joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100099c2
Capabilities:
Move file

Disassembly:
push 0xc
mov eax, 0x10180f1a
call fcn.1015f980
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
je 0x10009aaa
mov ecx, dword [ebp + 0xc]
cmp dword [ecx - 0xc], 0
je 0x10009aaa
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x18], esi
call fcn.100050fe
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.10007c61
pop ecx
test eax, eax
je 0x10009aa7
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x18], esi
push eax
mov dword [ebp - 0x18], eax
call fcn.100050fe
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10007c8d
mov esi, dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x10], edi
mov ebx, edi
pop ecx
test esi, esi
jle 0x10009aa2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x10009a70
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, esi
jl 0x10009a48
jmp 0x10009a73
xor ebx, ebx
inc ebx
push ecx
mov esi, esp
push dword [ebp - 0x18]
mov dword [ebp - 0x10], esi
call fcn.100050fe
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.10007c61
pop ecx
test eax, eax
jne 0x10009aa2
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, dword [ebp - 0x14]
jl 0x10009a73
mov eax, dword [ebp + 8]
jmp 0x10009aac
mov eax, dword [ebp + 8]
xor ebx, ebx
lea ecx, [eax - 0x10]
call fcn.10003bf1
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, ebx
call fcn.1015f94e
ret

Function at 0x10009ac7
Capabilities:
Delete file

Disassembly:
push 0x138
mov eax, 0x10180f5a
call fcn.1015f9b3
push ecx
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 4], ebx
mov dword [ebp - 0x140], esp
push 0x101c86f6
call fcn.10004dba
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x144], esp
push 0x101c8fb0
call fcn.10004dba
mov byte [ebp - 4], 2
mov edi, dword [ebp + 8]
push ecx
mov esi, esp
add edi, 0xfffffff0
push edi
mov dword [ebp - 0x13c], esi
call fcn.100050fe
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x138]
mov dword [esi], eax
or edx, 0xffffffff
mov byte [ebp - 4], bl
call fcn.1000986c
mov ecx, dword [ebp - 0x138]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.10003bf1
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x114]
mov edx, eax
sub esi, eax
mov cl, byte [edx]
mov byte [esi + edx], cl
inc edx
test cl, cl
jne 0x10009b53
mov eax, dword [eax - 0xc]
inc eax
cmp eax, 0x104
jae 0x10009bc9
mov byte [ebp + eax - 0x114], bl
lea eax, [ebp - 0x114]
mov dword [ebp - 0x12c], eax
mov eax, 0x414
mov word [ebp - 0x124], ax
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], 3
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x122], ebx
mov dword [ebp - 0x11e], ebx
mov dword [ebp - 0x11a], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, edi
call fcn.10003bf1
call fcn.1015f962
ret
call fcn.1015f447
int3
Function at 0x10009d53
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x10180fed
call fcn.1015f9b3
mov dword [ebp - 0x50], ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
lea edi, [eax - 0x10]
mov dword [ebp - 0x4c], edi
test edx, edx
je 0x10009e2f
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
push 0x101c8fb0
lea edi, [edx - 1]
call fcn.10004dba
push ecx
mov esi, esp
mov byte [ebp - 4], 2
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], esi
call fcn.100050fe
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
mov byte [ebp - 4], bl
call fcn.10009bcf
pop ecx
pop ecx
test eax, eax
jne 0x10009de7
push dword [ebp - 0x4c]
call fcn.100050fe
add eax, 0x10
lea ecx, [ebp - 0x44]
push ecx
push eax
lea edi, [eax - 0x10]
call fcn.10168d0c
add esp, 0xc
or esi, 0xffffffff
test eax, eax
mov ecx, edi
cmove esi, dword [ebp - 0x30]
call fcn.10003bf1
cmp esi, dword [ebp - 0x50]
jbe 0x10009e2c
and dword [ebp - 0x14], 0
mov edi, dword [ebp - 0x4c]
push ecx
mov esi, esp
push edi
mov dword [ebp - 0x48], esi
call fcn.100050fe
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x14]
mov edx, ebx
mov dword [esi], eax
call fcn.10009c4c
pop ecx
push ebx
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.10003bf1
jmp 0x10009e31
mov edi, dword [ebp - 0x4c]
xor ebx, ebx
mov ecx, edi
call fcn.10003bf1
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, ebx
call fcn.1015f962
ret
Function at 0x10019feb
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x10182af2
call fcn.1015f980
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x1001a011
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1001a06b
lea ecx, [ebp - 0x10]
call fcn.10004e08
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x10192a68]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1016dd1a
push eax
call fcn.10005ba7
add esp, 0x14
test esi, esi
je 0x1001a05e
push esi
call fcn.1016dc20
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10003bf1
mov eax, ebx
call fcn.1015f94e
ret 8

