joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408da0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x94
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [0x410de0], 1
mov dword [0x410df8], 0
mov esi, eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [0x410dfc], 0
mov dword [0x410e40], eax
mov eax, dword [ebp + 8]
mov dword [0x410e38], 0
mov dword [0x410e3c], 0
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDlgItem]
mov ecx, 0x3f2
mov edx, 0x5a8
sub esp, 8
mov ebx, eax
xor eax, eax
cmp dword [0x410de4], 1
mov dword [esp], 6
setg al
mov edi, eax
mov eax, ebx
add edi, 0x5ab
call sym._AddTextButton
mov dword [esp], 7
mov eax, ebx
mov ecx, 0x3f9
mov edx, 0x5a9
call sym._AddTextButton
mov dword [esp], 8
mov eax, ebx
mov ecx, 0x3fa
mov edx, 0x5aa
call sym._AddTextButton
mov dword [esp], 9
mov edx, edi
mov eax, ebx
mov ecx, 0x3fb
call sym._AddTextButton
mov dword [esp], 0xa
mov eax, ebx
mov ecx, 0x3fc
mov edx, 0x5ad
call sym._AddTextButton
mov dword [esp], 0xb
mov eax, ebx
mov ecx, 0x3fd
mov edx, 0x5ae
call sym._AddTextButton
mov dword [esp], 0xc
mov ecx, 0x3e8
mov eax, ebx
mov edx, 0x5af
call sym._AddTextButton
mov edi, dword [sym.imp.user32.dll_CreateWindowExW]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], 0
mov dword [esp + 4], 0x41311e
mov dword [esp], 0
call edi
mov dword [ebp - 0x70], 0x50
sub esp, 0x30
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x6c], 0x371
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x48], 0x16
mov dword [ebp - 0x38], 0x16
mov dword [ebp - 0x4c], 0x5a
mov dword [ebp - 0x44], 0x5a
mov dword [ebp - 0x2c], 0x64
mov dword [ebp - 0x3c], 0xd
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x40a
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, dword [ebp + 8]
sub esp, 0x10
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0x7e0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xa
mov dword [esp + 0x18], 0xc8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50300000
mov dword [esp + 8], 0
mov dword [esp + 4], str.PrtPreview
mov dword [esp], 0
call edi
sub esp, 0x30
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409060
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x40b8d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x18
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
cmp word [0x411a80], 0
jne 0x40b928
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 8
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 8], eax
mov eax, dword [0x410cb0]
mov dword [ebp - 0xc], 0x4b0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x45f
mov dword [esp], eax
call ebx
sub esp, 0x10
test eax, eax
je 0x40ba30
mov eax, dword [0x410cb0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb8
mov dword [esp], eax
call ebx
sub esp, 0x10
test eax, eax
je 0x40ba30
cmp word [0x411a80], 0
movzx eax, word [0x411880]
mov ebx, 0x411880
jne 0x40ba40
test ax, ax
je 0x40ba80
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x40b980
sub eax, ebx
sar eax, 1
cmp word [0x412900], 0
je 0x40b9b3
mov edx, 0x412900
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x40b9a0
sub edx, 0x412900
sar edx, 1
add eax, edx
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_calloc]
mov esi, eax
test eax, eax
je 0x40bacc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x412900
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [0x410cb8]
mov dword [esp + 4], esi
mov dword [esp + 0xc], 0x33
mov dword [esp + 8], 0x41c470
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
sub esp, 0x10
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
cmp ebx, 6
je 0x40ba90
xor eax, eax
cmp ebx, 7
sete al
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
mov ebx, 0x411a80
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x40ba48
cmp ebx, 0x411a80
jbe 0x40ba80
lea esi, [esi]
cmp ax, 0x5c
je 0x40bac0
cmp ax, 0x2f
je 0x40bac0
sub ebx, 2
movzx eax, word [ebx]
cmp ebx, 0x411a80
ja 0x40ba60
jmp 0x40b96f
xor eax, eax
jmp 0x40b98d
cmp word [0x411a80], 0
je 0x40bab0
mov edx, dword [0x410c40]
lea esp, [ebp - 8]
mov eax, 0x411a80
pop ebx
pop esi
pop ebp
jmp sym._DoSaveFile
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp sym._DialogSaveFile
movzx eax, word [ebx + 2]
add ebx, 2
jmp 0x40b96f
xor eax, eax
jmp 0x40ba20
Function at 0x40c270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
lea ebx, [eax*4]
lea eax, [ebp - 0x18]
lea esi, [ecx + ebx]
mov ecx, edx
lea edx, [ebp - 0x14]
sub esp, 0x24
add ebx, dword [ebp + 8]
mov dword [esi], 0
mov dword [ebx], 0
mov dword [ebp - 0x14], 0
call sym._registry_get_handle
test eax, eax
jne 0x40c2d7
mov eax, dword [ebp - 0x14]
cmp eax, 2
je 0x40c2e0
mov dword [esi], 0xf
cmp eax, 2
je 0x40c328
xor eax, eax
test edi, edi
sete al
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x14]
jne 0x40c2b4
jmp 0x40c2ba
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c2bf
jmp 0x40c2c8

Function at 0x40c370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x41c2e0
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 4
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call sym._registry_read_formatopts
mov dword [ebp + 8], esi
add esp, 4
mov ecx, ebx
mov edx, 0x41c2fc
pop ebx
mov eax, 1
pop esi
pop ebp
jmp sym._registry_read_formatopts

Function at 0x40c3b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 4
call sym._registry_get_handle
test eax, eax
je 0x40c3f8
mov dword [ebx], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c3db
cmp dword [ebp - 8], 4
jne 0x40c3db
jmp 0x40c3e1
Function at 0x40c4d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0x10
test eax, eax
je 0x40c51b
lea edx, [ebp - 4]
mov dword [esp + 0x10], 0x410d60
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.PageMargin
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x40c548
mov dword [0x410d60], 0x6dd
mov dword [0x410d68], 0x6dd
mov dword [0x410d64], 0x589
mov dword [0x410d6c], 0x589
leave
ret
cmp dword [ebp - 4], 0x10
jne 0x40c51b
jmp 0x40c543

Function at 0x40c550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 4
test eax, eax
je 0x40c59b
lea edx, [ebp - 4]
mov dword [esp + 0x10], 0x410de4
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviewPages
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x40c5b0
mov dword [0x410de4], 1
leave
ret
cmp dword [ebp - 4], 4
jne 0x40c59b
mov eax, dword [0x410de4]
test eax, eax
jle 0x40c59b
cmp eax, 2
jle 0x40c5a5
mov dword [0x410de4], 2
leave
ret

Function at 0x40c5d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0x10
call sym._registry_get_handle
test eax, eax
je 0x40c630
test ebx, ebx
je 0x40c61a
mov dword [ebx], 0
mov dword [ebx + 8], 0x258
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0x12c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c5fb
cmp dword [ebp - 8], 0x10
jne 0x40c5fb
jmp 0x40c61a
Function at 0x40c670
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Recent_file_list
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x5c]
lea eax, [ebp - 0x60]
push ebx
sub esp, 0x70
call sym._registry_get_handle
test eax, eax
je 0x40c6a0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._registry_read_filelist
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, 0x3ed
lea esi, [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetMenu]
mov dword [ebp - 0x3c], 0x30
mov dword [ebp - 0x64], eax
sub esp, 4
mov dword [ebp - 0x38], 0x20
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x64]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetMenuItemInfoW]
sub esp, 0x10
test eax, eax
je 0x40c71c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + edi*4 - 0x1000], eax
inc edi
cmp edi, 0x3f1
jne 0x40c6e6
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [ebp - 0x64], eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x40c810
mov eax, dword [ebp - 0x64]
xor edi, edi
mov ecx, esi
mov esi, edi
mov edi, ecx
test eax, eax
je 0x40c778
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
sub esp, 8
test eax, eax
je 0x40c82f
inc esi
cmp esi, 4
je 0x40c778
mov eax, dword [ebp + esi*4 - 0x4c]
test eax, eax
jne 0x40c74e
lea esi, [esi]
nop
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x40c791
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x48], eax
mov edi, dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [ebp + 8]
lea esi, [ebp - 0x58]
test edx, edx
je 0x40c810
inc ebx
mov dword [ebp + 8], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.File_d
mov dword [esp], esi
call edi
mov edx, dword [ebp + 8]
cmp word [edx], 0
je 0x40c828
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x40c7c8
sub eax, edx
add eax, 2
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
cmp ebx, 4
je 0x40c810
mov edx, dword [ebp + ebx*4 - 0x4c]
jmp 0x40c79d
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x40c68d
mov eax, 2
jmp 0x40c7d6
test esi, esi
je 0x40c791
lea eax, [ebp - 0x4c]
lea edx, [esi*4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x48]
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._memmove
jmp 0x40c791
Function at 0x40c860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, edx
push ebx
lea edx, [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x20
mov dword [ebp - 0xc], 0
call sym._registry_get_handle
test eax, eax
je 0x40c890
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x10]
shl ebx, 2
mov dword [esp + 0x14], 4
add esi, ebx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], esi
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExW]
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x10]
add ebx, dword [ebp + 8]
sub esp, 0x18
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40c920
Capabilities:
Set registry value

Disassembly:
push ebp
mov edx, 0x41c2e0
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 4
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call sym._registry_set_formatopts
mov dword [ebp + 8], esi
add esp, 4
mov ecx, ebx
mov edx, 0x41c2fc
pop ebx
mov eax, 1
pop esi
pop ebp
jmp sym._registry_set_formatopts

Function at 0x40c960
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Options
mov ebp, esp
push ebx
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x3c]
sub esp, 0x50
mov dword [ebp - 0x3c], 0
call sym._registry_get_handle
test eax, eax
je 0x40c9a0
mov ecx, str.Settings
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x3c]
call sym._registry_get_handle
test eax, eax
je 0x40ca58
mov ebx, dword [ebp - 4]
leave
ret
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowPlacement]
xor eax, eax
mov ebx, dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 8
cmp dword [ebp - 0x28], 3
sete al
mov dword [esp + 0x14], 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x34]
sub esp, 0x18
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x3c]
sub esp, 0x18
mov dword [esp], eax
call sym._registry_set_pagemargins
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x40c982
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._registry_set_previewpages
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
Function at 0x40ca80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0x410d60
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.PageMargin
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
leave
ret

Function at 0x40cac0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x410de4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviewPages
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
leave
ret
Function at 0x40d750
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 8
mov eax, dword [0x410cb8]
mov dword [esp + 4], 0x7d0
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDlgItem]
sub esp, 8
test ebx, ebx
je 0x40d7a8
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov eax, dword [0x410c40]
sub esp, 8
mov dword [esp], eax
call sym._reg_formatindex
mov ebx, dword [ebp - 4]
or dword [eax*4 + 0x41004c], 2
leave
ret
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov eax, dword [0x410c40]
sub esp, 8
mov dword [esp], eax
call sym._reg_formatindex
mov ebx, dword [ebp - 4]
and dword [eax*4 + 0x41004c], 0xfffffffd
leave
ret

Function at 0x40da50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
je 0x40da97
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
leave
ret 0x10

Function at 0x40daa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 8]
sub esp, 0x18
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
je 0x40dae3
cmp dword [ebp - 8], ebx
je 0x40daf0
mov ebx, dword [ebp - 4]
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 0x10
Function at 0x40e770
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x6f0]
push ebx
sub esp, 0x704
mov eax, dword [0x410cb8]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call ebx
mov dword [ebp - 0x6f8], ebx
sub esp, 8
mov dword [ebp - 0x6fc], eax
mov dword [esp + 4], 0x7dd
mov dword [esp], eax
call ebx
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call ebx
lea edx, [ebp - 0x6ec]
mov ecx, 0x1c
mov dword [ebp - 0x6f0], 0x74
mov edi, edx
mov dword [ebp - 0x6f4], eax
xor eax, eax
sub esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [0x410cb0]
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x606]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x6f4]
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], ecx
call ebx
sub esp, 0x10
test eax, eax
jne 0x40e858
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x6d6]
mov dword [esp], esi
mov esi, dword [sym.imp.kernel32.dll_lstrcmpW]
mov dword [esp + 4], edi
call esi
mov dword [ebp - 0x700], eax
sub esp, 8
test eax, eax
je 0x40e8c8
mov ecx, dword [ebp - 0x6f4]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp], ecx
mov dword [esp + 4], 0xc
call ebx
mov eax, dword [ebp - 0x6fc]
mov ebx, dword [ebp - 0x6f8]
sub esp, 0x10
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call ebx
sub esp, 8
call sym._populate_size_list
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x410cb8]
mov edi, dword [ebp - 0x6f8]
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call edi
sub esp, 8
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call edi
lea edi, [ebp - 0x678]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call ebx
mov ecx, 0x1c
lea edx, [ebp - 0x67c]
mov dword [ebp - 0x67c], 0x74
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x700]
sub esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [0x410cb0]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x6f4]
lea ecx, [ebp - 0x408]
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], eax
call ebx
mov edi, dword [ebp - 0x670]
mov edx, 0x66666667
sub esp, 0x10
mov eax, edi
sar edi, 0x1f
mov dword [esp + 4], 0x41c34c
imul edx
sar edx, 3
sub edx, edi
lea edi, [ebp - 0x20a]
mov dword [esp + 8], edx
mov dword [esp], edi
call dword [sym.imp.user32.dll_wsprintfW]
lea ecx, [ebp - 0x408]
mov dword [esp + 4], edi
mov dword [esp], ecx
call esi
sub esp, 8
test eax, eax
je 0x40e84d
mov eax, dword [ebp - 0x6f4]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x40e84d
Function at 0x40f250
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40f2cd
cmp al, 9
je 0x40f2c0
cmp al, 0x20
je 0x40f2c0
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp al, 0x5c
je 0x40f320
cmp al, 0x22
je 0x40f330
mov dword [ebp - 0x54], 0
movzx eax, byte [ebx + 1]
inc ebx
test al, al
je 0x40f2cd
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x40f280
test edi, 1
jne 0x40f280
lea esi, [esi]
movzx eax, byte [ebx + 1]
inc ebx
cmp al, 9
je 0x40f2c0
cmp al, 0x20
je 0x40f2c0
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x24], 1
jne 0x40f2e8
mov word [ebp - 0x20], 1
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x40f297
and dword [ebp - 0x54], 1
jne 0x40f290
xor edi, 1
jmp 0x40f297
Function at 0x40de24
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx