joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push esi
push edi
push 0x456a0c
push str._sSystem
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
lea edx, [esp + 0x14]
push ecx
push 0x20019
push 0
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4057bb
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0x5ae404
push ecx
push 0
mov edi, 4
push str.gbFullScreenFlag
push edx
mov dword [esp + 0x28], 3
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x4056ac
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057bb
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0x4342e4
push edx
push 0
push str.gnWindowLeft
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x4056e1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057bb
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push 0x4342e8
push eax
push 0
push str.gnWindowTop
push ecx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x405716
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057bb
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push 0x4342c4
push ecx
push 0
push str.gdwWindowWidth
push edx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x405748
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057bb
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0x4342c8
push edx
push 0
push str.gdwWindowHeight
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40577a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057bb
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push 0x4342d4
push eax
push 0
push str.gdwWindowBpp
push ecx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x4057ac
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4057bb
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4057d6
push str.Registry_Read_Error.
push 0x5ae1f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
xor eax, eax
pop esi
add esp, 0x110
ret
mov eax, 1
pop edi
mov dword [0x5af064], eax
pop esi
add esp, 0x110
ret
Function at 0x4057f0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x5af064]
sub esp, 0x118
test eax, eax
push esi
je 0x4059e1
mov al, byte [0x456a0c]
test al, al
je 0x4059e1
push 0x456a0c
lea eax, [esp + 0x1c]
push str._sSystem
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 4]
lea edx, [esp + 0x18]
push ecx
push 0x20006
push 0
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405875
lea eax, [esp + 4]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4059c7
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push 0x5ae404
push 3
push 0
push str.gbFullScreenFlag
push edx
call esi
test eax, eax
je 0x4058a6
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059c7
mov eax, dword [0x5ae3f8]
test eax, eax
je 0x4058ce
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [0x4342e4], edx
mov dword [0x4342e8], eax
mov ecx, dword [esp + 4]
push 4
push 0x4342e4
push 3
push 0
push str.gnWindowLeft
push ecx
call esi
test eax, eax
je 0x4058f9
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059c7
mov eax, dword [esp + 4]
push 4
push 0x4342e8
push 3
push 0
push str.gnWindowTop
push eax
call esi
test eax, eax
je 0x405924
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059c7
mov edx, dword [esp + 4]
push 4
push 0x4342c4
push 3
push 0
push str.gdwWindowWidth
push edx
call esi
test eax, eax
je 0x40594c
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059c7
mov ecx, dword [esp + 4]
push 4
push 0x4342c8
push 3
push 0
push str.gdwWindowHeight
push ecx
call esi
test eax, eax
je 0x405974
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059c7
mov eax, dword [esp + 4]
push 4
push 0x4342d4
push 3
push 0
push str.gdwWindowBpp
push eax
call esi
test eax, eax
je 0x40599c
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059c7
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
je 0x4059b8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059c7
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4059e1
push str.Registry_Write_Error.
push 0x5ae1f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop esi
add esp, 0x118
ret
mov eax, 1
pop esi
add esp, 0x118
ret
Function at 0x4059f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x5af084]
sub esp, 0xc
test al, al
je 0x405a5e
mov ecx, dword [reloc.DSOUND.dll_DirectSoundCreate]
lea eax, [esp]
push eax
push 0x20019
push 0
push 0x5af084
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a5e
mov eax, dword [esp + 0x14]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x405a74
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Registry_Read_Error.
push 0x5ae1f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
add esp, 0xc
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405a5e
mov eax, 1
add esp, 0xc
ret

Function at 0x405a90
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x5af084]
sub esp, 0xc
test al, al
je 0x405b03
mov ecx, dword [reloc.DSOUND.dll_DirectSoundCreate]
lea eax, [esp]
push eax
push 0x20019
push 0
push 0x5af084
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b03
push esi
mov esi, dword [esp + 0x18]
push esi
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
mov dword [esp + 8], eax
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop esi
je 0x405b19
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Registry_Read_Error.
push 0x5ae1f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
add esp, 0xc
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405b03
mov eax, 1
add esp, 0xc
ret

Function at 0x405b40
Capabilities:
Set registry value

Disassembly:
push ecx
mov al, byte [0x5af084]
test al, al
je 0x405bbf
mov ecx, dword [reloc.DSOUND.dll_DirectSoundCreate]
lea eax, [esp]
push eax
push 0x20006
push 0
push 0x5af084
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405b95
mov eax, dword [reloc.DSOUND.dll_DirectSoundCreate]
lea edx, [esp]
push 0
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5af084
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405bbf
mov edx, dword [esp + 8]
mov eax, dword [esp]
lea ecx, [esp + 0xc]
push 4
push ecx
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x405bd3
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Registry_Write_Error.
push 0x5ae1f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop ecx
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
je 0x405be9
mov eax, dword [esp]
push eax
jmp 0x405bb9
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405bbf
mov eax, 1
pop ecx
ret
Function at 0x405c00
Capabilities:
Set registry value

Disassembly:
push ecx
mov al, byte [0x5af084]
test al, al
je 0x405c87
mov ecx, dword [reloc.DSOUND.dll_DirectSoundCreate]
lea eax, [esp]
push eax
push 0x20006
push 0
push 0x5af084
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405c55
mov eax, dword [reloc.DSOUND.dll_DirectSoundCreate]
lea edx, [esp]
push 0
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5af084
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405c87
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x405c9b
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Registry_Write_Error.
push 0x5ae1f8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop ecx
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
je 0x405cb1
mov edx, dword [esp]
push edx
jmp 0x405c81
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405c87
mov eax, 1
pop ecx
ret

Function at 0x407430
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x26
xor ebx, ebx
call esi
push 0x68
movsx edi, ax
call esi
and eax, 0x8000
and edi, 0x8000
or eax, edi
je 0x40745a
mov ebx, 1
push 0x28
call esi
push 0x62
movsx edi, ax
call esi
and eax, 0x8000
and edi, 0x8000
or eax, edi
je 0x407477
or ebx, 2
push 0x25
call esi
push 0x64
movsx edi, ax
call esi
and eax, 0x8000
and edi, 0x8000
or eax, edi
je 0x407494
or ebx, 4
push 0x27
call esi
push 0x66
movsx edi, ax
call esi
and eax, 0x8000
and edi, 0x8000
or eax, edi
je 0x4074b1
or ebx, 8
push 0x20
call esi
push 0xd
movsx edi, ax
call esi
movsx eax, ax
push 0x5a
or edi, eax
call esi
and eax, 0x8000
and edi, 0x8000
or eax, edi
je 0x4074d7
or ebx, 0x20
push 0x58
call esi
test ah, 0x80
je 0x4074e3
or ebx, 0x10
push 0x1b
call esi
push 0x60
movsx edi, ax
call esi
movsx ecx, ax
push 0x24
or edi, ecx
call esi
and eax, 0x8000
and edi, 0x8000
or eax, edi
je 0x407509
or ebx, 0x40
push 0x23
call esi
test ah, 0x80
je 0x407515
or bl, 0x80
push 0x10
call esi
test ah, 0x80
je 0x407521
or bh, 1
push 9
call esi
test ah, 0x80
je 0x40752d
or bh, 2
mov al, byte [0x5af188]
test al, 1
je 0x407539
or ebx, 0x20
test al, 2
je 0x407540
or ebx, 0x10
mov eax, dword [0x4342e0]
test eax, eax
je 0x407550
call fcn.004073b0
or ebx, eax
pop edi
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4077a0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push 0
push 0
push DirectSoundCreate
push ebx
push edi
call fcn.00402490
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4077c7
pop edi
xor eax, eax
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
push esi
call fcn.00407750
add esp, 4
lea eax, [esi + 0x14]
mov dword [esi + 4], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call edi
lea ecx, [esi + 0x118]
push ebx
push ecx
call edi
mov edx, dword [esp + 0x1c]
lea eax, [esi + 0x10]
push eax
push 0
push esi
push 0x4076f0
push 0
push 0
mov dword [esi + 8], edx
mov dword [esi], 1
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
pop esi
test eax, eax
jne 0x40782f
pop edi
pop ebx
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
mov eax, 1
pop ebx
ret

Function at 0x4079f0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
mov edx, dword [esp + 4]
mov ecx, dword [eax*4 + 0x5695f8]
dec ecx
mov dword [eax*4 + 0x5695f8], ecx
shl eax, 8
add eax, ecx
test ecx, ecx
mov dword [eax*4 + 0x569df8], edx
jne 0x407a38
push str.Not_Enough_Stack_Area.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x5ae3f8]
push 0x30
push 0
push str.Not_Enough_Stack_Area.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
ret

Function at 0x407a40
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
cmp dword [eax*4 + 0x5695f8], 0x100
jbe 0x407a77
push str.Not_Stack_Data.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x5ae3f8]
push 0x30
push 0
push str.Not_Stack_Data.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x5af074]
mov ecx, dword [eax*4 + 0x5695f8]
mov edx, eax
shl edx, 8
add edx, ecx
inc ecx
mov dword [eax*4 + 0x5695f8], ecx
mov eax, dword [edx*4 + 0x569df8]
ret
Function at 0x407db0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov cl, byte [edx]
inc edx
and ecx, 0x3f
mov dword [eax], edx
add ecx, 0xfffffffc
cmp ecx, 0xa
ja case.0x407dca.5
jmp dword [ecx*4 + 0x407ea8]
push eax
call fcn.00407ac0
add esp, 4
and eax, 0xffff
lea eax, [eax*4 + 0x469d58]
ret
push eax
call fcn.00407ac0
mov cx, ax
mov eax, dword [0x5af074]
and ecx, 0xffff
add esp, 4
add ecx, dword [eax*4 + 0x5695f8]
shl eax, 8
add ecx, eax
lea eax, [ecx*4 + 0x569df8]
ret
push eax
call fcn.00407ac0
mov dx, ax
mov eax, dword [0x5af074]
add esp, 4
and edx, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [edx + eax*8]
lea eax, [ecx*4 + 0x46acf8]
ret
push eax
call fcn.00407ac0
add esp, 4
and eax, 0xffff
lea eax, [eax*4 + 0x564cf8]
ret
push eax
call fcn.00407ac0
and eax, 0xffff
add esp, 4
add eax, 0x457550
ret
push eax
call fcn.00407ad0
mov edx, dword [0x5af074]
add esp, 4
shl edx, 6
add eax, dword [edx + 0x5a9df8]
ret
push str.Script_Error._GetVarAdr_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x5ae3f8]
push 0x30
push 0
push str.Script_Error._GetVarAdr_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 4]
ret
Function at 0x4082c0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
sub esp, 0x104
shl eax, 6
add eax, 0x5a9e04
push esi
push eax
call fcn.00407ee0
mov esi, eax
add esp, 4
cmp esi, 0x100
jbe 0x4082ff
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
pop esi
add esp, 0x104
ret
mov ecx, dword [0x5af074]
shl ecx, 6
add ecx, 0x5a9e04
push ecx
call fcn.00407ee0
add esp, 4
lea edx, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 4]
push eax
push esi
call fcn.00402a50
add esp, 8
test eax, eax
jne 0x408342
mov eax, 2
pop esi
add esp, 0x104
ret
mov dword [esi*4 + 0x5695f8], 0x100
shl esi, 6
xor eax, eax
mov dword [esi + 0x5a9e08], 1
pop esi
add esp, 0x104
ret

Function at 0x408370
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
sub esp, 0x104
shl eax, 6
add eax, 0x5a9e04
push esi
push eax
call fcn.00407ee0
mov esi, eax
add esp, 4
cmp esi, 0x100
jbe 0x4083af
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
pop esi
add esp, 0x104
ret
mov ecx, dword [0x5af074]
shl ecx, 6
add ecx, 0x5a9e04
push ecx
call fcn.00407ee0
add esp, 4
lea edx, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 4]
push eax
push esi
call fcn.00402a50
add esp, 8
neg eax
sbb eax, eax
pop esi
and al, 0xfe
add eax, 2
add esp, 0x104
ret

Function at 0x408400
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
push esi
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
mov esi, eax
add esp, 4
cmp esi, 0x100
jbe 0x408433
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
pop esi
ret
mov ecx, dword [0x5af074]
shl ecx, 6
add ecx, 0x5a9e04
push ecx
call fcn.00407ee0
shl esi, 6
mov ecx, esi
mov esi, dword [0x5af074]
xor edx, edx
add esp, 4
shl esi, 6
mov dword [ecx + 0x5a9e14], edx
mov esi, dword [esi + 0x5a9df8]
mov dword [ecx + 0x5a9df8], esi
mov dword [ecx + 0x5a9e00], eax
mov dword [ecx + 0x5a9e04], eax
mov dword [ecx + 0x5a9e08], edx
xor eax, eax
pop esi
ret

Function at 0x408490
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
cmp eax, 0x100
jbe 0x4084be
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
ret
mov ecx, eax
mov dword [eax*4 + 0x5695f8], 0x100
shl ecx, 6
xor eax, eax
mov edx, dword [ecx + 0x5a9e00]
mov dword [ecx + 0x5a9e04], edx
mov dword [ecx + 0x5a9e08], 1
ret

Function at 0x4084f0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
cmp eax, 0x100
jbe 0x40851e
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
ret
shl eax, 6
mov dword [eax + 0x5a9e08], 0
xor eax, eax
ret
Function at 0x408530
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
cmp eax, 0x100
jbe 0x40855e
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
ret
shl eax, 6
push esi
mov esi, eax
push edi
xor edi, edi
cmp dword [esi + 0x5a9e14], edi
je 0x40858a
cmp dword [esi + 0x5a9dfc], edi
je 0x40858a
mov dword [esi + 0x5a9e14], edi
mov ecx, dword [esi + 0x5a9dfc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 0x5a9df8], edi
mov dword [esi + 0x5a9e00], edi
mov dword [esi + 0x5a9e04], edi
mov dword [esi + 0x5a9e08], edi
pop edi
xor eax, eax
pop esi
ret

Function at 0x4085b0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
cmp eax, 0x100
jbe 0x4085de
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
ret
cmp dword [0x5af074], eax
jne 0x4085ec
mov eax, 2
ret
shl eax, 6
mov dword [eax + 0x5a9e08], 0
xor eax, eax
ret

Function at 0x408600
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
cmp eax, 0x100
jbe 0x40862e
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
ret
shl eax, 6
mov ecx, dword [eax + 0x5a9df8]
test ecx, ecx
jne 0x408641
mov eax, 2
ret
mov dword [eax + 0x5a9e08], 1
xor eax, eax
ret

Function at 0x408650
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
cmp eax, 0x100
jbe 0x40867e
push str.Task_No_Error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 2
ret
mov edx, dword [0x5af074]
shl eax, 6
shl edx, 6
mov ecx, dword [eax + 0x5a9e08]
add edx, 0x5a9e04
push ecx
push edx
call fcn.00407ae0
add esp, 8
xor eax, eax
ret

Function at 0x408df0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x5af074]
push esi
shl eax, 6
add eax, 0x5a9e04
push edi
push eax
call fcn.00407ee0
mov ecx, dword [0x5af074]
mov esi, eax
shl ecx, 6
add ecx, 0x5a9e04
push ecx
call fcn.00407ee0
mov edx, dword [0x5af074]
mov edi, eax
shl edx, 6
add edx, 0x5a9e04
push edx
call fcn.00407ee0
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push 0
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408e63
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 2
pop esi
pop ecx
ret
mov eax, dword [0x5af074]
mov edx, dword [esp + 8]
shl eax, 6
add eax, 0x5a9e04
push edx
push eax
call fcn.00407ae0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x408e90
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x5af074]
push esi
shl eax, 6
add eax, 0x5a9e04
push edi
push eax
call fcn.00407ee0
mov ecx, dword [0x5af074]
mov esi, eax
shl ecx, 6
add ecx, 0x5a9e04
push ecx
call fcn.00407ee0
mov edx, dword [0x5af074]
mov edi, eax
shl edx, 6
add edx, 0x5a9e04
push edx
call fcn.00407ee0
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push 0
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x408f03
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 2
pop esi
pop ecx
ret
mov eax, dword [0x5af074]
mov edx, dword [esp + 8]
shl eax, 6
add eax, 0x5a9e04
push edx
push eax
call fcn.00407ae0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ecx
ret

Function at 0x409b40
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x5af074]
movsx eax, ax
shl ecx, 6
add ecx, 0x5a9e04
push eax
push ecx
call fcn.00407ae0
add esp, 8
xor eax, eax
ret

Function at 0x40dd60
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x5af074]
push esi
shl eax, 6
add eax, 0x5a9e04
push edi
push eax
call fcn.00407ee0
mov ecx, dword [0x5af074]
mov esi, eax
shl ecx, 6
add ecx, 0x5a9e04
push ecx
call fcn.00407ee0
mov edx, dword [0x5af074]
mov edi, eax
shl edx, 6
add edx, 0x5a9e04
push edx
call fcn.00407ee0
add esp, 0xc
test esi, esi
jne 0x40ddb0
mov esi, dword [0x5ae3f8]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop edi
xor eax, eax
pop esi
ret

Function at 0x40ee20
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40ee47
mov eax, 2
ret
push 0x5ae528
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x43cd9c
push 0x5ae528
call fcn.00407600
add esp, 8
xor eax, eax
ret

Function at 0x40f230
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x5af074]
sub esp, 0x104
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [0x5af074]
shl edx, 6
add edx, 0x5a9e04
push edx
call fcn.00407ee0
push eax
lea eax, [esp + 8]
push eax
call fcn.00407600
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
add esp, 0x104
ret
Function at 0x40f290
Capabilities:
Move file

Disassembly:
mov eax, dword [0x5af074]
sub esp, 0x208
shl eax, 6
push ebx
push esi
add eax, 0x5a9e04
push edi
push eax
call fcn.00407ee0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 4
mov esi, eax
lea ecx, [esp + 0x110]
push esi
push ecx
call edi
mov edx, dword [0x5af074]
shl edx, 6
add edx, 0x5a9e04
push edx
call fcn.00407ee0
push eax
lea eax, [esp + 0x118]
push eax
call fcn.00407600
mov ecx, dword [0x5af074]
shl ecx, 6
add ecx, 0x5a9e04
push ecx
call fcn.00407ee0
add esp, 0x10
lea edx, [esp + 0xc]
mov ebx, eax
push esi
push edx
call edi
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00407600
add esp, 8
lea ecx, [esp + 0xc]
lea edx, [esp + 0x110]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x208
ret

Function at 0x40f340
Capabilities:
Delete directory

Disassembly:
mov eax, dword [0x5af074]
shl eax, 6
add eax, 0x5a9e04
push eax
call fcn.00407ee0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
and al, 0xfe
add eax, 2
ret