joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d40b
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov eax, edx
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x4c
mov dword [ebp - 0x28], ecx
mov ecx, 4
fld dword [0x41d0e0]
mov dword [ebp - 0x1c], edx
cdq
idiv ecx
mov dword [ebp - 0x24], eax
fimul dword [ebp - 0x24]
lea ecx, [eax*4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
fst qword [ebp - 0x30]
fild dword [ebp - 0x20]
fstp qword [ebp - 0x38]
fabs
fstp qword [ebp - 0x48]
fld qword [ebp - 0x38]
fld qword [ebp - 0x30]
fucompi st(1)
fstp st(0)
jp 0x40d2f4
je 0x40d312
fld qword [ebp - 0x38]
fsub qword [ebp - 0x30]
fabs
fmul dword [0x41d0e4]
fld qword [ebp - 0x48]
fcompi st(1)
fstp st(0)
jae 0x40d312
call fcn.0040483b
jmp 0x40d315
mov edi, dword [ebp - 0x20]
cmp ebx, edi
jl 0x40d32e
mov eax, dword [ebp - 0x1c]
mov ecx, 4
xor esi, esi
cdq
idiv ecx
mov dword [ebp - 0x20], edx
jmp 0x40d3b7
cmp ebx, dword [ebp - 0x1c]
jb 0x40d343
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
dec eax
mov dword [esp + 4], eax
call fcn.00405a04
mov eax, dword [ebp - 0x28]
lea esi, [ebx + 4]
mov eax, dword [eax + ebx]
xor ebx, esi
mov dword [ebp - 0x3c], eax
jns 0x40d35c
test esi, esi
jns 0x40d35c
call fcn.0040483b
imul edx, dword [ebp - 0x3c], 0xcc9e2d51
mov ebx, esi
rol edx, 0xf
imul edx, edx, 0x1b873593
xor edx, dword [ebp - 0x24]
rol edx, 0xd
lea edx, [edx + edx*4]
lea eax, [edx - 0x19ab949c]
mov dword [ebp - 0x24], eax
jmp 0x40d2e6
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea edi, [ebx + eax]
mov eax, ebx
xor eax, edi
js 0x40d3fd
cmp edi, dword [ebp - 0x1c]
jb 0x40d3ab
mov eax, dword [ebp - 0x1c]
mov dword [esp], edi
lea edx, [eax - 1]
mov dword [esp + 4], edx
call fcn.00405a04
mov eax, dword [ebp - 0x28]
shl esi, 8
movzx eax, byte [eax + edi]
or esi, eax
cmp dword [ebp - 0x20], 0
jg 0x40d385
imul esi, esi, 0xcc9e2d51
mov ebx, dword [ebp - 0x24]
xor ebx, dword [ebp - 0x1c]
add esp, 0x4c
rol esi, 0xf
imul esi, esi, 0x1b873593
xor ebx, esi
mov eax, ebx
shr eax, 0x10
xor ebx, eax
imul ebx, ebx, 0x85ebca6b
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul eax, eax, 0xc2b2ae35
mov ebx, eax
shr ebx, 0x10
xor eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x20]
xor eax, edi
jns 0x40d394
call fcn.0040483b
jmp 0x40d394
xor edx, edx
test ecx, ecx
je 0x40d415
mov eax, dword [ecx]
mov edx, eax
add ecx, 8
jmp 0x40d2a0
Function at 0x419760
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0041aa70
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0041aa70
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4197c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4222dc]
test esi, esi
jle 0x4198c0
mov eax, dword [0x4222e0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4197f0
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x41986f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4197e0
mov dword [esp], ebx
call fcn.0041a130
mov edi, eax
test eax, eax
je 0x4198e7
mov eax, dword [0x4222e0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0041a240
mov edx, dword [0x4222e0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4198c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x419868
sub eax, 4
and eax, 0xfffffffb
jne 0x419876
add dword [0x4222dc], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x4222e0]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x419868
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00419760
xor esi, esi
jmp 0x4197fa
mov eax, dword [0x4222e0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00419760
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00419760
lea esi, [esi]
nop
Function at 0x419da0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4222f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4222f0]
sub esp, 4
test ebx, ebx
je 0x419df5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x419dee
test esi, esi
je 0x419dee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x419dd0
mov dword [esp], 0x4222f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x205974b5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x454e60f1
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x423e50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x423e6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x423e71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x423e60
mov eax, 1
add ebx, ebx
jne 0x423e83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x423e78
jne 0x423e94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423e78
xor ecx, ecx
sub eax, 3
jb 0x423ea8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423f1a
mov ebp, eax
add ebx, ebx
jne 0x423eb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423ee4
inc ecx
add ebx, ebx
jne 0x423ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423ec5
jne 0x423ee1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423ec5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423f04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423ef5
jmp 0x423e66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423f04
add edi, ecx
jmp 0x423e66
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x423f22
cmp byte [edi], 9
jne 0x423f22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x423f27
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x423f9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28020]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423f54
mov ecx, edi
jns 0x423f83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280ec]
or eax, eax
je 0x423f99
mov dword [ebx], eax
add ebx, 4
jmp 0x423f71
call dword [esi + 0x280fc]
mov ebp, dword [esi + 0x280f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x423fd3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x401710
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x410
mov edi, edx
mov ebp, eax
call fcn.00422e10
test eax, eax
je 0x401730
mov eax, ebp
mov edx, edi
call fcn.004018d0
lea esi, [esp + 0x20c]
mov dword [esp + 0xc], ebp
mov ebx, esi
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x401776
sub ebp, edi
push ebp
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebp
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebp + edi + 1]
jmp 0x40173d
mov ebp, dword [esp + 0xc]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x4017a0
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0xf013f
mov ecx, 0xf003f
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x40c]
push eax
push ecx
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4017e8
mov eax, 0xffffffff
add esp, 0x410
pop ebx
pop ebp
pop esi
pop edi
ret
lea esi, [esp + 0xc]
xor edi, edi
push 0x200
push esi
push edi
push dword [esp + 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0x4018bf
test eax, eax
jne 0x40182c
mov eax, dword [esp + 0x40c]
mov edx, esi
mov ecx, 1
call fcn.00401710
test eax, eax
jl 0x4018bf
inc edi
cmp edi, 0x64
jl 0x4017ee
mov esi, eax
push dword [esp + 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jl 0x40189f
call fcn.00401b70
test eax, eax
je 0x40188c
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.RegDeleteKeyEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4018ac
call fcn.00401b70
push 0
mov edx, 0x100
test eax, eax
cmovne eax, edx
push eax
push ebx
push ebp
call esi
add esp, 0x410
pop ebx
pop ebp
pop esi
pop edi
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0x410
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, esi
add esp, 0x410
pop ebx
pop ebp
pop esi
pop edi
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0x410
pop ebx
pop ebp
pop esi
pop edi
ret
mov esi, eax
jmp 0x401834
Function at 0x401bc0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edx
push eax
mov eax, 0x4060
call fcn.004277d0
mov edx, dword [esp + 0x4064]
mov eax, dword [esp + 0x4060]
mov ebx, eax
push 0x8000
push edx
call dword [sym.imp.MSVCR80.dll__open]
add esp, 8
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x401c0a
pxor xmm0, xmm0
movq qword [ebx], xmm0
movq qword [ebx + 8], xmm0
add esp, 0x4068
pop ebx
pop ebp
ret
lea eax, [esp + 0x400c]
call fcn.004252d0
lea eax, [esp + 0xc]
push 0x4000
push eax
push ebp
call dword [sym.imp.MSVCR80.dll__read]
add esp, 0xc
test eax, eax
jle 0x401c66
mov dword [esp + 0x4064], edi
lea edi, [esp + 0xc]
mov ecx, eax
lea eax, [esp + 0x400c]
mov edx, edi
call fcn.00401c90
push 0x4000
push edi
push ebp
call dword [sym.imp.MSVCR80.dll__read]
add esp, 0xc
mov ecx, eax
test ecx, ecx
jg 0x401c3b
mov edi, dword [esp + 0x4064]
lea edx, [esp + 0x400c]
mov eax, ebx
call fcn.00408c90
push ebp
call dword [sym.imp.MSVCR80.dll__close]
add esp, 0x406c
pop ebx
pop ebp
ret
Function at 0x402590
Capabilities:
Set registry value

Disassembly:
push esi
push ebp
push ebx
sub esp, 8
mov esi, edx
mov ebp, eax
test esi, esi
je 0x402649
mov dword [esp + 4], ecx
movsx eax, byte [esi]
test eax, eax
je 0x402649
call fcn.00401b70
mov ebx, eax
cmp dword [0x56e6a8], 0
jne 0x4025f8
pxor xmm0, xmm0
movq qword [0x56e660], xmm0
movd dword [0x56e668], xmm0
mov dword [0x56e660], 0xc
call fcn.00407150
mov dword [0x56e664], eax
mov eax, 1
mov dword [0x56e668], eax
mov dword [0x56e6a8], eax
mov edx, 0xf013f
lea ecx, [esp]
xor eax, eax
test ebx, ebx
mov ebx, 0xf003f
cmovne ebx, edx
push eax
push ecx
push 0x56e660
push ebx
push eax
push eax
push eax
push ebp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402649
lea eax, [esp + 4]
mov edx, 4
push edx
push eax
push edx
push 0
push esi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
pop ebx
pop ebp
pop esi
ret

Function at 0x404d00
Capabilities:
Get networking interfaces

Disassembly:
push edi
push ebp
push ebx
sub esp, 8
mov ebp, edx
mov ebx, eax
lea edi, [esp + 4]
xor ecx, ecx
mov dword [ebx], ecx
mov dword [esp], ecx
mov dword [esp + 4], ecx
push edi
mov dword [ebp], ecx
push ecx
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
je 0x404d31
xor eax, eax
add esp, 8
pop ebx
pop ebp
pop edi
ret
push dword [esp + 4]
call dword [sym.imp.MSVCR80.dll_malloc]
pop ecx
mov dword [ebx], eax
test eax, eax
je 0x404dab
push edi
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
lea edi, [esp]
push 1
push edi
push 0
call sub.iphlpapi.dll_GetIfTable
mov eax, dword [esp]
test eax, eax
je 0x404d81
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
pop ecx
mov dword [ebp], eax
test eax, eax
je 0x404d81
push 1
push edi
push eax
call sub.iphlpapi.dll_GetIfTable
mov eax, 1
add esp, 8
pop ebx
pop ebp
pop edi
ret
mov eax, dword [ebx]
test eax, eax
je 0x404d95
push eax
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov dword [ebx], 0
mov eax, dword [ebp]
test eax, eax
je 0x404dab
push eax
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov dword [ebp], 0
xor eax, eax
add esp, 8
pop ebx
pop ebp
pop edi
ret
Function at 0x409d50
Capabilities:
Query environment variable

Disassembly:
push str.SAPPHIRE_LICENSE_DIR
call dword [sym.imp.MSVCR80.dll_getenv]
pop ecx
test eax, eax
je 0x409d88
movsx edx, byte [eax]
test edx, edx
je 0x409d88
push 0x400
push eax
push 0x56bb60
call dword [sym.imp.MSVCR80.dll_strncpy]
add esp, 0xc
mov byte [0x56bf5f], 0
mov eax, 0x56bb60
ret
call sym.genarts_frontend_tmp.exe_get_config_dir
ret
Function at 0x40dca0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
sub esp, 0x30
mov ebp, eax
test ebp, ebp
je 0x40dcb2
movsx eax, byte [ebp]
test eax, eax
jne 0x40dcb9
xor eax, eax
add esp, 0x30
pop ebp
ret
lea eax, [esp]
push eax
push ebp
call dword [sym.imp.MSVCR80.dll__stat64i32]
add esp, 8
test eax, eax
jne 0x40dd0b
movzx eax, word [esp + 6]
test eax, 0x4000
je 0x40dcf1
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor ecx, ecx
mov edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
add esp, 0x30
pop ebp
ret
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ecx, ecx
mov edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
add esp, 0x30
pop ebp
ret
mov eax, 0xffffffff
add esp, 0x30
pop ebp
ret
Function at 0x40e1c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push edi
push esi
push ebp
sub esp, 0x51c
lea eax, [esp + 0x514]
call fcn.00404dc0
movzx eax, byte [esp + 0x514]
cmp eax, 0xd1
je 0x40e1ee
add esp, 0x51c
pop ebp
pop esi
pop edi
ret
movzx eax, byte [esp + 0x515]
test eax, eax
jne 0x40e1e4
lea eax, [esp + 0x40c]
mov edx, str.cXM3t3L2M_258PJ2MXZxcze9v3DxM7F3dmK5P726d_Y2M_E3vzP2NnDxcT248fLzcK7MPGz4rv0s_J397DxcSK5drew8XE2fbZx8vZz4T1zsbG1A
call fcn.004224a0
mov esi, eax
call fcn.00422e10
test eax, eax
je 0x40e222
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov edx, esi
call fcn.004018d0
lea edi, [esp + 0x20c]
mov dword [esp + 0x50c], ebx
mov ebp, edi
push 0x5428fc
push esi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40e26b
sub ebx, esi
push ebx
push esi
push edi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add edi, ebx
push edi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea esi, [ebx + esi + 1]
jmp 0x40e232
mov ebx, dword [esp + 0x50c]
mov edx, esi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x40e298
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push esi
push edi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0xf013f
mov ecx, 0xf003f
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x510]
push eax
push ecx
push 0
push ebp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e1e4
lea esi, [esp + 0xc]
xor edi, edi
push 0x200
push esi
push edi
push dword [esp + 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0x40e38b
test eax, eax
jne 0x40e318
mov eax, dword [esp + 0x510]
mov edx, esi
mov ecx, 1
call fcn.00401710
test eax, eax
jl 0x40e38b
inc edi
cmp edi, 0x64
jl 0x40e2de
mov esi, eax
push dword [esp + 0x510]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jl 0x40e1e4
call fcn.00401b70
test eax, eax
je 0x40e37a
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.RegDeleteKeyEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40e37a
call fcn.00401b70
push 0
mov edx, 0x100
test eax, eax
cmovne eax, edx
push eax
push ebp
push reloc.OLEAUT32.dll_SysReAllocString
call esi
jmp 0x40e1e4
push ebp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40e1e4
mov esi, eax
jmp 0x40e320
Function at 0x40ed80
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x308
mov ebx, edx
mov esi, eax
test ebx, ebx
je 0x40eec7
mov byte [ebx], 0
lea edi, [esp + 0x200]
push 0x53fc38
push str.Sapphire_AE
push 0x542830
push str.Software_sGenArts_s_s
push edi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x14
mov dword [esp + 0x304], 0x20
lea ebp, [esp]
mov dword [esp + 0x300], ebx
mov byte [ebx], 0
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40ee0f
sub ebx, edi
push ebx
push edi
push ebp
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add ebp, ebx
push ebp
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebx + edi + 1]
jmp 0x40edd6
mov ebx, dword [esp + 0x300]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x40ee3c
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push ebp
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x300]
push eax
push ecx
push 0
lea ebp, [esp + 0xc]
push ebp
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40eeaa
lea eax, [esp + 0x304]
push eax
push ebx
xor edx, edx
push edx
push edx
push esi
push dword [esp + 0x314]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
push dword [esp + 0x300]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x40eead
mov byte [ebx], 0
movsx eax, byte [ebx]
test eax, eax
jne 0x40eec7
mov edi, dword [esp + 0x328]
mov esi, ebx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x40eebd
mov eax, ebx
add esp, 0x308
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x40f210
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
mov eax, 0x20014
call fcn.004277d0
mov ebx, dword [0x56e74c]
lea ecx, [esp]
lea eax, [ebp + 0xc]
mov edx, ebx
neg edx
add edx, 0xffff
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.MSVCR80.dll__vsnprintf]
add esp, 0x10
lea esi, [esp + 0x10000]
test ebx, ebx
jle 0x40f2d6
lea edx, [esp + 0x10000]
and edx, 0xf
mov eax, edx
neg eax
add eax, 0x10
test edx, edx
cmovne edx, eax
lea ecx, [edx + 0x10]
cmp ebx, ecx
jl 0x40f378
mov eax, ebx
sub eax, edx
and eax, 0xf
neg eax
add eax, ebx
test edx, edx
jbe 0x40f296
xor ecx, ecx
mov byte [esp + ecx + 0x10000], 0x2e
inc ecx
cmp ecx, edx
jb 0x40f289
mov ecx, 0x2e2e2e2e
movd xmm0, ecx
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + edx + 0x10000], xmm0
add edx, 0x10
cmp edx, eax
jb 0x40f2a4
lea esi, [esp + edx + 0x10000]
cmp eax, ebx
jae 0x40f2d6
lea edx, [esp + 0x10001]
mov byte [esp + eax + 0x10000], 0x2e
lea esi, [edx + eax]
inc eax
cmp eax, ebx
jb 0x40f2c6
movsx eax, byte [esp]
test eax, eax
je 0x40f309
mov edx, 0x2e2e2e2e
xor ecx, ecx
mov edi, eax
movd xmm0, edx
pshufd xmm0, xmm0, 0
inc ecx
movsx edx, byte [esp + ecx]
cmp edi, 0xa
je 0x40f392
mov byte [esi], al
inc esi
mov eax, edx
mov edi, edx
test edi, edi
jne 0x40f2f0
mov ebx, dword [0x56e750]
mov byte [esi], 0
test ebx, ebx
je 0x40f37f
lea edx, [esp + 0x10000]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x40f341
mov eax, edx
add edx, ecx
call fcn.00425520
push ebx
push eax
push 1
lea edx, [esp + 0x1000c]
push edx
call dword [sym.imp.MSVCR80.dll_fwrite]
push ebx
call dword [sym.imp.MSVCR80.dll_fflush]
add esp, 0x14
lea eax, [esp + 0x10000]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x20014
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x40f2bb
call dword [sym.imp.MSVCR80.dll___iob_func]
mov ebx, eax
add ebx, 0x40
mov dword [0x56e750], ebx
jmp 0x40f316
test edx, edx
je 0x40f2fe
mov byte [esi], al
inc esi
mov dword [esp + 0x20004], esi
test ebx, ebx
jle 0x40f301
mov eax, esi
and eax, 0xf
mov edi, eax
neg edi
add edi, 0x10
test eax, eax
cmovne eax, edi
lea edi, [eax + 0x10]
cmp ebx, edi
jl 0x40f42b
mov edi, ebx
sub edi, eax
and edi, 0xf
neg edi
add edi, ebx
test eax, eax
jbe 0x40f3fc
mov dword [esp + 0x20008], 0
mov dword [esp + 0x20000], ebx
mov ebx, dword [esp + 0x20008]
mov byte [ebx + esi], 0x2e
inc ebx
cmp ebx, eax
jb 0x40f3ec
mov ebx, dword [esp + 0x20000]
movdqa xmmword [esi + eax], xmm0
add eax, 0x10
cmp eax, edi
jb 0x40f3fc
add esi, eax
cmp edi, ebx
jae 0x40f301
mov eax, dword [esp + 0x20004]
mov byte [eax + edi], 0x2e
lea esi, [edi + eax + 1]
inc edi
cmp edi, ebx
jb 0x40f419
jmp 0x40f301
xor edi, edi
jmp 0x40f40a