joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e58
Capabilities:
Get common file path
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x409e74
push eax
call sub.COMCTL32.DLL_ImageList_Destroy
mov eax, dword [esi + 0xc]
test eax, eax
je 0x409e81
push eax
call sub.USER32.dll_DestroyWindow
mov edx, dword [0x4669fc]
push 0
push edx
mov ecx, dword [0x4656d8]
push 0x10
push ecx
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp dword [esi + 8], 0
je 0x409eb2
mov eax, 0x45f1f5
jmp 0x409eb7
mov eax, 0x45f202
push eax
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x409efc
push 0
push 0x1e
push 0x11
push 0x32
call sub.USER32.dll_GetSystemMetrics
push eax
push 0x31
call sub.USER32.dll_GetSystemMetrics
push eax
call sub.COMCTL32.DLL_ImageList_Create
mov dword [esi + 0x10], eax
mov edx, dword [esi + 0x10]
push edx
push 0
push 0x402
mov ecx, dword [esi + 0xc]
push ecx
call sub.USER32.dll_SendMessageA
jmp 0x409f11
push 3
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esi + 0xc]
push eax
call sub.USER32.dll_SetWindowPos
cmp dword [esi + 8], 0
je 0x409f86
lea edx, [ebp - 4]
push edx
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x309
push 0x160
lea ecx, [ebp - 0x174]
push ecx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
lea edx, [ebp - 8]
push edx
call sub.SHELL32.DLL_SHGetMalloc
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0xffffffffffffffff
lea ecx, [ebp - 0x168]
push 0
push ecx
lea eax, [ebp - 0x174]
lea edx, [ebp - 0x168]
push eax
push pe_nt_image_headers32
push edx
push esi
call fcn.0040a080
mov ecx, dword [ebp - 0x174]
push ecx
call sub.USER32.dll_DestroyIcon
call sub.KERNEL32.dll_GetLogicalDrives
mov edi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, edi
je 0x409fc4
lea edx, [ebx + 0x41]
lea eax, [ebp - 0x14]
push edx
push 0x45f20b
push eax
call fcn.00456f9c
add esp, 0xc
lea edx, [ebp - 0x14]
push 0xffffffffffffffff
push 1
push 0
push 0
push ebx
push edx
push esi
call fcn.0040a080
inc ebx
cmp ebx, 0x20
jl 0x409f8f
push esi
call fcn.0040a198
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a080
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
cmp dword [ebx + 8], 0
je 0x40a169
test esi, esi
je 0x40a0ae
test edi, edi
je 0x40a0ae
xor edx, edx
jmp 0x40a0b3
mov edx, 1
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x40a0d5
push 0x301
push 0x160
lea ecx, [ebp - 0x164]
push ecx
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test esi, esi
je 0x40a0dd
mov eax, dword [esi]
jmp 0x40a0e3
mov eax, dword [ebp - 0x164]
push eax
push 0xffffffffffffffff
mov edx, dword [ebx + 0x10]
push edx
call sub.COMCTL32.DLL_ImageList_ReplaceIcon
cmp byte [ebp - 1], 0
mov esi, eax
je 0x40a103
mov ecx, dword [ebp - 0x164]
push ecx
call sub.USER32.dll_DestroyIcon
mov dword [ebp - 0x188], 0x37
test edi, edi
jne 0x40a117
lea edi, [ebp - 0x158]
mov dword [ebp - 0x180], edi
mov dword [ebp - 0x17c], 0x104
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x188]
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x178], esi
mov dword [ebp - 0x174], esi
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x16c], ecx
push eax
push 0
push 0x401
mov edx, dword [ebx + 0xc]
push edx
call sub.USER32.dll_SendMessageA
jmp 0x40a18f
push eax
mov ecx, dword [ebp + 0x20]
push ecx
push 0x14a
mov eax, dword [ebx + 0xc]
push eax
call sub.USER32.dll_SendMessageA
mov edx, dword [ebp + 0x10]
push edx
push eax
push 0x151
mov ecx, dword [ebx + 0xc]
push ecx
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x40a198
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x404]
push eax
push 0x400
call sub.KERNEL32.dll_GetCurrentDirectoryA
mov byte [ebp - 1], 0
xor ebx, ebx
push 0
push ebx
push 0x150
mov eax, dword [edi + 0xc]
push eax
call sub.USER32.dll_SendMessageA
mov esi, eax
cmp esi, 0xffffffff
je 0x40a20c
xor eax, eax
mov al, byte [ebp - 0x404]
push eax
call fcn.00458c24
pop ecx
add esi, 0x41
cmp eax, esi
jne 0x40a203
push 0
push ebx
push 0x14e
mov eax, dword [edi + 0xc]
push eax
call sub.USER32.dll_SendMessageA
mov byte [ebp - 1], 1
jmp 0x40a20c
inc ebx
cmp ebx, 0x80
jl 0x40a1be
cmp byte [ebp - 1], 0
jne 0x40a226
lea edx, [ebp - 0x404]
lea ecx, [ebp - 0x404]
push edx
push ecx
push edi
call fcn.0040a374
cmp dword [0x466a98], 0
je 0x40a23b
push 0x465b11
call fcn.0040a624
jmp 0x40a245
push 0x465b11
call fcn.0040a5e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a2dc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
mov ebx, dword [ebp + 8]
push 0x400
lea eax, [ebp - 0x400]
push eax
mov edx, dword [ebx + 0xc]
push edx
call sub.USER32.dll_GetWindowTextA
lea ecx, [ebp - 0x400]
push ecx
call fcn.00408f8c
lea eax, [ebp - 0x400]
push eax
push 0xffffffffffffffff
push 0x158
mov edx, dword [ebx + 0xc]
push edx
call sub.USER32.dll_SendMessageA
cmp eax, 0xffffffff
je 0x40a35e
push 0
push eax
push 0x14e
mov ecx, dword [ebx + 0xc]
push ecx
call sub.USER32.dll_SendMessageA
push ebx
call fcn.00409d38
cmp dword [0x466a98], 0
je 0x40a352
push 0x465b11
call fcn.0040a624
jmp 0x40a36a
push 0x465b11
call fcn.0040a5e8
jmp 0x40a36a
lea eax, [ebp - 0x400]
push eax
call fcn.0040abf8
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a5e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.KERNEL32.dll_GetCurrentDirectoryA
lea edx, [ebp - 0x400]
lea ecx, [ebp - 0x400]
push edx
push ecx
push ebx
call fcn.0040a374
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a7c4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x40a7dd
push eax
call sub.USER32.dll_DestroyWindow
mov eax, dword [0x4669fc]
push 0
push eax
mov edx, dword [0x4656d8]
push 0xd
push edx
push 0
push 0
push 0
mov esi, 0x56000944
push 0
push esi
push 0
push 0x45f23f
push 0
call sub.USER32.dll_CreateWindowExA
mov edi, eax
mov dword [ebx + 4], edi
push 0
push 0x14
push 0x41e
push edi
call sub.USER32.dll_SendMessageA
push 0x100010
push 0
push 0x41f
mov eax, dword [ebx + 4]
push eax
call sub.USER32.dll_SendMessageA
push 0x100010
push 0
push 0x420
mov edx, dword [ebx + 4]
push edx
call sub.USER32.dll_SendMessageA
mov dword [ebp - 8], 0xc0c0c0
push 0xf
call sub.USER32.dll_GetSysColor
mov dword [ebp - 4], eax
push 1
lea ecx, [ebp - 8]
push ecx
push 0
push 0x6b
mov eax, dword [0x466a00]
push eax
call sub.COMCTL32.DLL_CreateMappedBitmap
xor edx, edx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
push ecx
push 1
push 0x413
mov eax, dword [ebx + 4]
push eax
call sub.USER32.dll_SendMessageA
push 0x45d940
push 1
push 0x414
mov edx, dword [ebx + 4]
push edx
call sub.USER32.dll_SendMessageA
lea ecx, [ebp - 0x48]
push ecx
push 2
push ebx
call fcn.0040a92c
mov dword [ebp - 0x48], 0x38
mov dword [ebp - 0x44], 0x173
cmp dword [ebp - 0x40], 0
jne 0x40a8c3
or dword [ebp - 0x40], 1
or dword [ebp - 0x40], 4
mov eax, dword [ebx + 4]
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x24], edx
push 0x12
call sub.USER32.dll_GetSysColor
mov dword [ebp - 0x3c], eax
push 0xf
call sub.USER32.dll_GetSysColor
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x1c], 0
jne 0x40a8fa
mov dword [ebp - 0x1c], 0x28
lea ecx, [ebp - 0x58]
push ecx
mov eax, dword [ebx + 0xc]
push eax
call sub.USER32.dll_GetClientRect
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x20], edx
push ecx
push 0xffffffffffffffff
push 0x401
mov eax, dword [ebx + 8]
push eax
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40aa18
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call sub.KERNEL32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, esi
je 0x40aaea
lea edx, [ebx + 0x41]
lea eax, [ebp - 0xd4]
push edx
push 0x45f26d
push eax
call fcn.00456f9c
add esp, 0xc
lea edx, [ebp - 0x200]
push 0x2c
push 0
push edx
call fcn.00452e2c
mov dword [ebp - 0x200], 0x2c
mov dword [ebp - 0x1fc], 0x32
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1f8], ecx
lea eax, [ebx + 0x3b6]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x1e0], ebx
lea edx, [ebp - 0xd4]
mov dword [ebp - 0x1dc], edx
mov ecx, dword [ebp - 0x1dc]
push ecx
call fcn.00452eec
pop ecx
mov dword [ebp - 0x1d8], eax
lea eax, [ebp - 0x200]
push eax
push 1
push 0x64
push edi
call sub.USER32.dll_InsertMenuItemA
mov dword [ebp - 0x1f8], pe_nt_image_headers32
lea edx, [ebp - 0x200]
lea ecx, [ebx + 0x3b6]
push edx
push 0
push ecx
push edi
call sub.USER32.dll_SetMenuItemInfoA
inc ebx
cmp ebx, 0x20
jl 0x40aa30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40acb8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x2c]
add eax, 0x41
push eax
push 0x45f27b
lea edx, [ebp - 0xc]
push edx
call fcn.00456f9c
add esp, 0xc
lea ecx, [ebp - 0x170]
lea eax, [ebp - 0xc]
push 0x301
push 0x160
push ecx
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test byte [ebx + 0x10], 1
je 0x40ad28
push 0xd
call sub.USER32.dll_GetSysColor
push eax
mov edx, dword [ebx + 0x18]
push edx
call sub.GDI32.dll_SetBkColor
mov edi, eax
push 0xe
call sub.USER32.dll_GetSysColor
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.GDI32.dll_SetTextColor
mov dword [ebp - 0x10], eax
push 0
push 0
push 0x45f280
lea edx, [ebx + 0x1c]
push edx
push 2
mov ecx, dword [ebx + 0x20]
push ecx
mov eax, dword [ebx + 0x1c]
push eax
mov edx, dword [ebx + 0x18]
push edx
call sub.GDI32.dll_ExtTextOutA
push 0x31
call sub.USER32.dll_GetSystemMetrics
mov esi, eax
push 0x32
call sub.USER32.dll_GetSystemMetrics
push 3
push 0
push 0
push eax
push esi
mov eax, dword [ebp - 0x170]
push eax
mov edx, dword [ebx + 0x20]
push edx
mov ecx, dword [ebx + 0x1c]
push ecx
mov eax, dword [ebx + 0x18]
push eax
call sub.USER32.dll_DrawIconEx
mov edx, dword [ebp - 0x170]
push edx
call sub.USER32.dll_DestroyIcon
lea ecx, [ebp - 0x164]
push ecx
call fcn.00452eec
pop ecx
push eax
lea eax, [ebp - 0x164]
push eax
mov edx, dword [ebx + 0x20]
add edx, 2
push edx
add esi, dword [ebx + 0x1c]
add esi, 7
push esi
mov ecx, dword [ebx + 0x18]
push ecx
call sub.GDI32.dll_TextOutA
test byte [ebx + 0x10], 1
je 0x40adcd
push edi
mov eax, dword [ebx + 0x18]
push eax
call sub.GDI32.dll_SetBkColor
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebx + 0x18]
push ecx
call sub.GDI32.dll_SetTextColor
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ba80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push eax
call fcn.0040bcac
mov ebx, eax
lea eax, [ebp + 0x18]
push eax
push edi
lea edx, [ebp - 4]
push edx
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.ADVAPI32.dll_RegQueryValueExA
mov esi, eax
push ebx
call fcn.0040c44c
test ebx, ebx
je 0x40baba
test esi, esi
je 0x40bae4
mov eax, dword [ebp + 0x14]
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
xor eax, eax
jmp 0x40bae9
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14

Function at 0x40baf4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push eax
call fcn.0040bcac
mov ebx, eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push edi
lea edx, [ebp - 4]
push edx
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.ADVAPI32.dll_RegQueryValueExA
mov esi, eax
push ebx
call fcn.0040c44c
test ebx, ebx
je 0x40bb37
test esi, esi
je 0x40bb40
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
xor eax, eax
jmp 0x40bb45
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10

Function at 0x40bb74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push eax
call fcn.0040bcac
mov ebx, eax
lea eax, [ebp + 0x18]
push eax
push esi
lea edx, [ebp - 4]
push edx
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.ADVAPI32.dll_RegQueryValueExA
mov edi, eax
push ebx
call fcn.0040c44c
test ebx, ebx
je 0x40bbae
test edi, edi
je 0x40bbda
cmp dword [ebp + 0x14], 0
je 0x40bbc7
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
push esi
call fcn.00452dbc
add esp, 0xc
jmp 0x40bbd6
mov ecx, dword [ebp + 0x18]
push ecx
push 0
push esi
call fcn.00452e2c
add esp, 0xc
xor eax, eax
jmp 0x40bbdd
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x14

Function at 0x40bd70
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push ebx
cmp byte [ebx], 0
je 0x40bd8c
mov eax, 0x45f340
jmp 0x40bd91
mov eax, 0x45f342
push eax
push 0x45f32c
lea edx, [ebp - 0x100]
push edx
call fcn.00456f9c
add esp, 0x10
cmp dword [0x45d964], 0x80000001
je 0x40bdd7
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x100]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x100]
push eax
mov edx, dword [0x45d964]
push edx
call sub.ADVAPI32.dll_RegDeleteKeyA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40bdf4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push ebx
cmp byte [ebx], 0
je 0x40be10
mov eax, 0x45f357
jmp 0x40be15
mov eax, 0x45f359
push eax
push 0x45f343
lea edx, [ebp - 0x104]
push edx
call fcn.00456f9c
add esp, 0x10
cmp dword [0x45d964], 0x80000001
je 0x40be5b
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
lea edx, [ebp - 0x104]
push edx
mov ecx, dword [0x45d964]
push ecx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x40be93
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_RegDeleteValueA
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040c44c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40bfe8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff664
mov edx, dword [0x45d964]
lea eax, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
push 0x20019
push 0
push edi
push edx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x40c01d
xor eax, eax
jmp 0x40c176
push esi
call fcn.0040c21c
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push esi
