joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40900d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4b4388
push 0x5c6860
call fcn.004202e0
add esp, 8
mov dword [0x5c3430], 0
jmp 0x40904d
inc dword [0x5c3430]
cmp dword [0x5c3430], 0x3000
jge 0x40907a
mov eax, dword [0x5c3430]
mov byte [eax + 0x5c6ca0], 0
mov eax, dword [0x5c3430]
mov byte [eax + 0x5c3440], 0
jmp 0x409047
lea eax, [ebp - 4]
push eax
push 0x5c3440
push 0x5c6860
call fcn.0040c503
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4090a3
mov eax, 0xffffffff
jmp 0x4092b1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x5c3440
push 0x4b4394
call fcn.00409ec8
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4090d1
xor eax, eax
jmp 0x4092b1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x5c3440
push 0x4b43a0
call fcn.00409ec8
add esp, 0x10
test eax, eax
jne 0x4091ca
mov ebx, dword [ebp - 4]
and ebx, 0xffff
mov eax, dword [ebp - 0xc]
and eax, 0xffff
sub ebx, eax
push 0x4b43a8
call fcn.00420150
add esp, 4
add ebx, eax
push ebx
push 0x4b43b4
call fcn.00420150
add esp, 4
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push ecx
push 0x5c6ca0
call fcn.00420bc0
add esp, 0xc
push 0x4b43c0
call fcn.00420150
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
mov edx, dword [ebp - 0xc]
and edx, 0xffff
sub ecx, edx
add eax, ecx
push eax
push 0x5c6ca0
push 0x4b43cc
call fcn.00420150
add esp, 4
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push ecx
call fcn.00420bc0
add esp, 0xc
push 0x4b43d4
call fcn.00420150
add esp, 4
push eax
push 0x4b43dc
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00420bc0
add esp, 0xc
push 0x4b43e4
call fcn.00420150
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
lea ebx, [ecx + eax]
push 0x4b43ec
call fcn.00420150
add esp, 4
sub ebx, eax
mov word [ebp - 4], bx
jmp 0x409290
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 0x4b43f8
call fcn.00409ec8
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x409281
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x5c6ca0
call fcn.00420bc0
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
push 0x5c6ca0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00420bc0
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 8]
and ecx, 0xffff
inc ecx
sub eax, ecx
mov word [ebp - 4], ax
jmp 0x409290
mov eax, dword [ebp - 0xc]
and eax, 0xffff
sub eax, 2
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
push 0x5c3440
push 0x5c6860
call fcn.0040c64c
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x4092b1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409a94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4b447c
push 0x5c6860
call fcn.004202e0
add esp, 8
push 0x4b4480
push 0x5c6860
call fcn.004202e0
add esp, 8
cmp dword [ebp + 8], 0
je 0x409b70
mov eax, dword [ebp + 8]
push eax
push 0x5c6a80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4b4490
push 0x5c6a80
call fcn.004202e0
add esp, 8
push 0x4b4494
push 0x5c6a80
call fcn.004202e0
add esp, 8
push 0
push 0x5c6a80
call fcn.0042620f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409b70
mov eax, dword [ebp - 8]
push eax
call fcn.00423e2d
add esp, 4
push 0
push 0x5c6860
push 0x5c6a80
call fcn.0040d41d
add esp, 0xc
test eax, eax
jne 0x409b69
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x409bf0
xor eax, eax
jmp 0x409bf0
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4b44a4
push 0x5c6860
call fcn.004202e0
add esp, 8
push 0x4b44a8
push 0x5c6860
call fcn.004202e0
add esp, 8
push 0
push 0x5c6860
push 0
call fcn.0041c7bf
add esp, 4
push eax
push 0x550e18
call fcn.0041c467
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x5c6860
push 1
call fcn.0041c7bf
add esp, 4
push eax
push 0x560e18
call fcn.0041c467
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409bf0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409bf5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4b44b8
push 0x5c6860
call fcn.004202e0
add esp, 8
cmp dword [ebp + 8], 0
je 0x409cad
mov eax, dword [ebp + 8]
push eax
push 0x5c6a80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4b44c8
push 0x5c6a80
call fcn.004202e0
add esp, 8
push 0
push 0x5c6a80
call fcn.0042620f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409cad
mov eax, dword [ebp - 8]
push eax
call fcn.00423e2d
add esp, 4
push 0
push 0x5c6860
push 0x5c6a80
call fcn.0040d41d
add esp, 0xc
test eax, eax
jne 0x409ca6
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x409cd1
xor eax, eax
jmp 0x409cd1
push 0
push 0x5c6860
push 0xbc00
push 0x4a8778
call fcn.0041c467
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409cd1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409cd6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4b44d8
push 0x5c6860
call fcn.004202e0
add esp, 8
cmp dword [ebp + 8], 0
je 0x409d8e
mov eax, dword [ebp + 8]
push eax
push 0x5c6a80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4b44e4
push 0x5c6a80
call fcn.004202e0
add esp, 8
push 0
push 0x5c6a80
call fcn.0042620f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409d8e
mov eax, dword [ebp - 8]
push eax
call fcn.00423e2d
add esp, 4
push 0
push 0x5c6860
push 0x5c6a80
call fcn.0040d41d
add esp, 0xc
test eax, eax
jne 0x409d87
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x409dce
xor eax, eax
jmp 0x409dce
push 0
push 0x5c6860
push 0xffff
push 0x4964d0
call fcn.0041c467
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x5c6860
push 0x22a3
push 0x4a64d0
call fcn.0041c467
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409dce
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409dd3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00408aeb
test eax, eax
jne 0x409df0
xor eax, eax
jmp 0x409ec3
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4b44f0
push 0x5c6860
call fcn.004202e0
add esp, 8
cmp dword [ebp + 8], 0
je 0x409e9f
mov eax, dword [ebp + 8]
push eax
push 0x5c6a80
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4b4500
push 0x5c6a80
call fcn.004202e0
add esp, 8
push 0
push 0x5c6a80
call fcn.0042620f
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409e9f
mov eax, dword [ebp - 8]
push eax
call fcn.00423e2d
add esp, 4
push 0
push 0x5c6860
push 0x5c6a80
call fcn.0040d41d
add esp, 0xc
test eax, eax
jne 0x409e98
push 0x4000c
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x409ec3
xor eax, eax
jmp 0x409ec3
push 0
push 0x5c6860
push 0xe000
push 0x4884d0
call fcn.0041c467
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409ec3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409fb3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [0x5c3430], 0
jmp 0x409fd1
inc dword [0x5c3430]
cmp dword [0x5c3430], 0x3000
jge 0x409ff2
mov eax, dword [0x5c3430]
mov byte [eax + 0x5c3440], 0
jmp 0x409fcb
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4b4510
push 0x5c6860
call fcn.004202e0
add esp, 8
push 0x5c9ca0
push 0x5c3440
push 0x5c6860
call fcn.0040c503
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40a03e
mov eax, 0xffffffff
jmp 0x40a19d
mov ax, word [0x5c9ca0]
mov word [ebp - 4], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x40a13a
push 0x4b451c
push 0x5c9cb0
call fcn.004202d0
add esp, 8
test byte [ebp + 0xc], 2
je 0x40a094
push 0x5c9ca0
push 0x5c3440
call fcn.0040a477
add esp, 8
cmp eax, 0xffffffff
jne 0x40a094
mov eax, 0xffffffff
jmp 0x40a19d
test byte [ebp + 0xc], 1
je 0x40a0c3
push 0x5c9ca0
push 0x5c3440
call fcn.0040a67b
add esp, 8
cmp eax, 0xffffffff
jne 0x40a0c3
mov eax, 0xffffffff
jmp 0x40a19d
jmp 0x40a153
mov ax, word [0x5c9ca0]
mov word [ebp - 4], ax
test byte [ebp + 0xc], 1
je 0x40a101
push 0x5c9ca0
push 0x5c3440
call fcn.0040a976
add esp, 8
cmp eax, 0xffffffff
jne 0x40a101
mov eax, 0xffffffff
jmp 0x40a19d
test byte [ebp + 0xc], 2
je 0x40a130
push 0x5c9ca0
push 0x5c3440
call fcn.0040a1a2
add esp, 8
cmp eax, 0xffffffff
jne 0x40a130
mov eax, 0xffffffff
jmp 0x40a19d
jmp 0x40a153
cmp dword [ebp - 8], 1
je 0x40a0c8
cmp dword [ebp - 8], 2
je 0x40a053
jmp 0x40a153
mov eax, dword [ebp - 4]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x5c9ca0]
cmp eax, ecx
je 0x40a196
push 0x5c9ca0
push 0x5c3440
push 0x5c6860
call fcn.0040c64c
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40a196
mov eax, 0xffffffff
jmp 0x40a19d
xor eax, eax
jmp 0x40a19d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b27f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4b470c
push 0x5c6860
call fcn.004202e0
add esp, 8
push 0x5c6860
call fcn.0040d3f0
add esp, 4
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4b4718
push 0x5c6860
call fcn.004202e0
add esp, 8
push 0x5c6860
call fcn.0040d3f0
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b345
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov dword [ebp - 0x204], 0
push 0x200
push 0x5c6440
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test byte [ebp + 8], 2
je 0x40b421
push 0x5c6440
lea eax, [ebp - 0x200]
push eax
call fcn.004202d0
add esp, 8
push 0x4b4728
lea eax, [ebp - 0x200]
push eax
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040b2e8
add esp, 4
test eax, eax
je 0x40b3cb
push 0x200400b
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x5c6440
lea eax, [ebp - 0x200]
push eax
call fcn.004202d0
add esp, 8
push 0x4b4734
lea eax, [ebp - 0x200]
push eax
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040b2e8
add esp, 4
test eax, eax
je 0x40b421
push 0x200400a
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
test byte [ebp + 8], 1
je 0x40b4eb
push 0x5c6440
lea eax, [ebp - 0x200]
push eax
call fcn.004202d0
add esp, 8
push 0x4b4744
lea eax, [ebp - 0x200]
push eax
call fcn.004202e0
add esp, 8
push 0x4b4748
lea eax, [ebp - 0x200]
push eax
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040b2e8
add esp, 4
test eax, eax
je 0x40b495
push 0x2004017
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x5c6440
lea eax, [ebp - 0x200]
push eax
call fcn.004202d0
add esp, 8
push 0x4b4758
lea eax, [ebp - 0x200]
push eax
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040b2e8
add esp, 4
test eax, eax
je 0x40b4eb
push 0x2004015
call fcn.00406c68
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
mov eax, dword [ebp - 0x204]
jmp 0x40b4f6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b4fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5c6860
push 0x5c9cc0
call fcn.004202d0
add esp, 8
push 0x4b4768
push 0x5c6860
call fcn.004202e0
add esp, 8
push 2
push 0x5c6860
call fcn.00429ebd
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40b5b8
cmp dword [0x5bc8c4], 2
je 0x40b594
cmp dword [ebp - 4], 0
je 0x40b58f
push 0x2010003
call fcn.00406c68
add esp, 4
push 0x80005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40b62e
jmp 0x40b5b8
push 0x2010003
call fcn.00406c68
add esp, 4
push 0x80006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40b62e
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4b4774
push 0x5c6860
call fcn.004202e0
add esp, 8
push 2
push 0x5c6860
call fcn.00429ebd
add esp, 8
mov dword [ebp - 4], eax
cmp dword [0x5bc8c4], 2
je 0x40b627
cmp dword [ebp - 4], 0
je 0x40b627
push 0x2010004
call fcn.00406c68
add esp, 4
push 0x80005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40b62e
xor eax, eax
jmp 0x40b62e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c503
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x180
push 0x8002
mov eax, dword [ebp + 8]
push eax
call fcn.0042620f
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40c546
push 0x40006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c647
mov eax, dword [ebp - 8]
push eax
call fcn.00429f01
add esp, 4
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0xffff
jne 0x40c58f
mov eax, dword [ebp - 8]
push eax
call fcn.00423e2d
add esp, 4
push 0x40008
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c647
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.004242e7
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40c5cb
push 0x40009
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00423e2d
add esp, 4
mov eax, 0xffffffff
jmp 0x40c647
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax]
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004240f1
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c614
push 0x4000a
call fcn.00406ccc
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00423e2d
add esp, 4
mov eax, 0xffffffff
jmp 0x40c647
mov eax, dword [ebp - 8]
push eax
call fcn.00423e2d
add esp, 4
cmp eax, 0xffffffff
jne 0x40c640
push 0x40005
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40c647
xor eax, eax
jmp 0x40c647
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cbfd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0
push 0x200
push 0x5c6440
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5c6440
lea eax, [ebp - 0x200]
push eax
call fcn.004202d0
add esp, 8
push 0x4b4bb8
lea eax, [ebp - 0x200]
push eax
call fcn.004202e0
add esp, 8
push 0x4b4bbc
lea eax, [ebp - 0x200]
push eax
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0041c676
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0xffffffff
jne 0x40cca9
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
push 0x5c6440
lea eax, [ebp - 0x200]
push eax
call fcn.004202d0
add esp, 8
push str.Api_1lnm.dll
lea eax, [ebp - 0x200]
push eax
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0041c6b3
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0xffffffff
jne 0x40ccfd
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040cd15
add esp, 4
xor eax, eax
jmp 0x40cd10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d09d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x200
push 0x5c6860
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system.ini
push 0x5c6860
call fcn.004202e0
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x40d0ee
push str._hasp_
lea eax, [ebp - 0x88]
push eax
call fcn.004202d0
add esp, 8
jmp 0x40d102
push str._HARDLOCK_
lea eax, [ebp - 0x88]
push eax
call fcn.004202d0
add esp, 8
mov dword [0x5c3430], 0
jmp 0x40d117
inc dword [0x5c3430]
cmp dword [0x5c3430], 0x3000
jge 0x40d138
mov eax, dword [0x5c3430]
mov byte [eax + 0x5c3440], 0
jmp 0x40d111
push 0x5c9ca0
push 0x5c3440
push 0x5c6860
call fcn.0040c503
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40d162
mov eax, 0xffffffff
jmp 0x40d2b9
push 0x5c6a64
mov ax, word [0x5c9ca0]
push eax
push 0x5c3440
lea eax, [ebp - 0x88]
push eax
call fcn.00409ec8
add esp, 0x10
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x40d1ac
push 0x80002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x40d2b9
push 0x5c9f10
xor eax, eax
mov ax, word [0x5c9ca0]
xor ecx, ecx
mov cx, word [0x5c6a64]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x8c]
inc eax
push eax
push 0x4b4c38
call fcn.00409ec8
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x40d1fc
mov ax, word [0x5c9f10]
mov word [ebp - 4], ax
jmp 0x40d213
xor eax, eax
mov ax, word [0x5c9ca0]
xor ecx, ecx
mov cx, word [0x5c6a64]
sub eax, ecx
mov word [ebp - 4], ax
push 0x5c6a66
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00409ec8
add esp, 0x10
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x40d2a1
push 0x80
mov eax, dword [ebp + 0xc]
push eax
call fcn.00420150
add esp, 4
mov ecx, dword [ebp - 0x90]
add ecx, eax
inc ecx
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004201d0
add esp, 0xc
push 0x4b4378
mov eax, dword [ebp + 8]
push eax
call fcn.004208f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d292
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x40d29c
mov eax, dword [ebp + 8]
mov byte [eax + 0x80], 0
jmp 0x40d2b2
push 0x4b4c3c
mov eax, dword [ebp + 8]
push eax
call fcn.004202d0
add esp, 8
xor eax, eax
jmp 0x40d2b9
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d41d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d456
push 0x180
mov eax, dword [ebp + 0xc]
push eax
call fcn.00429f79
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x40d45e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40dfa6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
push 0x5c2c40
push 0xf003f
push 0
push 0x532ef8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e011
cmp dword [0x5c2e64], 2
je 0x40e00f
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e224
jmp 0x40e054
mov dword [ebp - 0x10], 1
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e054
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e224
push 0x5c2c40
push 0xf003f
push 0
push 0x532f30
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e0bd
cmp dword [0x5c2e64], 2
je 0x40e0a9
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e224
cmp dword [ebp - 0x10], 1
jne 0x40e0b8
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40e221
mov edx, dword [ebp - 0x20]
or edx, 1
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], 0xc
push 0x532f5c
push 0x5c30e0
call fcn.004202d0
add esp, 8
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x5c30e0
mov eax, dword [0x5c2c40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e124
push 0x532f64
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004202d0
add esp, 8
lea edx, [ebp - 0x1c]
push edx
push 0x5c9cb0
call fcn.004202d0
add esp, 8
push 0x532f6c
lea eax, [ebp - 0x1c]
push eax
call fcn.00420970
add esp, 8
test eax, eax
jge 0x40e15e
cmp dword [ebp - 0x10], 1
jne 0x40e159
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40e1e7
push 0x532f74
lea edx, [ebp - 0x1c]
push edx
call fcn.00420970
add esp, 8
test eax, eax
jg 0x40e17d
mov eax, dword [ebp - 0x20]
or al, 2
mov dword [ebp - 0x20], eax
jmp 0x40e1e7
push 0x532f7c
push 0x5c30e0
call fcn.004202d0
add esp, 8
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x5c30e0
mov ecx, dword [0x5c2c40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e1d4
mov edx, dword [ebp - 0x20]
or edx, 2
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
and eax, 2
test eax, eax
je 0x40e1e7
mov ecx, dword [ebp - 0x20]
or ecx, 2
mov dword [ebp - 0x20], ecx
mov edx, dword [0x5c2c40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5c2e64], eax
cmp dword [0x5c2e64], 0
je 0x40e221
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x40e224
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret