joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e6d
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x401f03
push edi
push 0x24
push str.WifiAutoInstallSrv
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x401efb
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x401ef4
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x401ef1
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x64
jl 0x401ec7
jmp 0x401ef4
xor esi, esi
inc esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004020c3
mov esp, ebp
pop ebp
ret

Function at 0x40504e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.00404c62
push eax
push esi
push dword [ebp + 8]
call fcn.00404c17
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00404c62
push eax
push esi
push dword [ebp + 8]
call fcn.00404c17
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00404c52
movsd dword es:[edi], dword [esi]
mov cl, 0x30
cwde
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
invalid
test dword [esi - 1], edi
invalid
invalid
Function at 0x40538f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x405329
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x405347
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4053a5
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40538c
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x405395
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40539f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x405381
inc dword [ebp + 0xc]
invalid
invalid

Function at 0x40594d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [eax], eax
add byte [eax - 0x6b75b], al
inc dword [eax]
and byte [ebp - 0x6b7], 0
invalid
invalid
dec edx
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.1003856d
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.1003856d
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.1003856d
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x1003856d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1003857c
pop dword [ebp - 0x50]
mov eax, 0x1003857c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x2c82067e
add dword [ebp - 0x60], 0x21d03ecd
mov dword [ebp - 0x5c], 0x8771bd0e
sub dword [ebp - 0x5c], 0x553e70c9
mov dword [ebp - 0x58], 0xcf9cb95d
sub dword [ebp - 0x58], 0x8350752f
mov dword [ebp - 0x54], 0xf9d36dac
add dword [ebp - 0x54], 0x62c9254
lea eax, [ebp - 0x60]
push eax
mov eax, 0xcfe11fe
sub eax, 0xfcf9431e
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa039011a
add dword [ebp - 0x60], 0xd439683c
mov dword [ebp - 0x5c], 0x2e5986aa
add dword [ebp - 0x5c], 0x1312dacb
mov dword [ebp - 0x58], 0x589e52a1
add dword [ebp - 0x58], 0xad119cb
mov dword [ebp - 0x54], 0xcc9f993f
sub dword [ebp - 0x54], 0xcc9f993f
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x41c2907e
sub eax, 0x31bdc1fa
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b246
push 0
call eax
mov ecx, 0x8f91aacd
add ecx, 0x706e8b2a
xor ebx, ebx
add ebx, eax
mov esi, 0x6b6d7971
sub esi, 0x5b67c571
add esi, dword [ebp - 0x50]
mov edx, 0xe80358c8
add edx, 0x8930b244
sub dword [ebp - 0x24], 0x298d7c16
mov edi, dword [esi]
add dword [ebp - 0x4c], 0x2b6e88f0
xor edi, edx
mov dword [ebx], edi
add dword [ebp - 0x18], edx
add ebx, 0x8e4d929d
add ebx, 0x71b26d67
add esi, 4
loop 0x1003869b
add eax, 0x67b07451
sub eax, 0x67afa9a2
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe65afe20
sub ecx, 0xd65afe20
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x402714
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4027ac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40278c
xor eax, eax
push ebp
push 0x402785
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027c8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40278c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x403ee0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404098
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403f41
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4040b4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403fae
xor eax, eax
push ebp
push 0x403fa7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x403f90
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4040d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403fae
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40408f
cmp byte [ebp - 0xd], 0
jne 0x403ff0
cmp byte [ebp - 0x12], 0
je 0x40408f
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404009
dec ebx
cmp byte [ebx], 0x2e
je 0x404018
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404008
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40408f
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404045
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40408f
cmp byte [ebp - 0xd], 0
je 0x40408f
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40408f
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40673c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406846
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40678f
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403194
jmp 0x40682d
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.004066f0
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406710
mov ebx, eax
test esi, esi
je 0x4067b7
dec esi
test esi, esi
jl 0x4067b7
cmp edi, ebx
jne 0x406796
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004031d4
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403420
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040321c
cmp eax, 2
jl 0x40682d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x40682d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040321c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x40682d
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040321c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403420
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40684d
lea eax, [ebp - 0x110]
call fcn.004030b0
ret

Function at 0x40696c
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x431e48]
mov byte [eax], 1
mov edx, dword [0x405084]
xor eax, eax
call fcn.00405394
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x40695c
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x4069fc
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x406a17
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x406a26
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x406a34
Capabilities:
Suspend thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 1
cmp word [ebx + 0x24], 0
je 0x406a4f
push dword [ebx + 0x26]
push dword [ebx + 0x22]
mov eax, ebx
call fcn.00406a7c
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_SuspendThread
pop ebx
ret

