joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415c34
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x415cd1
push ebx
push esi
call fcn.00415bfd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00415b91
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x415c7e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415cd0
push edi
push eax
call fcn.00412c35
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x415c9e
call fcn.004121d8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x415ccf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00415b91
add esp, 0x20
test eax, eax
jne 0x415cbd
push edi
call fcn.004121d8
jmp 0x415cc5
push ebx
call fcn.004121d8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41df80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41dfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41dfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401870
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
test byte [ecx + 4], 4
je 0x4018ba
push ebx
push esi
lea esi, [ecx + 0xdc]
push edi
test esi, esi
je 0x401892
lea edi, [esi + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x401897
mov edi, 0x14
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004021d0
mov ebx, eax
test esi, esi
je 0x4018b1
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
pop ebp
jmp fcn.00401660

Function at 0x4018c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x40196e
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x40196e
push 0
lea ecx, [ebp - 4]
mov dword [ebp + 0xc], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x401908
cmp dword [ebp - 4], 0
jbe 0x401908
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
shr eax, 1
test al, 1
je 0x40194c
lea eax, [esi + 0x188]
push eax
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40193b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40196e
add dword [esi + 0x138], edi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
add dword [esi + 0x138], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x401ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x144], 0
jne 0x401c13
cmp dword [esi + 0x150], 0
jne 0x401c13
cmp dword [esi + 0x15c], 0
jne 0x401c13
mov ecx, dword [esi + 4]
push edi
mov edi, ecx
mov byte [esi + 0x13c], 1
shr edi, 4
and edi, 4
test cl, 1
je 0x401b38
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x403880
push 0
push 0
call fcn.004a39b5
mov ecx, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0x144], eax
test cl, 0x10
je 0x401b5d
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x4039e0
push 0
push 0
call fcn.004a39b5
mov ecx, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0x150], eax
test cl, 0x20
je 0x401b82
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 0x403a00
push 0
push 0
call fcn.004a39b5
mov ecx, dword [esi + 4]
add esp, 0x18
mov dword [esi + 0x15c], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, ecx
test cl, 1
je 0x401bae
mov eax, dword [ebp - 4]
mov dword [esi + 0x148], eax
mov eax, dword [esi + 0x144]
test eax, eax
je 0x401be5
test cl, cl
jns 0x401bae
push 1
push eax
call edi
mov edx, dword [esi + 4]
mov ecx, edx
test dl, 0x10
je 0x401bd3
mov eax, dword [ebp - 8]
mov dword [esi + 0x154], eax
test eax, eax
je 0x401be5
test dl, dl
jns 0x401bd3
push 1
push dword [esi + 0x150]
call edi
mov ecx, dword [esi + 4]
test cl, 0x20
je 0x401c09
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x160], eax
test eax, eax
jne 0x401bfb
push 0x1f4
mov ecx, esi
call fcn.00401c20
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
test cl, cl
jns 0x401c09
push 1
push dword [esi + 0x15c]
call edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x401c20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x144], 0
jne 0x401c48
cmp dword [esi + 0x150], 0
jne 0x401c48
cmp dword [esi + 0x15c], 0
jne 0x401c48
xor al, al
pop esi
pop ebp
ret 4
mov ecx, dword [esi + 4]
mov eax, ecx
and eax, 0x208
push edi
cmp eax, 0x208
jne 0x401c80
cmp dword [esi + 0x114], 0
je 0x401c80
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push 0x32
call edi
cmp dword [esi + 0x114], 0
jne 0x401c70
mov ecx, dword [esi + 4]
shr ecx, 1
mov byte [esi + 0x13c], 0
test cl, 1
je 0x401c99
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetCommMask]
cmp dword [esi + 0x144], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
je 0x401cf8
push dword [esi + 0x14c]
call eax
push dword [ebp + 8]
push dword [esi + 0x144]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401ce1
push 0
push dword [esi + 0x144]
call ebx
test eax, eax
je 0x401d72
push dword [esi + 0x144]
call edi
mov eax, dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x144], 0
cmp dword [esi + 0x150], 0
je 0x401d3c
push dword [esi + 0x158]
call eax
push dword [ebp + 8]
push dword [esi + 0x150]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401d2a
push 0
push dword [esi + 0x150]
call ebx
test eax, eax
je 0x401d72
push dword [esi + 0x150]
call edi
mov dword [esi + 0x150], 0
cmp dword [esi + 0x15c], 0
je 0x401d8d
push dword [esi + 0x164]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebp + 8]
push dword [esi + 0x15c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401d7b
push 0
push dword [esi + 0x15c]
call ebx
test eax, eax
jne 0x401d7b
pop ebx
pop edi
xor al, al
pop esi
pop ebp
ret 4
push dword [esi + 0x15c]
call edi
mov dword [esi + 0x15c], 0
pop ebx
pop edi
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x402860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x519074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
lea esi, [ebx + 0x108]
shr eax, 1
test al, 1
je 0x40290d
test esi, esi
je 0x402899
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0x114], 0
jne 0x4028a6
xor edi, edi
jmp 0x4028ea
mov ecx, dword [ebx + 0x10c]
test ecx, ecx
je 0x4028c4
mov edi, dword [ecx + 4]
sub edi, dword [ecx]
cmp edi, 0x400
jb 0x4028c6
mov edi, 0x400
jmp 0x4028c6
xor edi, edi
test ecx, ecx
je 0x4028d3
mov eax, dword [ecx]
add eax, 0x10
add eax, ecx
jmp 0x4028d5
xor eax, eax
push edi
push eax
mov ecx, ebx
call fcn.004018c0
push edi
push 0
mov ecx, esi
call fcn.004021d0
mov edi, eax
test esi, esi
je 0x4028f8
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
lea edi, [ebx + 0x11c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x400
lea eax, [ebp - 0x404]
mov ecx, esi
push eax
call fcn.004021d0
mov esi, eax
push edi
mov dword [ebp - 0x410], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x402a12
xor edi, edi
mov eax, dword [ebx + 8]
sub esi, edi
cmp eax, 0xffffffff
je 0x402a00
test esi, esi
je 0x402a00
push 0
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x408], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x40298e
cmp dword [ebp - 0x40c], 0
jbe 0x40298e
push 1
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
shr eax, 1
test al, 1
je 0x4029d8
lea eax, [ebx + 0x188]
push eax
lea eax, [ebp - 0x408]
push eax
push esi
lea eax, [ebp - 0x404]
add eax, edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4029ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x402a00
add dword [ebx + 0x138], esi
mov eax, dword [ebp - 0x408]
jmp 0x402a02
push 0
lea eax, [ebp - 0x408]
push eax
push esi
lea eax, [ebp - 0x404]
add eax, edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x408]
add dword [ebx + 0x138], eax
jmp 0x402a02
xor eax, eax
mov esi, dword [ebp - 0x410]
add edi, eax
cmp edi, esi
jb 0x402946
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
Function at 0x405420
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3128
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x519074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405598
mov esi, dword [ebp + 0x18]
test esi, esi
jne 0x40547b
xor bl, bl
jmp 0x40559a
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
lea ecx, [ebp + 8]
cmovae eax, dword [ebp + 8]
add eax, esi
cmp dword [ebp + 0x1c], 0x10
mov edi, eax
cmovae ecx, dword [ebp + 8]
xor ebx, ebx
sub edi, ecx
xor edx, edx
cmp ecx, eax
cmova edi, ebx
test edi, edi
je 0x4054b5
cmp byte [ecx], 0x2f
jne 0x4054ac
mov byte [ecx], 0x5c
inc edx
inc ecx
cmp edx, edi
jne 0x4054a4
mov esi, dword [ebp + 0x18]
xor edi, edi
nop word [eax + eax]
cmp dword [ebp + 0x1c], 0x10
lea ebx, [ebp + 8]
cmovae ebx, dword [ebp + 8]
cmp edi, esi
jae 0x4054ea
mov eax, esi
sub eax, edi
push eax
lea eax, [ebx + edi]
push 0x5c
push eax
call fcn.004995a0
add esp, 0xc
test eax, eax
je 0x4054ea
sub eax, ebx
jmp 0x4054ed
or eax, 0xffffffff
cmp eax, 0xffffffff
mov dword [ebp - 0x18], 0
mov edi, esi
mov dword [ebp - 0x14], 0xf
cmovne edi, eax
mov byte [ebp - 0x28], 0
cmp esi, edi
lea eax, [ebp + 8]
mov ecx, edi
cmovb ecx, esi
cmp dword [ebp + 0x1c], 0x10
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
call fcn.00457020
cmp dword [ebp - 0x18], 0
je 0x405558
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405558
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004b6de3
add esp, 4
test eax, eax
jne 0x4055c2
mov edx, dword [ebp - 0x14]
inc edi
cmp edx, 0x10
jb 0x40558d
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405583
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405623
push edx
push ecx
call fcn.00476085
add esp, 8
mov esi, dword [ebp + 0x18]
cmp edi, esi
jb 0x4054c0
mov bl, 1
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x405600
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4055f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40561e
jmp 0x4055f6
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4055f2
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4055e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405623
push edx
push ecx
call fcn.00476085
add esp, 8
xor bl, bl
jmp 0x40559a
push edx
push ecx
call fcn.00476085
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00476066
mov esp, ebp
pop ebp
ret
call fcn.004a3cba
call fcn.004a3cba
int3
Function at 0x409cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3968
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x519074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x58], ebx
cmp dword [ebx + 0x14], 0x10
jb 0x409cf0
mov esi, dword [ebx]
mov edi, dword [eax + 0x94]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x409d1d
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x409d02
mov eax, dword [ebp - 0x50]
mov edi, dword [eax + 0x94]
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax + 0xa8]
and eax, edx
mov ecx, dword [ecx + 0x9c]
mov dword [ebp - 0x5c], ecx
mov esi, dword [ecx + eax*8]
add eax, eax
lea edx, [eax*4 + 4]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], eax
cmp eax, edi
jne 0x409d4e
mov eax, edi
jmp 0x409d53
mov eax, dword [edx + ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x409dc3
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x409d61
mov edx, dword [ebx]
mov ebx, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x68], ebx
cmp ebx, 0x10
mov ebx, dword [ebp - 0x58]
jb 0x409d75
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x54], eax
call fcn.0042e590
add esp, 8
test al, al
jne 0x409d9a
mov esi, dword [esi]
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x64]
jmp 0x409d46
cmp dword [ebp - 0x68], 0x10
lea eax, [esi + 8]
jb 0x409da5
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x409daf
mov ecx, dword [ebx]
push dword [ebp - 0x54]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0042e590
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp - 0x50]
cmp edi, dword [eax + 0x94]
jne 0x409dec
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
push ebx
mov edx, str.logger_with_name_
lea ecx, [ebp - 0x4c]
call fcn.0041c320
sub esp, 0x14
mov dword [ebp - 4], 0
mov ecx, esp
mov edx, eax
push str._already_exists
call fcn.0041c510
add esp, 4
lea ecx, [ebp - 0x34]
call fcn.00404900
push 0x514768
mov eax, ecx
push eax
call fcn.004988b9
int3
Function at 0x410f80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e446c
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x519074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov ecx, esi
mov dword [ebp - 0x414], 0
mov eax, dword [esi]
call dword [eax + 0x100]
test eax, eax
je 0x410fe8
nop dword [eax + eax]
push 0
mov ecx, esi
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::SComboBox::DeleteString_unsigned_int_]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x100]
test eax, eax
jne 0x410fd0
lea eax, [ebp - 0x414]
push eax
push 0x20019
push 0
push 0x4fe024
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411145
push 0x501ce4
lea ecx, [ebp - 0x420]
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::constructor_wchar_t_const__]
push 0x200
lea eax, [ebp - 0x410]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00499430
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00499430
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x418]
add esp, 0x18
mov dword [ebp - 0x418], 0x200
mov dword [ebp - 0x41c], 0x200
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push dword [ebp - 0x414]
call ebx
cmp eax, 0x103
je 0x411126
nop
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x420]
call dword [sym.imp.utilities.dll_public:_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_____thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::operator_wchar_t_const__]
lea ecx, [ebp - 0x420]
call dword [sym.imp.utilities.dll_public:_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_____thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::MakeLower_void_]
push 0
push 0
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0x100]
push eax
mov ecx, esi
call dword [sym.imp.soui.dll_public:_int___thiscall_SOUI::SComboBox::InsertItem_unsigned_int__wchar_t_const___int__long_int_]
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x200
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x41c], 0x200
push eax
push 0
push 0
lea eax, [ebp - 0x41c]
inc edi
push eax
lea eax, [ebp - 0x410]
push eax
push edi
push dword [ebp - 0x414]
call ebx
cmp eax, 0x103
jne 0x4110a0
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x420]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::destructor_void_]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x100]
test eax, eax
je 0x411163
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x104]
mov al, 1
jmp 0x411165
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
Function at 0x416920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x41694b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00417330
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x41696d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x41696f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x4169f3
jg 0x416984
test esi, esi
je 0x4169f3
test ecx, ecx
jl 0x4169cd
jg 0x41698e
test eax, eax
je 0x4169cd
cmp edi, ecx
jg 0x4169a2
jl 0x416998
cmp esi, eax
jae 0x4169a2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00498930
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x4169d0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4169f3
jg 0x4169da
test esi, esi
je 0x4169f3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4169f3
push eax
push esi
push 1
push edx
call fcn.004b5b33
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416a10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x416a3b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00417410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x416a5d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x416a5f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x416afe
jg 0x416a7c
test esi, esi
je 0x416afe
test ecx, ecx
jl 0x416ac9
jg 0x416a86
test eax, eax
je 0x416ac9
cmp ebx, ecx
jg 0x416a9a
jl 0x416a90
cmp esi, eax
jae 0x416a9a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00498930
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x416ad0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x416afe
jg 0x416ada
test esi, esi
je 0x416afe
cmp dword [edi + 0x4c], 0
je 0x416afe
mov ecx, edi
call fcn.00419440
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004ba4b2
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x519074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x416f30
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x416f6c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x416f6c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x417034
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x416f94
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov edx, dword [esi + 0x38]
test edx, edx
jne 0x416fc7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004b5db7
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
mov cl, bl
mov byte [ebp - 0x25], cl
mov edi, dword [edx]
cmp edi, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x41704a
lea eax, [ebp - 0x25]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov edx, dword [esi + 0x4c]
call fcn.0040a7b0
or ecx, 0xffffffff
test al, al
pop edi
cmovne ecx, ebx
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x417024
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004b5b33
add esp, 0x10
cmp edi, eax
jne 0x417034
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x416f57
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00476066
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov ecx, edx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edi + 0x1c]
test eax, eax
js 0x417034
cmp eax, 1
jle 0x417007
cmp eax, 3
jne 0x417034
mov cl, byte [ebp - 0x25]
jmp 0x416fe2