joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047f0
Capabilities:
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x204
push ebx
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x218]
stosw word es:[edi], ax
test esi, esi
stosb byte es:[edi], al
je 0x404960
mov ebp, dword [esp + 0x21c]
test ebp, ebp
je 0x404960
mov ebx, dword [esp + 0x220]
test ebx, ebx
je 0x404960
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4048b4
lea eax, [esp + 0x10]
push 0
push eax
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40488f
push esi
lea ecx, [esp + 0x18]
push 0x44ca18
push ecx
call fcn.00437eec
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404970
cmp dword [esp + 0x10], ebx
je 0x4048a8
push esi
lea edx, [esp + 0x18]
push 0x44ca18
push edx
call fcn.00437eec
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404970
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [edi - 2]
cmp ecx, 0x79
ja case.0x4048d7.7
xor edx, edx
mov dl, byte [ecx + 0x4049b8]
jmp dword [edx*4 + 0x4049a0]
cmp eax, 0xffffffff
je 0x4048fc
test al, 1
je 0x4048fc
push esi
push 0x44c9e0
lea eax, [esp + 0x1c]
push eax
call fcn.00437eec
add esp, 0xc
jmp 0x404970
push esi
lea ecx, [esp + 0x18]
push 0x44c9b4
push ecx
call fcn.00437eec
add esp, 0xc
jmp 0x404970
push esi
lea edx, [esp + 0x18]
push 0x44c978
push edx
call fcn.00437eec
add esp, 0xc
jmp 0x404970
push esi
push 0x44c950
jmp 0x4048ed
push esi
lea ecx, [esp + 0x18]
push 0x44c924
push ecx
call fcn.00437eec
add esp, 0xc
jmp 0x404970
push esi
lea edx, [esp + 0x18]
push 0x44c8f8
push edx
call fcn.00437eec
add esp, 0xc
jmp 0x404970
push esi
push 0x44c8c8
jmp 0x4048ed
mov ecx, 0xb
mov esi, 0x44c89c
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x14]
pop edi
pop esi
pop ebp
test al, al
pop ebx
je 0x404995
lea ecx, [esp + 4]
push ecx
push 0
call fcn.00401a60
add esp, 8
or eax, 0xffffffff
add esp, 0x204
ret
xor eax, eax
add esp, 0x204
ret
Function at 0x409720
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push ebp
push edi
push 0x44dd34
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov edi, eax
xor bl, bl
test edi, edi
je 0x409790
mov ebp, dword [esp + 0x10]
test ebp, ebp
jl 0x409790
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409790
push esi
push 0x5c
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
call dword [sym.imp.USER32.dll_EmptyClipboard]
test esi, esi
je 0x409783
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push ebp
call fcn.00408a00
add esp, 8
push esi
push edi
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp eax, esi
jne 0x409783
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
mov al, bl
pop ebp
pop ebx
ret
pop edi
mov al, bl
pop ebp
pop ebx
ret

Function at 0x4097a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push 0x44dd34
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov esi, eax
xor bl, bl
test esi, esi
je 0x409802
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409802
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x4097fc
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
push eax
test ecx, ecx
jl 0x4097f2
push ecx
call fcn.00408980
add esp, 8
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop esi
pop ebx
ret
call fcn.00408910
add esp, 4
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop esi
pop ebx
ret
Function at 0x40a470
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
push 0x197
push 0x284
push esi
push esi
call edi
push eax
call edi
push eax
call fcn.00437380
add esp, 0x10
push 0x44de50
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 2
push 0
push 0x14
push 0x41
push 0xd
push 0xc
push 0x44de20
push 0x44dad8
push esi
call fcn.00437490
push 0
push 0x210103
push 0xc8
push 0xfa
push 0x82
push 0xa
push 0x52
push 0
push 0x44dd08
push esi
call fcn.00437490
add esp, 0x50
push 0
push 0x410005
push 0xdc
push 0x124
push 0x268
push 0x2a
push 0xb
push 0
push 0x44dd24
push esi
call fcn.00437490
push 0
push 0x10001
push 1
push 0x17
push 0x50
push 0x15b
push 0xb
push 0x44dac8
push 0x44dac0
push esi
call fcn.00437490
add esp, 0x50
push 0
push 0x10000
push 2
push 0x17
push 0x50
push 0x15b
push 0x223
push 0x44dab8
push 0x44dac0
push esi
call fcn.00437490
add esp, 0x28
push 0xdc
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push 0x40a820
push 0xfffffffffffffffc
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x21
push 0
push 0x1036
push ebx
mov dword [0x45bf40], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x10], 0xf
xor ebp, ebp
mov edi, 0x43ff0c
mov eax, dword [edi - 4]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x24], ebp
push eax
push ebp
push 0x101b
push ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.USER32.dll_SendMessageA]
add edi, 0xc
inc ebp
cmp edi, 0x43ff60
jb 0x40a5a7
push esi
call fcn.0040a600
mov ecx, dword [esp + 0x3c]
push ecx
push esi
call fcn.0040a6c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x40abf0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
push 0xffffffffffffffeb
push edi
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
test esi, esi
je 0x40ac76
cmp dword [esi], 0
je 0x40ac76
lea eax, [esp + 0xc]
push 0x14
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esi + 0x10]
and ecx, 0xf0
cmp cl, 0x30
jne 0x40ac49
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.004078d0
mov eax, dword [esp + 0x10]
add esp, 8
jmp 0x40ac5a
lea ecx, [esp + 0xc]
push ecx
call fcn.0043863e
add esp, 4
mov dword [esp + 8], eax
mov ecx, dword [esi + 8]
cmp eax, ecx
jae 0x40ac67
mov eax, ecx
mov dword [esp + 8], eax
mov esi, dword [esi + 0xc]
cmp eax, esi
jbe 0x40ac7a
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x18
ret
Function at 0x40b690
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x20
lea eax, [esp]
push 0x20
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0x30]
test al, al
je 0x40b6c5
lea edx, [esp + 0x24]
lea eax, [esp]
push edx
push eax
call fcn.004078d0
mov eax, dword [esp + 0x2c]
add esp, 8
jmp 0x40b6d2
lea ecx, [esp]
push ecx
call fcn.0043863e
add esp, 4
mov edx, dword [esp + 0x28]
mov ecx, eax
cmp eax, edx
ja 0x40b6de
mov ecx, edx
push esi
mov esi, dword [esp + 0x30]
cmp ecx, esi
jae 0x40b6f2
cmp eax, edx
ja 0x40b6f4
mov eax, edx
pop esi
add esp, 0x20
ret
mov eax, esi
pop esi
add esp, 0x20
ret

Function at 0x40d220
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x493900]
push eax
call fcn.00413e20
add esp, 4
xor ecx, ecx
test eax, eax
jbe 0x40d24b
push ebx
mov dl, 1
mov bl, byte [ecx + 0x493916]
xor bl, dl
mov byte [ecx + 0x493916], bl
inc ecx
cmp ecx, eax
jb 0x40d237
pop ebx
ret

Function at 0x40ef00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push ebp
push edi
push 0x44e674
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov edi, eax
xor bl, bl
test edi, edi
je 0x40ef70
mov ebp, dword [esp + 0x10]
test ebp, ebp
jl 0x40ef70
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40ef70
push esi
push 0x48
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
call dword [sym.imp.USER32.dll_EmptyClipboard]
test esi, esi
je 0x40ef63
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push ebp
call fcn.0040ef80
add esp, 8
push esi
push edi
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp eax, esi
jne 0x40ef63
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
mov al, bl
pop ebp
pop ebx
ret
pop edi
mov al, bl
pop ebp
pop ebx
ret

Function at 0x40efc0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push 0x44e674
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov esi, eax
xor bl, bl
test esi, esi
je 0x40f022
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40f022
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x40f01c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
push eax
test ecx, ecx
jl 0x40f012
push ecx
call fcn.0040f090
add esp, 8
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop esi
pop ebx
ret
call fcn.0040f030
add esp, 4
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop esi
pop ebx
ret
Function at 0x4298f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, 0x484138
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x429966
mov edx, dword [0x485234]
test edx, edx
jne 0x429944
push edx
push 0x80
push 2
push edx
push 1
push 0x40000000
push 0x484138
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x429970
mov dword [0x485234], eax
call fcn.004382b6
mov edx, dword [0x485234]
add esp, 4
test edx, edx
je 0x429966
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 8]
push 0
push eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop edi
pop ecx
ret

Function at 0x429d20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x485300]
push esi
mov esi, dword [0x485308]
push edi
mov edi, dword [esp + 0x18]
xor eax, eax
cmp edi, ecx
setne al
xor ecx, ecx
test esi, esi
sete cl
or eax, ecx
je 0x429d6f
xor edx, edx
mov ecx, 0x485304
mov eax, edx
mov esi, 8
test al, 1
je 0x429d5c
shr eax, 1
xor eax, edi
jmp 0x429d5e
shr eax, 1
dec esi
jne 0x429d52
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x485704
jb 0x429d4b
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
cmp esi, 8
jb 0x429e67
xor edx, edx
sub esi, 8
mov dl, byte [ecx]
xor eax, edx
inc ecx
mov edx, eax
mov edi, eax
and edx, 0xff
shr edi, 8
mov eax, dword [edx*4 + 0x485304]
xor edx, edx
mov dl, byte [ecx]
xor eax, edi
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x485304]
xor edx, eax
xor eax, eax
mov al, byte [ecx]
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
shr edx, 8
mov eax, dword [eax*4 + 0x485304]
xor eax, edx
xor edx, edx
mov dl, byte [ecx]
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x485304]
xor edx, eax
xor eax, eax
mov al, byte [ecx]
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
shr edx, 8
mov eax, dword [eax*4 + 0x485304]
xor eax, edx
xor edx, edx
mov dl, byte [ecx]
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x485304]
xor edx, eax
xor eax, eax
mov al, byte [ecx]
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
shr edx, 8
mov eax, dword [eax*4 + 0x485304]
xor eax, edx
xor edx, edx
mov dl, byte [ecx]
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x485304]
xor eax, edx
cmp esi, 8
jae 0x429d84
test esi, esi
je 0x429e89
xor edx, edx
mov dl, byte [ecx]
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x485304]
xor eax, edx
dec esi
jne 0x429e6b
pop edi
pop esi
ret
Function at 0x42a090
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xb8
mov eax, dword [0x485710]
push ebx
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0xc4]
push esi
cmp eax, ecx
push edi
mov dword [esp + 0x10], ecx
jle 0x42a15b
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov eax, dword [0x485714]
mov ecx, dword [esp + 0x14]
add edx, 0xb4
push edx
push ebp
lea esi, [ecx + eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov edi, eax
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push 0x50
push eax
push edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esi]
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.0042a270
add esp, 8
cmp edx, ebx
jl 0x42a1b9
jg 0x42a122
cmp eax, dword [esp + 0x20]
jb 0x42a1b9
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
jg 0x42a1fb
jl 0x42a13a
cmp eax, dword [esp + 0x18]
ja 0x42a1fb
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov eax, dword [0x485710]
inc ecx
add esi, 0x28
cmp ecx, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
jl 0x42a0b8
xor esi, esi
test eax, eax
jle 0x42a1ac
xor ebx, ebx
mov eax, dword [0x485714]
lea ecx, [esi + 0xb4]
push ecx
push ebp
lea edi, [ebx + eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea edx, [esp + 0x28]
push 0x50
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [edi]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.0042a270
mov ecx, dword [edi + 0x20]
add esp, 8
inc esi
add ebx, 0x28
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [0x485710]
cmp esi, eax
jl 0x42a163
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb8
ret
mov eax, dword [esi]
mov ecx, dword [esp + 0x20]
push eax
push ebx
lea edx, [esp + 0x80]
push ecx
push edx
call fcn.00429eb0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x88]
push eax
push ecx
lea edx, [esp + 0x40]
push 0x454474
push edx
call fcn.00437eec
add esp, 0x20
lea eax, [esp + 0x28]
push 0x30
push 0x454460
push eax
jmp 0x42a23b
mov edx, dword [esi]
mov eax, dword [esp + 0x18]
push edx
push ecx
lea ecx, [esp + 0x80]
push eax
push ecx
call fcn.00429eb0
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x88]
push edx
push eax
lea ecx, [esp + 0x40]
push 0x45442c
push ecx
call fcn.00437eec
add esp, 0x20
lea edx, [esp + 0x28]
push 0x30
push 0x454460
push edx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push 0
push 0xb1
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xb8
ret
Function at 0x42a4e0
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
push ebx
call fcn.0042eed0
mov edi, dword [esp + 0x14]
add esp, 4
mov esi, eax
push 0xfffffffffffffff4
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, dword [0x485710]
sub eax, 0xb4
cmp eax, ecx
jae 0x42a595
mov ecx, dword [0x485714]
test esi, esi
jl 0x42a528
lea edx, [eax + eax*4]
push ebp
mov ebp, dword [ecx + edx*8]
cmp esi, ebp
pop ebp
jl 0x42a56b
cmp bl, 0x2d
jne 0x42a588
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8 + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
jg 0x42a588
jl 0x42a542
cmp dword [eax], 0
jae 0x42a588
push 0
push 0
push 0xb0
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
test al, al
jne 0x42a588
lea ecx, [esp + 0x18]
push 2
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [esp + 0x18], 0x2d
je 0x42a588
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x48570c]
push edx
push ebx
push eax
push edi
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcA]
pop edi
pop esi
pop ebx
ret
push 0x64
push 0x1b8
call dword [sym.imp.KERNEL32.dll_Beep]
pop edi
pop esi
pop ebx
ret

Function at 0x42e450
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
lea eax, [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x20]
push eax
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea edx, [ecx*4 + 0x485fa8]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, edi
xor eax, eax
shl esi, 6
add esi, edi
shl esi, 4
add esi, edi
shl esi, 2
mov ecx, dword [esi + 0x486970]
test ecx, ecx
jle 0x42e4e8
push ebx
push ebp
lea ebp, [esi + 0x486974]
lea ebx, [eax + 1]
lea eax, [esp + 0x10]
push ebx
push 0x454ac8
push eax
call fcn.00437eec
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x28]
not ecx
dec ecx
push ecx
push ebp
push 1
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esi + 0x486970]
mov eax, ebx
add ebp, 0x104
cmp eax, ecx
jl 0x42e49d
pop ebp
pop ebx
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x14
ret
Function at 0x42e590
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x124
mov ecx, dword [esp + 0x134]
mov edx, dword [esp + 0x138]
push ebx
mov ebx, dword [esp + 0x12c]
push esi
push ebx
mov dword [ebx*4 + 0x485f94], eax
lea eax, [ebx + ebx*4]
mov dword [ebx*4 + 0x48bad8], ecx
mov dword [ebx*4 + 0x485f80], edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [eax*4 + 0x485fa8]
mov eax, dword [esp + 0x138]
push eax
push 0x454ad0
push esi
call fcn.00437eec
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [ebx*4 + 0x485f94]
xor eax, eax
test ecx, ecx
jle 0x42e6b7
push ebp
push edi
lea ebp, [eax + 1]
lea edx, [esp + 0x1c]
push ebp
push 0x454ac8
push edx
mov dword [esp + 0x1c], 0x104
call fcn.00437eec
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42e6a4
mov edx, ebx
lea edi, [esp + 0x30]
shl edx, 6
add edx, ebx
shl edx, 4
add edx, ebx
shl edx, 2
mov eax, dword [edx + 0x486970]
mov ecx, eax
shl ecx, 6
add ecx, eax
xor eax, eax
lea esi, [edx + ecx*4 + 0x486974]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
inc dword [edx + 0x486970]
mov ecx, dword [ebx*4 + 0x485f94]
mov eax, ebp
cmp eax, ecx
jl 0x42e611
pop edi
pop ebp
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0042e1b0
add esp, 4
pop esi
pop ebx
add esp, 0x124
ret

Function at 0x42e800
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x200
push esi
mov esi, dword [esp + 0x20c]
test esi, esi
je 0x42e8b3
cmp byte [esi], 0
je 0x42e8b3
push ebx
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42e8a8
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp edi, 5
pop edi
je 0x42e863
push esi
lea eax, [esp + 0xc]
push 0x454b98
push eax
jmp 0x42e884
cmp eax, 0xffffffff
je 0x42e879
test al, 1
je 0x42e879
push esi
lea ecx, [esp + 0xc]
push 0x454b60
push ecx
jmp 0x42e884
push esi
lea edx, [esp + 0xc]
push 0x454b38
push edx
call fcn.00437eec
add esp, 0xc
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x210]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 8]
push ecx
push edx
call fcn.0042e790
add esp, 0xc
mov eax, ebx
pop ebx
pop esi
add esp, 0x200
ret
mov eax, dword [esp + 0x208]
push 0x454b10
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 8]
push ecx
push edx
call fcn.0042e790
add esp, 0xc
or eax, 0xffffffff
pop esi
add esp, 0x200
ret
Function at 0x42e910
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x42e95c
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e940
mov ecx, dword [esp + 8]
mov eax, dword [esi + 0xc]
cmp ecx, eax
je 0x42e955
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 8]
push 0x454bb4
push edx
push eax
call fcn.0042e790
add esp, 0xc
mov dword [esi + 0xc], 0
pop esi
ret
Function at 0x42fd90
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x204
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x210]
test eax, eax
je 0x42fdc1
push eax
call fcn.0042ef30
add esp, 4
mov eax, dword [0x48baf4]
test eax, eax
je 0x42ff64
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42fead
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.0042f120
add esp, 4
test al, al
je 0x42fe88
mov edx, dword [0x48bb04]
lea ecx, [esp + 8]
push 0
push ecx
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42fe4b
mov eax, dword [0x48baf4]
lea ecx, [esp + 0xc]
push eax
push 0x454e7c
push ecx
call fcn.00437eec
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42ff74
cmp dword [esp + 8], edi
je 0x42fe76
mov edx, dword [0x48baf4]
lea eax, [esp + 0xc]
push edx
push 0x454e7c
push eax
call fcn.00437eec
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42ff74
push esi
mov dword [0x48bafc], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42ff74
mov ecx, dword [0x48baf4]
lea edx, [esp + 0xc]
push ecx
push 0x454e3c
push edx
call fcn.00437eec
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42ff74
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x79
ja case.0x42fec7.7
xor ecx, ecx
mov cl, byte [eax + 0x42ffc4]
jmp dword [ecx*4 + 0x42ffac]
mov edx, dword [0x48baf4]
push edx
push 0x454e08
lea eax, [esp + 0x14]
push eax
call fcn.00437eec
add esp, 0xc
jmp 0x42ff74
mov ecx, dword [0x48baf4]
lea edx, [esp + 0xc]
push ecx
push 0x454dc4
push edx
call fcn.00437eec
add esp, 0xc
jmp 0x42ff74
mov eax, dword [0x48baf4]
lea ecx, [esp + 0xc]
push eax
push 0x454d94
push ecx
call fcn.00437eec
add esp, 0xc
jmp 0x42ff74
mov edx, dword [0x48baf4]
push edx
push 0x454d60
jmp 0x42feda
mov ecx, dword [0x48baf4]
lea edx, [esp + 0xc]
push ecx
push 0x454d2c
push edx
call fcn.00437eec
add esp, 0xc
jmp 0x42ff74
mov eax, dword [0x48baf4]
lea ecx, [esp + 0xc]
push eax
push 0x454cf4
push ecx
call fcn.00437eec
add esp, 0xc
jmp 0x42ff74
mov ecx, 0xd
mov esi, 0x454cc0
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0xc]
pop edi
test al, al
pop esi
je 0x42ffa0
call fcn.0042efa0
push 0
call fcn.0042ef30
lea edx, [esp + 8]
push edx
call fcn.00422370
add esp, 8
xor al, al
add esp, 0x204
ret
mov al, 1
add esp, 0x204
ret