joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441030
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x441050
lea ecx, [esi + eax]
add ecx, 0xfffffffe
mov eax, esi
not eax
and eax, ecx
xor ecx, esi
add eax, eax
sub eax, ecx
mov ebx, eax
sar ebx, 1
add ebx, 4
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x441086
mov ecx, 0xffffffff
jmp 0x441088
add ecx, ecx
push ecx
call fcn.00408580
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x4410d1
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x4410c0
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 8], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xf4f5f6f7
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
mov edx, ecx
or edx, 0x9cdb5cd4
xor edx, esi
mov esi, edx
not esi
add edx, 0xdb
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x441130
mov esi, dword [esp]
mov ecx, dword [0x44dee4]
test ecx, ecx
je 0x4411c1
xor edx, edx
mov ebx, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x441190
inc edx
cmp ecx, edx
jne 0x441180
jmp 0x4411c1
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4411c1
mov edx, esp
lea esi, [esp + 0x10]
push edi
push ebp
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44deec]
mov edi, eax
call fcn.0043e980
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00408590
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4411e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x441200
lea ecx, [esi + eax]
add ecx, 0xfffffffe
mov eax, esi
not eax
and eax, ecx
xor ecx, esi
add eax, eax
sub eax, ecx
mov edi, eax
sar edi, 1
lea ebx, [edi + 4]
and eax, 2
mov ecx, ebx
xor ecx, 1
add ecx, eax
jns 0x441236
mov ecx, 0xffffffff
jmp 0x441238
add ecx, ecx
push ecx
call fcn.00408580
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x441281
add esi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x441270
mov word [ecx], 0
mov edx, 3
sub edx, edi
and edx, 2
mov ecx, ebx
and ecx, 0xfffd
imul ecx, edx
and edi, 2
or ebx, 2
imul ebx, edi
lea edx, [ebx + ecx]
mov word [esp], dx
add ecx, ebx
add ecx, 2
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xf4f5f6f7
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx + 0x20]
mov edx, ecx
or edx, 0x9cdb5cd4
xor edx, esi
mov esi, edx
not esi
add edx, 0xdb
and esi, 1
or edx, 1
add edx, esi
mov byte [esp + ecx + 0x20], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 4
jb 0x441300
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44dee4]
test ecx, ecx
je 0x441389
xor edx, edx
mov edi, dword [0x44dee8]
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x1ce638e1
je 0x441360
inc edx
cmp ecx, edx
jne 0x441350
jmp 0x441389
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x441389
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44deec]
mov edi, eax
call fcn.0043e980
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.00408590
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44139f
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4413b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xf4f5f6f7
xor eax, eax
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax]
mov edx, eax
or edx, 0x9cdb5cd4
xor edx, ecx
mov ecx, edx
not ecx
add edx, 0xdb
and ecx, 1
or edx, 1
add edx, ecx
mov byte [esp + eax], dl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x4413d0
mov eax, dword [esp]
mov edx, dword [0x44dee4]
test edx, edx
je 0x441458
xor ebx, ebx
mov ecx, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x441430
inc ebx
cmp edx, ebx
jne 0x441420
jmp 0x441458
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x441458
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44deec]
call fcn.0043e980
add esp, 0x20
test edi, edi
je 0x441462
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x44146e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x441480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xf4f5f6f7
xor eax, eax
nop
nop
nop
movzx edi, byte [esp + eax + 4]
mov ebx, eax
or ebx, 0x9cdb5cd4
xor ebx, edi
mov edi, ebx
not edi
add ebx, 0xdb
and edi, 1
or ebx, 1
add ebx, edi
mov byte [esp + eax + 4], bl
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
cmp eax, 4
jb 0x4414a0
mov eax, dword [esp + 4]
mov ebx, dword [0x44dee4]
test ebx, ebx
je 0x44152e
xor ebp, ebp
mov edi, dword [0x44dee8]
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x441500
inc ebp
cmp ebx, ebp
jne 0x4414f0
jmp 0x44152e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x44152e
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x44deec]
call fcn.0043e980
add esp, 0x30
cmp eax, 0x103
jne 0x4415d9
mov dword [esp], 0xf4f5f6f7
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov ecx, eax
or ecx, 0x9cdb5cd4
xor ecx, edx
mov edx, ecx
not edx
add ecx, 0xdb
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x441550
mov eax, dword [esp]
mov ecx, dword [0x44dee4]
test ecx, ecx
je 0x4415d1
xor edx, edx
mov edi, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x4415b0
inc edx
cmp ecx, edx
jne 0x4415a0
jmp 0x4415d1
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x4415d1
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44deec]
call fcn.0043e980
add esp, 0x18
test eax, eax
js 0x4415d9
mov eax, dword [esp + 4]
test esi, esi
je 0x4415ec
xor ecx, ecx
cmp eax, 0xc0000011
je 0x4415ea
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], 0xf4f5f6f7
xor eax, eax
nop
nop
nop
movzx edi, byte [esp + eax + 4]
mov ebx, eax
or ebx, 0x9cdb5cd4
xor ebx, edi
mov edi, ebx
not edi
add ebx, 0xdb
and edi, 1
or ebx, 1
add ebx, edi
mov byte [esp + eax + 4], bl
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
cmp eax, 4
jb 0x441620
mov eax, dword [esp + 4]
mov ebx, dword [0x44dee4]
test ebx, ebx
je 0x4416ae
xor ebp, ebp
mov edi, dword [0x44dee8]
nop
nop
nop
nop
nop
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x441680
inc ebp
cmp ebx, ebp
jne 0x441670
jmp 0x4416ae
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x4416ae
lea eax, [esp + 4]
push 0
push 0
push edx
push ecx
push eax
push 0
push 0
push 0
push dword [esp + 0x40]
push 0x24
push ebx
push dword [0x44deec]
call fcn.0043e980
add esp, 0x30
cmp eax, 0x103
jne 0x441759
mov dword [esp], 0xf4f5f6f7
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
mov ecx, eax
or ecx, 0x9cdb5cd4
xor ecx, edx
mov edx, ecx
not edx
add ecx, 0xdb
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 4
jb 0x4416d0
mov eax, dword [esp]
mov ecx, dword [0x44dee4]
test ecx, ecx
je 0x441751
xor edx, edx
mov edi, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x441730
inc edx
cmp ecx, edx
jne 0x441720
jmp 0x441751
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x441751
push 0
push 0
push dword [esp + 0x28]
push 0xc
push ecx
push dword [0x44deec]
call fcn.0043e980
add esp, 0x18
test eax, eax
js 0x441759
mov eax, dword [esp + 4]
test esi, esi
je 0x441763
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441770
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
xor ebx, ebx
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x441790
lea ebp, [edi + ebx]
add ebp, 0xfffffffe
mov ebx, edi
not ebx
and ebx, ebp
xor ebp, edi
add ebx, ebx
sub ebx, ebp
and ebx, 0xfffe
mov word [esp + 4], bx
add ebx, 2
mov word [esp + 6], bx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xf4f5f6f7
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax]
mov ebx, eax
or ebx, 0x9cdb5cd4
xor ebx, edi
mov edi, ebx
not edi
add ebx, 0xdb
and edi, 1
or ebx, 1
add ebx, edi
mov byte [esp + eax], bl
mov edi, eax
and edi, 1
xor eax, 1
lea eax, [eax + edi*2]
cmp eax, 4
jb 0x441800
mov eax, dword [esp]
mov edi, dword [0x44dee4]
test edi, edi
je 0x441882
xor ebx, ebx
mov ebp, dword [0x44dee8]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x40915fe0
je 0x441861
inc ebx
cmp edi, ebx
jne 0x441850
jmp 0x441882
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x441882
lea eax, [esp + 0xc]
push esi
push eax
push edx
push ecx
push 0x10
push edi
push dword [0x44deec]
call fcn.0043e980
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402000
Capabilities:
Get graphical window text
Set console window title

Disassembly:
sub esp, 0xfc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push str.UDEC_Initializing...
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [0x648244], ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetTopWindow]
mov edi, eax
cmp edi, ebx
je 0x402096
lea eax, [esp + 0x8c]
push 0x7f
push eax
push edi
call ebp
mov byte [esp + 0x10b], bl
mov esi, str.UDEC_Initializing...
