joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ab3
Capabilities:
Create process on windows
Get disk information
Self delete
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x34
cmp word [eax + 2], 0x3a
push ebx
jne 0x404c69
movzx ecx, word [eax + 4]
cmp cx, 0x5c
je 0x404adc
cmp cx, 0x2f
jne 0x404c69
mov ax, word [eax]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xc], 0x5c
mov word [ebp - 0xa], bx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x404b0c
push dword [ebp + 8]
jmp 0x404c6a
lea eax, [ebp - 0x28]
push str.7ZSfx_03x.cmd
push eax
call fcn.00404667
pop ecx
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x404c31
push esi
push edi
lea ecx, [ebp - 0x1c]
call fcn.00410f2d
push str.:Repeat_r_n
lea ecx, [ebp - 0x1c]
call fcn.004112ce
mov edi, str.del__
push edi
lea ecx, [ebp - 0x1c]
call fcn.00411326
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00410fd0
mov esi, 0x41a7d4
push esi
lea ecx, [ebp - 0x1c]
call fcn.00411326
push str.if_exist__
lea ecx, [ebp - 0x1c]
call fcn.00411326
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00410fd0
push str.__goto_Repeat_r_n
lea ecx, [ebp - 0x1c]
call fcn.00411326
push edi
lea ecx, [ebp - 0x1c]
call fcn.00411326
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00410fd0
push esi
lea ecx, [ebp - 0x1c]
call fcn.00411326
mov esi, dword [ebp - 0x18]
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00402d7b
mov eax, dword [eax]
add esp, 0xc
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x34]
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
cmp esi, ebx
pop esi
je 0x404c44
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jne 0x404c44
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push dword [ebp - 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x404c6f
push dword [ebp - 0x28]
call fcn.00402755
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
jmp 0x404c70
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
leave
ret
Function at 0x404cd7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
push ebx
push esi
push edi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.004180e0
call fcn.0040223d
push 3
call fcn.00402293
push 0x28
mov dword [0x41d748], eax
call fcn.00402293
push 2
mov dword [0x41d744], eax
call fcn.00402293
push 5
mov dword [0x41d740], eax
call fcn.00402293
push 0x15
mov dword [0x41d73c], eax
call fcn.00402293
push 0x16
mov dword [0x41d738], eax
call fcn.00402293
push 0x17
mov dword [0x41d734], eax
call fcn.00402293
add esp, 0x1c
xor ebx, ebx
mov dword [0x41d730], eax
mov dword [0x41d728], ebx
mov dword [0x41d72c], ebx
mov edi, 0x41d7c4
xor esi, esi
push esi
push ebx
lea eax, [ebp - 0x2a4]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x404e06
push ebx
lea eax, [ebp - 0x98]
push str.7zSfxFolder_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00410f2d
lea ecx, [ebp - 0xc]
call fcn.00410f2d
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.004112ce
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xc]
call fcn.004112ce
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.004037cf
cmp dword [esi + 0x41d394], ebx
jne 0x404df6
push dword [esi + 0x41d398]
lea ecx, [ebp - 0x18]
call fcn.004112ce
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xc]
call fcn.004112ce
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.004037cf
add esi, 8
cmp esi, 0x28
jb 0x404dc6
lea ecx, [ebp - 0x18]
call fcn.0040262e
inc ebx
cmp ebx, 0x40
jl 0x404d5d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406634
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.004065e7
add esp, 0x1c
leave
ret
Function at 0x407fa2
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
mov edi, 0x4b6
push edi
mov esi, ecx
call fcn.004069ec
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
inc eax
inc eax
push edi
mov ecx, esi
mov dword [esi + 0x58], eax
call fcn.00406a09
push 1
inc edi
push edi
mov ecx, esi
call fcn.00406a09
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
push 0x2b4
lea eax, [ebp - 0x4d0]
push eax
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4d0]
push edi
push dword [esi + 4]
mov dword [esi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x407052
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
mov dword [esi + 0x54], eax
call fcn.00407c71
mov ecx, esi
mov edi, eax
call fcn.00407669
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x41082a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410850
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x410850
xor al, al
jmp 0x410870
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00418610
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x4180e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x41da80], ecx
add edx, 1
cmp edx, 0x100
jb 0x4180e2
cmp edx, 0x800
jae 0x4181cb
mov edi, edi
mov eax, dword [edx*4 + 0x41d680]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x41da80]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x41da7c], eax
jb 0x4181a0
mov eax, 0x418930
mov dword [0x41da7c], eax
mov dword [0x41fa80], eax
mov dword [0x41da78], 0x418850
call fcn.00418400
test eax, eax
jne 0x4181f7
mov dword [0x41fa80], 0x418850
ret
Function at 0x10001c3c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x10001c86
push 0x12
push 0x4010173
push 6
call fcn.100025f6
add esp, 0xc
jmp 0x10001c8b
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10002f80
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10003012
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10003004
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x10002ffc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x10002fc5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x100036f0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100036fd
xor eax, eax
pop esi
ret
push esi
call dword [0x10a6c9c0]
add esp, 4
test eax, eax
jne 0x1000370d
pop esi
ret
cmp eax, 1
jne 0x1000371b
cmp byte [esi], 0x5c
jne 0x1000371b
xor eax, eax
pop esi
ret
push esi
call fcn.100034a0
add esp, 4
test eax, eax
je 0x1000372f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40618e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4061b2
xor eax, eax
test eax, eax
je 0x4061c4
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4061c4
xor ecx, ecx
jmp 0x4061c7
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406271
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4222c4], 0
push esi
jne 0x4062a8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406282
mov dword [ecx*4 + 0x4222c0], eax
inc ecx
cmp ecx, 0x100
jl 0x40627d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4062d9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4222c0]
xor eax, esi
inc ecx
dec edx
jne 0x4062bb
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b63a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub edi, 0x86f64b97
inc ebx
or ebx, ebx
call fcn.0043b66e
add ebx, edi
sub ebx, 0x5608b0d4
xor dword [ecx], eax
inc edi
and edi, ebx
inc ecx
and ebx, edi
sub edi, ebx
add ebx, 0xc5b2336c
cmp ecx, edx
jne fcn.0043b63a
mov edi, edi
ret
Function at 0xaca3c8
Capabilities:
Decompress data using aplib

Disassembly:
call 0xaca518
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaca3ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaca3da
add dl, dl
jne 0xaca3f9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaca44c
xor eax, eax
add dl, dl
jne 0xaca406
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaca4ed
add dl, dl
jne 0xaca415
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaca420
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaca42b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaca436
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaca442
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaca3e5
mov eax, 1
add dl, dl
jne 0xaca45a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaca465
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaca451
sub eax, ebx
mov ebx, 1
jne 0xaca498
mov ecx, 1
add dl, dl
jne 0xaca47e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaca489
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaca475
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaca3e5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaca4af
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaca4ba
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaca4a6
cmp eax, 0x7d00
jae 0xaca4dd
cmp eax, 0x500
jb 0xaca4d8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaca3e5
cmp eax, 0x7f
ja 0xaca4e0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaca3e5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaca50e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaca3e5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41a4738
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x41a47cf
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x41a47e8
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a47d6
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41b153c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41b159c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41b1586
push 3
push 0x41b15a8
push 0x41b15a8
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41b15ac
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b15a3
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41b4a20
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xffffffc0
mov eax, 0x41b4adc
mov dword [esp], eax
mov eax, 0x41b4afc
mov dword [esp + 4], eax
mov eax, 0x41b4b1c
mov dword [esp + 8], eax
mov eax, 0x41b4b3c
mov dword [esp + 0xc], eax
mov eax, 0x41b4b5c
mov dword [esp + 0x10], eax
mov eax, 0x41b4b7c
mov dword [esp + 0x14], eax
mov eax, 0x41b4b9c
mov dword [esp + 0x18], eax
mov eax, 0x41b4bc0
mov dword [esp + 0x1c], eax
mov eax, 0x41b4be4
mov dword [esp + 0x20], eax
mov eax, 0x41b4c04
mov dword [esp + 0x24], eax
mov eax, 0x41b4c24
mov dword [esp + 0x28], eax
mov eax, 0x41b4c44
mov dword [esp + 0x2c], eax
mov eax, 0x41b4c60
mov dword [esp + 0x30], eax
mov eax, 0x41b4c7c
mov dword [esp + 0x34], eax
mov eax, 0x41b4c9c
mov dword [esp + 0x38], eax
mov eax, 0x41b4cbc
mov dword [esp + 0x3c], eax
mov eax, esp
mov edx, 0xf
call fcn.041aac48
mov edx, 0x41b4ce0
mov eax, 0x41b6804
call fcn.041ab008
add esp, 0x40
ret
Function at 0x401770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0x10
test eax, eax
je 0x4017a5
lea ecx, [ebp - 4]
push ecx
push 0x419290
push 0
push 0
push 0x40c4d8
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x4017a5
cmp dword [ebp - 4], 0x10
je 0x4017b3
movaps xmm0, xmmword [0x40c2f0]
movaps xmmword [0x419290], xmm0
add esp, 4
pop ebp
ret

Function at 0x4017e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], 4
mov esi, 1
test eax, eax
je 0x40182e
lea ecx, [ebp - 8]
push ecx
push 0x4192a4
push 0
push 0
push str.PreviewPages
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x40182e
cmp dword [ebp - 8], 4
jne 0x40182e
mov eax, dword [0x4192a4]
test eax, eax
jle 0x40182e
mov esi, 2
cmp eax, 3
jb 0x401834
mov dword [0x4192a4], esi
add esp, 4
pop esi
pop ebp
ret
Function at 0x404100
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x38
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
push str.Options
call dbg.registry_get_handle
add esp, 4
test eax, eax
jne 0x404188
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], 0x2c
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowPlacement]
xor eax, eax
cmp dword [ebp - 0x34], 3
sete al
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExW]
push 0x10
push eax
push 3
push 0
push str.FrameRect
push dword [ebp - 8]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push 0
push str.Maximized
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dbg.registry_set_pagemargins
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
push str.Settings
call dbg.registry_get_handle
add esp, 4
test eax, eax
jne 0x4041b3
push dword [ebp - 8]
call dbg.registry_set_previewpages
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
add esp, 0x38
pop esi
pop ebp
ret

Function at 0x404350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x10
lea ecx, [ebp - 8]
xor edx, edx
push str.Options
call dbg.registry_get_handle
add esp, 4
test eax, eax
je 0x404384
test esi, esi
jne 0x4043ae
jmp 0x4043b8
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
push str.FrameRect
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0xc]
xor ecx, 0x10
or ecx, eax
sete al
test esi, esi
je 0x4043b8
test al, al
jne 0x4043b8
movaps xmm0, xmmword [0x40c560]
movups xmmword [esi], xmm0
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
add esp, 8
pop esi
pop ebp
ret

Function at 0x4043d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 8]
xor edx, edx
push str.Options
call dbg.registry_get_handle
add esp, 4
test eax, eax
je 0x404413
mov dword [esi], 0
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
add esp, 8
pop esi
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
push str.Maximized
push dword [ebp - 8]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x4043fe
cmp dword [ebp - 0xc], 4
je 0x404404
jmp 0x4043fe
Function at 0x404bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
mov edx, 0x40c61a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dbg.registry_read_formatopts
add esp, 8
mov ecx, 1
mov edx, 0x40c622
pop ebp
jmp dbg.registry_read_formatopts

Function at 0x404be0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, edx
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebx + ecx*4], 0
mov dword [edi + ecx*4], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push eax
call dbg.registry_get_handle
add esp, 4
test eax, eax
jne 0x404c94
lea ebx, [ebx + esi*4]
cmp dword [ebp - 0x14], 2
jne 0x404c46
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0
push str.BarState0
push dword [ebp - 0x18]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x404c4c
mov dword [ebx], 0xf
lea edi, [edi + esi*4]
cmp dword [ebp - 0x14], 2
jne 0x404c77
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push 0
push str.Wrap
push dword [ebp - 0x18]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x404c8b
test esi, esi
je 0x404c84
cmp esi, 1
jne 0x404c8b
xor eax, eax
jmp 0x404c89
mov eax, 1
mov dword [edi], eax
push dword [ebp - 0x18]
call dword [sym.imp.advapi32.dll_RegCloseKey]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x404ca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
push 0x40c61a
call dbg.registry_get_handle
add esp, 4
test eax, eax
jne 0x404cfe
mov ebx, dword [sym.imp.advapi32.dll_RegSetValueExW]
push 4
push edi
push 4
push 0
push str.BarState0
push dword [ebp - 0x10]
call ebx
push 4
push esi
push 4
push 0
push str.Wrap
push dword [ebp - 0x10]
call ebx
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
push 0x40c622
call dbg.registry_get_handle
add esp, 4
test eax, eax
jne 0x404d53
add edi, 4
mov ebx, dword [sym.imp.advapi32.dll_RegSetValueExW]
push 4
push edi
push 4
push 0
push str.BarState0
push dword [ebp - 0x10]
call ebx
add esi, 4
push 4
push esi
push 4
push 0
push str.Wrap
push dword [ebp - 0x10]
call ebx
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret