joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407c30
Capabilities:
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5c2068
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x692dfc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x14]
call fcn.0040fb40
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.0040fcd0
push 0x666478
push 0xc8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x407d3f
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407d3f
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.0040fe90
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x666300
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.0056be90
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0040fd00
push eax
lea ecx, [esp + 0x18]
call fcn.0040fd30
push eax
call fcn.0056bb70
add esp, 8
cmp dword [esp + 0xc], eax
je 0x407d7a
push 0x80
push 0x666300
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x665d5c
push 0x666300
call fcn.00591d00
mov esi, eax
add esp, 8
test esi, esi
jne 0x407d55
push 0x10
push str.Warning
push str.Can_not_update_steam_api.dll
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407d7a
push 0x10
push str.Warning
push str.No_steam_api.dll_resource
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407d7a
push esi
lea ecx, [esp + 0x18]
call fcn.0040fd00
push eax
push 1
lea ecx, [esp + 0x20]
call fcn.0040fd30
push eax
call fcn.005927f4
push esi
call fcn.005915c0
add esp, 0x14
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0040fbf0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x407f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5c2218
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x692dfc]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
fldz
lea ecx, [esp + 0x14]
fst dword [esi]
mov dword [esi + 8], 0
fstp dword [esi + 4]
call fcn.0040fb40
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0
call fcn.0040fcd0
movzx eax, word [esp + 0x5c]
push 0x66659c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x40805d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40805d
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.0040fe90
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040fd00
push eax
lea ecx, [esp + 0x1c]
call fcn.0040fd30
mov ecx, dword [0x699d7c]
push eax
add ecx, 0x54
call fcn.0056dcd0
push eax
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemory
test eax, eax
jne 0x40805d
mov ecx, dword [0x699d7c]
call fcn.0057d6a0
push 1
push 1
push 0x16
push 4
push 4
mov ecx, eax
mov dword [esi + 8], eax
call fcn.0057f550
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push edx
call fcn.0057f380
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [ecx + 0x44]
call eax
fild dword [esp + 0x60]
mov ecx, dword [esp + 0x40]
fild dword [esp + 0x40]
test ecx, ecx
jge 0x40803e
fadd dword [0x668020]
fdivp st(1)
mov edx, dword [esp + 0x44]
fstp dword [esi]
fild dword [esp + 0x64]
fild dword [esp + 0x44]
test edx, edx
jge 0x408058
fadd dword [0x668020]
fdivp st(1)
fstp dword [esi + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0xffffffff
call fcn.0040fbf0
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret 0xc
Function at 0x409690
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x692dfc]
xor eax, esp
mov dword [esp + 0x414], eax
push ebp
push edi
lea eax, [esp + 0x14]
mov edi, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.0056be90
add esp, 0xc
test al, al
je 0x4096cf
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x112]
je 0x4097a2
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x665d5c
push esi
call fcn.00591d00
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4096fd
lea eax, [esp + 0x18]
push eax
mov eax, ebx
call fcn.00408b40
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.0040fd00
push eax
mov ecx, edi
call fcn.0040fd30
push eax
push esi
lea ecx, [ebx + 0x4e0]
call fcn.00579780
mov eax, dword [esi + 0x10a]
cmp eax, dword [esp + 8]
je 0x409748
push 0
push 0x19f
push str..Updater.cpp
push str.fe__size__out_size
call fcn.0056b4f0
add esp, 0x10
lea edi, [ebx + 0x20dd4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ebp
push 1
push ecx
push edx
call fcn.005927f4
push ebp
call fcn.005915c0
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.MiniA.exe
push esi
call fcn.00594acd
add esp, 8
test eax, eax
jne 0x409795
mov byte [ebx + 0x21654], 1
call fcn.00409a00
mov eax, dword [esp + 0xc]
push eax
call fcn.0056d0d0
add esp, 4
mov ecx, dword [esp + 0x41c]
pop edi
pop ebp
xor ecx, esp
call fcn.00591137
add esp, 0x41c
ret
Function at 0x409890
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5c2cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x692dfc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x18]
push eax
call fcn.0040bfc0
xor ebx, ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], ebx
call fcn.0040c050
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
xor esi, esi
sar ecx, 2
test ecx, ecx
jbe 0x409938
mov ebp, 0x100000
lea esp, [esp]
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
sar edx, 2
cmp esi, edx
jb 0x409908
call fcn.005923bc
mov eax, dword [edi + 0x5f4]
mov eax, dword [eax + esi*4]
test dword [eax + 0x116], ebp
jne 0x409924
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040c160
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
inc esi
sar edx, 2
cmp esi, edx
jb 0x4098f0
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
sub ecx, ebp
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
xor esi, esi
add eax, edx
je 0x4099b7
add edi, 0x5e4
mov dword [esp + 0x14], edi
cmp esi, eax
jb 0x409970
call fcn.005923bc
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
lea edi, [ebx + ebp]
push edi
call fcn.0057b240
test byte [edi + 0x116], 1
je 0x40998d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
sub ecx, ebp
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
add ebx, 0x128
cmp esi, eax
jb 0x409970
xor ebx, ebx
cmp ebp, ebx
je 0x4099c4
push ebp
call fcn.0056d0d0
add esp, 4
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0056d0d0
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x409a00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x61c
mov eax, dword [0x692dfc]
xor eax, esp
mov dword [esp + 0x614], eax
lea eax, [esp + 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.MiniA.exe
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 8]
push 0x666c14
push edx
call fcn.00401aa0
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x14]
call fcn.00401710
mov ecx, dword [esp + 0x628]
add esp, 0x14
xor ecx, esp
call fcn.00591137
add esp, 0x61c
ret
Function at 0x409ec0
Capabilities:
Delete file

Disassembly:
sub esp, 0x40c
mov eax, dword [0x692dfc]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push ebp
push esi
push str.Making_sure_extracted_files_exists_n
call fcn.0056b1e0
add esp, 4
push 1
lea ebx, [edi + 0x4e0]
push 1
mov ecx, ebx
call fcn.00579300
mov eax, dword [edi + 0x5f8]
sub eax, dword [edi + 0x5f4]
xor ebp, ebp
sar eax, 2
test eax, eax
jbe 0x409fae
mov edi, edi
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
sar ecx, 2
cmp ebp, ecx
jb 0x409f28
call fcn.005923bc
mov edx, dword [edi + 0x5f4]
mov esi, dword [edx + ebp*4]
test byte [esi + 0x116], 1
je 0x409f96
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.0056be90
add esp, 0xc
test al, al
je 0x409f69
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x112]
jne 0x409f69
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 0x10a]
je 0x409f96
push esi
push str.restoring__s_n
call fcn.0056b1e0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x666d90
push esi
mov ecx, ebx
call fcn.0057a170
test al, al
je 0x409fda
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
inc ebp
sar ecx, 2
cmp ebp, ecx
jb 0x409f10
mov ecx, ebx
call fcn.00579460
push str.Making_sure_extracted_files_exists___finished_n
call fcn.0056b1e0
mov ecx, dword [esp + 0x418]
add esp, 4
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00591137
add esp, 0x40c
ret
push esi
lea edx, [esp + 0x18]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push edx
call fcn.00401ac0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.00408b40
int3
Function at 0x40a580
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2d20
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x692dfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [esi + 0x20dec], 0
je 0x40a5d7
push 0
push 0x368
push str..Updater.cpp
push str.status___STATUS_Checking
call fcn.0056b4f0
add esp, 0x10
mov ecx, esi
call fcn.00408ba0
call fcn.00408dd0
test al, al
je 0x40a602
mov ecx, esi
call fcn.00408e50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [esi + 0x98], 1
call fcn.00409120
mov dword [esi + 0x20dec], eax
lea eax, [esi + 0x20df5]
push 0x66608e
push eax
call fcn.00401ac0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov ebx, 5
cmp dword [esi + 0x20dec], ebx
jne 0x40a733
mov ecx, dword [esi + 0x217f8]
mov eax, dword [0x73f410]
or eax, dword [0x73f414]
mov dword [0x73f400], ecx
mov edx, dword [esi + 0x217fc]
mov dword [0x73f404], edx
je 0x40a68c
call fcn.00402bb0
test al, al
je 0x40a68c
push 0
push 0
push 0x73f400
push 0x402870
push 0
push 0
call fcn.00591a77
add esp, 0x18
mov dword [0x73f5c8], eax
call fcn.00409180
call fcn.004092d0
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x5e4]
push ecx
push eax
push str.current_build_version_d__updater_data_version_d_n
call fcn.0056b1e0
mov eax, dword [esi + 0x5e4]
add esp, 0xc
cmp eax, dword [esi + 0x1c]
jne 0x40a6c0
mov eax, esi
call fcn.0040a4b0
mov ebx, esi
call fcn.00409570
mov ecx, esi
call fcn.00409bb0
call fcn.0040a410
push str.Validating_game_data_n
call fcn.0056b1e0
add esp, 4
lea edx, [esi + 0x20df5]
push 0x666f0c
push edx
call fcn.00401ac0
add esp, 8
lea eax, [esi + 0x21600]
push eax
lea ecx, [esi + 0x215f8]
push ecx
push 0
lea ecx, [esi + 0x4e0]
call fcn.0057cda0
test al, al
jne 0x40a71f
push str.Game_data_is_damaged__please_restart_launcher_to_repair_damaged_files
mov eax, esi
call fcn.00408b40
push str.Validating_game_data___finished_n
call fcn.0056b1e0
add esp, 4
mov eax, esi
call fcn.0040a4b0
push 0x32
call edi
jmp 0x40a633
Function at 0x40bbc0
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x21638], 0
je 0x40bbe2
push 0
push 0x60d
push str..Updater.cpp
push str.mainThread___NULL
call fcn.0056b4f0
add esp, 0x10
cmp dword [esi + 0x21658], 0
je 0x40bc04
push 0
push 0x60e
push str..Updater.cpp
push str.loginThread___NULL
call fcn.0056b4f0
add esp, 0x10
push ebx
push edi
push 0
push 0
push esi
push 0x40a800
push 0
push 0
call fcn.00591a77
push 0
push 0
push esi
push 0x40ae70
push 0
push 0
mov dword [esi + 0x21638], eax
call fcn.00591a77
add esp, 0x30
mov dword [esi + 0x21d20], eax
lea edi, [esi + 0x21648]
mov ebx, 3
push 0
push 0
push esi
push 0x40ae80
push 0
push 0
call fcn.00591a77
mov dword [edi], eax
add esp, 0x18
add edi, 4
sub ebx, 1
jne 0x40bc46
pop edi
pop ebx
ret

Function at 0x40bcf0
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.CUpdater::Stop___n
mov esi, eax
call fcn.0056b1e0
add esp, 4
cmp byte [esi + 0x20df4], 0
jne 0x40bd13
mov eax, dword [esi + 0x21640]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x7222dc
call edi
lea eax, [esi + 0x20dd4]
push eax
mov dword [esp + 0x14], eax
call edi
mov eax, dword [esi + 0x21638]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x40bd58
push ebx
push eax
call edi
mov ecx, dword [esi + 0x21638]
push ecx
call ebp
mov dword [esi + 0x21638], ebx
mov eax, dword [esi + 0x21d20]
cmp eax, ebx
je 0x40bd75
push ebx
push eax
call edi
mov edx, dword [esi + 0x21d20]
push edx
call ebp
mov dword [esi + 0x21d20], ebx
mov eax, dword [esi + 0x21658]
cmp eax, ebx
je 0x40bd92
push ebx
push eax
call edi
mov eax, dword [esi + 0x21658]
push eax
call ebp
mov dword [esi + 0x21658], ebx
add esi, 0x21648
mov ebx, 3
lea ecx, [ecx]
mov eax, dword [esi]
test eax, eax
je 0x40bdb6
push 0
push eax
call edi
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi], 0
add esi, 4
sub ebx, 1
jne 0x40bda0
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edx
call esi
push 0x7222dc
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40dee0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
push esi
push edi
push 0x11
mov dword [esp + 0xc], 4
call fcn.00592a75
mov edi, eax
push 0x288
mov dword [esp + 0x14], edi
call fcn.00592a75
mov esi, eax
add esp, 8
test esi, esi
jne 0x40df1a
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.00592b3f
add esp, 4
lea eax, [esp + 8]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40df4a
mov ecx, dword [esp + 8]
push ecx
call fcn.00592a75
mov esi, eax
add esp, 4
test esi, esi
jne 0x40df4a
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.00592b3f
add esp, 4
lea edx, [esp + 8]
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x40dfa3
movzx eax, byte [esi + 0x199]
movzx ecx, byte [esi + 0x198]
movzx edx, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push ecx
movzx ecx, byte [esi + 0x195]
push edx
movzx edx, byte [esi + 0x194]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.00406b70
add esp, 0x20
mov eax, edi
pop edi
pop esi
add esp, 8
ret
push esi
call fcn.00592c04
add esp, 4
pop edi
pop esi
add esp, 8
ret

Function at 0x40e2c0
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e319
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e2f0
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.username
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40e320
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e370
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.username
push eax
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret 4
Function at 0x40e380
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, 0x33832352
lea esi, [esp + 0x1d]
mov ebx, eax
call fcn.0040e6f0
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40e3c0
call fcn.0040e420
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x2c
ret
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
add ebx, 0x100
push ebx
push 0
push 0
lea eax, [esp + 0x27]
push eax
push ecx
mov dword [esp + 0x28], 0x32
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], 0x7a
mov byte [esp + 0x32], 0x68
mov byte [esp + 0x33], 0x77
mov byte [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x2c
ret

Function at 0x40e420
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1f8
mov eax, dword [0x692dfc]
xor eax, esp
mov dword [esp + 0x1f4], eax
push esi
push edi
mov edi, 0x33832352
lea esi, [esp + 0x15]
call fcn.0040e6f0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e4fa
push 0x1c8
push eax
lea edx, [esp + 0x38]
push edx
call fcn.00594b20
add esp, 0xc
lea eax, [esp + 0x30]
call fcn.004021c0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push eax
push ecx
lea esi, [ebx + 0x100]
push str.0x_I64x
mov edx, esi
call fcn.0040e730
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e4b2
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
push esi
push 1
push 0
lea edx, [esp + 0x1a]
push edx
push eax
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x23], 0x6b
mov byte [esp + 0x24], 0x7a
mov byte [esp + 0x25], 0x68
mov byte [esp + 0x26], 0x77
mov byte [esp + 0x27], cl
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1fc]
pop edi
pop esi
xor ecx, esp
call fcn.00591137
mov esp, ebp
pop ebp
ret

Function at 0x40e510
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e566
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
add edx, 0x132
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.Identifier
push eax
mov dword [esp + 0x1c], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret 4
Function at 0x40e570
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SYSTEMControlSet001ControlComputerNameComputerName
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e5c6
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
add edx, 0x164
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.ComputerName
push eax
mov dword [esp + 0x1c], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret 4

Function at 0x40e750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x692dfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x4c
mov dword [ebp - 0x10], edi
call fcn.00592a75
mov esi, eax
xor ebx, ebx
add esp, 4
cmp esi, ebx
jne 0x40e798
cmp edi, ebx
je 0x40e785
mov dword [edi], 0x6d
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00591137
mov esp, ebp
pop ebp
ret
push 0x4c
push ebx
push esi
call fcn.00594b20
push 0x614c
push 1
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
call fcn.005a3600
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x40e7e5
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x40e7c9
mov dword [eax], 0x6d
push esi
call fcn.00592c04
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00591137
mov esp, ebp
pop ebp
ret
push 0x614c
push ebx
push edi
call fcn.00594b20
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x48], edi
mov dword [edi + 4], ebx
mov dword [edi + 0x38], ebx
mov dword [edi], 8
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 0x44], ecx
mov ecx, dword [eax + 0x3c]
add esp, 0xc
cmp ecx, ebx
je 0x40e827
push 6
lea edx, [ebp - 0xc]
push edx
push esi
call ecx
add esp, 0xc
jmp 0x40e83b
mov eax, dword [eax + 0x38]
push eax
push 6
lea ecx, [ebp - 0xc]
push 1
push ecx
call fcn.00597407
add esp, 0x10
cmp eax, 6
je 0x40e86f
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x40e84d
mov dword [eax], 0x66
push edi
call fcn.00592c04
push esi
call fcn.00592c04
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00591137
mov esp, ebp
pop ebp
ret
push 3
lea edx, [ebp - 0xc]
push edx
push str.GIFVER
mov byte [ebp - 6], bl
call fcn.005951d8
add esp, 0xc
test eax, eax
je 0x40e898
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x40e84d
mov dword [eax], 0x67
jmp 0x40e84d
mov ebx, esi
call fcn.0040e900
test eax, eax
jne 0x40e8d2
push edi
call fcn.00592c04
push esi
call fcn.00592c04
mov eax, dword [ebp - 0x10]
add esp, 8
test eax, eax
je 0x40e85c
pop edi
pop esi
mov dword [eax], 0x68
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00591137
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [esi + 0x40], 0
cmp byte [ebp - 9], 0x39
sete al
xor ecx, ebp
mov dword [edi + 0x6148], eax
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00591137
mov esp, ebp
pop ebp
ret