joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408abc
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
mov eax, 0x409c37
call fcn.004093e0
sub esp, 0x68
mov eax, dword [0x40d238]
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp byte [ebp + 0xc], bl
mov eax, ecx
push edi
mov dword [ebp - 0x68], 1
lea ecx, [eax + 0x30]
jne 0x408aef
lea ecx, [eax + 0x24]
mov dword [ebp - 0x70], ecx
lea ecx, [eax + 0x3c]
call fcn.00408a43
lea eax, [ebp - 0x6c]
push eax
push esi
mov dword [ebp - 0x6c], ebx
call dword [0x40a2b0]
xor edi, edi
cmp dword [ebp - 0x6c], ebx
mov dword [ebp - 0x74], eax
jle 0x408c35
mov eax, dword [ebp - 0x74]
push dword [eax + edi*4]
lea ecx, [ebp - 0x2c]
call dword [0x40a1c8]
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call dword [0x40a19c]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call dword [0x40a19c]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call dword [0x40a1c0]
push eax
call dword [0x40a2c8]
test eax, eax
je 0x408b73
push 0x40a508
lea ecx, [ebp - 0x48]
call dword [0x40a194]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x64]
call dword [0x40a1a8]
jmp 0x408bcf
push ebx
push 0x3a
lea ecx, [ebp - 0x2c]
call dword [0x40a18c]
mov esi, eax
mov eax, dword [0x40a198]
mov eax, dword [eax]
cmp esi, eax
jne 0x408b94
push eax
push 1
lea ecx, [ebp - 0x48]
jmp 0x408bc5
cmp esi, 1
jbe 0x408bcf
lea eax, [esi - 1]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
call dword [0x40a190]
lea ecx, [ebp - 0x2c]
inc esi
call dword [0x40a1c4]
cmp esi, eax
jae 0x408bcf
mov eax, dword [0x40a198]
push dword [eax]
lea ecx, [ebp - 0x64]
push esi
lea eax, [ebp - 0x2c]
push eax
call dword [0x40a190]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x408c05
cmp byte [ebp + 0xc], bl
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
lea edx, [ebp - 0x64]
push edx
lea edx, [ebp - 0x48]
push edx
je 0x408bf2
call dword [eax + 4]
jmp 0x408bf4
call dword [eax]
test eax, eax
jne 0x408bfb
mov dword [ebp - 0x68], ebx
mov esi, dword [esi]
mov eax, dword [ebp - 0x70]
cmp esi, dword [eax + 4]
jne 0x408bdb
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call dword [0x40a1bc]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call dword [0x40a1bc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x40a1bc]
inc edi
cmp edi, dword [ebp - 0x6c]
jl 0x408b16
push dword [ebp - 0x74]
call dword [0x40a150]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x68]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004093bb
leave
ret 8
Function at 0x401d70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp eax, edi
mov dword [esp + 0xc], edi
je 0x401e21
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x401e21
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401e21
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x401e0e
jbe 0x401e0e
lea eax, [ebx + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x401e0e
push ebp
push ebp
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x401e0e
lea ecx, [esp + 0x10]
push ebp
push ecx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401e0e
cmp dword [esp + 0x10], ebx
jne 0x401e0e
mov edx, dword [esp + 0x18]
push edi
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop ebx
je 0x401e21
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ecx
ret

Function at 0x403200
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ebx, ebx
push 0x105
push 0x40
mov dword [esp + 0x14], ebx
call edi
push 0x105
push 0x40
mov esi, eax
call edi
test esi, esi
mov edi, eax
je 0x4032e0
test edi, edi
push ebp
je 0x4032d4
mov eax, dword [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
mov cl, byte [eax + esi - 1]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x403263
push 0x41115c
push esi
call ebp
push str.cnmunins.exe
push esi
call ebp
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
call ebx
cmp byte [eax + edi - 1], 0x5c
je 0x403289
push 0x41115c
push edi
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.00403300
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4032d4
push ebx
push edi
call ebp
mov ebp, dword [esp + 0x24]
push edi
lea eax, [ebp + 0x82c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xa
push edi
push esi
call dword [ebp + 0xcd8]
test eax, eax
je 0x4032cd
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x10]
pop ebp
test edi, edi
je 0x4032eb
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret
Function at 0x403f80
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x154
push ebp
mov ebp, dword [esp + 0x15c]
xor eax, eax
push esi
cmp ebp, eax
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
je 0x404154
mov edi, dword [esp + 0x168]
cmp edi, eax
je 0x404154
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
push 0x105
push 0x40
call esi
mov ebx, eax
push 0x105
push 0x40
mov dword [esp + 0x24], ebx
call esi
test ebx, ebx
mov esi, eax
je 0x404144
test esi, esi
je 0x40413d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
mov dword [edi], 0
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str..inf
push ebx
call edi
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x40413d
test byte [esp + 0x24], 0x10
jne 0x404050
mov ecx, dword [esp + 0x168]
push ecx
push esi
call ebp
push 0x41115c
push esi
call edi
lea edx, [esp + 0x50]
push edx
push esi
call edi
push esi
call fcn.00404430
add esp, 4
test eax, eax
je 0x404050
inc dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40401d
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x40413d
mov ecx, dword [esp + 0x16c]
mov edx, eax
shl edx, 6
add edx, eax
mov dword [ecx], eax
shl edx, 2
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x40413d
mov ecx, dword [esp + 0x1c]
mov ebx, eax
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x404126
test byte [esp + 0x24], 0x10
jne 0x4040ff
mov edx, dword [esp + 0x168]
push edx
push esi
call ebp
push 0x41115c
push esi
call edi
lea eax, [esp + 0x50]
push eax
push esi
call edi
push esi
call fcn.00404430
add esp, 4
test eax, eax
je 0x4040ff
push esi
push ebx
call ebp
add ebx, 0x104
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4040be
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x404139
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
pop ebx
je 0x404150
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x154
ret
Function at 0x404160
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x154
push ebp
mov ebp, dword [esp + 0x15c]
xor eax, eax
push esi
cmp ebp, eax
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
je 0x404334
mov edi, dword [esp + 0x168]
cmp edi, eax
je 0x404334
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
push 0x105
push 0x40
call esi
mov ebx, eax
push 0x105
push 0x40
mov dword [esp + 0x24], ebx
call esi
test ebx, ebx
mov esi, eax
je 0x404324
test esi, esi
je 0x40431d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
mov dword [edi], 0
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str..inf
push ebx
call edi
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x40431d
test byte [esp + 0x24], 0x10
jne 0x404230
mov ecx, dword [esp + 0x168]
push ecx
push esi
call ebp
push 0x41115c
push esi
call edi
lea edx, [esp + 0x50]
push edx
push esi
call edi
push esi
call fcn.00404500
add esp, 4
test eax, eax
je 0x404230
inc dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4041fd
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x40431d
mov ecx, dword [esp + 0x16c]
mov edx, eax
shl edx, 6
add edx, eax
mov dword [ecx], eax
shl edx, 2
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x40431d
mov ecx, dword [esp + 0x1c]
mov ebx, eax
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x404306
test byte [esp + 0x24], 0x10
jne 0x4042df
mov edx, dword [esp + 0x168]
push edx
push esi
call ebp
push 0x41115c
push esi
call edi
lea eax, [esp + 0x50]
push eax
push esi
call edi
push esi
call fcn.00404500
add esp, 4
test eax, eax
je 0x4042df
push esi
push ebx
call ebp
add ebx, 0x104
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40429e
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x404319
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
pop ebx
je 0x404330
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x154
ret
Function at 0x404340
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x30c
push ebx
push esi
push edi
xor ebx, ebx
push 0x104
push 0x40
xor esi, esi
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x404424
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.inf
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00404160
add esp, 8
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x404403
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x404403
mov esi, eax
jbe 0x404403
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call ebp
lea ecx, [esp + 0x21c]
lea edx, [esp + 0x11c]
push ecx
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
push esi
call fcn.00409865
lea edx, [esp + 0x130]
push str..pnf
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
push edi
call fcn.004099ac
add esp, 0x28
push edi
call ebp
mov eax, dword [esp + 0x10]
add esi, 0x104
inc ebx
cmp ebx, eax
jb 0x4043a9
mov eax, dword [esp + 0x18]
pop ebp
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, 1
test eax, eax
je 0x404415
push eax
call esi
push edi
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x30c
ret
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30c
ret

Function at 0x404660
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push ebp
mov dword [esp + 8], 0
je 0x404739
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x404739
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push 0x105
push 0x40
call esi
push 0x105
push 0x40
mov edi, eax
call esi
test edi, edi
mov esi, eax
je 0x404719
test esi, esi
je 0x404724
push 0x104
push edi
push 0x64
push 0
push ebx
call fcn.004092fd
test eax, eax
je 0x404719
push ebx
push 0x104
push esi
push str.NotFound
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.NotFound
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404719
cmp byte [esi], 0x22
jne 0x404709
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
cmp byte [eax + esi - 1], 0x22
jne 0x404709
push esi
call ebx
dec eax
push eax
lea eax, [esi + 1]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x404711
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 1
test esi, esi
je 0x404724
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
je 0x40472f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x404740
Capabilities:
Read .ini file

Disassembly:
push ecx
mov ecx, dword [esp + 8]
xor eax, eax
push ebp
push edi
test ecx, ecx
mov dword [esp + 8], eax
je 0x40487d
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40487d
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40487d
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
push esi
push 0x105
push 0x40
call edi
push 0x105
push 0x40
mov ebx, eax
call edi
push 0x105
push 0x40
mov esi, eax
call edi
test ebx, ebx
mov ebp, eax
je 0x404863
test esi, esi
je 0x404858
test ebp, ebp
je 0x404858
mov edi, dword [esp + 0x1c]
lea eax, [esi + 1]
push edi
push eax
mov byte [esi], 0x22
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esp + 0x18]
push 0x104
push ebx
push 0x64
push 0
push edi
mov byte [eax + esi + 1], 0x22
call fcn.004092fd
test eax, eax
je 0x404858
push edi
push 0x104
push ebp
push str.NotFound
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.NotFound
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404858
mov al, byte [ebp]
mov ecx, 0x41162c
cmp al, cl
mov edi, ebp
jne 0x404823
mov al, byte [edi + 1]
inc edi
mov edx, 0x41162c
cmp al, dl
je 0x404816
push 0x2c
push edi
call fcn.00409ae9
add esp, 8
test eax, eax
je 0x404844
sub eax, edi
inc eax
push eax
mov eax, dword [esp + 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x404850
mov ecx, dword [esp + 0x20]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], 1
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call edi
jmp 0x404869
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
je 0x404870
push esi
call edi
pop esi
pop ebx
test ebp, ebp
je 0x404879
push ebp
call edi
mov eax, dword [esp + 8]
pop edi
pop ebp
pop ecx
ret

Function at 0x404890
Capabilities:
Read .ini file

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
xor eax, eax
push ebp
test ebx, ebx
push esi
mov dword [esp + 0xc], eax
je 0x404957
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x404957
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x404957
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push 0x105
push 0x40
call esi
push 0x105
push 0x40
mov edi, eax
call esi
test edi, edi
mov esi, eax
je 0x404945
test esi, esi
je 0x404938
push 0x104
push edi
push 0x69
push ebp
push ebx
call fcn.004092fd
test eax, eax
je 0x404938
push ebx
push 0x104
push esi
push str.NotFound
push str.DataFile
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.NotFound
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404938
mov eax, dword [esp + 0x20]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x404949
mov ebx, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x404949
mov ebx, dword [esp + 0x10]
test esi, esi
pop edi
je 0x404955
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4059c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x14]
xor eax, eax
push ebp
push esi
test ecx, ecx
mov dword [esp + 0x14], eax
je 0x405b9c
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x405b9c
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
push edi
push 0x208
push 0x40
call esi
push 0x208
push 0x40
mov dword [esp + 0x1c], eax
call esi
push 0x105
push 0x40
mov edi, eax
call esi
push 0x105
push 0x40
mov ebp, eax
call esi
push 0x105
push 0x40
mov ebx, eax
call esi
push 0x105
push 0x40
mov dword [esp + 0x20], eax
call esi
mov esi, eax
test ebp, ebp
mov dword [esp + 0x10], esi
je 0x405b65
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405b5a
test edi, edi
je 0x405b5a
test ebx, ebx
je 0x405b5a
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x405b5a
test esi, esi
je 0x405b5a
mov esi, dword [esp + 0x24]
push 0x104
push eax
push 0x13a7
mov eax, dword [esi + 0xc50]
push eax
call sub.USER32.dll_LoadStringW
mov ecx, dword [esp + 0x28]
push ecx
push edi
call fcn.00409ede
push 0x4116b4
push edi
call fcn.00409eb4
mov edx, dword [esp + 0x24]
push edx
push edi
call fcn.00409eb4
push str..lnk
push edi
call fcn.00409eb4
add esp, 0x20
lea eax, [esi + 0x728]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x41115c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.helpkicker.exe
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x10]
push 0x105
lea eax, [esi + 0x14]
push ecx
add esi, 0x214
push 0x66
push eax
push esi
mov dword [esp + 0x38], eax
call fcn.004092fd
mov edx, dword [esp + 0x10]
push esi
push 0x104
push ebp
push str.NotFound
push str.HelpFile
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.NotFound
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x405b56
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x18]
push ebp
push eax
push str._p_s__s_
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
push ebx
push edi
call fcn.00405d30
add esp, 0x1c
test eax, eax
je 0x405b56
mov dword [esp + 0x1c], 1
mov esi, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
call ebp
jmp 0x405b6b
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x405b76
push eax
call ebp
test edi, edi
je 0x405b7d
push edi
call ebp
test ebx, ebx
je 0x405b84
push ebx
call ebp
mov eax, dword [esp + 0x18]
pop edi
test eax, eax
pop ebx
je 0x405b91
push eax
call ebp
test esi, esi
je 0x405b98
push esi
call ebp
mov eax, dword [esp + 0x14]
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x405d30
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x30c
push ebx
push ebp
mov ebp, dword [esp + 0x318]
xor ebx, ebx
push esi
push edi
test ebp, ebp
je 0x405e33
mov edi, dword [esp + 0x324]
test edi, edi
je 0x405e33
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x105
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405e33
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x21c]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
push edi
call fcn.00409865
lea ecx, [esp + 0x30]
lea edx, [esp + 0x28]
push ecx
push edx
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
lea eax, [esp + 0x10]
push eax
push 0x40f478
push 1
push ebx
push 0x40f468
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x405e2c
mov eax, dword [esp + 0x10]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x10]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x24]
mov eax, dword [esp + 0x328]
test eax, eax
je 0x405df9
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x40f488
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x405e22
mov eax, dword [esp + 0x18]
push 1
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ebx, 1
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x30c
ret

Function at 0x407a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
test eax, eax
push edi
mov dword [esp + 8], 0
mov esi, 0x57
je 0x407ada
mov edi, dword [esp + 0x14]
test edi, edi
je 0x407ada
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407acb
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x407ada
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ecx
ret