 1
push ebx
push edi
call fcn.00530f2b
add esp, 0x1c
test eax, eax
je 0x43790d
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push ebx
push edi
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00403853
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push esi
push eax
call fcn.00429d47
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004036ba
push edi
call fcn.0051ce2d
pop ecx
push dword [ebp - 0x2c]
call fcn.00530b28
pop ecx
mov eax, esi
call fcn.0051d386
ret

Function at 0x437925
Capabilities:
Read file on windows

Disassembly:
push 0x28
mov eax, 0x54e3d5
call fcn.0051d3dc
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], ebx
jb 0x437960
mov eax, dword [eax]
push 0x55e650
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.005316d9
add esp, 0xc
cmp dword [ebp - 0x2c], 0
je 0x437a16
push 2
push ebx
push dword [ebp - 0x2c]
call fcn.00531295
push dword [ebp - 0x2c]
call fcn.00531d0e
push 0
push 0
push dword [ebp - 0x2c]
mov ebx, eax
call fcn.00531295
add esp, 0x1c
test ebx, ebx
je 0x437a0d
lea eax, [ebx + 1]
push eax
call fcn.0051ce24
mov edi, eax
pop ecx
test edi, edi
je 0x437a0d
lea eax, [ebx + 1]
push eax
push 0
push edi
call fcn.00520800
push dword [ebp - 0x2c]
push 1
push ebx
push edi
call fcn.00530f2b
add esp, 0x1c
test eax, eax
je 0x437a06
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push ebx
push edi
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00403853
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00401dfe
lea ecx, [ebp - 0x28]
call fcn.004036ba
push edi
call fcn.0051ce2d
pop ecx
push dword [ebp - 0x2c]
call fcn.00530b28
pop ecx
mov eax, esi
call fcn.0051d386
ret
Function at 0x437a74
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4218
call fcn.0051d4f0
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x420c]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.00520800
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x437ab3
mov eax, dword [esi]
lea ecx, [ebp - 0x4214]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x437b7c
cmp eax, 0x3fff
ja 0x437b7c
cmp dword [esi + 0x14], 8
jb 0x437adb
mov esi, dword [esi]
lea ecx, [ebp - 0x420c]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x437b7c
lea eax, [ebp - 0x4218]
push eax
lea eax, [ebp - 0x4210]
push eax
push 0x55e000
lea eax, [ebp - 0x420c]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x437b7c
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00520800
mov ecx, dword [ebp - 0x4210]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x55ded0
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00403b24
lea eax, [ebp - 0x20c]
push eax
call fcn.00524c40
add esp, 0x2c
mov ecx, edi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0040389c
xor eax, eax
inc eax
jmp 0x437b7e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051d360
leave
ret
Function at 0x437b8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00520800
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x210]
add esp, 0xc
mov dword [ebp - 0x210], 0x103
xor ebx, ebx
inc ebx
mov dword [ebp - 0x214], ebx
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
test eax, eax
jne 0x437cde
cmp ax, word [ebp - 0x20c]
je 0x437cde
push 3
pop edi
push edi
lea eax, [ebp - 0x20c]
push 0x56d3bc
push eax
call fcn.00532c8f
add esp, 0xc
test eax, eax
jne 0x437c32
push 2
jmp 0x437cc4
push edi
lea eax, [ebp - 0x20c]
push 0x56d3c4
push eax
call fcn.00532c8f
add esp, 0xc
test eax, eax
jne 0x437c4f
push 5
jmp 0x437cc4
push edi
lea eax, [ebp - 0x20c]
push 0x56d3cc
push eax
call fcn.00532c8f
add esp, 0xc
test eax, eax
jne 0x437c6f
mov esi, edi
jmp 0x437d12
push edi
lea eax, [ebp - 0x20c]
push 0x56d3d4
push eax
call fcn.00532c8f
add esp, 0xc
test eax, eax
jne 0x437c8c
push 6
jmp 0x437cc4
push edi
lea eax, [ebp - 0x20c]
push 0x56d3dc
push eax
call fcn.00532c8f
add esp, 0xc
test eax, eax
jne 0x437ca9
push 7
jmp 0x437cc4
push edi
lea eax, [ebp - 0x20c]
push 0x56d3e4
push eax
call fcn.00532c8f
add esp, 0xc
test eax, eax
jne 0x437cc7
push 8
pop esi
jmp 0x437d12
push edi
lea eax, [ebp - 0x20c]
push 0x56d3ec
push eax
call fcn.00532c8f
add esp, 0xc
jmp 0x437d12
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.VersionNumber
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call edi
test eax, eax
jne 0x437d12
cmp ax, word [ebp - 0x20c]
cmovne esi, ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d360
leave
ret

Function at 0x437e0e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 4
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x437ec7
mov eax, dword [ebp - 4]
test eax, eax
je 0x437ec7
xor ecx, ecx
lea eax, [eax*2 + 1]
push 2
pop ebx
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0051ce24
mov esi, eax
pop ecx
test esi, esi
je 0x437ec7
mov eax, dword [ebp - 4]
lea eax, [eax*4 + 2]
push eax
push 0
push esi
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x437ebe
push esi
call fcn.00524c40
pop ecx
mov ecx, dword [ebp + 0x14]
push eax
push esi
call fcn.0040389c
push ebx
push esi
call fcn.0051ce16
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x437ec9
push ebx
push esi
call fcn.0051ce16
pop ecx
pop ecx
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x437ecd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x10]
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x14]
push eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x437f6a
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x437f6a
inc eax
push eax
call fcn.0051ce24
mov esi, eax
pop ecx
test esi, esi
je 0x437f6a
mov eax, dword [ebp + 0x14]
inc eax
push eax
push 0
push esi
call fcn.00520800
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x437f60
push esi
call fcn.00524dd0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00403853
push 1
push esi
call fcn.0051ce16
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x437f6c
push 1
push esi
call fcn.0051ce16
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x437fe7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401b4a
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0051d360
leave
ret

Function at 0x43814f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4381ca
push ebx
push esi
call fcn.005331a0
pop ecx
pop ecx
test eax, eax
jne 0x4381ca
push edi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 0x55e650
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.005316c2
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4381a9
push edi
push 2
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.00530f2b
push edi
call fcn.00530b28
add esp, 0x14
push 0x56d358
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
pop edi
test eax, eax
jne 0x4381c6
push esi
call fcn.0043bf37
pop ecx
mov ebx, eax
mov eax, ebx
jmp 0x4381cc
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d360
leave
ret

Function at 0x4385c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4385d5
mov ecx, dword [ecx]
add eax, eax
push eax
push ecx
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret
Function at 0x438987
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x418], eax
cmp dword [eax + 0x10], ebx
je 0x438ae9
cmp dword [esi + 0x10], ebx
je 0x438ae9
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00520800
add esp, 0xc
cmp dword [ebp + 0xc], 0xffffffff
je 0x438a0b
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x438a0b
push 0x311
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___SHGetSpecialFolderPath_error.
jmp 0x438af8
mov eax, dword [ebp - 0x418]
cmp dword [eax + 0x14], 8
jb 0x438a19
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x438a3f
push 0x318
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___PathAppend_error.
jmp 0x438af8
lea eax, [ebp - 0x20c]
push eax
push 0x31c
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___installdir_is:__s
call fcn.00402cc1
add esp, 0x10
cmp dword [edi + 0x10], ebx
jne 0x438ac1
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00520800
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x438a7f
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x438b00
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438b00
push 0x324
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___find_file_is_success.
call fcn.00402cc1
mov bl, 1
jmp 0x438afd
cmp dword [edi + 0x14], 8
jb 0x438ac9
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x438ad1
mov esi, dword [esi]
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x20c]
push edi
push eax
push esi
call fcn.0043a8e1
mov bl, al
jmp 0x438b00
push 0x308
push str.base::RivalMonitor::CheckInstalledFile
push str.__s__d___SubKey__wstrAppendFile_is_NULL.
call fcn.00402cc1
add esp, 0xc
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d360
leave
ret 0x10
Function at 0x438dd2
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x418], ebx
push edi
mov edi, dword [ebp + 0xc]
test ecx, ecx
je 0x438f88
cmp dword [edi + 0x10], ebx
je 0x438f88
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00520800
movzx eax, byte [ebp + 0x18]
add esp, 0xc
shl eax, 8
inc eax
mov dword [ebp - 0x428], 1
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x424], 0x206
jb 0x438e52
mov edi, dword [edi]
lea ecx, [ebp - 0x418]
push ecx
push eax
push ebx
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x438f77
mov eax, dword [ebp - 0x420]
cmp dword [eax + 0x14], 8
jb 0x438e7e
mov eax, dword [eax]
lea ecx, [ebp - 0x424]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x428]
push ecx
push ebx
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x438f77
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00520800
add esp, 0xc
cmp dword [esi + 0x10], ebx
je 0x438f04
cmp dword [esi + 0x14], 8
jb 0x438ecb
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x414]
push eax
push 0x55e068
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00401ab5
add esp, 0x14
test eax, eax
jns 0x438f2f
push 0x247
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d____snwprintf_s_failed.
jmp 0x438f97
lea eax, [ebp - 0x414]
push eax
push 0x556c20
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00401ab5
add esp, 0x10
test eax, eax
jns 0x438f2f
push 0x24c
jmp 0x438ef5
lea eax, [ebp - 0x20c]
mov esi, str.base::RivalMonitor::CheckInstalledReg
push eax
push 0x251
push esi
push str.__s__d___file_path_is:__s
call fcn.00402cc1
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438f9f
push 0x255
push esi
push str.__s__d___file_is_exist.
call fcn.00402cc1
xor ebx, ebx
add esp, 0xc
inc ebx
jmp 0x438f9f
push 0x23e
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d___RegOpenKey_or_RegQueryValueEx_failed.
jmp 0x438f97
push 0x22d
push str.base::RivalMonitor::CheckInstalledReg
push str.__s__d___root__strSubKey_is_NULL.
call fcn.00402cc1
add esp, 0xc
cmp dword [ebp - 0x418], 0
je 0x438fb4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d360
leave
ret 0x14
Function at 0x438fc7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 0x434], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x420], edx
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x418], ebx
push edi
mov edi, dword [ebp + 0x10]
test ecx, ecx
je 0x439165
cmp dword [edx + 0x10], ebx
je 0x439165
cmp dword [edi + 0x10], ebx
je 0x439165
cmp dword [eax + 0x10], ebx
je 0x439165
cmp dword [esi + 0x10], ebx
je 0x439165
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00520800
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00520800
movzx ecx, byte [ebp + 0x1c]
mov eax, 0x206
mov dword [ebp - 0x428], eax
add esp, 0x18
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x420]
shl ecx, 8
inc ecx
mov dword [ebp - 0x41c], 1
cmp dword [eax + 0x14], 8
jb 0x439090
mov eax, dword [eax]
lea edx, [ebp - 0x418]
push edx
push ecx
push ebx
push eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x439154
cmp dword [edi + 0x14], 8
jb 0x4390b6
mov edi, dword [edi]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push edi
push dword [ebp - 0x418]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
test eax, eax
jne 0x439154
mov eax, dword [ebp - 0x42c]
cmp dword [eax + 0x14], 8
jb 0x4390ed
mov eax, dword [eax]
lea ecx, [ebp - 0x430]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x41c]
push ecx
push ebx
push eax
push dword [ebp - 0x418]
call edi
test eax, eax
jne 0x439154
lea eax, [ebp - 0x20c]
push eax
push 0x2f1
push str.base::RivalMonitor::CheckInstalledRegFile
push str.__s__d___installdir_is:__s
call fcn.00402cc1
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x439136
mov esi, dword [esi]
mov ecx, dword [ebp - 0x434]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0043a8e1
mov bl, al
jmp 0x43917c
push 0x2ed
push str.base::RivalMonitor::CheckInstalledRegFile
push str.__s__d___RegOpenKey_or_RegQueryValueEx_failed.
jmp 0x439174
push 0x2d8
push str.base::RivalMonitor::CheckInstalledRegFile
push str.__s__d___root__SubKey__value_name1__value_name2__value_filename_is_NULL.
call fcn.00402cc1
add esp, 0xc
cmp dword [ebp - 0x418], 0
je 0x439191
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d360
leave
ret 0x18
Function at 0x43a8e1
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x5cd9c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x668], eax
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x43aa2a
test edi, edi
je 0x43aa2a
test esi, esi
je 0x43aa2a
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 0x414]
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x43a964
push 0x33c
push str.base::RivalMonitor::IsFileInDir
push str.__s__d___PathCombine_error.
call fcn.00402cc1
add esp, 0xc
jmp 0x43aa2a
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43aa2a
test byte [ebp - 0x664], 0x10
push 0x2e
pop eax
je 0x43aa09
cmp word [ebp - 0x638], ax
jne 0x43a9b3
cmp word [ebp - 0x636], bx
je 0x43aa09
cmp word [ebp - 0x636], ax
jne 0x43a9b3
cmp word [ebp - 0x634], bx
je 0x43aa09
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00520800
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x43aa09
push dword [ebp - 0x668]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x43aa09
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43aa20
lea eax, [ebp - 0x664]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x43aa23
jmp 0x43a983
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d360
leave
ret 0xc

Function at 0x43ab41
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret