joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bb08
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x615580]
cmp dword [eax + 0x30], 0
je 0x45bbb2
cmp dword [ebx + 0x94], 0
jne 0x45bbac
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45ba98
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45bbac
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45bb72
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45bbac
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417998
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45bb81
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45c8cc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45c901
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047ec
jmp 0x45c90e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404750
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45dc88
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45dcf6
mov eax, esi
call fcn.00447930
test al, al
je 0x45dcf6
mov eax, dword [ebx + 0x84]
call fcn.00447590
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45dcf6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45dcea
push 0
mov eax, dword [ebx + 0x84]
call fcn.00447590
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043f9b0
jmp 0x45dcf6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045dac4
pop esi
pop ebx
ret

Function at 0x461d80
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x1c]
add esp, 0x20
ret
Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
bound esp, qword [eax - 0x69]
xor bh, byte [ecx]
and esi, dword [edi + esi - 0x18]
sbb ah, ch
in eax, 0xaf
jb 0x414b2f
rol dword [ecx], 8
invalid
in al, 0xb1
push ss
invalid
jmp 0xe9788078
adc ebx, ebx
pop edi
xor al, 0x35
jno 0x414b9e
cwde
jecxz 0x414afb
loope 0x414b01
pop ebp
aaa
cdq
xor esi, dword [0x357303b6]
aaa
jmp 0x2e75253b
mov cl, 0x31
aaa
jmp 0x9d3d5818
Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x405600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and cl, byte [eax]
cmp dword [edi - 0x7212a9a4], edi
add byte [eax], al
mov dl, 0xca
out dx, al
sar edx, 0xaf
in al, 0x2b
rcl dword [eax]
mov cl, 0x10
jecxz 0x4055bb
pop ebp
nop
jmp 0x405625
jmp 0x405636
mov esi, 0x162
nop
jmp 0x40564c
invalid
nop
jmp 0x405661
push 0x40
jmp 0x405671
push 0x1000
push esi
jmp 0x40568a
push 0
jmp 0x405699
push 0xe553a458
call ebp
mov ebx, eax
jmp 0x4056b4
mov edi, eax
nop
mov ecx, esi
call fcn.004057db
jmp fcn.004056d0
Function at 0x4012a5
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 0
push 0x63
push 0x2a
push 0x15
push 0
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
jmp 0x40131c
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0xcfb
jge 0x401330
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x401313
push 0x40
mov ebx, 0x1000
push ebx
mov eax, 0x1400
push eax
push 0
push str.w353hjsfds
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x2c]
call dword [ebp - 0x2c]
mov dword [0x40f3a8], eax
mov dword [ebp + 8], 0x27
mov eax, 0xa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40228d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40eff8
cmp edx, dword [eax]
je 0x4022af
add eax, 8
inc ecx
cmp eax, 0x40f088
jl 0x4022a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40eff8]
jne 0x4023dd
mov eax, dword [0x40f3bc]
cmp eax, 1
je 0x4023b7
test eax, eax
jne 0x4022e0
cmp dword [0x40ef4c], 1
je 0x4023b7
cmp edx, 0xfc
je 0x4023dd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402317
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004036d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004037c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40235a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004037c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x405b88
push edi
call fcn.004038d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004036d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004036e0
lea eax, [ebp - 0xa0]
push 0x405b68
push eax
call fcn.004036e0
push dword [esi + 0x40effc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004036e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040383b
add esp, 0x2c
pop edi
jmp 0x4023dd
lea eax, [ebp + 8]
lea esi, [esi + 0x40effc]
push 0
push eax
push dword [esi]
call fcn.004037c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x414de5
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], eax
add ebx, ebx
add ebx, 1
sub edi, 0xf55e1f4e
add edx, 4
cmp edx, ecx
jne fcn.00414de5
ret
Function at 0x401110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401129
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401164
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401160
lea ebx, [ebx]
cmp esi, eax
jae 0x401164
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401150
cmp esi, eax
jb 0x40116a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x407660
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a480
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3c08
call fcn.005f9ca0
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x3c18], esi
mov dword [ebp - 4], 0
push 0x1400
push 0
lea eax, [ebp - 0x1414]
push eax
call fcn.005f8cb0
add esp, 0xc
push 0x13ff
cmp dword [esi + 0x177c], 0
je 0x4076fe
lea ecx, [ebp - 0x3c14]
push ecx
mov edx, dword [esi + 0x1778]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x407712
push 0x1400
lea eax, [ebp - 0x1414]
push eax
lea ecx, [ebp - 0x3c14]
push ecx
call fcn.004071f0
add esp, 0xc
jmp 0x407712
lea edx, [ebp - 0x1414]
push edx
mov eax, dword [esi + 0x1778]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x1400
lea ecx, [ebp - 0x1414]
push ecx
mov ecx, esi
call fcn.00407370
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005f85e7
mov esp, ebp
pop ebp
ret

Function at 0x408a80
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push ebx
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jle 0x408ae7
add esi, 3
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.005cfaa6
mov edi, eax
add esp, 4
test edi, edi
je 0x408ae0
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x408ad7
mov ecx, dword [esp + 0x18]
push edi
call fcn.004017d0
mov ebp, 1
push edi
call fcn.005cfa9b
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x408ba0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x625758
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x70a308]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
mov eax, dword [0x70a308]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
xor eax, eax
mov ebx, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov word [esp + 0x10], ax
mov dword [esp + 0x24], eax
push esi
call fcn.0059c050
movzx ecx, al
add esp, 4
neg ecx
sbb ecx, ecx
and ecx, 0xfde9
push ecx
push esi
lea ecx, [esp + 0x14]
call fcn.00401960
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x408c1e
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [ebx + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.004011f0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005f85e7
add esp, 0x1c
ret 8

Function at 0x40c0b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61af70
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3c04
call fcn.005f9ca0
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
push 0x1400
push 0
lea eax, [ebp - 0x1414]
push eax
call fcn.005f8cb0
add esp, 0xc
push 0x13ff
cmp dword [esi + 0x588], 0
je 0x40c148
lea ecx, [ebp - 0x3c14]
push ecx
mov edx, dword [esi + 0x584]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40c15c
push 0x1400
lea eax, [ebp - 0x1414]
push eax
lea ecx, [ebp - 0x3c14]
push ecx
call fcn.004071f0
add esp, 0xc
jmp 0x40c15c
lea edx, [ebp - 0x1414]
push edx
mov eax, dword [esi + 0x584]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x1414]
push ecx
push 0x64edec
lea edx, [esi + 0x50c]
push edx
call fcn.00402f60
add esp, 0xc
mov ecx, esi
call fcn.0040bb80
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005f85e7
mov esp, ebp
pop ebp
ret
Function at 0x40d1d0
Capabilities:
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x2b8]
sub esp, 0x2b8
push 0xffffffffffffffff
push 0x61b098
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [esi + 0x74]
call fcn.0040ce30
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [esi + 0xc8]
cmp edi, dword [eax + 0x1c]
jge 0x40d365
lea ecx, [ebp - 0x14]
call fcn.004024e0
mov byte [ebp - 4], 1
push edi
mov ecx, dword [esi + 0xc8]
add ecx, 0x14
call fcn.0040d090
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [esi + 0xc8]
mov eax, dword [edx + 4]
push eax
push 0x650bf0
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f60
add esp, 0x10
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [esi + 0x74]
call fcn.0040ce10
mov ebx, eax
inc dword [ebp - 0x18]
push 0x2b4
push 0
lea ecx, [ebp]
push ecx
call fcn.005f8cb0
add esp, 0xc
push edi
mov ecx, dword [esi + 0xc8]
add ecx, 0x14
call fcn.0040d090
mov eax, dword [eax]
push 0x4411
push 0x160
lea edx, [ebp]
push edx
push 0x80
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x48], 0
mov eax, dword [ebp + 4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [esi + 0x74]
call fcn.0040cdd0
push edi
mov ecx, dword [esi + 0xc8]
add ecx, 0x14
call fcn.0040d090
cmp dword [eax + 8], 0
mov eax, 0x710c2c
jne 0x40d2ff
mov eax, 0x710c30
mov eax, dword [eax]
push eax
push ebx
push 1
mov edx, dword [esi + 0x94]
push edx
call fcn.0040ce70
add esp, 0x10
mov dword [ebp - 0x7c], 2
push edi
mov ecx, dword [esi + 0xc8]
add ecx, 0x14
call fcn.0040d090
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x84]
push eax
push ebx
push 0x1074
mov ecx, dword [esi + 0x94]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
push ebx
lea ecx, [esi + 0x74]
call fcn.0040cdf0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402550
inc edi
jmp 0x40d21e
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.005f85e7
add ebp, 0x2b8
mov esp, ebp
pop ebp
ret
Function at 0x40d4c0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61b0e8
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call fcn.005d169f
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [0x70f738], ebx
je 0x40d51e
push esi
call fcn.00454ae0
add esp, 4
push 0x129
push esi
mov ecx, 0x70f6f8
call fcn.004d64c0
push 0x160
push ebx
lea eax, [ebp - 0x198]
push eax
call fcn.005f8cb0
add esp, 0xc
push 0x4011
push 0x160
lea ecx, [ebp - 0x198]
push ecx
push 0x80
push 0x650c48
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea edi, [esi + 0x74]
push eax
push 1
push 0x1003
mov ecx, edi
call fcn.00401590
push 0x21
mov ecx, edi
call fcn.0040ce50
mov byte [ebp - 0x1a4], bl
mov eax, 0x60
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
xor edx, edx
mov word [ebp - 0x1c], dx
mov byte [ebp - 4], 1
mov eax, dword [0x70f730]
push eax
mov ecx, dword [0x710c20]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401960
mov eax, dword [ebp - 0x20]
cmp eax, ebx
jne 0x40d5b5
lea eax, [ebp - 0x1c]
push eax
push 0xbe
lea ecx, [ebp - 0x1a4]
call fcn.0040cf20
push eax
push ebx
mov edx, dword [esi + 0x94]
push edx
call fcn.0040cce0
add esp, 0x10
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
xor eax, eax
mov word [ebp - 0x34], ax
mov byte [ebp - 4], 2
mov ecx, dword [0x70f730]
push ecx
mov edx, dword [0x710c24]
push edx
lea ecx, [ebp - 0x38]
call fcn.00401960
mov eax, dword [ebp - 0x38]
cmp eax, ebx
jne 0x40d607
lea eax, [ebp - 0x34]
push eax
push 0x6e
lea ecx, [ebp - 0x1a4]
call fcn.0040cf20
push eax
push 1
mov eax, dword [esi + 0x94]
push eax
call fcn.0040cce0
add esp, 0x10
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
xor ecx, ecx
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 3
mov edx, dword [0x70f730]
push edx
mov eax, dword [0x710c28]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401960
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
jne 0x40d656
lea eax, [ebp - 0x28]
push eax
push 0x12c
lea ecx, [ebp - 0x1a4]
call fcn.0040cf20
push eax
push 2
mov ecx, dword [esi + 0x94]
push ecx
call fcn.0040cce0
add esp, 0x10
mov ecx, esi
call fcn.0040d1d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.004011f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.004011f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.004011f0
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005f85e7
mov esp, ebp
pop ebp
ret
Function at 0x40d850
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 0x14]
push 1
xor esi, esi
push esi
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d8a5
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.found
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d8a5
mov esi, dword [esp + 8]
mov eax, dword [esp + 4]
test eax, eax
je 0x40d8b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4

Function at 0x40d9a0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x61b11b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x70a308]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70a308]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x14], edi
je 0x40daef
mov eax, dword [esi + 8]
xor ebx, ebx
cmp eax, edi
mov dword [esp + 0x14], edi
jle 0x40daef
test edi, edi
jl 0x40db17
cmp ebx, eax
jge 0x40db17
mov eax, dword [esi + 4]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0xf003f
push 0
push 0x64f8bc
add eax, edi
mov eax, dword [eax + 4]
push 0
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40da74
lea ecx, [esp + 0x20]
call fcn.004b1950
mov dword [esp + 0x23c], 0
push 1
push str.Cannot_open__create__registry_subkey_during_CBrowsersIntegration::Save__._r_n
lea ecx, [esp + 0x28]
call fcn.004b1ac0
mov dword [esp + 0x23c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.004b1ab0
jmp 0x40dad1
cmp ebx, dword [esi + 8]
jge 0x40db17
mov ecx, dword [esi + 4]
mov ecx, dword [edi + ecx]
mov eax, ecx
lea ebp, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40da88
mov edx, dword [esp + 0x14]
sub eax, ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push ecx
push 1
push 0
push 0x650fa8
push edx
call ebp
cmp ebx, dword [esi + 8]
jge 0x40db17
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi + 8]
mov eax, dword [esp + 0x14]
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push 0
push 0x650fa4
push eax
mov dword [esp + 0x30], ecx
call ebp
mov eax, dword [esi + 8]
inc ebx
add edi, 0xc
cmp ebx, eax
jl 0x40d9f9
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40daef
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.005f85e7
add esp, 0x22c
ret
call fcn.005cfbb9
int3