joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406647
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x40666b
xor eax, eax
test eax, eax
je 0x40667d
cmp byte [ebp + eax - 0x121], 0x5c
je 0x40667d
xor ecx, ecx
jmp 0x406680
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x40676c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42ca1c], 0
push esi
jne 0x4067a3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40677d
mov dword [ecx*4 + 0x42ca18], eax
inc ecx
cmp ecx, 0x100
jl 0x406778
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067d4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42ca18]
xor eax, esi
inc ecx
dec edx
jne 0x4067b6
pop edi
not eax
pop esi
ret 0xc

Function at 0x401300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push str.TeenyWiny
push str.Balaklava
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401338
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xbc], eax
push str.Times_New
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 8]
push eax
call fcn.00401600
add esp, 4
push str.Roman
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x3c], 0xe
mov dword [ebp - 0x4c], 0xa
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call section..text
add esp, 8
test eax, eax
jne 0x40139c
xor eax, eax
jmp 0x4013d5
push 0
push 0
push 0
lea ecx, [ebp - 0xb8]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4013cf
lea edx, [ebp - 0xb8]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40139c
mov eax, dword [ebp - 0xb0]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov edx, dword [0x42d00c]
mov eax, dword [ebp + 8]
mov esi, ecx
xor edx, ebp
mov dword [ebp - 8], edx
cmp dword [esi + 0x1c], eax
jne 0x401a82
mov eax, dword [esi + 0x20]
inc eax
jmp 0x401a91
mov dword [esi + 0x1c], eax
mov eax, 1
mov dword [esi + 0x20], 0
mov dword [esi + 0x20], eax
cmp dword [esi + 0x10], 0
je 0x401aff
cmp dword [esi + 0x14], 8
jb 0x401b11
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push 0x429284
push eax
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x401aff
push dword [ebp - 0xc]
push 1
push 5
push str.GBP1_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push dword [esi + 0x1c]
push 0x429233
push dword [ebp - 0xc]
call fcn.00401b80
add esp, 0xc
push dword [esi + 0x20]
push 0x429233
push dword [ebp - 0xc]
call fcn.00401b80
add esp, 0xc
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00425eac
add esp, 8
pop esi
pop ebp
ret 4
mov eax, esi
jmp 0x401aa2
Function at 0x4048e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x42d00c]
mov bl, 1
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x38], 0
je 0x404961
cmp byte [ecx + 0x3d], 0
mov esi, ecx
je 0x404961
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40495f
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x34]
lea edi, [ebp - 0x30]
lea edx, [esi + 0x40]
mov ebx, dword [ecx]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edx
call dword [ebx + 0x20]
cmp eax, 3
je 0x404975
cmp eax, 1
je 0x40493b
test eax, eax
jne 0x40495f
mov byte [esi + 0x3d], 0
mov ebx, dword [ebp - 0x34]
sub ebx, edi
je 0x404956
push dword [esi + 0x4c]
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x40495f
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x404961
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425eac
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x404961
Function at 0x406b30
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov eax, dword [0x42d00c]
xor eax, ebp
mov dword [ebp - 8], eax
push str.MOZ_CRASHREPORTER_NO_DELETE_DUMP
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x406b5c
cmp byte [eax], 0
jne 0x406c3b
cmp dword [0x42d558], 0
je 0x406ba9
lea esi, [ebp - 0x20]
mov edx, 0x42d548
mov ecx, esi
call fcn.00411750
cmp dword [ebp - 0xc], 7
jbe 0x406b7d
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
cmp ecx, 8
jb 0x406ba9
mov eax, dword [ebp - 0x20]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x406c4b
push edx
push eax
call fcn.004255af
add esp, 8
cmp dword [0x42d570], 0
je 0x406bf2
lea esi, [ebp - 0x20]
mov edx, 0x42d560
mov ecx, esi
call fcn.00411750
cmp dword [ebp - 0xc], 7
jbe 0x406bca
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
cmp ecx, 8
jb 0x406bf2
mov eax, dword [ebp - 0x20]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x406c66
push edx
push eax
call fcn.004255af
add esp, 8
cmp dword [0x42d588], 0
je 0x406c3b
lea esi, [ebp - 0x20]
mov edx, 0x42d578
mov ecx, esi
call fcn.00411750
cmp dword [ebp - 0xc], 7
jbe 0x406c13
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
cmp ecx, 8
jb 0x406c3b
mov eax, dword [ebp - 0x20]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x406c81
push edx
push eax
call fcn.004255af
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00425eac
add esp, 0x1c
pop esi
pop ebp
ret
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x406c99
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x406b9f
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x406c99
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x406be8
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x406c99
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x406c31
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x410cb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1c
mov eax, ecx
mov ecx, dword [0x42d00c]
lea esi, [ebp - 0x24]
mov edx, eax
xor ecx, ebp
mov dword [ebp - 0xc], ecx
mov ecx, esi
call fcn.00411750
cmp dword [ebp - 0x10], 7
jbe 0x410cda
mov esi, dword [ebp - 0x24]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
cmp ecx, 8
jb 0x410d06
mov eax, dword [ebp - 0x24]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x410d30
push edx
push eax
call fcn.004255af
add esp, 8
test esi, esi
jne 0x410d17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410d2c
mov bl, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00425eac
mov eax, ebx
add esp, 0x1c
pop esi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x410d19
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x410d48
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x410cfc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x411f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
cmp byte [0x42d620], 1
movzx eax, cx
jne 0x411fad
push 5
push eax
push 0
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push edi
push dword [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
or byte [esi + 0xa], 0x40
push 0
push dword [ebp + 8]
push dword [ebp - 0x14]
push esi
push 0
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x411fbc
push 0
push dword [ebp + 8]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamW]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x414a10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x42d00c]
mov edi, edx
mov esi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x10]
cmp dword [ecx + 0x10], eax
je 0x414ac1
lea ebx, [ebp - 0x28]
mov edx, edi
mov ecx, ebx
call fcn.00411750
cmp dword [ebp - 0x14], 7
jbe 0x414a48
mov ebx, dword [ebp - 0x28]
lea edi, [ebp - 0x40]
mov edx, esi
mov ecx, edi
call fcn.00411750
cmp dword [ebp - 0x2c], 7
jbe 0x414a5d
mov edi, dword [ebp - 0x40]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x2c]
cmp eax, 1
sete bl
cmp ecx, 8
jb 0x414a8c
mov eax, dword [ebp - 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x414ae8
push edx
push eax
call fcn.004255af
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x414aad
mov eax, dword [ebp - 0x28]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x414b00
push edx
push eax
call fcn.004255af
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425eac
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esi + 0x14], 0xf
jbe 0x414b18
mov ecx, dword [esi]
cmp dword [edi + 0x14], 0xf
jbe 0x414b20
mov edx, dword [edi]
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x414a33
mov bl, 1
jmp 0x414aad
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x414b24
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x414a82
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x414b24
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x414aa3
mov ecx, esi
cmp dword [edi + 0x14], 0xf
ja 0x414acf
mov edx, edi
jmp 0x414ad1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x4173e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x814
mov eax, dword [0x42d00c]
lea esi, [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push 0
push 0x31
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41741f
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
lea ebx, [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x400
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x18]
cmp dword [esi + 0x1c], 8
jb 0x417441
mov ebx, dword [ebx]
lea edx, [ebp - 0x818]
push edx
push eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
xor esi, esi
test eax, eax
je 0x4174dc
lea eax, [ebp - 0x810]
mov ebx, eax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
lea ecx, [ebp - 0x820]
push ecx
push eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x4174dc
mov eax, dword [ebp - 0x818]
mov edx, dword [ebp - 0x820]
lea edi, [ebp + 0x10]
sub eax, edx
js 0x4174df
lea edi, [ebp + 8]
mov esi, dword [edi + 0x24]
mov ecx, dword [edi + 4]
test esi, esi
jne 0x4174a8
mov esi, dword [ecx + 8]
sub esi, edx
sub esi, dword [ecx]
add esi, eax
cmp byte [edi + 0x20], 0
je 0x4174b4
sub dword [ecx], esi
jmp 0x4174b7
add dword [ecx + 8], esi
lea eax, [ebp + 8]
mov ebx, eax
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [eax + 8]
sub ecx, edi
sub eax, edx
push 1
push ecx
push eax
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_MoveWindow]
lea edi, [ebp + 0x10]
lea eax, [ebp + 8]
mov ecx, dword [eax + 0x1c]
cmp ecx, 8
jb 0x417502
mov eax, dword [edi]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x417519
push edx
push eax
call fcn.004255af
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425eac
mov eax, esi
add esp, 0x814
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x417531
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x4174f8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x417540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x42d00c]
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, edx
lea ebx, [ebp - 0x1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ecx], 0
push ebx
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x417586
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x417586
xor ebx, ebx
jmp 0x4175c7
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 4
lea edx, [ebp - 0x20]
lea edi, [ebp - 0x14]
push ecx
push edx
push edi
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
test eax, eax
jne 0x4175be
cmp dword [ebp - 0x14], 4
jne 0x4175be
cmp dword [ebp - 0x20], 1
mov eax, dword [ebp + 8]
mov bl, 1
sete byte [eax]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425eac
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4179d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x838
mov eax, dword [0x42d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x3f6
mov dword [ebp - 0x840], ecx
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push 0
push 0
push 0x31
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x417a1c
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
lea esi, [ebp - 0x838]
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
push esi
push dword [ebp - 0x840]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea esi, [ebp - 0x810]
push 0x400
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
lea ecx, [ebp - 0x828]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x417c02
mov ecx, dword [ebp - 0x838]
mov esi, dword [ebp - 0x830]
mov eax, dword [ebp - 0x828]
sub esi, ecx
cmp eax, esi
jl 0x417c02
cvtsi2ss xmm0, eax
cvtsi2ss xmm1, esi
divss xmm0, xmm1
cvtss2sd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
mov ebx, ecx
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
mov edx, ebx
add esp, 8
fstp dword [ebp - 0x844]
mov ecx, dword [ebp - 0x834]
cvttss2si eax, dword [ebp - 0x844]
mov ebx, ecx
imul eax, dword [ebp - 0x824]
sub ebx, dword [ebp - 0x82c]
add ebx, eax
test ebx, ebx
jle 0x417c02
push 1
push eax
push esi
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
mov esi, dword [0x42d618]
mov ecx, dword [esi + 4]
call fcn.00416e60
mov eax, dword [0x42d618]
lea ecx, [ebp - 0x820]
lea edx, [ebp - 0x83c]
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [0x42d61c], 0
mov dword [ebp - 0x83c], 0x3ed
call fcn.00418b10
lea edi, [ebp - 0x820]
lea edx, [ebp - 0x83c]
mov dword [ebp - 0x83c], 0x3f4
mov ecx, edi
call fcn.00418b10
push edi
mov esi, dword [ebp - 0x840]
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
add ebx, dword [ebp - 0x814]
mov dword [ebp - 0x814], ebx
mov ecx, dword [ebp - 0x81c]
mov eax, dword [ebp - 0x820]
mov edx, dword [ebp - 0x818]
sub ebx, ecx
sub edx, eax
push 1
push ebx
push edx
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
lea esi, [ebp - 0x820]
mov edx, 0x4276d8
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276dc
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276e0
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276e4
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276e8
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276ec
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276f0
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276f4
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276f8
mov ecx, esi
call fcn.00418b10
mov edx, 0x4276fc
mov ecx, esi
call fcn.00418b10
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425eac
add esp, 0x838
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x418710
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x828
mov eax, dword [0x42d00c]
mov esi, edx
lea edi, [ebp - 0x810]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x400
push edi
push 0x3f1
mov dword [ebp - 0x830], ecx
push ecx
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], 0
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 4
mov ebx, eax
cmp eax, 7
jbe 0x418795
sub esp, 0xc
mov al, byte [ebp - 0x82c]
lea ecx, [ebp - 0x828]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], ebx
call section..text
jmp 0x4187ba
mov eax, ebx
mov dword [ebp - 0x818], ebx
lea ecx, [ebp - 0x828]
add eax, ebx
push eax
push edi
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov word [ebp + ebx*2 - 0x828], 0
cmp dword [0x42d5fc], 7
mov eax, 0x42d5e8
jbe 0x4187cd
mov eax, dword [0x42d5e8]
lea ecx, [ebp - 0x82c]
push ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x418828
mov eax, dword [ebp - 0x818]
cmp dword [ebp - 0x814], 7
lea eax, [eax + eax + 2]
jbe 0x4187ff
mov ecx, dword [ebp - 0x828]
jmp 0x418805
lea ecx, [ebp - 0x828]
push eax
push ecx
push 1
push 0
push str.Email
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x418853
mov eax, dword [ebp - 0x828]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x41893a
push edx
push eax
call fcn.004255af
add esp, 8
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x814], 7
push 0x3f2
push dword [ebp - 0x830]
call edi
xor ebx, ebx
test eax, eax
mov esi, 0x42d5e8
mov ecx, 0x42d5e8
setne al
cmp dword [0x42d5fc], 7
jbe 0x418896
mov ecx, dword [0x42d5e8]
mov bl, al
mov edx, str.IncludeURL
push ebx
call fcn.00418ed0
add esp, 4
push 0x3f0
push dword [ebp - 0x830]
call edi
xor ebx, ebx
test eax, eax
mov ecx, 0x42d5e8
setne al
cmp dword [0x42d5fc], 7
jbe 0x4188ce
mov ecx, dword [0x42d5e8]
mov bl, al
mov edx, str.EmailMe
push ebx
call fcn.00418ed0
add esp, 4
push 0x3ef
push dword [ebp - 0x830]
call edi
xor ebx, ebx
test eax, eax
setne al
cmp dword [0x42d5fc], 7
jbe 0x418901
mov esi, dword [0x42d5e8]
mov bl, al
mov edx, str.SubmitCrashReport
mov ecx, esi
push ebx
call fcn.00418ed0
add esp, 4
push dword [ebp - 0x834]
push dword [ebp - 0x830]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425eac
add esp, 0x828
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x418955
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x418849
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x418960
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x7e4
mov dword [ebp - 0x7f0], edx
mov edi, ecx
lea ebx, [ebp - 0x3fa]
mov eax, dword [0x42d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1f5
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x7ec]
lea ecx, [ebp - 0x7e8]
push eax
push ecx
push 0xb0
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x7ec]
mov ecx, dword [ebp - 0x7e8]
mov edi, 0xfffffffe
sub eax, ecx
je 0x418a10
lea edi, [ebp - 0x7e4]
lea ecx, [ebp + ecx*2 - 0x3fa]
push eax
push ecx
push 0x1f5
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov eax, dword [ebp - 0x7ec]
sub eax, dword [ebp - 0x7e8]
mov word [ebp + eax*2 - 0x7e4], 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
not edi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call esi
mov ebx, eax
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x7f0]
push 0
push 0xfde9
call esi
mov ecx, dword [ebp - 0x10]
add ebx, edi
add ebx, eax
xor ecx, ebp
call fcn.00425eac
mov eax, ebx
add esp, 0x7e4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x418ed0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x42d00c]
mov esi, edx
mov edi, ecx
lea ebx, [ebp - 0x14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push 2
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418f16
push 0x429288
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 2
push 0
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418f42
push 0x429288
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x418f77
movzx eax, byte [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425eac
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret