joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
lea ecx, [esp + 8]
push esi
push edi
mov esi, 1
mov edi, dword [esp + 0x1c]
push ebp
mov ebx, dword [esp + 0x1c]
push eax
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
push 0
push edi
push ebx
call ebp
test eax, eax
jne 0x401d67
cmp dword [esp + 0x10], 0x400
jbe 0x401c82
xor eax, eax
pop ebp
mov dword [0x40e1c8], 0
pop edi
pop esi
pop ebx
add esp, 8
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push 0x40ddc0
push ecx
push 0
push edi
push ebx
call ebp
test eax, eax
jne 0x401d67
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x401cc0
cmp eax, 3
jl 0x401d8d
cmp eax, 4
jle 0x401d30
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
push 0x40fb78
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401ce7
push 0x401
push 0x40ddc0
push 0x40ddc0
call fcn.0040b700
add esp, 0xc
cmp dword [esp + 0x28], 0
je 0x401d00
push 0x400
push 0x40ddc0
call fcn.00402e30
add esp, 8
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push eax
push 0x40ddc0
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esi, eax
test esi, esi
jne 0x401d8d
mov eax, esi
pop ebp
mov dword [0x40e1c4], 0
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
push eax
push ecx
push 0x40ddc0
push edi
push edx
call fcn.00401da0
add esp, 0x14
mov esi, eax
test esi, esi
jne 0x401d8d
mov eax, esi
pop ebp
mov dword [0x40e1c4], 0
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push eax
push 0x410328
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esi, eax
test esi, esi
jne 0x401d8d
mov dword [0x40e1c4], 0
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x401f00
Capabilities:
Read .ini file
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0xc
test eax, eax
push ebx
push esi
push edi
push ebp
mov esi, 1
jle 0x4020c8
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [esp + 0x10]
mov ecx, dword [edi]
mov edx, dword [esp + 0x20]
push eax
push 2
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401f7f
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
mov edx, dword [edi]
mov eax, dword [esp + 0x2c]
push 2
push 0
push 0x410328
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x401f7f
xor esi, esi
jmp 0x4020bb
mov eax, dword [edi + 4]
cmp eax, 1
je 0x402003
cmp eax, 2
jl 0x4020b0
cmp eax, 3
jg 0x4020b0
xor ebx, ebx
cmp dword [edi + 0x10], ebx
jle 0x401ff9
xor ebp, ebp
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + ebp + 0xc]
cmp dword [ecx*4 + 0x40e410], 0
je 0x401ff0
mov eax, dword [esp + 0x30]
mov ecx, dword [edi]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, dword [edi + 0xc]
add ecx, ebp
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
push eax
push edx
mov eax, dword [ecx + 4]
mov edx, dword [esp + 0x24]
push eax
mov ecx, dword [ecx]
push ecx
push edx
call fcn.004020e0
add esp, 0x20
test esi, esi
je 0x401fee
mov esi, 1
test eax, eax
jne 0x401ff0
xor esi, esi
add ebp, 0x10
inc ebx
cmp dword [edi + 0x10], ebx
jg 0x401fa2
cmp dword [edi + 4], 2
je 0x4020b0
mov eax, dword [edi + 0x14]
cmp dword [eax*4 + 0x40e410], 0
je 0x4020b0
mov eax, dword [esp + 0x2c]
mov ecx, dword [edi]
push eax
push 0x400
push 0x40ddc0
push 0x410328
push str.DefaultValue
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [edi + 8], 0
je 0x40206b
push 0x400
push 0x40ddc0
call fcn.00402ed0
add esp, 8
push 1
push 0x40ddc0
call fcn.00402f80
add esp, 8
cmp eax, 3
jne 0x40206b
mov byte [0x40ddc0], 0
xor esi, esi
cmp byte [0x40ddc0], 0
jne 0x40207b
cmp dword [esp + 0x30], 0
je 0x4020b0
push 0x40ddc0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, dword [esp + 0x10]
push eax
push 0x40ddc0
push 1
push 0
push 0x410328
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x4020ae
mov esi, 1
test eax, eax
je 0x4020b0
xor esi, esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 0x18
dec dword [esp + 0x14]
jne 0x401f20
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4020e0
Capabilities:
Read .ini file
Set registry value

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x80
push ebx
push esi
push edi
mov esi, 1
mov edi, dword [esp + 0x94]
push ebp
mov ecx, dword [esp + 0xac]
push eax
push 0x400
push 0x40ddc0
push 0x410328
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, dword [esp + 0xb0]
test ebp, ebp
jne 0x40213a
cmp byte [0x40ddc0], 0
jne 0x40213a
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x80
ret
mov eax, dword [esp + 0x9c]
cmp eax, 1
je 0x40215d
cmp eax, 3
jl 0x402317
cmp eax, 4
jle 0x4022fe
jmp 0x402317
cmp dword [esp + 0xa0], 0
je 0x402196
push 0x400
push 0x40ddc0
call fcn.00402ed0
add esp, 8
push 1
push 0x40ddc0
call fcn.00402f80
add esp, 8
cmp eax, 3
jne 0x402196
mov byte [0x40ddc0], 0
xor esi, esi
push 0x40fb78
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edi
call ebx
test eax, eax
jne 0x4022a9
mov eax, 0x40ddc0
test eax, eax
je 0x4022a9
cmp byte [0x40ddc0], 0
je 0x4022a9
push str..bmp
push eax
call fcn.0040a990
add esp, 4
push eax
call ebx
test eax, eax
je 0x4022a9
push str..dib
push 0x40ddc0
call fcn.0040a990
add esp, 4
push eax
call ebx
test eax, eax
je 0x4022a9
push str..rle
push 0x40ddc0
call fcn.0040a990
add esp, 4
push eax
call ebx
test eax, eax
je 0x4022a9
mov eax, dword [0x4104c0]
test eax, eax
je 0x402235
push eax
call fcn.0040b990
mov dword [0x4104c0], 0
add esp, 4
mov eax, dword [esp + 0xa8]
push 0
push eax
push 0x40ddc0
call fcn.00409a60
add esp, 0xc
mov dword [0x4104c0], eax
test eax, eax
je 0x40228a
lea eax, [esp + 0x10]
push eax
call fcn.00409920
add esp, 4
test esi, esi
je 0x40228a
lea eax, [esp + 0x10]
push 0x40ddc0
push eax
mov ecx, dword [0x4104c0]
push ecx
call fcn.0040b500
add esp, 0xc
test eax, eax
je 0x40228a
mov esi, 1
jmp 0x40228c
xor esi, esi
test esi, esi
je 0x4022a2
lea eax, [esp + 0x10]
push eax
push 0x40ddc0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4022a9
mov byte [0x40ddc0], 0
test ebp, ebp
jne 0x4022c6
cmp byte [0x40ddc0], 0
jne 0x4022c6
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x80
ret
push 0x40ddc0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, dword [esp + 0x94]
push eax
push 0x40ddc0
push 1
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x4022fa
test eax, eax
jne 0x4022fa
mov esi, 1
jmp 0x402317
xor esi, esi
jmp 0x402317
push 0x40ddc0
push eax
mov eax, dword [esp + 0x9c]
push edi
push eax
call fcn.00402330
add esp, 0x10
mov esi, eax
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x80
ret

Function at 0x402330
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x10]
push eax
call fcn.00402370
mov ecx, dword [esp + 0xc]
add esp, 4
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push 0x40ddc0
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 1
sbb eax, eax
neg eax
ret
Function at 0x402460
Capabilities:
Read .ini file
Set registry value

Disassembly:
sub esp, 4
cmp dword [0x40e420], 0
push ebx
push esi
push edi
jne 0x40247b
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 4
ret
push 0x7f02
mov ebx, dword [sym.imp.USER32.dll_LoadCursorA]
push 0
call ebx
push eax
mov esi, dword [sym.imp.USER32.dll_SetCursor]
call esi
lea eax, [esp + 0xc]
mov ecx, dword [0x40f0b0]
push eax
push 2
push 0
push ecx
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4024bb
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
push 0x7f02
push 0
call ebx
push eax
call esi
cmp dword [esp + 0x14], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x400
push 0x40ddc0
mov eax, 0x40fcbc
push 0x410328
jne 0x4024f2
mov eax, 0x40fcb4
push eax
mov eax, dword [0x40f0b0]
push eax
call ecx
push 0x400
push 0x40ddc0
call fcn.00402ed0
add esp, 8
push 1
push 0x40ddc0
call fcn.00402f80
add esp, 8
cmp eax, 3
jne 0x402528
mov byte [0x40ddc0], 0
cmp byte [0x40ddc0], 0
jne 0x402545
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 4
ret
push 0x7f02
push 0
call ebx
push eax
call esi
push 0x40ddc0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, dword [esp + 0xc]
push eax
push 0x40ddc0
push 1
push 0
push 0x410328
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push 0x7f02
push 0
call ebx
push eax
call esi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 1
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 4
ret
Function at 0x402a30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
mov ecx, dword [esp + 0x18]
push esi
push edi
mov esi, 1
mov edx, dword [esp + 0x1c]
push eax
push esi
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402a60
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
mov ebx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x10]
push 0
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push ebx
push eax
call edi
test eax, eax
jne 0x402ab5
cmp dword [esp + 0x10], 0x400
jbe 0x402a98
xor esi, esi
mov dword [0x40e1c8], esi
jmp 0x402ab7
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push ecx
push edx
push 0
push ebx
push eax
call edi
test eax, eax
je 0x402ab7
xor esi, esi
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x402b40
Capabilities:
Read .ini file
Set registry value

Disassembly:
sub esp, 0x70
mov dword [esp], 1
push ebx
push esi
push edi
push ebp
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 2
push 0
push 0x410328
push 0
push 0x40f458
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402b98
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x70
ret
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
push 0x40e9e0
mov eax, dword [edi + 0x40f4d8]
push 0x400
push 0x40ddc0
push 0x410328
push eax
push 0x40f458
call esi
cmp byte [0x40ddc0], bl
jne 0x402be1
mov eax, dword [edi + 0x40f540]
push eax
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x402c19
push 0x40ddc0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, dword [edi + 0x40f4d8]
mov edx, dword [esp + 0x14]
push eax
push 0x40ddc0
push 1
push ebx
push ecx
push edx
call ebp
test eax, eax
je 0x402c0c
mov dword [esp + 0x10], ebx
push 0x40ddc0
call fcn.00402c50
add esp, 4
mov dword [esp + edi + 0x1c], eax
add edi, 4
cmp edi, 0x64
jl 0x402ba8
lea eax, [esp + 0x1c]
push eax
push 0x40f540
push 0x19
call dword [sym.imp.USER32.dll_SetSysColors]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x70
ret
Function at 0x403250
Capabilities:
Get disk size

Disassembly:
sub esp, 0x568
push ebx
push esi
push edi
push ebp
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 8
push esi
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call ebp
mov dword [esp + 0x20], eax
push 0xa
push esi
call ebp
mov dword [esp + 0x24], eax
push 0xe
push esi
call ebp
mov dword [esp + 0x28], eax
push 0xc
push esi
mov edi, 3
call ebp
mov ebx, eax
push 0x26
push esi
call ebp
imul ebx, dword [esp + 0x28]
test ah, 1
je 0x4032a7
push 0x68
push esi
call ebp
mov edi, eax
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
imul ebx, dword [esp + 0x24]
imul ebx, dword [esp + 0x20]
shr ebx, 3
lea eax, [esp + 0x170]
push eax
call fcn.00409920
lea eax, [esp + 0x34]
lea ecx, [esp + 0x174]
lea esi, [ebx + edi*4 + 0x20036]
add esp, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40330b
cmp dword [esp + 0x4c], 0
jne 0x403304
cmp dword [esp + 0x50], esi
jae 0x4032ff
sub esi, dword [esp + 0x50]
jmp 0x403304
mov esi, 0x20000
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, byte [esp + 0x170]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x10], bl
push ecx
lea edx, [esp + 0x1c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x20]
push edx
lea edx, [esp + 0x18]
push eax
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x403355
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x568
ret
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x18]
imul eax, dword [esp + 0x14]
cmp eax, esi
jae 0x4033db
cmp dword [esp + 0x580], 0
je 0x4033ce
shr esi, 0xa
push 0x200
lea eax, [esp + 0x174]
mov ecx, dword [0x40e1d0]
push eax
mov ebp, dword [sym.imp.USER32.dll_LoadStringA]
push 0x15
push ecx
call ebp
lea ecx, [esp + 0x170]
lea edx, [esp + 0x374]
movsx eax, bl
push eax
push esi
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x388]
mov edx, dword [esp + 0x590]
add esp, 0x14
push 0x10
push 0x40e430
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x568
ret
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x568
ret
Function at 0x406420
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ebp, ebp
mov edi, dword [esp + 0x14]
cmp byte [edi], 0
je 0x40647a
cmp dword [0x40e424], 0
je 0x40647a
push edi
mov eax, dword [ebx + 0x40f4d8]
push 0x400
push 0x40ddc0
push 0x410328
push eax
push 0x410330
call esi
push 0x40ddc0
call fcn.00402c50
add esp, 4
mov ecx, dword [ebx + 0x40f540]
mov dword [ecx*4 + 0x40d3c0], eax
jmp 0x406487
push ebp
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebx + 0x40d3c0], eax
add ebx, 4
inc ebp
cmp ebx, 0x64
jl 0x406432
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x407750
Capabilities:
Read .ini file
Set registry value

Disassembly:
sub esp, 0x9c
push ebx
push esi
lea eax, [esp + 0xc]
push edi
push ebp
push 0
mov ebp, 0x4c
push eax
mov dword [esp + 0x1c], ebp
push ebp
push 0x2d
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0x40e9e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x400
push 0x40ddc0
push 0x410328
push str.IconMetrics
push str.Metrics
call ebx
cmp byte [0x40ddc0], 0
je 0x40780d
push 0x40ddc0
mov esi, 0x40ddc0
call fcn.00402370
lea edi, [esp + 0x64]
add esp, 4
mov ecx, 0x13
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0xb0]
test ebp, ebp
je 0x4077e1
mov eax, dword [0x40ddc4]
mov ecx, dword [0x40ddc8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0xb4], 0
je 0x4077fa
lea esi, [esp + 0x70]
lea edi, [esp + 0x24]
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x14]
push 1
push eax
push 0x4c
push 0x2e
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x407814
mov ebp, dword [esp + 0xb0]
test ebp, ebp
je 0x4078f2
lea eax, [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 2
push 0
push str.Control_PanelDesktopWindowMetrics
push Ordinal_2
call ebp
test eax, eax
jne 0x4078f2
push 0x40e9e0
push 0x400
push 0x40ddc0
push 0x410328
push str.Shell_Icon_Size
push str.Control_PanelDesktopWindowMetrics
call ebx
cmp byte [0x40ddc0], 0
je 0x407894
push 0x40ddc0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
inc eax
mov ecx, dword [esp + 0x10]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x40ddc0
push 1
push 0
push str.Shell_Icon_Size
push ecx
call esi
jmp 0x4078a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x40e9e0
push 0x400
push 0x40ddc0
push 0x410328
push str.Shell_Small_Icon_Size
push str.Control_PanelDesktopWindowMetrics
call ebx
cmp byte [0x40ddc0], 0
je 0x4078e7
push 0x40ddc0
call edi
inc eax
mov ecx, dword [esp + 0x10]
push eax
push 0x40ddc0
push 1
push 0
push str.Shell_Small_Icon_Size
push ecx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x9c
ret
Function at 0x407900
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x2a8
lea eax, [esp]
push ebx
mov dword [esp + 4], 0x154
push esi
push edi
push ebp
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
push eax
push 0x154
push 0x29
call ebx
push 0x40e9e0
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x400
push 0x40ddc0
push 0x410328
push str.NonclientMetrics
push str.Metrics
call ebp
cmp byte [0x40ddc0], 0
je 0x407b0c
push 0x40ddc0
mov esi, 0x40ddc0
call fcn.00402370
lea edi, [esp + 0x168]
add esp, 4
mov ecx, 0x55
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], 0x154
cmp dword [esp + 0x2bc], 0
je 0x407a09
lea eax, [esp + 0x17c]
push 1
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00407b20
lea ecx, [esp + 0x1cc]
lea edx, [esp + 0x78]
add esp, 0xc
push 1
push ecx
push edx
call fcn.00407b20
lea ecx, [esp + 0x210]
lea edx, [esp + 0xbc]
add esp, 0xc
push 1
push ecx
push edx
call fcn.00407b20
lea ecx, [esp + 0x24c]
lea edx, [esp + 0xf8]
add esp, 0xc
push 1
push ecx
push edx
call fcn.00407b20
lea ecx, [esp + 0x288]
lea edx, [esp + 0x134]
add esp, 0xc
push 1
push ecx
push edx
call fcn.00407b20
add esp, 0xc
cmp dword [esp + 0x2c0], 0
je 0x407afc
lea eax, [esp + 0x17c]
push 2
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00407b20
lea ecx, [esp + 0x1cc]
lea edx, [esp + 0x78]
add esp, 0xc
push 2
push ecx
push edx
call fcn.00407b20
lea ecx, [esp + 0x210]
lea edx, [esp + 0xbc]
add esp, 0xc
push 2
push ecx
push edx
call fcn.00407b20
lea ecx, [esp + 0x24c]
lea edx, [esp + 0xf8]
add esp, 0xc
push 2
push ecx
push edx
call fcn.00407b20
lea ecx, [esp + 0x288]
lea edx, [esp + 0x134]
add esp, 0xc
push 2
push ecx
push edx
call fcn.00407b20
mov ecx, dword [esp + 0x174]
mov edx, dword [esp + 0x178]
mov eax, dword [esp + 0x17c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x180]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x184]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c4]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x1c8]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x208]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x20c]
mov dword [esp + 0x74], ecx
mov dword [esp + 0xb4], edx
mov dword [esp + 0xb8], eax
add esp, 0xc
lea eax, [esp + 0x10]
push 1
push eax
push 0x154
push 0x2a
call ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2a8
ret
Function at 0x408150
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x140
push ebx
push esi
push edi
push ebp
push 0x64
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0x40e8d0
push 0x40e5c0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
push 0x410468
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40e5c0
call ebx
push 0x40e500
push 0x40e5c0
call ebx
lea eax, [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
push 0x40e5c0
call ebp
cmp eax, 0xffffffff
mov ebp, eax
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
je 0x408212
lea eax, [esp + 0x3c]
push eax
push 0x40e5c0
call edi
push 0x40e5c0
call fcn.004057d0
add esp, 4
push 0x40e5c0
push 0
push 0x143
push esi
call ebx
cmp eax, 0xfffffffe
je 0x4081fe
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4081b8
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x408212
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x140
ret
push 0x40e1e0
push 0
push 0x14a
push esi
call ebx
cmp eax, 0xfffffffe
jne 0x408233
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x140
ret
cmp dword [0x41035c], 0
je 0x40825d
push 0x40e4a0
push 1
push 0x14a
push esi
call ebx
cmp eax, 0xfffffffe
jne 0x40825d
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x140
ret
push 0x40ecb0
push 0xffffffffffffffff
push 0x14a
push esi
call ebx
cmp eax, 0xfffffffe
jne 0x40827e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x140
ret
cmp byte [0x40e9e0], 0
je 0x4082a0
push 0x40ed70
push 0xffffffffffffffff
push 0x158
push esi
call ebx
mov dword [0x40ed64], eax
cmp eax, 0xffffffff
jne 0x4082c2
mov dword [0x40ed64], 0
push 0x410328
push 0x40e9e0
call edi
push 0x40e1e0
push 0x40ed70
call edi
push 0
mov eax, dword [0x40ed64]
push eax
push 0x14e
push esi
call ebx
call fcn.00409440
call fcn.00401110
push 0
push 0
push 0x146
push esi
call ebx
pop ebp
mov dword [0x40e234], eax
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x140
ret
Function at 0x409560
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
cmp byte [0x40e9e0], 0
mov dword [esp], 0
je 0x4095ac
lea eax, [esp + 4]
push 0x40e9e0
push 0x200
push eax
push 0x410328
push str.SCRNSAVE.EXE
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 4], 0
je 0x4095bd
mov dword [esp], 1
jmp 0x4095bd
lea eax, [esp]
push 0
push eax
push 0
push 0x10
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp]
mov ecx, dword [0x40e488]
push eax
push 0xc8
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
add esp, 0x208
ret

Function at 0x409810
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [eax]
cmp al, 0x22
jne 0x409836
mov al, byte [esi + 1]
inc esi
test al, al
je 0x40982e
cmp al, 0x22
jne 0x409822
cmp byte [esi], 0x22
jne 0x409840
inc esi
jmp 0x409840
cmp al, 0x20
jle 0x409840
inc esi
cmp byte [esi], 0x20
jg 0x40983a
cmp byte [esi], 0
je 0x409850
cmp byte [esi], 0x20
jg 0x409850
inc esi
cmp byte [esi], 0
jne 0x409845
mov dword [esp + 0x30], 0
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x30], 1
mov eax, 0xa
je 0x409878
mov eax, dword [esp + 0x34]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]