joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40389e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aebe3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x403991
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x403941
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x403922
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x40393f
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.00442139
mov dword [eax], 1
jmp 0x403917
jmp 0x40398c
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x40396f
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x40398c
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.00442139
mov dword [eax], 0x9b3198a8
jmp 0x403964
jmp 0x403a63
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], 0x51ae
mov dword [ebp - 0x54], str.egaktiu_sikjuinox_plm_qnnvz_nfouguk_rjxdlfpy_prtdgu_fhmxw_ohkwoonap
cmp dword [ebp - 0x24], 0x51eb
jle 0x403a03
and dword [ebp - 0x1c], 0
jmp 0x4039bb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1be9
jge 0x4039fb
and dword [ebp - 0x20], 0
jmp 0x4039d1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x513
jge 0x4039f9
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
mov ecx, 0xae0558
call fcn.00441f36
jmp 0x4039ca
jmp 0x4039b4
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x5181
jge 0x403a23
mov edx, dword [ebp - 0x54]
mov ecx, 0xae0558
call fcn.004438dc
jmp 0x403a3f
or dword [ebp - 4], 0xffffffff
jmp 0x403a49
push 0xbcf
push dword [ebp - 0x58]
push 0x24b9
push 0
push dword [ebp - 0x5c]
call fcn.0041aaab
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409f17
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x409f48
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push 0x3a0f
push dword [ebp - 8]
call fcn.00409f98
add esp, 0x10
jmp 0x409f94
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x409f76
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x409f94
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x409f94
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esp, ebp
pop ebp
ret

Function at 0x40a097
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x40a101
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x40a0ed
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
push 2
mov ecx, dword [ebp - 0x1c]
call fcn.00442139
mov dword [eax], esi
jmp 0x40a0ff
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x40a11d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 1
call fcn.00403a74
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a141
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aece7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x40a2c4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x40a2ae
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], 0x4c82
mov dword [ebp - 0x44], str.kleus_snrvemvl_ztn_eymaw_acjlide
cmp dword [ebp - 0x28], 0x4ef2
jle 0x40a231
and dword [ebp - 0x24], 0
jmp 0x40a1bf
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5a2a
jge 0x40a231
and dword [ebp - 0x1c], 0
jmp 0x40a1d5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5e00
jge 0x40a22f
and dword [ebp - 0x20], 0
jmp 0x40a1eb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x65fa
jge 0x40a22d
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x64]
call fcn.00441f21
jmp 0x40a1e4
jmp 0x40a1ce
jmp 0x40a1b8
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x40a253
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x40a270
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.00442139
mov dword [eax], 0x5c68ec0a
jmp 0x40a248
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4a8e
jge 0x40a286
push dword [ebp - 0x44]
call fcn.00499008
pop ecx
jmp 0x40a2a2
or dword [ebp - 4], 0xffffffff
jmp 0x40a2ac
jmp 0x40a2c2
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x40a2c2
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x40a2d8
push 0
push 0x7616
push 0x1fae
call fcn.0040867b
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a2e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x40a30c
push 1
push 0x2aba
push 0x7de8
call fcn.0040a340
add esp, 0xc
jmp 0x40a33c
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x40a332
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40a330
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x40a33c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov esp, ebp
pop ebp
ret
Function at 0x4158df
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aed0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x415916
push 1
call fcn.00415ad0
pop ecx
jmp 0x415abf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x415a40
mov dword [ebp - 0x28], 0x4728
mov dword [ebp - 0x34], str.aoflna_ftnojqaiz_yhzv_wbxk
cmp dword [ebp - 0x28], 0x48f1
jle 0x4159dc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
and dword [ebp - 0x1c], 0
jmp 0x41596a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x30e6
jge 0x4159dc
and dword [ebp - 0x20], 0
jmp 0x415980
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x12dd
jge 0x4159da
and dword [ebp - 0x24], 0
jmp 0x415996
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x49e6
jge 0x4159d8
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x74]
call fcn.00441f21
jmp 0x41598f
jmp 0x415979
jmp 0x415963
mov byte [ebp - 0x11], 0
push 0x3b9f
push 0x5cb2
push 0x1e96
push 0x6061
lea eax, [ebp - 0x11]
push eax
push 0
call fcn.00404f6f
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4354
jge 0x415a18
push dword [ebp - 0x34]
call fcn.00499008
pop ecx
jmp 0x415a34
or dword [ebp - 4], 0xffffffff
jmp 0x415a3e
jmp 0x415abf
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x415a7a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 7
jg 0x415abf
mov dword [ebp - 0x50], 0xffffffff
push 0
push 0x70f8
push dword [ebp - 0x2c]
call fcn.004035da
add esp, 0xc
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x415aad
cmp dword [ebp - 0x50], 0
je 0x415aab
jmp 0x415abf
jmp 0x415abd
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x2c]
call fcn.0041b2c8
add esp, 0xc
jmp 0x415a6f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415aec
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aed19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x415c00
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x3940
mov dword [ebp - 0x24], str.raewydra_zspaajwl_oxbs_yptxvcax_wwi_fiogcqi_xlhz_ypwumknk_hagqyq_rarwzm_vstlb_dajmjxid_kfyajuxfl
cmp dword [ebp - 0x1c], 0x3ac4
jle 0x415b9a
and dword [ebp - 0x14], 0
jmp 0x415b44
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2d59
jge 0x415b9a
and dword [ebp - 0x18], 0
jmp 0x415b5a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3def
jge 0x415b98
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.00441f21
jmp 0x415b53
jmp 0x415b3d
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x415bb8
push 0x9a6
push 0
push 0x1324
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x415bc2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x36b9
jge 0x415bd8
push dword [ebp - 0x24]
call fcn.00499008
pop ecx
jmp 0x415bf4
or dword [ebp - 4], 0xffffffff
jmp 0x415bfe
jmp 0x415c21
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0x6082
push dword [ebp - 0x2c]
push 0
call fcn.0041a368
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a2a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41a326
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41a2d9
push 0x1510
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x41a324
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41a307
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x41a324
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.00442139
mov dword [eax], 0x781b
jmp 0x41a2fc
jmp 0x41a33a
push 0x20ee
push 0
push 0x4ec4
call fcn.00401fba
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41a82b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x41a85a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 0
call fcn.0042745d
add esp, 0xc
jmp 0x41a8db
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x41a8b3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41a8b1
push 0x19c7
push 0x4824
push 0x6784
push 0x31f7
push 1
push 0
push 0x6341
call fcn.00419f53
add esp, 0x1c
jmp 0x41a8db
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41a8db
push 0x9a6
push 0
push 0x1324
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esp, ebp
pop ebp
ret

Function at 0x41b24f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41b2b2
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41b27d
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x41b2b0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41b2b0
push 1
push 0x4d06
push 0x358
push 0
push 1
push 0x72d6
call fcn.0041e4fb
add esp, 0x18
jmp 0x41b2c4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
call fcn.004056a8
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41cd22
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aee13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41ceca
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x41ce7d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x47cb
mov dword [ebp - 0x34], str.ujmeliau_gxqpaq_rabtqsl_dojdmlx
cmp dword [ebp - 0x24], 0x48d7
jle 0x41ce25
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
and dword [ebp - 0x20], 0
jmp 0x41cdb6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x46e8
jge 0x41ce11
and dword [ebp - 0x18], 0
jmp 0x41cdcc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5da5
jge 0x41ce0f
and dword [ebp - 0x1c], 0
jmp 0x41cde2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5bd3
jge 0x41ce0d
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0xae0558
call fcn.00441f36
jmp 0x41cddb
jmp 0x41cdc5
jmp 0x41cdaf
push 0
push 0x2004
push 0x1e6
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x45d4
jge 0x41ce45
mov edx, dword [ebp - 0x34]
mov ecx, 0xae0558
call fcn.004438dc
jmp 0x41ce61
or dword [ebp - 4], 0xffffffff
jmp 0x41ce6b
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x41ce7b
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x41cec8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x41ceab
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x41cec8
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.00442139
mov dword [eax], 0xfffffff8
jmp 0x41cea0
jmp 0x41cee6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0
call fcn.004071a1
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c369
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aef99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42c4ce
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42c481
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0x2d8f
mov dword [ebp - 0x34], str.vzj_zmfm_trjxqc
cmp dword [ebp - 0x20], 0x3120
jle 0x42c427
and dword [ebp - 0x18], 0
jmp 0x42c3e7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x29ae
jge 0x42c427
and dword [ebp - 0x1c], 0
jmp 0x42c3fd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1d8b
jge 0x42c425
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0xae0558
call fcn.00441f36
jmp 0x42c3f6
jmp 0x42c3e0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x42c43f
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2ce2
jge 0x42c459
mov edx, dword [ebp - 0x34]
mov ecx, 0xae0558
call fcn.004438dc
jmp 0x42c475
or dword [ebp - 4], 0xffffffff
jmp 0x42c47f
jmp 0x42c4cc
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x42c4af
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x42c4cc
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.00442139
mov dword [eax], 0x5c68ec0a
jmp 0x42c4a4
jmp 0x42c4e0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 1
call fcn.004271f9
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e5ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aefff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x42e644
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0x7770
push 1
push dword [ebp - 0x24]
push 0x745e
push dword [ebp - 0x28]
call fcn.0042e774
add esp, 0x14
jmp 0x42e763
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x42e752
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x841
mov dword [ebp - 0x38], str.ofgp_lmotnj_coajfyfk_lui
cmp dword [ebp - 0x20], 0x94c
jle 0x42e6e4
and dword [ebp - 0x18], 0
jmp 0x42e68e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x22c9
jge 0x42e6e4
and dword [ebp - 0x1c], 0
jmp 0x42e6a4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb1d
jge 0x42e6e2
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.004019d3
pop ecx
pop ecx
mov ecx, eax
call fcn.00441f2b
push eax
call fcn.00499008
pop ecx
lea ecx, [ebp - 0x64]
call fcn.00441f21
jmp 0x42e69d
jmp 0x42e687
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x73c
jge 0x42e700
push dword [ebp - 0x38]
call fcn.00499008
pop ecx
jmp 0x42e71c
or dword [ebp - 4], 0xffffffff
jmp 0x42e726
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x42e763
push 0
push 0x24aa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret