joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419be0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xdb
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419c63
cmp eax, 0x8f
jbe 0x419c25
push eax
push str.f22b949dddab4a3b22b3deb97ac
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.1397430f842303cf27eb0e8f2ca37
call esi
test eax, eax
jne 0x419c5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x419c80
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.b0dde73991472699bb8f4f
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419d27
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419d27
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419d40
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419d27
test al, 1
jne 0x419d05
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419cd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419d27
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.16173f3dc7274c33720b3f6981010
call fcn.00439b50
add esp, 4
jmp 0x419d27

Function at 0x419d50
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x4c
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [esp]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
call fcn.00439c27
call fcn.00439c27
call fcn.00439c27
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00439641
add esp, 0x4c
ret
Function at 0x419dc0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x88
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419e41
cmp eax, 0x6c
jbe 0x419e03
push eax
push str.864fa3d94b013721ab598cc3f
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.204d7b6585b3ad6516599fb9
call esi
test eax, eax
jne 0x419e39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x419e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.c5311b858707d9d9febd1febd53f
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.dee943f7f829e55d
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x419ec8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.0ac9bf2761c510274225751
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419e95
test eax, eax
jne 0x419edf
push edi
push str.c4a7671dfa2f62fd8e6df6ed27e554f_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.fb8336bbc50592b19__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x419f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.4c4b3879e583ba0f98459d
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.c5e153e9139b638be17f4d
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x419f78
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.127f65e9af09f1ef9551
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419f45
test eax, eax
jne 0x419f8f
push edi
push str.57fd2df3e6679269012704059_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.434380f94833105301dde55dd0__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x419fb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x27
idiv ecx
inc esi
dec dl
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419fe6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a066
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41a066
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x41a080
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.f50bb2e39905b4fbede53529403
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.496105afeba5ad014387d
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a0f8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.d7213553feff051719e5f515ea0f7
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a0c5
test eax, eax
jne 0x41a10f
push edi
push str.45af1f2db62741c5fca744afcce_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.32f78a331859fdb73__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41a130
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.af81df93f069c19f0e2d05dbad2f
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.9b6532ad01f77e99
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a1a8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.72fb01c10ceb08617503706f1f0
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a175
test eax, eax
jne 0x41a1bf
push edi
push str.70797e51587500f11d1bd8a30_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.bcc3b187c16d5d85e2c__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41a1e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.9f256ce37225844b1
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.91b785ab8a6df725696ded2546a9a
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a258
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.b1f7f6ef33dba97d53bf0265018
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a225
test eax, eax
jne 0x41a26f
push edi
push str.45c957bd2581ddb34b7bce6fb293c98_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.7067cfef7d019e299f7__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41a300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x6e
idiv ecx
inc esi
add dl, 0x78
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41a336
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a3b7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41a3b7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x41a3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.aeef722978e70ebdfce599
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.c3c1cce73e135c13e76167e587f3a8
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a448
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.b41d70f18cd1f0891439ddfffe0b522
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a415
test eax, eax
jne 0x41a45f
push edi
push str.86f1af7f004f0bd3573d737b_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.07136a51089109bb__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41a480
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xed
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41a503
cmp eax, 0x90
jbe 0x41a4c5
push eax
push str.3beff971a2657581bb2db283
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.317f7f01765f858339b5b
call esi
test eax, eax
jne 0x41a4fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x41a520
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xb1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41a5a3
cmp eax, 0x96
jbe 0x41a565
push eax
push str.e1873a6f98c1fa89b76151252e4dc55
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.269300ab0b31c419a7478ded7bc95
call esi
test eax, eax
jne 0x41a59b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x41a5c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.24c526ed7bc176c3f7218839eb4
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.17f9f21fd41dc6b3e7a9
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a638
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.072f39497d41186bb0115293c00f
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a605
test eax, eax
jne 0x41a64f
push edi
push str.30bd6da526593ed1fb0fcd477a27dfc_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.49ef5ef3070f3d25e40__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41a670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x67
idiv ecx
inc esi
sub dl, cl
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41a6a6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a726
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41a726
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x41a740
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.d53f6bc508b3a2c54ad9151d
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.205f5167ba1bc185c80f39fd3fe
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a7b8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.347f06a92b550939b3b3f0
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a785
test eax, eax
jne 0x41a7cf
push edi
push str.8365fd396ee355cfe1_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.f48bd3a56621982f5ad3__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41a7f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.58a5ae07d66b0e7b51ff462d27d3d9
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.71d53895db9d9a873c
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a868
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.97656f55e6b7fa516c29430722
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a835
test eax, eax
jne 0x41a87f
push edi
push str.1885b111867f4ee929f950bb_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.12c34fcf10c5cfffcce1e3e__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41a9c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.cb532fbd6b658b230
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.f193d9b52b775493477b47fbcf2be2
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41aa38
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.3ed187af93ad2bc75fa7be5b669d869
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41aa05
test eax, eax
jne 0x41aa4f
push edi
push str.1aa1e35508bf34c50b4569f151d7_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.5a9d4a27272f8b05f519e2fd4e51c12__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41aa70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x9d
idiv ecx
inc esi
add dl, 0x33
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41aaa6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41ab27
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41ab27
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x41ab40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x20
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41abc7
push esi
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea edi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x41ab90
sub ecx, edi
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00402f50
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [esp + 0x20], 0x10
pop edi
pop esi
jb 0x41abc7
mov eax, dword [esp + 4]
push eax
call fcn.00439c49
add esp, 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00439641
add esp, 0x20
ret
Function at 0x41abe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0xd5
idiv ecx
inc esi
add dl, 0xf
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41ac16
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41ac97
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41ac97
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x41acb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.35a5392368bbee99566f0c8513d92
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.6fb3a0212b9318df707b20072
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41ad28
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.5e256e6fc2996165b401ac8ff99fd69
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41acf5
test eax, eax
jne 0x41ad3f
push edi
push str.6159c8a584c3b3cdd06381ddca95_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.be8d91978e8355fbe3c3b1__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret