joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a3e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
push ecx
lea esi, [edi + 4]
xor ebp, ebp
push esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], eax
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
jne 0x40a415
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov edx, dword [esi + eax*2 + 2]
lea eax, [esi + eax*2 + 2]
mov ecx, dword [eax + 4]
add eax, 4
add eax, 4
push ebx
mov ebx, dword [eax]
add eax, 4
mov dword [esp + 0x14], edx
cmp ebx, ebp
je 0x40a43f
mov edx, dword [eax]
mov dword [esp + 0x10], edx
add eax, 4
jmp 0x40a443
mov edx, dword [esp + 0x10]
sub eax, edi
cmp eax, dword [esp + 0x28]
jbe 0x40a453
mov eax, dword [esp + 0x20]
cmp eax, ebp
jmp 0x40a476
cmp ecx, ebp
je 0x40a48b
lea eax, [edx - 1]
cmp eax, 0x13bfe
ja 0x40a48b
push edx
call fcn.0041d8b8
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x40a48b
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40a481
push eax
call fcn.0041af0b
add esp, 4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
test ebx, ebx
je 0x40a493
lea ebx, [esp + 0x10]
cmp dword [esp + 0x14], 0
mov edi, dword [esp + 0x24]
mov dword [edi], 0x2ef2
mov esi, 0xc
je 0x40a4b5
lea ecx, [edi + 0xc]
mov dword [esp + 0x14], ecx
mov esi, 0x10
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 8], eax
mov dword [esi + edi], ebx
add esi, 4
test ebx, ebx
je 0x40a4e3
mov edx, dword [ebx]
mov dword [esi + edi], edx
add esi, 4
mov eax, dword [edi + 8]
neg eax
sbb eax, eax
not eax
and eax, ebp
mov dword [esi + edi], eax
add esi, 4
cmp dword [edi + 8], 0
jne 0x40a518
test ebp, ebp
je 0x40a518
test ebx, ebx
je 0x40a518
mov eax, dword [ebx]
test eax, eax
je 0x40a518
push eax
lea ecx, [esi + edi]
push ebp
push ecx
call fcn.0041a2b0
add esp, 0xc
add esi, dword [ebx]
mov edx, dword [esp + 0x2c]
mov dword [edi + 4], esi
mov dword [edx], esi
test ebp, ebp
je 0x40a52e
push ebp
call fcn.0041af0b
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40a53f
push eax
call fcn.0041af0b
add esp, 4
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
Function at 0x40a730
Capabilities:
Move file

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
jne 0x40a74e
xor eax, eax
pop edi
pop ecx
ret
push esi
lea ecx, [esp + 8]
lea esi, [eax + edi + 1]
push ecx
push esi
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
jne 0x40a779
mov edx, dword [esp + 0x10]
push edx
call fcn.0041af0b
add esp, 4
pop esi
xor eax, eax
pop edi
pop ecx
ret
sub eax, edi
lea eax, [eax + esi + 1]
cmp eax, dword [esp + 0x18]
jbe 0x40a7a2
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041af0b
mov edx, dword [esp + 0xc]
push edx
call fcn.0041af0b
add esp, 8
pop esi
xor eax, eax
pop edi
pop ecx
ret
mov edi, dword [esp + 8]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push edi
mov dword [esi], 0x7f1
mov dword [esi + 4], 0xc
push ebx
mov dword [eax], 0xc
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push ebx
mov dword [esi + 8], eax
call fcn.0041af0b
push edi
call fcn.0041af0b
add esp, 8
pop ebx
pop esi
mov eax, 1
pop edi
pop ecx
ret

Function at 0x40a7f0
Capabilities:
Move file

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
jne 0x40a80e
xor eax, eax
pop edi
pop ecx
ret
push esi
lea ecx, [esp + 8]
lea esi, [edi + eax*2 + 2]
push ecx
push esi
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
jne 0x40a839
mov edx, dword [esp + 0x10]
push edx
call fcn.0041af0b
add esp, 4
pop esi
xor eax, eax
pop edi
pop ecx
ret
lea eax, [eax + eax + 2]
sub eax, edi
add eax, esi
cmp eax, dword [esp + 0x18]
jbe 0x40a864
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041af0b
mov edx, dword [esp + 0xc]
push edx
call fcn.0041af0b
add esp, 8
pop esi
xor eax, eax
pop edi
pop ecx
ret
mov edi, dword [esp + 8]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push edi
mov dword [esi], 0x2f01
mov dword [esi + 4], 0xc
push ebx
mov dword [eax], 0xc
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push ebx
mov dword [esi + 8], eax
call fcn.0041af0b
push edi
call fcn.0041af0b
add esp, 8
pop ebx
pop esi
mov eax, 1
pop edi
pop ecx
ret
Function at 0x40a8b0
Capabilities:
Move file

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
jne 0x40a8ce
xor eax, eax
pop edi
pop ecx
ret
push esi
lea ecx, [esp + 8]
lea esi, [eax + edi + 1]
push ecx
push esi
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
jne 0x40a8f9
mov edx, dword [esp + 0x10]
push edx
call fcn.0041af0b
add esp, 4
pop esi
xor eax, eax
pop edi
pop ecx
ret
mov ecx, dword [esi + eax + 1]
lea eax, [esi + eax + 1]
sub eax, edi
add eax, 4
cmp eax, dword [esp + 0x18]
jbe 0x40a929
mov eax, dword [esp + 0x10]
push eax
call fcn.0041af0b
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0041af0b
add esp, 8
pop esi
xor eax, eax
pop edi
pop ecx
ret
mov edi, dword [esp + 8]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push ecx
push edi
mov dword [esi], 0x7f2
mov dword [esi + 4], 0xc
push ebx
mov dword [edx], 0xc
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push ebx
mov dword [esi + 8], eax
call fcn.0041af0b
push edi
call fcn.0041af0b
add esp, 8
pop ebx
pop esi
mov eax, 1
pop edi
pop ecx
ret
Function at 0x40a980
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x220
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
mov ebx, dword [esp + 0x234]
push ebp
mov ebp, dword [esp + 0x230]
push esi
mov esi, dword [esp + 0x230]
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.0041a230
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x24], 0
call fcn.00406fe0
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40a9f8
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x220
ret
push edi
lea edi, [esi + eax*2 + 2]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
jne 0x40aa24
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041af0b
add esp, 4
xor eax, eax
jmp 0x40ab71
mov edx, dword [edi + eax*2 + 2]
lea eax, [edi + eax*2 + 2]
sub eax, esi
add eax, 4
mov dword [esp + 0x1c], edx
cmp eax, dword [esp + 0x23c]
jbe 0x40aa5c
mov eax, dword [esp + 0x10]
push eax
call fcn.0041af0b
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0041af0b
add esp, 8
xor eax, eax
jmp 0x40ab71
push 0x104
lea edx, [esp + 0x24]
mov dword [ebp], 0x2f02
mov dword [ebp + 4], 0xc
push edx
mov dword [ebx], 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x20]
add eax, 0xfffffffe
jmp 0x40aa90
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40aa90
mov ecx, dword [str.drivers]
mov edx, dword [0x434588]
mov dword [eax], ecx
mov ecx, dword [0x43458c]
mov dword [eax + 4], edx
mov edx, dword [0x434590]
mov dword [eax + 8], ecx
mov cx, word [0x434594]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40aad1
mov edi, dword [esp + 0x10]
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x24]
push edx
push edi
call fcn.0041ee98
mov esi, dword [esp + 0x24]
add esp, 0xc
mov ebx, 1
test eax, eax
je 0x40ab32
test esi, esi
je 0x40ab40
lea eax, [esp + 0x20]
lea edx, [eax + 2]
jmp 0x40ab10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ab10
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0041ee98
add esp, 0xc
test eax, eax
jne 0x40ab40
push 0
call fcn.004119a0
mov dword [esp + 0x18], ebx
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [esp + 0x14], 0
mov dword [ebp + 8], eax
je 0x40ab60
push ebx
call fcn.004119a0
add esp, 4
push edi
call fcn.0041af0b
push esi
call fcn.0041af0b
add esp, 8
mov eax, ebx
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041a7bc
add esp, 0x220
ret

Function at 0x40ab90
Capabilities:
Clear file content

Disassembly:
cmp dword [esp + 0xc], 4
mov eax, dword [esp + 4]
mov eax, dword [eax]
jae 0x40aba0
xor eax, eax
ret
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
mov dword [esi], 0x7f3
mov dword [esi + 4], 0xc
push eax
mov dword [ecx], 0xc
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [esi + 8], eax
mov eax, 1
pop esi
ret
Function at 0x40b060
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov dword [esp + 4], eax
lea eax, [edx + 4]
add eax, 4
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [eax - 4]
add eax, 4
push edi
mov edi, dword [eax - 4]
sub eax, edx
add eax, 4
cmp eax, dword [esp + 0x14]
jbe 0x40b08e
pop edi
xor eax, eax
pop ebx
ret
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov dword [ebp], 0x7da
lea esi, [ebp + 0xc]
cmp edi, 0x10000
jbe 0x40b0c2
mov edx, dword [esp + 0x20]
sub esi, ebp
mov dword [ebp + 8], 0
mov dword [ebp + 4], esi
mov dword [edx], esi
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret
mov dword [esi], ecx
add esi, 4
test ecx, ecx
je 0x40b0d0
mov ecx, esi
add esi, 4
test ebx, ebx
je 0x40b0d6
mov ebx, esi
push 0
push ecx
mov ecx, dword [esp + 0x1c]
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp + 8], eax
test eax, eax
je 0x40b0f3
test edi, edi
je 0x40b0f3
add esi, edi
mov edx, dword [esp + 0x20]
sub esi, ebp
mov dword [ebp + 4], esi
mov dword [edx], esi
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret

Function at 0x40b110
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x10010
call fcn.0041bfd0
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x1000c], eax
mov eax, dword [esp + 0x10020]
push ebx
mov ebx, dword [esp + 0x1001c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x10024]
mov ecx, dword [edi]
lea esi, [edi + 4]
add esi, 4
mov ebp, dword [esi + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi - 4]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
add esi, 4
add esi, 4
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x40b185
cmp eax, 0x10000
ja 0x40b185
push eax
lea edx, [esp + 0x20]
push esi
push edx
call fcn.0041a2b0
mov eax, dword [esp + 0x1c]
add esp, 0xc
add esi, dword [esp + 0x10]
sub esi, edi
cmp esi, dword [esp + 0x1002c]
jbe 0x40b194
xor eax, eax
jmp 0x40b1e2
mov dword [ebx], 0x7db
lea esi, [ebx + 0xc]
cmp eax, 0x10000
jbe 0x40b1ad
mov dword [ebx + 8], 0
jmp 0x40b1d2
mov dword [esi], ebp
add esi, 4
test ebp, ebp
je 0x40b1bb
mov ebp, esi
add esi, 4
mov ecx, dword [esp + 0x14]
push 0
push ebp
push eax
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebx + 8], eax
mov edx, dword [esp + 0x18]
sub esi, ebx
mov dword [ebx + 4], esi
mov dword [edx], esi
mov eax, 1
mov ecx, dword [esp + 0x1001c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041a7bc
add esp, 0x10010
ret
Function at 0x40b3e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [esp + 0xc], 4
mov eax, dword [esp + 4]
mov eax, dword [eax]
jae 0x40b3f0
xor eax, eax
ret
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
mov dword [esi], 0x7e6
mov dword [esi + 4], 0xc
push eax
mov dword [ecx], 0xc
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esi + 8], eax
mov eax, dword [0x474160]
pop esi
cmp eax, 0xffffffff
je 0x40b44d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 0x10
je 0x40b44c
test bl, 1
jne 0x40b44c
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [0x474160]
and ebx, 0xffffffef
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebx
mov eax, 1
ret

Function at 0x40b460
Capabilities:
Get file size

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [edx + 4]
lea eax, [edx + 4]
push esi
mov esi, dword [esp + 0xc]
add eax, 4
push edi
mov edi, dword [edx]
test ecx, ecx
je 0x40b47c
lea ecx, [esi + 0xc]
sub eax, edx
cmp eax, dword [esp + 0x14]
jbe 0x40b489
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x18]
push ecx
mov dword [esi], 0x7e7
mov dword [esi + 4], 0x10
push edi
mov dword [eax], 0x10
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
pop edi
mov eax, 1
pop esi
ret
Function at 0x40c430
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
lea ecx, [esp + 0x20]
push ecx
lea esi, [edi + 4]
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
je 0x40c481
lea edx, [esp + 0xc]
lea esi, [esi + eax + 1]
push edx
push esi
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
jne 0x40c489
mov eax, dword [esp + 0x20]
push eax
call fcn.0041af0b
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
lea esi, [esi + eax + 1]
push ebp
mov ebp, dword [esi]
add esi, 4
test ebp, ebp
je 0x40c49b
lea ebp, [esp + 0x1c]
mov ecx, dword [esi]
add esi, 4
push ebx
mov ebx, dword [esi]
add esi, 4
test ebx, ebx
je 0x40c4b9
mov eax, dword [esi]
mov dword [esp + 0x10], eax
add esi, 4
lea ebx, [esp + 0x10]
jmp 0x40c4bd
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x40c502
test ebx, ebx
je 0x40c502
lea ecx, [eax - 1]
cmp ecx, 0x13bfe
ja 0x40c502
push eax
call fcn.0041d8b8
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x40c50e
mov edx, dword [esp + 0x28]
push edx
call fcn.0041af0b
mov eax, dword [esp + 0x18]
push eax
call fcn.0041af0b
add esp, 8
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
sub esi, edi
cmp esi, dword [esp + 0x30]
jbe 0x40c537
push ecx
call fcn.0041af0b
mov edx, dword [esp + 0x18]
push edx
call fcn.0041af0b
add esp, 8
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x2c]
push ebx
push eax
mov eax, dword [esp + 0x1c]
push ebp
push eax
push ecx
push edx
mov dword [edi], 0x7ee
lea esi, [edi + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [edi + 8], eax
mov dword [esi], ebp
add esi, 4
test ebp, ebp
je 0x40c56f
mov ecx, dword [esp + 0x20]
mov eax, esi
add esi, 4
mov dword [eax], ecx
mov dword [esi], ebx
add esi, 4
test ebx, ebx
je 0x40c583
mov edx, dword [esp + 0x10]
mov ebx, esi
add esi, 4
mov dword [ebx], edx
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x40c5b2
test ebx, ebx
je 0x40c5b2
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x40c5b2
cmp ebx, 0x13c00
jae 0x40c5b2
cmp dword [edi + 8], 0
jne 0x40c5b2
push ebx
push ebp
push esi
call fcn.0041a2b0
add esp, 0xc
add esi, ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
sub esi, edi
mov dword [edi + 4], esi
push ecx
mov dword [eax], esi
call fcn.0041af0b
mov edx, dword [esp + 0x18]
push edx
call fcn.0041af0b
add esp, 8
test ebp, ebp
je 0x40c5e1
push ebp
call fcn.0041af0b
add esp, 4
pop ebx
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x40c5f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
lea ecx, [esp + 0x20]
push ecx
lea esi, [edi + 4]
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
je 0x40c641
lea edx, [esp + 0xc]
lea esi, [esi + eax*2 + 2]
push edx
push esi
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
jne 0x40c649
mov eax, dword [esp + 0x20]
push eax
call fcn.0041af0b
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
lea esi, [esi + eax*2 + 2]
push ebp
mov ebp, dword [esi]
add esi, 4
test ebp, ebp
je 0x40c65b
lea ebp, [esp + 0x1c]
mov ecx, dword [esi]
add esi, 4
push ebx
mov ebx, dword [esi]
add esi, 4
test ebx, ebx
je 0x40c679
mov eax, dword [esi]
mov dword [esp + 0x10], eax
add esi, 4
lea ebx, [esp + 0x10]
jmp 0x40c67d
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x40c6c2
test ebx, ebx
je 0x40c6c2
lea ecx, [eax - 1]
cmp ecx, 0x13bfe
ja 0x40c6c2
push eax
call fcn.0041d8b8
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x40c6ce
mov edx, dword [esp + 0x28]
push edx
call fcn.0041af0b
mov eax, dword [esp + 0x18]
push eax
call fcn.0041af0b
add esp, 8
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
sub esi, edi
cmp esi, dword [esp + 0x30]
jbe 0x40c6f7
push ecx
call fcn.0041af0b
mov edx, dword [esp + 0x18]
push edx
call fcn.0041af0b
add esp, 8
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x2c]
push ebx
push eax
mov eax, dword [esp + 0x1c]
push ebp
push eax
push ecx
push edx
mov dword [edi], 0x2efe
lea esi, [edi + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [edi + 8], eax
mov dword [esi], ebp
add esi, 4
test ebp, ebp
je 0x40c72f
mov ecx, dword [esp + 0x20]
mov eax, esi
add esi, 4
mov dword [eax], ecx
mov dword [esi], ebx
add esi, 4
test ebx, ebx
je 0x40c743
mov edx, dword [esp + 0x10]
mov ebx, esi
add esi, 4
mov dword [ebx], edx
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x40c772
test ebx, ebx
je 0x40c772
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x40c772
cmp ebx, 0x13c00
jae 0x40c772
cmp dword [edi + 8], 0
jne 0x40c772
push ebx
push ebp
push esi
call fcn.0041a2b0
add esp, 0xc
add esi, ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
sub esi, edi
mov dword [edi + 4], esi
push ecx
mov dword [eax], esi
call fcn.0041af0b
mov edx, dword [esp + 0x18]
push edx
call fcn.0041af0b
add esp, 8
test ebp, ebp
je 0x40c7a1
push ebp
call fcn.0041af0b
add esp, 4
pop ebx
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
Function at 0x40c7b0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push ecx
lea esi, [edi + 4]
push esi
mov dword [esp + 0x14], eax
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
je 0x40c7f9
lea edx, [esp + 8]
lea esi, [esi + eax + 1]
push edx
push esi
call fcn.00406f30
add esp, 8
cmp eax, 0xffffffff
jne 0x40c801
mov eax, dword [esp + 0x14]
push eax
call fcn.0041af0b
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 8
ret
lea eax, [esi + eax + 1]
mov edx, dword [eax + 4]
add eax, 4
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [eax - 4]
add eax, 4
add eax, 4
test edx, edx
je 0x40c82d
lea edx, [ecx - 1]
cmp edx, 0x13bfe
ja 0x40c82d
mov edx, eax
add eax, ecx
jmp 0x40c82f
xor edx, edx
sub eax, edi
cmp eax, dword [esp + 0x20]
jbe 0x40c857
mov eax, dword [esp + 0x18]
push eax
call fcn.0041af0b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041af0b
add esp, 8
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov esi, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push ebx
push ebp
push edx
mov dword [esi], 0x7ef
lea edi, [esi + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], eax
mov eax, edi
sub eax, esi
mov dword [esi + 4], eax
push ebp
mov dword [ecx], eax
call fcn.0041af0b
push ebx
call fcn.0041af0b
add esp, 8
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x40c8b0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push ecx
lea esi, [edi + 4]
push esi
mov dword [esp + 0x14], eax
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
je 0x40c8f9
lea edx, [esp + 8]
lea esi, [esi + eax*2 + 2]
push edx
push esi
call fcn.00406fe0
add esp, 8
cmp eax, 0xffffffff
jne 0x40c901
mov eax, dword [esp + 0x14]
push eax
call fcn.0041af0b
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 8
ret
lea eax, [esi + eax*2 + 2]
mov edx, dword [eax + 4]
add eax, 4
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [eax - 4]
add eax, 4
add eax, 4
test edx, edx
je 0x40c92d
lea edx, [ecx - 1]
cmp edx, 0x13bfe
ja 0x40c92d
mov edx, eax
add eax, ecx
jmp 0x40c92f
xor edx, edx
sub eax, edi
cmp eax, dword [esp + 0x20]
jbe 0x40c957
mov eax, dword [esp + 0x18]
push eax
call fcn.0041af0b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041af0b
add esp, 8
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov esi, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push ebx
push ebp
push edx
mov dword [esi], 0x2eff
lea edi, [esi + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], eax
mov eax, edi
sub eax, esi
mov dword [esi + 4], eax
push ebp
mov dword [ecx], eax
call fcn.0041af0b
push ebx
call fcn.0041af0b
add esp, 8
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x40d090
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 4]
lea eax, [ecx + 4]
add eax, 4
push ebx
mov ebx, dword [ecx]
push edi
mov edi, dword [eax]
sub eax, ecx
add eax, 4
cmp eax, dword [esp + 0x14]
jbe 0x40d0b3
pop edi
xor eax, eax
pop ebx
ret
push ebp
push esi
mov esi, dword [esp + 0x18]
mov dword [esi], 0x9ce
lea ebp, [esi + 0xc]
cmp edi, 0x10000
jbe 0x40d0d3
mov dword [esi + 8], 0xffffffff
jmp 0x40d0ed
test edx, edx
je 0x40d0d9
mov edx, ebp
push edi
push edx
push ebx
call fcn.00421074
add esp, 0xc
mov dword [esi + 8], eax
test eax, eax
jle 0x40d0ed
add ebp, eax
mov ecx, dword [esp + 0x20]
mov eax, ebp
sub eax, esi
mov dword [esi + 4], eax
pop esi
pop ebp
pop edi
mov dword [ecx], eax
mov eax, 1
pop ebx
ret

Function at 0x40d190
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, dword [esi]
lea eax, [esi + 4]
mov edx, dword [eax + 4]
add eax, 4
mov ebx, dword [eax + 4]
push edi
mov edi, dword [eax - 4]
add eax, 4
add eax, 4
test ecx, ecx
je 0x40d1c4
test edx, edx
jbe 0x40d1c4
test edi, edi
jbe 0x40d1c4
mov ebp, edx
imul ebp, edi
mov ecx, eax
add eax, ebp
sub eax, esi
cmp eax, dword [esp + 0x1c]
jbe 0x40d1d3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov esi, dword [esp + 0x18]
mov dword [esi], 0x9d1
lea ebp, [esi + 0xc]
cmp edx, 0x10000
jbe 0x40d1f1
mov dword [esi + 8], 0
jmp 0x40d200
push ebx
push edx
push edi
push ecx
call fcn.0041adba
add esp, 0x10
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x20]
mov eax, ebp
sub eax, esi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
ret

Function at 0x40d220
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push ebx
push ebp
lea eax, [ecx + 4]
mov ebx, dword [eax + 4]
add eax, 4
mov ebp, dword [eax + 4]
push edi
mov edi, dword [eax - 4]
add eax, 4
sub eax, ecx
add eax, 4
cmp eax, dword [esp + 0x18]
jbe 0x40d24c
pop edi
pop ebp
xor eax, eax
pop ebx
ret
mov ecx, ebx
imul ecx, edi
push esi
mov esi, dword [esp + 0x18]
lea eax, [esi + 0xc]
mov dword [esi], 0x9d9
mov dword [esp + 0x14], eax
cmp ecx, 0x10000
jbe 0x40d274
mov dword [esi + 8], 0xffffffff
jmp 0x40d291
test edx, edx
je 0x40d27a
mov edx, eax
push ebp
push ebx
push edi
push edx
call fcn.0041ab5e
add esp, 0x10
mov dword [esi + 8], eax
test eax, eax
jbe 0x40d291
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
sub eax, esi
mov dword [esi + 4], eax
pop esi
pop edi
pop ebp
mov dword [edx], eax
mov eax, 1
pop ebx
ret