Function at 0x1001ccae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x1001cced
call fcn.10034032
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001cced
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001ccf5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.10038b1a
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1001d6fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1001d786
cmp dword [esi + 0x20], 0
je 0x1001d786
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001d786
cmp dword [ebp + 8], 0
je 0x1001d786
xor edi, edi
mov ebx, edi
call fcn.10034032
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x1001d76a
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001d786
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1003d5e1
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1001d782
mov ecx, esi
call fcn.1001d498
mov eax, edi
jmp 0x1001d788
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10031764
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x100317b7
push esi
push dword [ebp + 8]
call fcn.1003194a
mov edi, eax
test edi, edi
je 0x100317b2
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100317b2
mov eax, dword [ebp - 8]
jmp 0x100317c9
mov eax, dword [ebp + 0x10]
jmp 0x100317c9
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x10033541
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], edi
je 0x10033586
call fcn.10034032
push 0xf0
push dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10033583
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100335cd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
xor ebx, ebx
inc ebx
test edi, edi
je 0x100335a9
mov ecx, dword [eax]
push dword [ebp + 0x10]
push edi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10192a68]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x100335ca
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x10192a68]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x10035e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x84], ebx
test ebx, 0xffff0000
jne 0x10035ebb
cmp dword [edi + 0x80], 0
jne 0x10035ebb
movzx eax, bx
mov dword [edi + 0x80], eax
call fcn.10034032
push 5
push ebx
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.10036129
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10035ee8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10034032
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10035f1b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.10035f2e
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10040056
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x100400ac
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x10040085
call fcn.10037365
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x1004009a
call fcn.10037365
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x100400ac
call fcn.10037365
call fcn.10034032
cmp dword [eax + 0x3c], 0
je 0x100400c1
push edi
mov ecx, ebx
call fcn.1003f779
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.100402a7
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x100400ea
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x100400f6
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1004d67b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x1004d694
call fcn.10034032
mov esi, dword [eax + 0xc]
push 0x1019948c
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x1004d6d6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1004d6d6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1004d6d6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.1004d6df
jmp 0x1004d6d8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100cfa05
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.10019b9e
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x100cfa41
call fcn.100cfc22
mov dword [esi + 0xc], 1
jmp 0x100cfa46
call fcn.100cfc22
cmp dword [esi], 0
je 0x100cfa91
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x100cfa6c
push edi
call fcn.10018151
lea ecx, [edi + 1]
push ecx
jmp 0x100cfa7b
push 0xff
call fcn.10004fb0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.1000a0f9
pop edi
jmp 0x100cfab5
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x100cfab5
push dword [esi]
push dword [ebp - 4]
call fcn.1003e595
pop esi
leave
ret 0xc

Function at 0x100cfb79
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.100cfc22
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x100cfbc1
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10018151
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1000a0f9
jmp 0x100cfbcc
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.1003e595
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1012551c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.1016fb10
pop ecx
test eax, eax
jne 0x1012555e
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10011b9e
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10125524
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x10134d75
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.1015c1d6
call fcn.10034086
cmp dword [eax + 0x14], 0
jne 0x10134d90
mov ecx, esi
pop esi
jmp fcn.10134099
pop esi
ret

Function at 0x1014094b
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.10004bb2
call fcn.10034086
cmp dword [eax + 0x14], 0
jne 0x10140966
mov ecx, esi
pop esi
jmp fcn.101401bc
pop esi
ret

Function at 0x10179861
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101794de
Function at 0x4042a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x124
mov eax, dword [0x415060]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
push edi
push str.gswin32.ini
push 0x100
lea eax, [esp + 0x30]
push eax
push str.Courier_New
push str.FontName
push str.Text
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.gswin32.ini
push 0xa
push str.FontSize
push str.Text
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [0x416b90]
mov esi, eax
push esi
lea ecx, [esp + 0x2c]
push ecx
push edx
call fcn.004049f0
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0xc
push str.gswin32.ini
lea eax, [esp + 0x2c]
push eax
push str.FontName
push str.Text
call edi
push esi
lea ecx, [esp + 0xc]
push 0x412790
push ecx
call fcn.00406984
add esp, 0xc
push str.gswin32.ini
lea edx, [esp + 0xc]
push edx
push str.FontSize
push str.Text
call edi
mov ecx, dword [esp + 0x128]
pop edi
pop esi
xor ecx, esp
call fcn.00406a2d
add esp, 0x124
ret
Function at 0x4057c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x40
mov eax, dword [ebx + 0xc]
add eax, 2
imul eax, dword [ebx + 0x10]
push esi
push edi
add eax, 1
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
mov dword [esp + 0xc], edi
je 0x4058e9
push ebp
xor ebp, ebp
cmp dword [ebx + 0x10], ebp
jle 0x405853
mov esi, dword [ebx + 0xc]
mov eax, esi
imul eax, ebp
add eax, dword [ebx + 8]
push esi
push eax
push edi
call fcn.00406ce0
add esp, 0xc
sub esi, 1
js 0x405830
lea esp, [esp]
cmp byte [esi + edi], 0x20
jne 0x405830
sub esi, 1
mov byte [esi + edi + 1], 0
jns 0x405820
add esi, 1
mov byte [esi + edi], 0xd
add esi, 1
mov byte [esi + edi], 0xa
add esi, 1
mov byte [esi + edi], 0
add ebp, 1
add edi, esi
cmp ebp, dword [ebx + 0x10]
jl 0x405801
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405860
sub eax, edx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x2042
add edi, 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov ecx, dword [ebx + 0x20]
push ecx
mov edi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [ebx + 0x158]
mov esi, eax
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
mov cl, byte [esp + 0x48]
mov edx, dword [ebx + 0x20]
sub cl, 0xff
neg cl
push esi
push edx
sbb ecx, ecx
and ecx, 0xfffffffa
add ecx, 7
mov ebp, ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebx + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push ebp
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebp
pop edi
pop esi
add esp, 0x40
ret

Function at 0x4058f0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x40596b
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
push edi
mov dword [esp + 8], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov cl, byte [eax]
test cl, cl
je 0x405963
mov edi, dword [esi + 0x30]
push ebx
push ebp
mov ebx, dword [esi + 0x28]
mov edx, ebx
sub edx, dword [esi + 0x2c]
jns 0x405934
add edx, edi
lea ebp, [edi - 1]
cmp edx, ebp
jae 0x405953
mov byte [ebx], cl
add dword [esi + 0x28], 1
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x30]
sub ecx, edx
cmp ecx, edi
jb 0x405953
mov dword [esi + 0x28], edx
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x405928
mov edi, dword [esp + 0xc]
pop ebp
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
add esp, 4
jmp dword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x4063b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0xc
push esi
mov esi, dword [esp + 0x20]
push edi
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406446
test esi, esi
mov edi, dword [esp + 0x28]
mov eax, dword [edi]
mov dword [esp + 0x10], 1
mov dword [esp + 8], eax
jne 0x4063f3
lea esi, [esp + 0x24]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x10]
push esi
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40642f
mov eax, dword [esp + 8]
mov dword [edi], eax
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
cmp esi, 0xea
jne 0x406446
mov ecx, dword [esp + 8]
mov dword [edi], ecx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0xc
ret
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x406670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x415060]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
mov ebx, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x124]
push edi
mov edi, dword [esp + 0x12c]
lea eax, [esp + 0x1c]
push 0x100
push eax
call fcn.004065c0
add esp, 8
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x28]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40675b
test esi, esi
mov eax, dword [edi]
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], eax
jne 0x4066e8
lea esi, [esp + 0xf]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push esi
lea edx, [esp + 0x20]
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x406732
mov edx, dword [esp + 0x10]
mov dword [edi], edx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00406a2d
add esp, 0x114
ret
cmp esi, 0xea
jne 0x40675b
mov eax, dword [esp + 0x10]
mov dword [edi], eax
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00406a2d
add esp, 0x114
ret
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00406a2d
add esp, 0x114
ret
Function at 0x406780
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x415060]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
mov edi, dword [esp + 0x120]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.004065c0
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 0x20006
push 0
lea edx, [esp + 0x20]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406807
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0x4128c3
push 0
lea edx, [esp + 0x30]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x40683d
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x406810
sub eax, edx
add eax, 1
push eax
mov eax, dword [esp + 0x10]
push edi
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
pop edi
mov eax, esi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
call fcn.00406a2d
add esp, 0x10c
ret

Function at 0x406a2d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x415060]
jne 0x406a37
repz ret
jmp fcn.00408ef7