joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d4c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x435
push ecx
mov dword [ebp - 8], 0x200
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov edx, 2
lea edi, [eax + 1]
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047d547
add esp, 4
mov dword [ebp - 0xc], eax
mov esi, eax
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, esi
movzx eax, word [ecx]
mov ecx, eax
test ax, ax
je 0x40d61c
mov edi, dword [ebp + 8]
nop dword [eax]
movzx eax, cx
xor ecx, ecx
cmp cx, ax
jae 0x40d554
nop word [eax + eax]
cmp ax, 0x20
ja 0x40d554
movzx eax, word [esi + 2]
add esi, 2
xor ecx, ecx
cmp cx, ax
jb 0x40d540
movzx eax, word [esi]
mov ecx, eax
test ax, ax
je 0x40d61c
cmp ecx, 0x30
jne 0x40d580
movzx eax, word [esi + 2]
mov edx, eax
cmp eax, 0x78
je 0x40d579
mov eax, ecx
cmp edx, 0x58
jne 0x40d580
movzx eax, word [esi + 4]
add esi, 4
movzx eax, ax
push eax
call fcn.004851e0
add esp, 4
test eax, eax
je 0x40d615
movzx eax, word [esi]
push eax
call fcn.00485b8e
mov ebx, eax
mov ecx, 5
add esi, 2
lea eax, [ebx - 0x41]
cmp ecx, eax
sbb eax, eax
and eax, 0xfffffff9
add eax, 0x37
sub ebx, eax
movzx eax, word [esi]
push eax
call fcn.004851e0
add esp, 8
test eax, eax
je 0x40d5ea
movzx eax, word [esi]
push eax
shl ebx, 4
call fcn.00485b8e
add ebx, eax
add esp, 4
add eax, 0xffffffbf
add esi, 2
cmp eax, 5
ja 0x40d5e7
add ebx, 0xffffffc9
jmp 0x40d5ea
add ebx, 0xffffffd0
cmp word [esi], 0x20
ja 0x40d615
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40d615
mov eax, dword [ebp - 4]
dec ecx
mov dword [ebp - 8], ecx
mov byte [eax + edi], bl
inc eax
mov dword [ebp - 4], eax
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x40d530
jmp 0x40d61c
mov dword [ebp - 4], 0
push dword [ebp - 0xc]
call fcn.00457d30
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dca0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov dword [ebp + 8], ebx
je 0x40dcc3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [eax + 4]
xor edx, edx
mov ecx, ebx
push 0
call fcn.004171f0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40deb3
push 0x4b47c8
push 0
lea ecx, [edi + 0x18]
call fcn.00416700
mov esi, dword [ebp + 0xc]
add esp, 8
mov dword [edi + 0x23c], 0x1100
cmp esi, 0x9c49
je 0x40dd17
cmp esi, 0x9c4a
je 0x40dd17
cmp esi, 0x9c4c
jne 0x40dd21
mov dword [edi + 0x23c], 0x1900
push edi
push 0x4367c0
mov edx, 0xaf
mov dword [edi + 0x244], 0xaf
mov ecx, ebx
call fcn.00416140
mov ebx, dword [edi + 0x10]
lea eax, [edi + 0x10]
add esp, 8
cmp ebx, eax
je 0x40dea5
sub esi, 0x9c49
je 0x40de18
sub esi, 1
je 0x40ddaf
sub esi, 2
jne 0x40de92
push 0x38
lea eax, [ebp - 0x78]
mov dword [ebp - 0x7c], 0x3c
push esi
push eax
call fcn.0047ee20
mov eax, dword [ebx + 0x1c]
add esp, 0xc
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0x4b4bd8
mov dword [ebp - 0x60], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40de92
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40de92
mov esi, dword [ebx + 0x1c]
mov ecx, esi
call fcn.00419300
test eax, eax
je 0x40dde7
push 0x4a6dac
push eax
call fcn.004809a5
add esp, 8
test eax, eax
jne 0x40dde7
mov eax, dword [ebp + 8]
push 0x1a0
push 1
push eax
call fcn.0047aec0
add esp, 0xc
jmp 0x40de92
push 0x4b5278
push str.OpenAs_RunDLLW
push str.Shell32.dll
call fcn.004788b0
test eax, eax
jne 0x40de92
mov eax, dword [ebp + 8]
push 1
push esi
push dword [0x4b3a24]
push eax
call dword [0x4b5278]
jmp 0x40de92
mov eax, dword [ebx + 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x3c], 0x400
mov dword [ebp - 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40de92
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x483
jne 0x40de92
lea eax, [ebp - 0x40]
mov dword [ebp - 0x34], str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40de92
call esi
test ebx, ebx
je 0x40dea5
push ebx
push 0
push dword [0x4b3a28]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x250
push edi
call fcn.0047d539
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 8
push ecx
mov edi, edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test byte [edi + 0xc], 0x40
xorps xmm0, xmm0
mov esi, eax
mov dword [ebp - 0x30], 0x2c
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
je 0x41417c
lea eax, [ebp - 0x30]
push eax
push dword [esi + 0x1035c]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x10360], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x10364], eax
and dword [edi + 0xc], 0xffffffbf
pop edi
mov dword [esi + 0x1035c], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x1035c]
test eax, eax
je 0x41419f
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41419f
push 0
push dword [esi + 0x1035c]
call dword [sym.imp.USER32.dll_ShowWindow]
test byte [edi + 0xc], 8
je 0x4141b6
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x4141b6
mov edx, edi
call fcn.00417a70
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
Function at 0x4141d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
mov esi, edx
push edi
mov edi, ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], edi
movzx eax, word [esi + 0xc]
cmp eax, 0x66
je 0x414205
cmp eax, 0x46
jne 0x414358
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x414358
push 8
push edi
call ebx
mov edi, eax
mov ebx, 0x15
mov eax, dword [edi + 0x1035c]
lea ecx, [edi + 0x10131]
test eax, eax
jne 0x41427b
mov eax, dword [0x4b3a24]
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push ecx
movups xmmword [ecx + 0x10], xmm0
movq qword [ecx + 0x20], xmm0
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ecx + 4], eax
lea eax, [edi + 0x1015a]
mov dword [ecx + 0x10], eax
mov eax, 0x100
mov dword [ecx], 0x28
mov word [ecx + 0x18], ax
mov dword [ecx + 0xc], 0x10001
call dword [sym.imp.COMDLG32.dll_FindTextW]
mov dword [edi + 0x1035c], eax
cmp dword [edi + 0x10360], 0
jne 0x414293
cmp dword [edi + 0x10364], 0
mov ecx, 0x17
cmove ebx, ecx
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4142a4
and ebx, 0xffffffef
or ebx, 0x40
push ebx
push 0
push 0
push dword [edi + 0x10364]
push dword [edi + 0x10360]
push 0
push dword [edi + 0x1035c]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [edi + 0x1035c]
test eax, eax
je 0x414347
test bl, 0x40
je 0x414347
push eax
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x414344
mov ebx, dword [sym.imp.USER32.dll_SetFocus]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x414335
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x8000000
jne 0x414335
push 0x28
lea eax, [ebp - 0x54]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [ebp - 0x54]
push 0x4a6158
push eax
call fcn.004809a5
add esp, 8
test eax, eax
jne 0x414335
push esi
call ebx
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x4142e5
mov esi, dword [ebp - 0x58]
mov eax, dword [esi]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [edi + 0xbc], eax
mov edi, dword [ebp - 0x5c]
cmp word [esi + 0xc], 0x72
jne 0x414380
push 8
push edi
call ebx
mov ecx, edi
or dword [eax + 0x1013d], 8
mov edx, dword [esi]
mov dword [eax + 0xbc], edx
lea edx, [eax + 0x10131]
call fcn.00414100
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
Function at 0x4143a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov eax, dword [edi + 8]
cmp eax, 0xffffff4f
je 0x4144fc
cmp eax, 0xffffff65
je 0x4144ee
cmp eax, 0xffffff9b
jne 0x414501
push 8
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [edi]
mov esi, eax
cmp ecx, dword [esi + 0x64]
jne 0x414501
cmp dword [esi + 0xc0], 0
jne 0x414501
mov eax, dword [esi + 8]
mov ecx, dword [edi + 0xc]
cmp ecx, dword [eax + 4]
jge 0x414501
test byte [edi + 0x14], 3
je 0x414501
mov edi, dword [eax + ecx*4 + 0x10]
mov edx, edi
mov ecx, dword [edi + 0x20]
mov eax, ecx
sub eax, 6
je 0x414457
sub eax, 2
je 0x414447
sub eax, 1
je 0x414437
push ecx
mov ecx, esi
call fcn.004124f0
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x414474
push 9
mov ecx, esi
call fcn.004124f0
add esp, 4
push 0xb
jmp 0x414465
push 8
mov ecx, esi
call fcn.004124f0
add esp, 4
push 0xa
jmp 0x414465
push 6
mov ecx, esi
call fcn.004124f0
add esp, 4
push 7
xor edx, edx
mov dword [ebp - 4], eax
mov ecx, esi
call fcn.004124f0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x68]
add esp, 4
mov ecx, dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x41449e
push eax
call ecx
test eax, eax
je 0x414498
push 0
push dword [esi + 0x68]
call ebx
mov ecx, dword [sym.imp.USER32.dll_IsWindowVisible]
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4144b3
push eax
call ecx
test eax, eax
je 0x4144b3
push 0
push dword [esi + 0x70]
call ebx
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x4144cc
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4144cc
push 0
push dword [esi + 0x6c]
call ebx
mov eax, dword [ebp - 4]
mov ecx, esi
mov dword [esi + 0x6c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xf8], edi
mov dword [esi + 0x70], eax
call fcn.00412d30
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004141d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00413a70
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4163c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
mov dword [ebp - 0x420], 0
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4163ff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x420]
push eax
push 0xf003f
push 0
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41649c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0x210]
push 0x105
push eax
push 0
push dword [ebp - 0x420]
call edi
test eax, eax
jne 0x41648f
nop
lea eax, [ebp - 0x210]
push eax
push esi
push 0x4a54c0
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.00401040
add esp, 0x14
lea edx, [ebp - 0x41c]
mov ecx, 0x80000000
call fcn.004163c0
test eax, eax
jne 0x41648f
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
push dword [ebp - 0x420]
call edi
test eax, eax
je 0x416440
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
Function at 0x4173e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x210], ecx
push esi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41743c
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x184
push dword [ebp - 0x210]
call fcn.0047ab10
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
test al, 0x10
je 0x41745c
mov ecx, esi
mov edi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417447
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], bx
je 0x4174ba
test edi, edi
je 0x417488
push esi
push edi
push 0x4a54c0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00401040
add esp, 0x14
lea eax, [ebp - 0x20c]
jmp 0x41748a
mov eax, esi
push eax
push ebx
call fcn.0047cbc0
mov ecx, esi
mov ebx, eax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4174a0
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], ax
jne 0x417461
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d2db
mov esp, ebp
pop ebp
ret

Function at 0x417900
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x2b4
lea eax, [ebp - 0x2b8]
mov ebx, ecx
push 0
push eax
call fcn.0047ee20
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x4010
push 0x2b4
push eax
push 0x20
push str.a.txt
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x2b8]
mov edi, eax
test ecx, ecx
je 0x41795e
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x1003
push ebx
call edi
push 0x2b4
lea eax, [ebp - 0x2b8]
push 0
push eax
call fcn.0047ee20
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x4011
push 0x2b4
push eax
push 0x20
push str.a.txt
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], eax
test ecx, ecx
je 0x4179c0
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x2bc]
push eax
push 1
push 0x1003
push ebx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
Function at 0x418670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push ebx
push esi
push eax
push 1
push 0
push str.SoftwareBlizzard_EntertainmentWarcraft_III
push 0x80000001
mov esi, ecx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4186f5
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push esi
push 0
push 0
push str.InstallPath
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4186ea
cmp eax, 0xea
je 0x4186ea
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push esi
push 0
push 0
push str.InstallPathX
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4186ea
cmp eax, 0xea
jne 0x4186ec
mov bl, 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4189f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b3a24]
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], eax
push edx
push eax
mov dword [ebp - 4], esi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x418a41
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0xc]
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x418a41
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x418a93
cmp edi, 4
jbe 0x418a93
mov eax, dword [ebx]
sub edi, 4
push eax
push 8
push dword [0x4b3a28]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x418a93
push edi
lea ecx, [ebx + 4]
push ecx
lea eax, [ebp - 4]
push eax
push esi
call fcn.00443780
add esp, 0x10
cmp eax, 1
je 0x418a93
push esi
push 0
push dword [0x4b3a28]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
xor ecx, ecx
jmp 0x418a96
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x418a9f
mov dword [eax], ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x2000
mov esi, edx
mov dword [ebp - 4], ecx
call fcn.0047d547
add esp, 4
mov edi, eax
push dword [ebp + 8]
push 0
push esi
push 0xfff
push edi
call fcn.00401030
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00484fec
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x4196e9
cmp eax, 0xfff
ja 0x4196e9
je 0x4196e9
lea esi, [edi + eax*2]
jmp 0x4196f8
xor eax, eax
lea esi, [edi + 0x1ffe]
mov word [edi + 0x1ffe], ax
push 0
push edi
call fcn.0047d140
mov ebx, eax
test ebx, ebx
je 0x41972c
push 0
mov ecx, esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
sub ecx, edi
sar ecx, 1
push ecx
push ebx
push dword [eax + 0x414]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.00457d30
add esp, 4
push edi
call fcn.00457d30
add esp, 4
sub esi, edi
sar esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x140], edx
lea ecx, [ebp - 0x138]
mov edx, ecx
push edi
test esi, esi
je 0x419d71
mov edi, 0x10
movzx eax, byte [esi]
lea esi, [esi + 1]
shr eax, 4
movzx eax, byte [eax + str.0123456789ABCDEF]
mov byte [ecx], al
lea ecx, [edx + 2]
movzx eax, byte [esi - 1]
and eax, 0xf
movzx eax, byte [eax + str.0123456789ABCDEF]
mov byte [edx + 1], al
mov edx, ecx
sub edi, 1
jne 0x419d42
jmp 0x419db8
mov edi, str._____________ERROR______________
lea eax, [ebp - 0x138]
xor esi, esi
mov ecx, 0x134
sub edi, eax
lea eax, [ecx + 0x7ffffeca]
test eax, eax
je 0x419d9f
mov al, byte [edi + edx]
test al, al
je 0x419d9f
mov byte [edx], al
inc esi
inc edx
sub ecx, 1
jne 0x419d85
test ecx, ecx
lea eax, [edx - 1]
lea ecx, [ebp - 0x138]
cmovne eax, edx
mov byte [eax], 0
lea eax, [esi - 1]
cmovne eax, esi
add ecx, eax
push dword [ebp - 0x140]
lea eax, [ebp - 0x13c]
mov word [ecx], 0x2a20
push str._s_r_n
push 0
push 0
push eax
add ecx, 2
lea eax, [ebp - 4]
sub eax, ecx
mov dword [ebp - 0x13c], ecx
push eax
push ecx
call fcn.0041d600
add esp, 0x1c
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x138]
push 0
push eax
mov eax, dword [ebp - 0x13c]
sub eax, ecx
push eax
mov eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
Function at 0x41f3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x31c], eax
mov edi, ecx
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push eax
call fcn.0047ee20
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x30c], ax
lea eax, [ebp - 0x30a]
push eax
call fcn.0047ee20
add esp, 0x18
mov dword [ebp - 0x314], 0x100
mov dword [ebp - 0x318], 0x208
test esi, esi
jne 0x41f47d
push 0x2e
push ebx
call fcn.0047eb3c
add esp, 8
mov esi, 0x4a76b0
test eax, eax
cmovne esi, eax
push 0
push esi
call fcn.0047d060
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x310]
push eax
push 1
push 0
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f5bf
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x310]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41f5bf
cmp word [ebp - 0x104], si
je 0x41f5bf
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.0047d060
mov dword [edi + 8], eax
lea eax, [ebp - 0x310]
push eax
push 1
push esi
lea eax, [ebp - 0x104]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f560
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x30c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f554
cmp word [ebp - 0x30c], ax
je 0x41f554
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.0047d060
mov dword [edi + 0xc], eax
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x41f593
push eax
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
push ebx
call fcn.0041f5e0
test al, al
je 0x41f593
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret 0xc
push str.open
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
push ebx
call fcn.0041f5e0
pop edi
test al, al
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d2db
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4248b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
test ecx, ecx
je 0x424954
push 0x104
lea edx, [ebp - 0x108]
call fcn.004246e0
add esp, 4
lea edi, [eax + 1]
cmp edi, 1
je 0x424954
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x424954
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.0047ef80
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x4b4e4c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42494d
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0047d2db
mov esp, ebp
pop ebp
ret