joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c0e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0042b010
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x43c1ab
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x43c1ab
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x43c15e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x43c169
or bh, 8
and edi, 0x8000000
je 0x43c184
mov eax, dword [0x47077c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x43c1ab
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x43c5ab
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x43c5cf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x43c5ea
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x43e62a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x43e64c
cmp dword [edi + 0x3c], 0
jne 0x43e64c
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004487fe
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0043e679
pop edi
pop esi
pop ebx
ret 8

Function at 0x441434
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x441476
call fcn.004487fe
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x441476
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x44146d
xor eax, eax
jmp 0x44147e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00441484
pop edi
pop esi
pop ebx
ret 4

Function at 0x4497b0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4497de
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4497fc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00449716
jmp 0x4497fc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4497fc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00449716
test edi, edi
mov eax, edi
jne 0x4497e6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402254
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call sub.rtl100.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x40243e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [esi + 0x482], 0x41
mov byte [esi + 0x483], 0x30
mov byte [esi + 0x484], 0x35
mov byte [esi + 0x485], 0x43
mov byte [esi + 0x486], 0x4c
mov byte [esi + 0x487], 0x44
mov byte [esi + 0x488], 0x45
mov byte [esi + 0x489], 0x42
mov byte [esi + 0x48a], 0x46
mov byte [esi + 0x48b], 0x2d
mov byte [esi + 0x48c], 0x47
mov byte [esi + 0x48d], 0x53
mov byte [esi + 0x48e], 0x34
mov byte [esi + 0x48f], 0x4b
mov byte [esi + 0x490], 0x48
mov byte [esi + 0x491], 0x52
mov byte [esi + 0x492], 0x49
mov byte [esi + 0x493], 0x54
mov byte [esi + 0x494], 0x4a
mov byte [esi + 0x495], 0x4f
mov byte [esi + 0x496], 0x4e
mov byte [esi + 0x497], 0x38
mov byte [esi + 0x498], 0x56
mov byte [esi + 0x499], 0x51
mov byte [esi + 0x49a], 0x4d
mov byte [esi + 0x49b], 0x58
mov byte [esi + 0x49c], 0x31
mov byte [esi + 0x49d], 0x50
mov byte [esi + 0x49e], 0x57
mov byte [esi + 0x49f], 0x39
mov byte [esi + 0x4a0], 0x37
mov byte [esi + 0x4a1], 0x3a
mov byte [esi + 0x4a2], 0x5a
mov byte [esi + 0x4a3], 0x33
mov byte [esi + 0x4a4], 0x55
mov byte [esi + 0x4a5], 0x32
mov byte [esi + 0x4a6], 0x59
mov byte [esi + 0x4a7], 0x36
lea eax, [ebp - 8]
call sub.rtl100.bpl__System__LStrClr_qqrpv
mov eax, dword [ebp - 4]
call sub.rtl100.bpl__System__LStrLen_qqrx17System_AnsiString
test eax, eax
jle 0x40240b
mov dword [ebp - 0x10], eax
mov edi, 1
mov ebx, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
cmp al, byte [esi + ebx + 0x481]
jne 0x4023ff
cmp ebx, 0x14
jge 0x4023e4
lea eax, [ebp - 0x14]
movzx edx, byte [esi + ebx + 0x494]
call sub.rtl100.bpl__System__LStrFromChar_qqrr17System_AnsiStringc
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call sub.rtl100.bpl__System__LStrCat_qqrv
jmp 0x4023ff
lea eax, [ebp - 0x18]
movzx edx, byte [esi + ebx + 0x46e]
call sub.rtl100.bpl__System__LStrFromChar_qqrr17System_AnsiStringc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call sub.rtl100.bpl__System__LStrCat_qqrv
inc ebx
cmp ebx, 0x27
jne 0x4023b1
inc edi
dec dword [ebp - 0x10]
jne 0x4023ac
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call sub.rtl100.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402445
lea eax, [ebp - 0x18]
mov edx, 2
call sub.rtl100.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl100.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x100014de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100014e8
repz ret
jmp fcn.10002323

Function at 0x10015c56
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100040cc
and dword [ebp - 4], 0
cmp dword [0x1002094c], 0
mov ebx, eax
jne 0x10015d07
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10015db8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10015db8
push eax
call fcn.1000405a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1002094c], eax
call esi
push eax
call fcn.1000405a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10020950], eax
call esi
push eax
call fcn.1000405a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10020954], eax
call esi
push eax
call fcn.1000405a
pop ecx
mov dword [0x1002095c], eax
test eax, eax
je 0x10015d07
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000405a
pop ecx
mov dword [0x10020958], eax
mov eax, dword [0x10020958]
cmp eax, ebx
je 0x10015d5f
cmp dword [0x1002095c], ebx
je 0x10015d5f
push eax
call fcn.100040d5
push dword [0x1002095c]
mov esi, eax
call fcn.100040d5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10015d5f
test edi, edi
je 0x10015d5f
call esi
test eax, eax
je 0x10015d56
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10015d56
test byte [ebp - 0xc], 1
jne 0x10015d5f
or dword [ebp + 0x10], 0x200000
jmp 0x10015d98
mov eax, dword [0x10020950]
cmp eax, ebx
je 0x10015d98
push eax
call fcn.100040d5
pop ecx
test eax, eax
je 0x10015d98
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10015d98
mov eax, dword [0x10020954]
cmp eax, ebx
je 0x10015d98
push eax
call fcn.100040d5
pop ecx
test eax, eax
je 0x10015d98
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002094c]
call fcn.100040d5
pop ecx
test eax, eax
je 0x10015db8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10015dba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49e92c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 0xc]
and eax, dword [ebp + 8]
test eax, eax
jne 0x49e959
mov ecx, dword [0x412060]
imul ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x49e959
cmp dword [ebp + 0x10], 0
jne 0x49e959
mov dword [ebp - 0x28], 0
jmp 0x49e960
mov dword [ebp - 0x28], 1
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
je 0x49e97c
cmp dword [ebp + 0xc], 0
je 0x49e97c
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 8]
test eax, eax
jne 0x49e98e
mov ecx, 0xa872a0a4
test ecx, ecx
jne 0x49e98e
mov dword [ebp - 0x2c], 0
jmp 0x49e995
mov dword [ebp - 0x2c], 1
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 8]
add eax, 0x5f42df82
mov ecx, dword [ebp + 0xc]
and ecx, eax
test ecx, ecx
je 0x49e9c5
mov edx, dword [ebp + 0x10]
imul edx, edx, 0x77ed1563
and edx, dword [ebp + 0x10]
test edx, edx
je 0x49e9c5
mov dword [ebp - 0x30], 1
jmp 0x49e9cc
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
mov eax, dword [ecx + 0x7c]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049e2d5
add esp, 8
test eax, eax
je 0x49ea21
jmp 0x49ea63
mov dword [ebp - 0x18], 0
jmp 0x49ea33
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, dword [edx + 0x18]
jae 0x49ea8e
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [edx + eax*4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0049e2d5
add esp, 8
test eax, eax
jne 0x49ea63
jmp 0x49ea2a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov edx, dword [ebp - 0x18]
xor eax, eax
mov ax, word [ecx + edx*2]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [edx + eax*4]
mov eax, ecx
jmp 0x49ea90
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x62d5e9
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0062d799
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x62d6e7
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x62d68a
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x62d6cd
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x62d6a1
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x62d6bc
test al, 0x40
je 0x62d6b3
mov ecx, dword [edi + 0x20]
jmp 0x62d6ba
test al, 0x80
je 0x62d6cd
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x62d6cd
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x62d659
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40208c
Capabilities:
Copy file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
push esi
and dword [ebp - 4], 0
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0040255b
pop ecx
test eax, eax
pop ecx
je 0x402201
push dword [ebp + 0xc]
call fcn.004025f7
push dword [ebp + 8]
lea eax, [ebp - 0x310]
push eax
call fcn.00407600
lea eax, [ebp - 0x310]
push eax
call fcn.004025bc
push dword [ebp + 0x14]
lea eax, [ebp - 0x310]
push eax
call fcn.00407610
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.00407600
lea eax, [ebp - 0x108]
push eax
call fcn.004025bc
push dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push eax
call fcn.00407610
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 0x2c
mov edi, 0x80
lea eax, [ebp - 0x108]
push edi
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x108]
push 0
push eax
lea eax, [ebp - 0x310]
push eax
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push edi
push eax
call esi
cmp dword [ebp - 4], 0
jne 0x402201
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.0040255b
pop ecx
test eax, eax
pop ecx
je 0x402201
push dword [ebp + 0x10]
call fcn.004025f7
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
call fcn.00407600
lea eax, [ebp - 0x20c]
push eax
call fcn.004025bc
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push eax
call fcn.00407610
add esp, 0x18
lea eax, [ebp - 0x20c]
push edi
push eax
call esi
lea eax, [ebp - 0x20c]
push 0
push eax
lea eax, [ebp - 0x310]
push eax
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push edi
push eax
call esi
cmp dword [ebp - 4], 0
je 0x402201
mov dword [0x412528], 1
call fcn.0040193a
cmp eax, 2
lea eax, [ebp - 0x108]
push 4
push eax
lea eax, [ebp - 0x20c]
push eax
ja 0x4021fb
call fcn.004022ba
add esp, 0xc
jmp 0x402201
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402209
Capabilities:
Delete directory
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push eax
call fcn.00407600
pop ecx
xor esi, esi
cmp dword [ebp + 0xc], esi
pop ecx
lea eax, [ebp - 0x104]
push eax
je 0x4022a5
call fcn.004025bc
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call fcn.00407610
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4022b7
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040255b
pop ecx
test eax, eax
pop ecx
je 0x4022b7
mov dword [0x412528], 1
call fcn.0040193a
cmp eax, 2
push 4
lea eax, [ebp - 0x104]
push esi
push eax
ja 0x4022b1
call fcn.004022ba
add esp, 0xc
jmp 0x4022b7
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4022b7
jmp 0x40227d
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop esi
leave
ret
Function at 0x40265d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor edi, edi
push eax
push 3
push edi
push dword [ebp + 8]
xor ebx, ebx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x4026ce
lea eax, [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 8]
push edi
push eax
push edi
push edi
push dword [ebp - 4]
mov dword [ebp - 8], 1
mov dword [ebp + 8], edi
call esi
push dword [ebp + 8]
call fcn.0040795b
push dword [ebp + 8]
mov ebx, eax
push edi
push ebx
call fcn.004077c0
add esp, 0x10
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push ebx
push eax
push edi
push edi
push dword [ebp - 4]
call esi
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
mov dword [ebp - 0xc], edi
jne 0x4026fa
push dword [ebp + 8]
push str.vaIue_not_set
push ebx
call fcn.00408320
add esp, 0xc
test eax, eax
jne 0x4026fa
mov dword [ebp - 0xc], 1
cmp ebx, edi
je 0x402705
push ebx
call fcn.004079cf
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40270d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp + 8]
xor edi, edi
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40276f
push esi
mov esi, str.vaIue_not_set
push esi
call fcn.004078e0
pop ecx
inc eax
push eax
push esi
push 1
mov esi, 0x412524
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40276b
push edi
push esi
push str.Error_writing_default_key
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
pop edi
pop esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret

Function at 0x402aec
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402b24
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x402bb5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402be0
xor eax, eax
jmp 0x402c0a
push edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
pop esi
pop ebp
ret
Function at 0x402c0d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x18]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402c36
xor eax, eax
leave
ret
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp + 0xc]
push dword [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret

Function at 0x402c65
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x412534]
inc dword [0x412534]
cmp eax, 0x10
push ebx
jae 0x402ceb
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402ceb
push esi
mov esi, 0x104
push esi
call fcn.0040795b
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x402ce1
push edi
push esi
push dword [ebp - 4]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, eax
test edi, edi
jne 0x402cd2
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00402c65
pop ecx
test eax, eax
pop ecx
je 0x402cd2
dec ebx
inc ebx
test edi, edi
je 0x402cac
push dword [ebp - 4]
call fcn.004079cf
pop ecx
pop edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
dec dword [0x412534]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
pop ebx
leave
ret

Function at 0x402d09
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x412538]
inc dword [0x412538]
cmp eax, 0x10
jae 0x402d9a
lea eax, [ebp + 0xc]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402d9a
push ebx
push esi
mov esi, 0x104
push esi
call fcn.0040795b
mov ebx, eax
pop ecx
test ebx, ebx
je 0x402d8f
and dword [ebp + 8], 0
push edi
push esi
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, eax
test edi, edi
jne 0x402d80
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
call dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
call fcn.00402d09
add esp, 0x1c
inc dword [ebp + 8]
test edi, edi
je 0x402d50
push ebx
call fcn.004079cf
pop ecx
pop edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
dec dword [0x412538]
pop ebp
ret