lea eax, [esp + 0x8c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40207e
cmp cl, bl
je 0x40207a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40207e
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40205a
xor eax, eax
jmp 0x402083
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4020c0
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
cmp edi, ebx
jne 0x40203a
cmp dword [esp + 0x10], 0x3e8
ja 0x4020cc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
mov eax, dword [0x648244]
inc ecx
cmp eax, ebx
mov dword [esp + 0x10], ecx
je 0x402027
jmp 0x4020d9
cmp edi, ebx
je 0x402096
mov dword [0x648244], edi
jmp 0x4020a8
push str.Failed_to_find_console_window_handle__n
call fcn.00614bd8
add esp, 4
mov eax, dword [esp + 0x120]
mov eax, dword [eax]
dec eax
je 0x402135
dec eax
je 0x402110
dec eax
jne 0x402160
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x110]
mov edx, dword [ecx]
lea ecx, [esp + 0x3c]
fld dword [eax]
push edx
sub esp, 8
fstp qword [esp]
push str.UDEC__4.2f_Beta__i
push ecx
jmp 0x402158
mov edx, dword [esp + 0x118]
mov ecx, dword [esp + 0x110]
mov eax, dword [edx]
lea edx, [esp + 0x3c]
fld dword [ecx]
push eax
sub esp, 8
fstp qword [esp]
push str.UDEC__4.2f_Alpha__i
push edx
jmp 0x402158
mov eax, dword [esp + 0x114]
mov edx, dword [esp + 0x110]
mov ecx, dword [eax]
lea eax, [esp + 0x3c]
fld dword [edx]
push ecx
sub esp, 8
fstp qword [esp]
push str.UDEC__4.2f._3.3i_SP
push eax
call fcn.006147a3
add esp, 0x14
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edx, dword [0x648244]
push 0xfffffffffffffffa
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x7f00
push ebx
mov dword [0x64824c], eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0x4036d0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [esp + 0x2c], eax
mov eax, dword [0x6c0028]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x34], 2
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
call esi
test ax, ax
jne 0x40220a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
lea edx, [esp + 0x14]
mov dword [esp + 0x24], ebx
push edx
call esi
test ax, ax
jne 0x40220a
call edi
push eax
push str.Failed_to_register_plot_window_class___i___n
call fcn.00614bd8
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xfc
ret
Function at 0x402720
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push edi
push 0
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x402784
mov ebp, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call ebp
test eax, eax
je 0x40278c
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x10]
push eax
call ebx
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
jne 0x402752
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0xffffffffffffffff
call fcn.00615015
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x403de0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x1c0
mov ecx, dword [eax]
push esi
cmp ecx, 1
push edi
jg 0x403e48
mov esi, dword [esp + 0x1cc]
mov ecx, 0x13
lea edi, [esp + 0x38]
mov eax, dword [0x64828c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
test eax, eax
mov byte [esp + 0x87], 0
je 0x403e20
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x88]
lea edx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [0x64828c], eax
jne 0x403e8b
pop edi
xor eax, eax
pop esi
add esp, 0x1c0
ret
mov eax, dword [0x64828c]
test eax, eax
je 0x403e3d
cmp eax, 0xffffffff
je 0x403e3d
lea ecx, [esp + 0x88]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403e8b
mov edx, dword [0x64828c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov dword [0x64828c], 0
xor eax, eax
pop esi
add esp, 0x1c0
ret
push ebx
lea eax, [esp + 0x24]
push ebp
lea ecx, [esp + 0xa4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov eax, dword [esp + 0x18]
mov ecx, 0x64
and eax, 0xffff
mov esi, dword [esp + 0x20]
cdq
idiv ecx
mov edi, dword [esp + 0x1a]
mov ebp, dword [esp + 0x1e]
mov ebx, dword [esp + 0x22]
and esi, 0xffff
and edi, 0xffff
and ebp, 0xffff
and ebx, 0xffff
cmp esi, 0xc
mov byte [esp + 0x13], 0x61
mov dword [esp + 0x14], edx
jle 0x403eff
sub esi, 0xc
mov byte [esp + 0x13], 0x70
test byte [esp + 0x90], 0x10
je 0x403f1d
lea edx, [esp + 0x30]
push str._DIR_
push edx
call fcn.006147a3
add esp, 8
jmp 0x403f37
mov eax, dword [esp + 0xb0]
lea ecx, [esp + 0x30]
push eax
push str._12lu
push ecx
call fcn.006147a3
add esp, 0xc
movsx ecx, byte [esp + 0x13]
lea edx, [esp + 0xbc]
lea eax, [esp + 0x30]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x1e0]
push ecx
push ebx
push esi
push edx
push ebp
push edi
push str._02i__02i__02i___02i:_02i_c___12s___48s
push eax
call fcn.006147a3
add esp, 0x28
mov eax, 1
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c0
ret
Function at 0x403f80
Capabilities:
Move file

Disassembly:
sub esp, 0x58
push esi
mov esi, dword [esp + 0x64]
push edi
mov ecx, 0xa
lea edi, [esp + 8]
xor al, al
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x64]
mov ecx, 0xa
lea edi, [esp + 0x34]
mov byte [esp + 0x30], al
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x5c], al
lea eax, [esp + 8]
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
test eax, eax
je 0x403fc9
xor eax, eax
add esp, 0x58
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403fdb
mov eax, 5
add esp, 0x58
ret
Function at 0x403fe0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x28
push esi
lea eax, [esp + 4]
push edi
lea ecx, [esp + 0x1c]
xor edi, edi
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push edi
push 0xf003f
push edi
push str.Goober
push edi
push str.Software
push 0x80000001
mov dword [esp + 0x50], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], edi
call esi
test eax, eax
jne 0x40412d
lea edx, [esp + 8]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push 0xf003f
push edi
push str.Goober
push edi
push str.Itasca
push ecx
call esi
test eax, eax
jne 0x40412d
lea edx, [esp + 8]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
push edi
push 0xf003f
push edi
push str.Goober
push edi
push str.UDEC400
push ecx
call esi
test eax, eax
jne 0x40412d
cmp dword [esp + 8], 1
je 0x40418d
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 8]
lea eax, [esp + 0x20]
push edx
mov edx, dword [str.xltlplllhllPlLlDl_l]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edi
push edx
push eax
mov dword [esp + 0x20], 4
mov dword [esp + 0x2c], 5
call esi
test eax, eax
jne 0x4041b0
lea eax, [esp + 8]
lea ecx, [esp + 0x24]
push eax
mov eax, dword [0x6c0008]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push edi
push eax
push ecx
call esi
test eax, eax
jne 0x40412d
lea edx, [esp + 8]
lea eax, [esp + 0x28]
push edx
mov edx, dword [0x6c000c]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edi
push edx
push eax
call esi
test eax, eax
jne 0x4041b0
lea eax, [esp + 8]
lea ecx, [esp + 0x2c]
push eax
mov eax, dword [0x6c0010]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push edi
push eax
push ecx
call esi
test eax, eax
je 0x404154
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
mov edx, eax
pop edi
pop esi
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x24]
mov dword [edx + 0xc], ecx
add esp, 0x28
ret
lea edx, [esp + 8]
lea eax, [esp + 0x14]
push edx
mov edx, dword [0x6c0014]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edi
push edx
push eax
call esi
test eax, eax
jne 0x4041b0
cmp dword [esp + 0x14], 3
jne 0x40418d
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
test eax, eax
jne 0x4041b0
mov eax, dword [esp + 0x18]
push eax
call esi
test eax, eax
jne 0x4041b0
mov eax, dword [esp + 0x1c]
push eax
call esi
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
mov ecx, eax
pop edi
pop esi
mov dword [ecx], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x20]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + 0xc], edx
add esp, 0x28
ret
Function at 0x4041e0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x648248]
sub esp, 0x50
test eax, eax
push esi
je 0x404371
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x404371
mov eax, dword [0x648248]
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x30], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x404371
lea edx, [esp + 8]
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push 0
push 0xf003f
push 0
push str.Goober
push 0
push str.Software
push 0x80000001
mov dword [esp + 0x38], ecx
call esi
test eax, eax
jne 0x404371
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
push 0xf003f
push eax
push str.Goober
push eax
mov eax, dword [esp + 0x2c]
push str.Itasca
push eax
call esi
test eax, eax
jne 0x404371
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
push edx
push eax
push 0xf003f
push eax
push str.Goober
push eax
mov eax, dword [esp + 0x28]
push str.UDEC400
push eax
call esi
test eax, eax
jne 0x404371
mov edx, dword [str.xltlplllhllPlLlDl_l]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
test eax, eax
jne 0x404371
mov edx, dword [0x6c0008]
lea ecx, [esp + 0x1c]
push 4
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
test eax, eax
jne 0x404371
mov edx, dword [0x6c000c]
lea ecx, [esp + 0x20]
push 4
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
test eax, eax
jne 0x404371
mov edx, dword [0x6c0010]
lea ecx, [esp + 0x24]
push 4
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
test eax, eax
jne 0x404371
mov edx, dword [0x6c0014]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
call esi
test eax, eax
jne 0x404371
mov ecx, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
test eax, eax
jne 0x404371
mov edx, dword [esp + 0xc]
push edx
call esi
test eax, eax
jne 0x404371
mov eax, dword [esp + 0x10]
push eax
call esi
pop esi
add esp, 0x50
ret