mov eax, dword [0x45d964]
push eax
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
je 0x40c058
mov edx, dword [ebp - 4]
push edx
call fcn.0040c44c
xor eax, eax
jmp 0x40c176
xor ebx, ebx
mov dword [ebp - 0x14], 0xc8
mov dword [ebp - 0x18], 0x3e8
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x4d4]
push eax
push edx
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x14]
push ecx
push 0
push eax
lea edx, [ebp - 0xec]
push edx
push ebx
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegEnumValueA
test eax, eax
jne 0x40c0b6
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x4d4]
push eax
push edx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xec]
push ecx
push 0
push eax
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegSetValueExA
inc ebx
jmp 0x40c05a
xor ebx, ebx
mov dword [ebp - 0x1c], 0xc8
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x59c]
push ecx
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
jne 0x40c15f
lea edx, [ebp - 0x59c]
push edx
push edi
push 0x45f388
lea ecx, [ebp - 0x79c]
push ecx
call fcn.00456f9c
add esp, 0x10
lea eax, [ebp - 0x59c]
push eax
push esi
push 0x45f38e
lea edx, [ebp - 0x99c]
push edx
call fcn.00456f9c
add esp, 0x10
lea ecx, [ebp - 0xc]
lea eax, [ebp - 8]
lea edx, [ebp - 0x99c]
push ecx
push eax
push 0
push 0x20006
push 0
push 0
push 0
push edx
mov ecx, dword [0x45d964]
push ecx
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
jne 0x40c15f
lea eax, [ebp - 0x99c]
push eax
lea edx, [ebp - 0x79c]
push edx
call fcn.0040bfe8
inc ebx
jmp 0x40c0b8
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040c44c
mov eax, dword [ebp - 8]
push eax
call fcn.0040c44c
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40c23c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd28
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push esi
mov edx, dword [0x45d964]
push edx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x40c2dd
xor ebx, ebx
mov dword [ebp - 8], 0xc8
lea eax, [ebp - 0x10]
lea edx, [ebp - 8]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0xd8]
push ecx
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
jne 0x40c2bd
lea edx, [ebp - 0xd8]
push edx
push esi
push 0x45f3ab
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.00456f9c
add esp, 0x10
lea eax, [ebp - 0x2d8]
push eax
call fcn.0040c23c
inc ebx
jmp 0x40c268
mov edx, dword [ebp - 4]
push edx
call fcn.0040c44c
push esi
mov ecx, dword [0x45d964]
push ecx
call sub.ADVAPI32.dll_RegDeleteKeyA
test eax, eax
jne 0x40c2dd
inc dword [0x469790]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c46c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff764
push ebx
push esi
push edi
xor ebx, ebx
xor esi, esi
lea eax, [ebp - 0x2c]
push eax
call fcn.004262c0
lea edx, [ebp - 0x24]
push edx
call fcn.004262c0
push 0
push 0x4656f0
call fcn.00423214
jmp 0x40c512
lea ecx, [ebp - 4]
lea eax, [ebp - 0x87c]
push ecx
push eax
lea edx, [ebp - 0x47c]
push 0x400
push edx
call sub.KERNEL32.dll_GetFullPathNameA
test eax, eax
je 0x40c512
lea ecx, [ebp - 0x87c]
push ecx
call fcn.00452eec
pop ecx
mov edi, eax
inc edi
lea eax, [edi + esi + 1]
push eax
push ebx
call fcn.00459ccc
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40c5ad
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x87c]
or ecx, 0xffffffff
lea edx, [esi + ebx]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esi, edi
lea eax, [ebp - 0x47c]
push eax
push 0x4656f0
call fcn.00423214
test al, al
jne 0x40c49c
test esi, esi
je 0x40c5ad
mov byte [ebx + esi], 0
push 0x1e
push 0
lea edx, [ebp - 0x89c]
push edx
call fcn.00452e2c
add esp, 0xc
mov ecx, dword [0x4656d8]
mov dword [ebp - 0x89c], ecx
mov dword [ebp - 0x898], 3
cmp dword [ebp + 8], 0
je 0x40c56b
mov word [ebp - 0x88c], 0x40
mov dword [ebp - 0x894], ebx
lea eax, [ebp - 0x89c]
push eax
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 5], dl
push ebx
call fcn.00459d7c
cmp byte [ebp - 5], 0
pop ecx
je 0x40c5ad
cmp dword [ebp - 0x88a], 0
jne 0x40c5ad
push 0x45f3c8
push 0x4656f0
call fcn.0041f7c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c8a4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ebx, ebx
jne 0x40c8e7
push 0x4656f0
call fcn.0042333c
test eax, eax
jne 0x40c8e7
push 0x30
push 0x65
call fcn.00408028
push eax
push 0x14b
call fcn.00408028
push eax
mov eax, dword [0x4656d8]
push eax
call sub.USER32.dll_MessageBoxA
jmp 0x40caff
push 0x15c0
push 0
push 0x469794
call fcn.00452e2c
mov dword [0x46a7a0], 2
add esp, 0xc
mov edx, dword [0x468f28]
test ebx, ebx
mov dword [0x46acec], edx
mov ecx, dword [0x468f2c]
mov dword [0x46acf0], ecx
mov eax, dword [0x468f30]
mov dword [0x46acf4], eax
movsx eax, byte [ebp + 0x14]
mov edx, dword [0x468f34]
mov dword [0x46acf8], edx
mov ecx, dword [0x468f10]
mov dword [0x46ace4], ecx
mov dword [0x46a7b0], eax
mov byte [0x46ad54], 0
jle 0x40c9af
cmp dword [0x466a98], 0
je 0x40c9af
push 0x465fe5
call fcn.0041834e
test eax, eax
je 0x40c9a0
dec eax
je 0x40c9a0
mov edx, dword [0x469b94]
push edx
call fcn.00459d7c
pop ecx
push 0x30
push 0x65
call fcn.00408028
push eax
push 0x1fd
call fcn.00408028
push eax
mov ecx, dword [0x4656d8]
push ecx
call sub.USER32.dll_MessageBoxA
jmp 0x40caff
push 0x469794
push 0x465fe5
call fcn.0041eca0
cmp ebx, 1
jne 0x40ca20
cmp dword [0x466a98], 0
jne 0x40ca20
push esi
call sub.KERNEL32.dll_GetFileAttributesA
mov edi, eax
push esi
call fcn.0040809c
push esi
push edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
mov esi, 0x46ad54
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp edi, 0xffffffff
je 0x40ca00
test edi, 0x10
jne 0x40ca16
push 0x2e
push 0x46ad54
call fcn.00453124
add esp, 8
test eax, eax
je 0x40ca16
mov byte [eax], 0
push 0x46ad54
call fcn.0040da08
mov eax, dword [ebp + 0x10]
mov edx, dword [0x4656d8]
push eax
push 0x40cb08
push edx
mov ecx, dword [0x466a00]
push 0x45f449
push ecx
call sub.USER32.dll_DialogBoxParamA
test eax, eax
jne 0x40ca56
mov eax, dword [0x469b94]
push eax
call fcn.00459d7c
pop ecx
jmp 0x40caff
test ebx, ebx
jle 0x40ca9d
mov dword [0x469b94], esi
mov dword [0x469b98], ebx
mov dword [0x46a7e0], 2
cmp dword [0x466a98], 0
je 0x40cab5
push 0x46a8e4
push 0x465fe5
call fcn.0041ec64
cmp byte [0x46a8e4], 0
je 0x40cab5
push 0x46a8e4
call fcn.004080c8
jmp 0x40cab5
push 0x469b98
push 0x469b94
push 0x4656f0
call fcn.00423494
test eax, eax
je 0x40caff
push 0
push 0x45f45c
push 0x45f450
call fcn.0040bb50
mov dword [0x46ace8], eax
push 0x469794
push 0x465fe5
call fcn.0041ed28
mov edx, dword [0x469b94]
push edx
call fcn.00459d7c
pop ecx
cmp dword [0x466a98], 0
jne 0x40caff
push 0x469794
push 0x4656f0
call fcn.0041f7c4
pop edi
pop esi
pop ebx
pop ebp
ret 0x10