Function at 0x406ab8
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [ebx + 0x19], 1
pop ebx
ret
Function at 0x406d1c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406db4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x406d69
mov eax, dword [ebx + 0x19]
call fcn.004033e0
push eax
push esi
mov eax, edi
call fcn.004033e0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033e0
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x406d9e
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.004033e0
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406518
mov eax, dword [ebp - 8]
call fcn.004033e0
push eax
mov eax, edi
call fcn.004033e0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033e0
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406dbb
lea eax, [ebp - 8]
call fcn.004030b0
ret
Function at 0x408990
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x40899f
mov edx, dword [edx + 0x36]
jmp fcn.004031d4
mov ecx, dword [edx + 0x18]
jecxz 0x408997
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.0040354c
pop edx
mov ecx, dword [ebx]
jecxz 0x4089c7
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40aa08
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040a784
je 0x40aa4d
mov eax, ebx
push edx
call fcn.0040ad4c
pop edx
cmp eax, edx
je 0x40aa4d
test edx, edx
mov eax, ebx
jne 0x40aa2c
pop ebx
inc edx
jmp fcn.0040ad3c
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x40aa35
dec edx
push edx
xor edx, edx
call fcn.0040ad3c
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.0040a484
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040aa6c
ret
Function at 0x40ae00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov byte [esp], 0
cmp dword [0x4324fc], 0
je 0x40aec2
mov eax, dword [0x4324fc]
call fcn.004079b0
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40aec2
call sub.user32.dll_EmptyClipboard
test eax, eax
je 0x40aebd
mov eax, ebx
xor edx, edx
call fcn.0040ad3c
mov esi, 0x28
mov eax, dword [ebx + 0x3d]
mov ax, word [eax + 0xe]
cmp ax, 8
ja 0x40ae66
mov ecx, eax
mov eax, 1
shl eax, cl
shl eax, 2
add esi, eax
mov eax, dword [ebx + 0x45]
add eax, esi
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov ebp, eax
push ebp
call sub.kernel32.dll_GlobalLock
mov edi, eax
test edi, edi
je 0x40aebd
mov edx, edi
mov eax, dword [ebx + 0x3d]
mov ecx, esi
call fcn.004025d8
mov ecx, dword [ebx + 0x45]
mov edx, edi
add edx, esi
mov eax, dword [ebx + 0x41]
call fcn.004025d8
push ebp
call sub.kernel32.dll_GlobalUnlock
test eax, eax
jne 0x40aebd
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x40aebd
push ebp
push 8
call sub.user32.dll_SetClipboardData
test eax, eax
setne byte [esp]
call sub.user32.dll_CloseClipboard
mov al, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40b7c0
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x4313f0], 0xff
je 0x40b7d6
mov al, byte [0x4313f0]
jmp 0x40b836
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40b80f
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x40b7fb
mov al, 6
jmp 0x40b831
cmp edx, 5
jb 0x40b831
cmp dword [esp + 8], 1
jb 0x40b80b
mov al, 5
jmp 0x40b831
mov al, 4
jmp 0x40b831
cmp eax, 1
jne 0x40b82f
mov al, 1
cmp dword [esp + 4], 4
ja 0x40b82b
cmp dword [esp + 4], 4
jne 0x40b831
cmp dword [esp + 8], 0xa
jb 0x40b831
mov al, 2
jmp 0x40b831
xor eax, eax
mov byte [0x4313f0], al
add esp, 0x94
ret
Function at 0x10001880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10001a58
mov edi, dword [0x10006084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10001967
test byte [0x10002030], 8
jne 0x10001a00
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10002040], 8
jne 0x100019c0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001909
cmp esi, 3
jbe 0x10001978
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000191a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100040cc]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001909
mov dword [esp], 0x10002040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100018e0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100018e0
mov dword [esp], 0x10002030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100018cb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100018d3
mov eax, 0xffffffff
jmp 0x10001967
Function at 0x4017d4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 4
pop ecx
push 5
pop edx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x10], 7
mov dword [ebp - 0xc], 8
mov dword [ebp - 8], 9
mov dword [ebp - 4], 0xa
xor eax, eax
push esi
add eax, ecx
cmp eax, 0x14
jl 0x401821
mov esi, edx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
dec esi
jne 0x40182a
pop esi
leave
ret

Function at 0x4018d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
cdq
mov ecx, 0xde
idiv ecx
add dl, 0x33
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x401908
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40198f
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40198f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret

Function at 0x40199d
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.d0ffac7b5b8dd89f55e
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.16cd6e37657d338b289d3b138091c3
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x401a0e
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.0ee72f37ced3f9c1b99d1e754f7f36f
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x4019e3
test eax, eax
jne 0x401a1e
push esi
push str.6fed24e735c7361fd50dedc1c30_d
jmp 0x401a24
push eax
push str.bdc98e4568319d234__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret