joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
lea ebx, [eax*4]
lea eax, [ebp - 0x24]
lea esi, [ecx + ebx]
mov ecx, edx
lea edx, [ebp - 0x20]
sub esp, 0x3c
add ebx, dword [ebp + 8]
mov dword [esi], 0
mov dword [ebx], 0
mov dword [ebp - 0x20], 0
call sym._registry_get_handle
test eax, eax
jne 0x40c487
mov eax, dword [ebp - 0x20]
cmp eax, 2
je 0x40c490
mov dword [esi], 0xf
cmp eax, 2
je 0x40c4d8
xor eax, eax
test edi, edi
sete al
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x20]
jne 0x40c464
jmp 0x40c46a
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c46f
jmp 0x40c478

Function at 0x40c520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x41c2c0
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call sym._registry_read_formatopts
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41c2dc
pop ebx
mov eax, 1
pop esi
pop ebp
jmp sym._registry_read_formatopts

Function at 0x40c560
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 4
call sym._registry_get_handle
test eax, eax
je 0x40c5a8
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c58b
cmp dword [ebp - 0xc], 4
jne 0x40c58b
jmp 0x40c591
Function at 0x40c680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0x10
test eax, eax
je 0x40c6cb
lea edx, [ebp - 0xc]
mov dword [esp + 0x10], 0x410d60
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.PageMargin
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x40c6f8
mov dword [0x410d60], 0x6dd
mov dword [0x410d68], 0x6dd
mov dword [0x410d64], 0x589
mov dword [0x410d6c], 0x589
leave
ret
cmp dword [ebp - 0xc], 0x10
jne 0x40c6cb
jmp 0x40c6f3

Function at 0x40c700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 4
test eax, eax
je 0x40c74b
lea edx, [ebp - 0xc]
mov dword [esp + 0x10], 0x410de4
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviewPages
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
je 0x40c760
mov dword [0x410de4], 1
leave
ret
cmp dword [ebp - 0xc], 4
jne 0x40c74b
mov eax, dword [0x410de4]
test eax, eax
jle 0x40c74b
cmp eax, 2
jle 0x40c755
mov dword [0x410de4], 2
leave
ret

Function at 0x40c780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 0x10
call sym._registry_get_handle
test eax, eax
je 0x40c7e0
test ebx, ebx
je 0x40c7ca
mov dword [ebx], 0
mov dword [ebx + 8], 0x258
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0x12c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c7ab
cmp dword [ebp - 0xc], 0x10
jne 0x40c7ab
jmp 0x40c7ca
Function at 0x40c820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Recent_file_list
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x6c]
push ebx
sub esp, 0x9c
call sym._registry_get_handle
test eax, eax
je 0x40c858
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._registry_read_filelist
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, 0x3ed
lea esi, [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetMenu]
mov dword [ebp - 0x48], 0x30
mov dword [ebp - 0x7c], eax
sub esp, 4
mov dword [ebp - 0x44], 0x20
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetMenuItemInfoW]
sub esp, 0x10
test eax, eax
je 0x40c8d4
mov eax, dword [ebp - 0x28]
mov dword [ebp + edi*4 - 0x100c], eax
inc edi
cmp edi, 0x3f1
jne 0x40c89e
mov eax, dword [ebp - 0x58]
mov esi, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [ebp - 0x7c], eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
je 0x40c9c8
mov eax, dword [ebp - 0x7c]
xor edi, edi
mov ecx, esi
mov esi, edi
mov edi, ecx
test eax, eax
je 0x40c930
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
sub esp, 8
test eax, eax
je 0x40c9e7
inc esi
cmp esi, 4
je 0x40c930
mov eax, dword [ebp + esi*4 - 0x58]
test eax, eax
jne 0x40c906
lea esi, [esi]
nop
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x40c949
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x54], eax
mov edi, dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [ebp + 8]
lea esi, [ebp - 0x64]
test edx, edx
je 0x40c9c8
inc ebx
mov dword [ebp + 8], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.File_d
mov dword [esp], esi
call edi
mov edx, dword [ebp + 8]
cmp word [edx], 0
je 0x40c9e0
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x40c980
sub eax, edx
add eax, 2
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
cmp ebx, 4
je 0x40c9c8
mov edx, dword [ebp + ebx*4 - 0x58]
jmp 0x40c955
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x40c840
mov eax, 2
jmp 0x40c98e
test esi, esi
je 0x40c949
lea eax, [ebp - 0x58]
lea edx, [esi*4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x54]
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._memmove
jmp 0x40c949
Function at 0x40ca20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, edx
push ebx
lea edx, [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x30
mov dword [ebp - 0xc], 0
call sym._registry_get_handle
test eax, eax
je 0x40ca50
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x10]
shl ebx, 2
mov dword [esp + 0x14], 4
add esi, ebx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], esi
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExW]
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x10]
add ebx, dword [ebp + 8]
sub esp, 0x18
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40cae0
Capabilities:
Set registry value

Disassembly:
push ebp
mov edx, 0x41c2c0
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call sym._registry_set_formatopts
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41c2dc
pop ebx
mov eax, 1
pop esi
pop ebp
jmp sym._registry_set_formatopts

Function at 0x40cb20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Options
mov ebp, esp
push ebx
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
sub esp, 0x64
mov dword [ebp - 0x40], 0
call sym._registry_get_handle
test eax, eax
je 0x40cb60
mov ecx, str.Settings
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
call sym._registry_get_handle
test eax, eax
je 0x40cc18
mov ebx, dword [ebp - 4]
leave
ret
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowPlacement]
xor eax, eax
mov ebx, dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 8
cmp dword [ebp - 0x2c], 3
sete al
mov dword [esp + 0x14], 0x10
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x38]
sub esp, 0x18
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x40]
sub esp, 0x18
mov dword [esp], eax
call sym._registry_set_pagemargins
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x40cb42
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._registry_set_previewpages
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
Function at 0x40cc40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0x410d60
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.PageMargin
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
leave
ret

Function at 0x40cc80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x410de4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviewPages
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
leave
ret
Function at 0x40d930
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [0x410cb8]
mov dword [esp + 4], 0x7d0
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDlgItem]
sub esp, 8
test ebx, ebx
je 0x40d988
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov eax, dword [0x410c40]
sub esp, 8
mov dword [esp], eax
call sym._reg_formatindex
mov ebx, dword [ebp - 4]
or dword [eax*4 + 0x41004c], 2
leave
ret
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov eax, dword [0x410c40]
sub esp, 8
mov dword [esp], eax
call sym._reg_formatindex
mov ebx, dword [ebp - 4]
and dword [eax*4 + 0x41004c], 0xfffffffd
leave
ret

Function at 0x40dc40
Capabilities:
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov esi, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
je 0x40dc93
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
xor eax, eax
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10

Function at 0x40dca0
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov ebx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
lea ecx, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 4], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, eax
sub esp, 0x14
mov eax, 1
test edx, edx
je 0x40dcf1
cmp dword [ebp - 0x1c], ebx
je 0x40dd00
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esi], ebx
lea esp, [ebp - 0xc]
xor eax, eax
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 0x10
Function at 0x40e990
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x6fc]
push ebx
sub esp, 0x71c
mov eax, dword [0x410cb8]
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call ebx
mov dword [ebp - 0x710], ebx
sub esp, 8
mov dword [ebp - 0x714], eax
mov dword [esp + 4], 0x7dd
mov dword [esp], eax
call ebx
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call ebx
lea edx, [ebp - 0x6f8]
mov ecx, 0x1c
mov dword [ebp - 0x6fc], 0x74
mov edi, edx
mov dword [ebp - 0x70c], eax
xor eax, eax
sub esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [0x410cb0]
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x612]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x70c]
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], ecx
call ebx
sub esp, 0x10
test eax, eax
jne 0x40ea78
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x6e2]
mov dword [esp], esi
mov esi, dword [sym.imp.kernel32.dll_lstrcmpW]
mov dword [esp + 4], edi
call esi
mov dword [ebp - 0x718], eax
sub esp, 8
test eax, eax
je 0x40eae8
mov ecx, dword [ebp - 0x70c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp], ecx
mov dword [esp + 4], 0xc
call ebx
mov eax, dword [ebp - 0x714]
mov ebx, dword [ebp - 0x710]
sub esp, 0x10
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call ebx
sub esp, 8
call sym._populate_size_list
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x410cb8]
mov edi, dword [ebp - 0x710]
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call edi
sub esp, 8
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call edi
lea edi, [ebp - 0x684]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call ebx
mov ecx, 0x1c
lea edx, [ebp - 0x688]
mov dword [ebp - 0x688], 0x74
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0x718]
sub esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [0x410cb0]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x70c]
lea ecx, [ebp - 0x414]
sub esp, 0x10
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], eax
call ebx
mov edi, dword [ebp - 0x67c]
mov edx, 0x66666667
sub esp, 0x10
mov eax, edi
sar edi, 0x1f
mov dword [esp + 4], 0x41c32c
imul edx
sar edx, 3
sub edx, edi
lea edi, [ebp - 0x216]
mov dword [esp + 8], edx
mov dword [esp], edi
call dword [sym.imp.user32.dll_wsprintfW]
lea ecx, [ebp - 0x414]
mov dword [esp + 4], edi
mov dword [esp], ecx
call esi
sub esp, 8
test eax, eax
je 0x40ea6d
mov eax, dword [ebp - 0x70c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x40ea6d
Function at 0x40f460
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40f4ed
cmp al, 9
je 0x40f4e0
cmp al, 0x20
je 0x40f4e0
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x40f548
cmp al, 0x22
je 0x40f550
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
inc ebx
test al, al
je 0x40f4ed
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x40f4a0
test edi, 1
jne 0x40f4a0
lea esi, [esi]
movzx eax, byte [ebx + 1]
inc ebx
cmp al, 9
je 0x40f4e0
cmp al, 0x20
je 0x40f4e0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x40f508
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x40f4b7
and dword [ebp - 0x6c], 1
jne 0x40f4b0
xor edi, 1
jmp 0x40f4b7
Function at 0x5111de
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.0056a130
pop ecx
test eax, eax
jne 0x511220
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00417b2d
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5111e6
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret

Function at 0x571cbe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00571b34

Function at 0x7cb3fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7cb406
pushal
call 0x7cb40c
pop ebp
sub ebp, 0x10
sub ebp, 0x3cb3fc
jmp 0x7cb422
mov eax, 0x3cb3fc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f4
mov edx, 0xe203405
xor byte [eax], dl
inc eax
dec ecx
jne 0x7cb439
jmp 0x7cb44c
mov cs, eax
mov cs, word [ecx + edi - 0x7bfafafb]
invalid
Function at 0x10005a4a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x10024050]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x10005aed
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.1000c680
pop ecx
pop ecx
test eax, eax
je 0x10005ad6
test ebx, ebx
je 0x10005aca
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1000c680
pop ecx
pop ecx
test eax, eax
jle 0x10005ad6
push ebx
call fcn.10006dc1
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.10006da0
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x10005a97
xor edi, edi
cmp ebx, edi
jne 0x10005af1
xor eax, eax
jmp 0x10005b5d
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x10005b20
call fcn.10006dc1
pop ecx
cmp dword [ebp - 0x70], edi
je 0x10005aed
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x10005aed
call fcn.10006dc1
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005b10
cmp dword [ebp - 0x70], edi
je 0x10005b53
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.10006da0
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008c61
add ebp, 0x9c
leave
ret
Function at 0x10008c61
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10024050]
jne 0x10008c6b
repz ret
jmp fcn.1000d082

Function at 0x1000c680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000c68f
pop dword [ebp - 0x28]
mov eax, 0x5397ca73
sub eax, 0x439703e4
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2d5f7551
sub dword [ebp - 0x38], 0xdf0d3006
mov dword [ebp - 0x34], 0x5df65ee0
sub dword [ebp - 0x34], 0x2bc3129b
mov dword [ebp - 0x30], 0xb2eb3e5c
add dword [ebp - 0x30], 0x996105d2
mov dword [ebp - 0x2c], 0xefd8b151
sub dword [ebp - 0x2c], 0xefd8b151
lea eax, [ebp - 0x38]
push eax
mov eax, 0x12e110a8
add eax, 0xfd20afa8
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x791d782e
add dword [ebp - 0x38], 0xfb54f128
mov dword [ebp - 0x34], 0xa69997a1
sub dword [ebp - 0x34], 0x652d362c
mov dword [ebp - 0x30], 0x102e8056
add dword [ebp - 0x30], 0x5340ec16
mov dword [ebp - 0x2c], 0x82bc5850
add dword [ebp - 0x2c], 0x7d43a7b0
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x6a22eee7
sub eax, 0x5a212e9b
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3b166
push 0
call eax
mov ecx, 0x3221e2eb
sub ecx, 0x32219cac
mov esi, eax
mov edi, 0x1002aa00
add edi, dword [ebp - 0x28]
mov ebx, 0x56e668af
sub ebx, 0x16168cf5
mov edx, dword [edi]
add dword [ebp - 0x10], 0x90b24a29
add edx, ebx
xor dword [ebp - 0x18], ecx
mov dword [esi], edx
sub dword [ebp - 0xc], ebx
add esi, 0xc05f4737
sub esi, 0xc05f4733
add edi, 0xd336fa82
sub edi, 0xd336fa7e
loop 0x1000c7ab
add eax, 0x10bcf
mov ebx, eax
add eax, 0x61477997
sub eax, 0x61477992
mov ecx, 0xffed846a
add ecx, 0x10127b96
add ecx, dword [ebp - 0x28]
call ebx
leave
ret