joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a6f13
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100a6f4b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100a4fca
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100a4fa2
jmp 0x100a6f57
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100a860d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100a864f
call fcn.100ae70d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100a864f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100a8646
xor eax, eax
jmp 0x100a8657
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100a865d
pop edi
pop esi
pop ebx
ret 4
Function at 0x13142b06
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [eax], 0xfffff000
jne 0x13142b1b
mov dl, byte [eax + 5]
cmp dl, 0xe8
je 0x13142b20
cmp dl, 0xcc
je 0x13142b20
dec eax
dec ecx
jne fcn.13142b06
ret
add eax, 0xa
add eax, dword [eax - 4]
ret

Function at 0x13142dff
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
mov ebx, edx
sub ecx, ecx
push 6
pop edx
mov eax, dword fs:[ecx + 0x30]
cmp byte [ebx + 2], cl
jne 0x13142e19
dec edx
mov dword [eax], edx
mov byte [eax], dl
xor eax, dword [ebx + 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
je 0x13142e96
push eax
push dword [ebx + 0x30]
call dword [ebx + 0x10]
push dword [ebp + 0x10]
call dword [ebx + 8]
test eax, eax
sete byte [ebp - 1]
pop eax
je 0x13142e79
sub ecx, ecx
cmp byte [ebx + 2], cl
mov edx, dword fs:[ecx + 0x30]
push eax
je 0x13142e54
shr eax, 2
inc eax
shl eax, 3
add eax, dword [edx + 0x44]
mov ecx, dword [ebp + 0x10]
xor ecx, dword [ebx + 4]
mov dword [eax], ecx
cmp byte [ecx], 7
pop eax
jae 0x13142e71
inc dword [ecx + 4]
dec dword [edx + 4]
jmp 0x13142e79
inc word [ecx + 2]
dec word [edx + 2]
push eax
push dword [ebx + 0x30]
call dword [ebx + 0x18]
pop eax
cmp byte [ebp - 1], 0
je 0x13142e96
push eax
call sub.KERNEL32.DLL_CloseHandle
push 0x57
pop ecx
call fcn.13142d8f
pop ebx
leave
ret 0xc
Function at 0x131437a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1314381c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.13141dc4
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0x13143830
call fcn.13141e28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13143823
lea eax, [ebp - 0x104]
call fcn.13141cd0
ret

Function at 0x13143a78
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x13143a80
push ecx
push ebx
mov eax, 0x13143a18
call fcn.13142388
xor eax, eax
push ebp
push 0x13143bc0
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.13143460
lea eax, [ebp - 0x14]
call fcn.131437a8
lea eax, [ebp - 0x14]
mov edx, 0x13143bd8
call fcn.13141de4
mov edx, dword [ebp - 0x14]
mov eax, 0x13156e88
call fcn.13141670
mov eax, dword [0x131554c4]
mov byte [eax], 2
mov edx, 1
mov eax, 0x13156e88
call fcn.131419d0
call fcn.1314124c
mov ebx, eax
test bx, bx
jne 0x13143afa
mov eax, 0x13156e88
call fcn.131417b4
call fcn.13141210
test bx, bx
je 0x13143b25
lea eax, [ebp - 0x18]
call fcn.131437a8
lea eax, [ebp - 0x18]
mov edx, 0x13143bd8
call fcn.13141de4
mov eax, dword [ebp - 0x18]
push eax
call sub.shlwapi.dll_PathFileExistsA
test eax, eax
jne 0x13143ba5
call fcn.1314392c
lea eax, [ebp - 0x1c]
call fcn.131437a8
lea eax, [ebp - 0x1c]
mov edx, 0x13143bec
call fcn.13141de4
mov eax, dword [ebp - 0x1c]
push eax
call sub.shlwapi.dll_PathFileExistsA
test eax, eax
jne 0x13143b84
push 0
lea eax, [ebp - 0x20]
call fcn.131437a8
lea eax, [ebp - 0x20]
mov edx, 0x13143bec
call fcn.13141de4
mov eax, dword [ebp - 0x20]
call fcn.13141f50
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.131413b8
mov eax, dword [ebp - 0x24]
call fcn.13141f50
push eax
call sub.KERNEL32.DLL_CopyFileA
mov eax, 0x13143c00
call fcn.13143834
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov edx, 0x13143c10
call fcn.13142818
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13143bc7
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.13141cf4
ret
Function at 0x4018cd
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434488
push 0x42f320
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x1c], ebx
push 1
pop esi
mov dword [0x43ac04], esi
mov dword [ebp - 4], ebx
mov word [0x43abe0], si
push dword [0x43abfc]
movsx eax, byte [0x43abcd]
push eax
call fcn.00411706
add dword [0x43ac08], eax
movsx eax, byte [0x43abd1]
and eax, dword [0x43abf8]
add dword [0x43abf0], eax
push 0x4e
call fcn.00415e1f
add esp, 0xc
call eax
test eax, 0x80000000
je 0x4019b8
movsx eax, byte [0x43abcc]
push eax
movsx eax, byte [0x43abc8]
push eax
call fcn.004117ef
add byte [0x43abcf], al
push dword [0x43abf8]
push 0x8955ffff
call fcn.00411775
add word [0x43abdc], ax
mov eax, dword fs:[0x20]
mov dword [ebp - 0x1c], eax
movsx eax, word [0x43abe2]
push eax
push 0xba03ffff
call fcn.004118af
add esp, 0x18
mov word [0x43abda], ax
mov eax, dword [0x43ac0c]
or eax, 0x8f75ffff
mov word [0x43abda], ax
jmp 0x401a90
cmp dword [0x43abf0], ebx
jne 0x4019cd
cmp word [0x43abde], bx
jne 0x4019cd
xor eax, eax
jmp 0x4019cf
mov eax, esi
mov byte [0x43abcc], al
xor eax, eax
cmp word [0x43abdc], bx
setne al
mov word [0x43abe2], ax
push edx
push ecx
push ebx
push eax
imul eax, eax, 0x9c4dffff
sub eax, ebx
and ecx, 0x2bc7ffff
inc ecx
imul edx, ecx
pop eax
pop ebx
pop ecx
pop edx
mov ebx, dword fs:[0x30]
push edx
push ecx
push ebx
push eax
inc ecx
imul ecx, ebx
inc ebx
dec ecx
sub edx, ecx
add edx, 0xef91ffff
inc eax
pop eax
pop ebx
pop ecx
pop edx
mov bl, byte [ebx + 2]
push edx
push ebx
push eax
imul edx, eax
xor edx, 0x9511ffff
inc edx
add edx, 0x7a69ffff
xor ebx, 0x69c5ffff
pop eax
pop ebx
pop edx
movzx ebx, bl
push edx
push ecx
push ebx
push eax
add ebx, 0x76bbffff
nop
sub ebx, eax
mov edx, edx
sub ebx, ebx
or eax, ecx
dec ebx
mov ecx, ebx
pop eax
pop ebx
pop ecx
pop edx
mov dword [ebp - 0x1c], ebx
push edx
push ecx
push ebx
push eax
imul ebx, ebx
sub edx, eax
nop
sub ecx, edx
sub edx, 0x6f59ffff
dec edx
sub eax, ebx
and ecx, 0xb3dfffff
pop eax
pop ebx
pop ecx
pop edx
dec word [0x43abd2]
call dword [sym.imp.USER32.dll_GetCursor]
mov byte [0x43abcc], al
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
jmp 0x401ad0
or word [0x43abe2], 0xffff
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add byte [0x43abd0], al
cmp dword [ebp - 0x1c], ebx
je 0x401aed
mov byte [ebp - 0x20], 1
mov al, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406c48
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 4
push 0x40
mov dword [ebp - 8], eax
call fcn.00415e1f
pop ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x406cf5
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x406cea
push esi
cmp dword [ebp - 0x24], 0x10
jb 0x406cd4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jne 0x406cd4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
je 0x406cd4
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x406cd4
cmp byte [ebp + 8], 0
push esi
je 0x406cc3
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x406cc9
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
push 0x37
call fcn.00415e1f
pop ecx
call eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x406c8c
pop esi
push edi
push 0x37
call fcn.00415e1f
pop ecx
call eax
pop edi
leave
ret
Function at 0x40832b
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x42fec1
call fcn.0042f2d0
push ecx
push ecx
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
push ebx
mov byte [esi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x10]
push ebx
mov dword [ebp - 4], ebx
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push ebx
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push ebx
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x40]
push ebx
mov byte [ebp - 4], 3
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x50]
push ebx
mov byte [ebp - 4], 4
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], 0x64
mov byte [esi + 0x7c], bl
mov byte [esi + 0x7d], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x408d32
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
push ebx
push esi
push dword [0x43abf0]
push 0x1123ffff
call fcn.004118af
add dword [0x43abe8], eax
dec byte [0x43abce]
push 0xeb49ffff
push 0xb329ffff
call fcn.0041181a
push 3
mov word [0x43abd4], ax
push dword [esp + 0x20]
call fcn.00408cee
mov esi, eax
mov ax, word [0x43abe0]
add ax, word [0x43abec]
xor ebx, ebx
add esp, 0x18
cmp dword [0x43ac04], ebx
mov word [0x43abe0], ax
mov byte [0x43abc9], 1
jne 0x408da2
cmp ax, bx
jne 0x408da2
xor eax, eax
jmp 0x408da5
push 1
pop eax
add dword [0x43abf0], eax
cmp edx, ebx
jne 0x408e45
call dword [sym.imp.USER32.dll_GetCursor]
push dword [0x43ac08]
mov byte [0x43abc8], al
push 0x7a5dffff
call fcn.00411906
movsx eax, word [0x43abdc]
push 1
push eax
mov dword [0x43abe8], 1
lea esi, [esi*4 + 1]
mov byte [0x43abd0], 1
call fcn.0041181a
mov byte [0x43abce], al
or word [0x43abda], 0xffff
movsx eax, byte [0x43abca]
or eax, 0xcca1ffff
add esp, 0x10
add dword [0x43ac00], eax
inc word [0x43abdc]
cmp dword [0x43abec], ebx
jne 0x408e2e
cmp byte [0x43abd0], bl
je 0x408e31
push 1
pop ebx
add dword [0x43ac0c], ebx
mov word [0x43abd6], 0xfffe
jmp 0x408f3d
or byte [0x43abcf], 0xff
push 0x5b6dffff
push 0xe459ffff
mov byte [0x43abcc], 1
lea esi, [esi*4 + 5]
call fcn.00411864
add word [0x43abd6], ax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
add dword [0x43abe8], eax
push 0xc575ffff
push 0x4d7fffff
call fcn.00411738
pop ecx
mov byte [0x43abcb], al
pop ecx
push 0xb863ffff
call dword [sym.imp.USER32.dll_IsMenu]
add dword [0x43ac0c], eax
movsx eax, word [0x43abdc]
push eax
movsx eax, byte [0x43abcf]
push eax
call fcn.00411775
mov dword [0x43abf4], eax
movsx eax, word [0x43abda]
push eax
push dword [0x43abec]
call fcn.00411775
add word [0x43abd4], ax
push 0xe97fffff
push 0x49e9ffff
call fcn.00411706
add byte [0x43abcd], al
push 0x3d71ffff
push 0x1b2dffff
call fcn.004117ef
add word [0x43abd8], ax
push 0xe273ffff
movsx eax, word [0x43abe2]
push eax
call fcn.00411706
mov byte [0x43abca], al
add esp, 0x28
xor eax, eax
cmp word [0x43abd8], bx
setne al
mov dword [0x43ac04], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov byte [0x43abd1], al
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x409227
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp byte [0x43abcf], al
mov dword [ebp - 4], eax
jne 0x409245
cmp dword [0x43abf4], eax
mov byte [0x43abd1], al
je 0x40924c
mov byte [0x43abd1], 1
push esi
mov esi, dword [ebp + 8]
push edi
mov al, byte [esi]
inc byte [0x43abc8]
mov byte [ebp - 1], al
movsx ax, byte [0x43abc8]
neg eax
mov word [0x43abde], ax
call dword [sym.imp.USER32.dll_GetCursor]
mov edi, dword [ebp + 0xc]
add word [0x43abd8], ax
cmp edi, 1
jbe 0x409287
mov al, byte [esi + 1]
mov byte [ebp - 2], al
mov ax, word [0x43ac0c]
add byte [0x43abd0], 0xfe
sub word [0x43abdc], ax
mov ax, word [0x43abf4]
sub word [0x43abd4], ax
cmp edi, 2
jbe 0x4092b3
mov al, byte [esi + 2]
mov byte [ebp - 3], al
movsx eax, word [0x43abda]
push eax
movsx eax, word [0x43abe2]
push eax
call fcn.004118af
add dword [0x43abf0], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add byte [0x43abc9], al
push 0x9643ffff
movsx eax, word [0x43abd6]
push eax
call fcn.00411706
mov word [0x43abde], ax
lea eax, [ebp - 4]
push eax
call fcn.0040905b
mov esi, dword [ebp + 0x10]
push 0x4621ffff
mov byte [esi], al
movsx eax, word [0x43abd4]
push eax
call fcn.00411864
push dword [0x43abf4]
mov word [0x43abe4], ax
push 0x7c85ffff
call fcn.004117ef
add dword [0x43abec], eax
mov al, byte [0x43abcb]
and al, byte [0x43abc8]
add byte [0x43abca], al
lea eax, [ebp - 4]
push eax
call fcn.0040905b
mov byte [esi + 1], al
movsx eax, word [0x43abe0]
push eax
push 0xa20dffff
call fcn.00411775
add esp, 0x28
cmp edi, 1
mov byte [0x43abc9], al
je 0x409378
lea eax, [ebp - 4]
push eax
call fcn.0040905b
pop ecx
jmp 0x40937a
mov al, 0x3d
mov byte [esi + 2], al
mov ecx, dword [0x43ac00]
movsx eax, word [0x43abde]
lea eax, [ecx + eax + 0x1da7ffff]
mov dword [0x43ac00], eax
movsx eax, word [0x43abd2]
imul eax, dword [0x43abf8]
cmp edi, 3
mov dword [0x43ac04], eax
jne 0x4093ba
lea eax, [ebp - 4]
push eax
call fcn.0040905b
pop ecx
jmp 0x4093bc
mov al, 0x3d
mov byte [esi + 3], al
mov ax, word [0x43abec]
add word [0x43abd8], ax
push 0x8777ffff
movsx eax, byte [0x43abca]
push eax
call fcn.004118af
pop ecx
mov word [0x43abe0], ax
pop ecx
pop edi
pop esi
leave
ret 0xc
Function at 0x409b7e
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x42ff2d
call fcn.0042f2d0
sub esp, 0x10
movsx eax, word [0x43abe4]
or eax, 0x465dffff
dec byte [0x43abce]
mov dword [0x43abec], eax
push esi
movsx eax, word [0x43abd4]
push eax
movsx eax, byte [0x43abcf]
push eax
call fcn.00411775
mov word [0x43abda], ax
xor eax, eax
xor esi, esi
cmp byte [0x43abd0], al
pop ecx
setne al
or byte [0x43abcf], 0xff
pop ecx
mov dword [0x43abf8], eax
mov al, byte [ebp + 0x13]
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
and dword [ebp - 4], esi
xor eax, eax
cmp dword [0x43abfc], eax
setne al
add word [0x43abd2], ax
movsx eax, byte [0x43abd0]
push eax
push 0x3d01ffff
call fcn.00411906
mov word [0x43abd4], ax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042993d
add esp, 0x14
test eax, eax
je 0x409cdf
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push dword [0x433ed0]
mov word [0x43abe2], ax
push dword [ebp + 0x10]
call fcn.004151aa
pop ecx
test eax, eax
pop ecx
je 0x409cdf
push 0x483fffff
push dword [0x43abf8]
call fcn.00411864
add word [0x43abe0], ax
push 0xfea5ffff
movsx eax, byte [0x43abd1]
push eax
call fcn.00411775
add dword [0x43abec], eax
mov al, byte [0x43abf8]
neg al
mov byte [0x43abc9], al
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
call fcn.00414d0c
add esp, 0x18
test eax, eax
je 0x409cdf
mov ax, word [0x43abda]
inc word [0x43abd6]
push dword [ebp + 0x10]
dec ax
mov word [0x43abde], ax
call fcn.00409d11
mov esi, eax
movsx eax, byte [0x43abd1]
push eax
movsx eax, word [0x43abd2]
push eax
call fcn.004116b5
add esp, 0xc
add byte [0x43abca], al
movsx eax, word [0x43abdc]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
add byte [0x43abce], al
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40a4e4
Capabilities:
Set registry value

Disassembly:
mov eax, 0x42fff2
call fcn.0042f2d0
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [0x43ac00], ebx
push esi
mov esi, ecx
jne 0x40a50d
cmp dword [0x43abf8], ebx
mov byte [0x43abcd], bl
je 0x40a514
mov byte [0x43abcd], 1
push 0x9a97ffff
push 0x2271ffff
call fcn.004118af
add byte [0x43abd0], al
xor eax, eax
cmp word [0x43abe4], bx
pop ecx
pop ecx
setne al
add word [0x43abe0], ax
cmp dword [esi + 0xf4], ebx
je 0x40a63a
push 0x3acbffff
push dword [0x43ac04]
call fcn.004118af
mov dword [0x43abec], eax
lea eax, [ebp - 0x1c]
push 2
push eax
call fcn.004202ad
mov al, byte [0x43abf8]
push dword [ebp + 8]
imul byte [0x43abce]
mov byte [0x43abce], al
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.0042bee3
add esp, 0x18
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [ebp - 4], 1
push dword [ecx]
lea ecx, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push dword [0x43ac00]
push 0x8badffff
call fcn.004117b3
cmp dword [0x43abec], ebx
pop ecx
pop ecx
mov dword [0x43ac00], eax
je 0x40a5e3
cmp word [0x43abd2], bx
mov dword [0x43abe8], 1
jne 0x40a5e9
mov dword [0x43abe8], ebx
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x40a5f5
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp + 0xc]
push 4
push ecx
push 4
push ebx
push eax
push dword [esi + 0xf4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movsx eax, word [0x43abd8]
or byte [0x43abcf], 0xff
push 0x2a9ffff
push eax
call fcn.00411906
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov dword [0x43abf4], eax
push 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x412130
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x530
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
push dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
push 0x3a
call fcn.00415e1f
pop ecx
call eax
push dword [0x43abfc]
mov dword [ebp + 8], eax
movsx ax, byte [0x43abcb]
neg eax
push 0xfd67ffff
mov word [0x43abd6], ax
call fcn.004118af
add byte [0x43abc8], al
cmp dword [ebp + 8], 0xffffffff
pop ecx
pop ecx
je 0x41230d
dec byte [0x43abd1]
push ebx
mov ebx, 0x96
push edi
push ebx
lea eax, [ebp - 0xa4]
push esi
push eax
mov dword [ebp - 0xc], esi
call sub.MSVCRT.dll_memset
movsx eax, byte [0x43abd1]
push 0x7945ffff
push eax
mov dword [ebp - 0xa4], esi
call fcn.00411738
dec byte [0x43abc8]
mov byte [0x43abd1], al
movsx eax, byte [0x43abd0]
push 0x33b3ffff
push eax
call fcn.00411775
mov word [0x43abe4], ax
mov eax, dword [0x43abf8]
and eax, 0x9befffff
mov dword [ebp - 0xa0], esi
mov dword [0x43abe8], eax
movsx eax, word [0x43abdc]
push eax
push 0xdd83ffff
call fcn.004117ef
add word [0x43abd6], ax
push 0x439bffff
push 0x740fffff
call fcn.00411775
mov edi, 0x48a
mov word [0x43abdc], ax
push edi
lea eax, [ebp - 0x530]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0xa61dffff
push 0xc7fbffff
call fcn.004118af
add esp, 0x40
mov word [0x43abdc], ax
mov al, byte [0x43abd0]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
add word [0x43abd8], ax
push 0x306dffff
push 0x595fffff
call fcn.004117ef
pop ecx
mov dword [0x43abe8], eax
pop ecx
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 0x530]
push edi
push eax
lea eax, [ebp - 0xa4]
push ebx
push eax
push 0x2d1400
push dword [ebp + 8]
push 0x63
call fcn.00415e1f
pop ecx
call eax
push 1
test eax, eax
pop edi
je 0x4122d3
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x530]
push eax
call fcn.00411bf1
push 0x6909ffff
push 0x9dedffff
mov dword [ebp - 4], edi
call fcn.004118af
add dword [0x43ac08], eax
pop ecx
pop ecx
cmp word [0x43abe0], si
je 0x4122e6
cmp dword [0x43abf0], esi
je 0x4122e6
mov esi, edi
push dword [ebp + 8]
mov al, byte [0x43abfc]
add word [0x43abd6], si
mov byte [0x43abca], al
push 0x37
call fcn.00415e1f
pop ecx
call eax
inc word [0x43abd2]
pop edi
pop ebx
movsx eax, word [0x43abde]
imul eax, dword [0x43abec]
inc word [0x43abd4]
mov dword [0x43abec], eax
movsx eax, byte [0x43abcb]
push 0xf9b9ffff
push eax
call fcn.0041181a
pop ecx
mov dword [0x43abf8], eax
mov eax, dword [ebp - 4]
pop ecx
pop esi
leave
ret 4