joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
or ebx, 0xffffffff
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], edx
xor edx, edx
mov dword [ebp - 4], edx
test edi, edi
je 0x40684f
test eax, eax
je 0x40684f
lea ecx, [ebp - 4]
push ecx
push 0x20119
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x40681c
mov ebx, 0xffffff9b
jmp 0x40684f
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push esi
push edx
push 0
push edi
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x40683c
mov ebx, 0xffffff37
jmp 0x40684f
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, 1
jne 0x40684f
test esi, esi
je 0x40684f
mov byte [esi + ebx], 0
mov edx, dword [ebp - 4]
test edx, edx
je 0x40685f
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
jge 0x406876
test esi, esi
je 0x406876
mov byte [esi], 0
mov byte [esi + 1], 0
mov byte [esi + 2], 0
mov byte [esi + 3], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406880
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push esi
push edi
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x4068be
cmp eax, 2
jne 0x4068b7
mov eax, 1
jmp 0x406986
xor eax, eax
jmp 0x406986
push esi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
add ebx, esi
movsx eax, byte [ebx - 1]
cmp eax, 0x5c
je 0x4068d8
mov byte [ebx], 0x5c
inc ebx
mov byte [ebx], 0
mov dword [ebp - 4], 0x104
lea edx, [ebp - 0x10]
lea ecx, [ebp - 4]
push edx
push 0
push 0
push 0
push ecx
lea eax, [ebp - 0x114]
push eax
push 0
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
jne 0x406965
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x114]
or ecx, 0xffffffff
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push esi
push edi
call fcn.00406880
add esp, 8
test eax, eax
je 0x406965
mov dword [ebp - 4], 0x104
lea eax, [ebp - 0x10]
lea edx, [ebp - 4]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
je 0x406903
dec ebx
mov byte [ebx], 0
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegCloseKey
push esi
push edi
call sub.ADVAPI32.dll_RegDeleteKeyA
test eax, eax
jne 0x406984
mov eax, 1
jmp 0x406986
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406afc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0xc]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push ecx
push 0x20119
push 0
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x406b65
lea ecx, [ebp - 8]
lea eax, [ebp - 4]
push ecx
push 0
push eax
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
call sub.ADVAPI32.dll_RegQueryValueExA
mov ebx, eax
cmp ebx, 0xea
je 0x406b50
test ebx, ebx
jne 0x406b5c
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406b6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
xor edx, edx
lea ecx, [ebp - 0xc]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push ecx
push 0x20119
push 0
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x406bd5
lea ecx, [ebp - 8]
lea eax, [ebp - 4]
push ecx
push 0
push eax
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
call sub.ADVAPI32.dll_RegQueryValueExA
mov ebx, eax
cmp ebx, 0xea
je 0x406bc0
test ebx, ebx
jne 0x406bcc
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40738c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test ebx, ebx
jne 0x4073ac
xor eax, eax
jmp 0x407406
test eax, eax
jne 0x4073b7
mov byte [ebx], 0
xor eax, eax
jmp 0x407406
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
mov ecx, dword [esi]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov dword [edx], ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x14]
push ecx
push edx
push 0
lea edx, [ebp - 4]
push edx
push ebx
mov edx, dword [edi]
push edx
push eax
call sub.ADVAPI32.dll_RegEnumValueA
test eax, eax
je 0x4073e9
mov byte [ebx], 0
xor eax, eax
jmp 0x407406
mov ecx, dword [ebp - 4]
mov byte [ebx + ecx], 0
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov byte [eax + edx], 0
mov eax, 1
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
inc dword [edi]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x40ca3c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40ca45
add esp, 0xffffffdc
mov eax, dword [ebp - 4]
mov eax, 0x4e911f
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
call fcn.004d57f0
mov word [ebp - 0x14], 8
push esi
push edi
lea edi, [ebp - 0x2028]
mov esi, 0x4e711e
mov ecx, 0x800
lea edx, [ebp - 0x2028]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 0x18]
push eax
push 0x2000
push edx
push 0x5e54ff
push edi
push esi
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
jne 0x40cb34
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x40cadb
test ebx, ebx
je 0x40cac0
mov byte [ebx], 0
mov dword [0x4e2074], 0x37
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40cbb4
test ebx, ebx
je 0x40cb07
mov ecx, dword [ebp + 0x14]
push esi
push edi
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
push edi
push esi
call fcn.0040c948
mov dword [0x4e2074], 0x38
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40cbb4
push 0
lea ecx, [ebp - 0x2028]
push ecx
call fcn.0040c778
add esp, 8
test ebx, ebx
je 0x40cb6e
xor eax, eax
lea edi, [ebp - 0x2028]
or ecx, 0xffffffff
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [0x4e2074], 0x39
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40cbb4
mov esp, ebp
mov edi, dword [ebp - 0x2034]
mov esi, dword [ebp - 0x2030]
mov ebx, dword [ebp - 0x202c]
pop ebp
ret
Function at 0x40d224
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov eax, 0x4e92c3
push ebx
push esi
push edi
call fcn.004d57f0
mov word [ebp - 0x14], 8
lea edi, [ebp - 0x44]
mov esi, 0x4e92a3
mov ecx, 8
lea eax, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 8
push 0x4e929b
push 0x1f
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x44]
push eax
call fcn.0040d0cc
pop ecx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40d2ad
mov esp, ebp
mov edi, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x48]
pop ebp
ret

Function at 0x40daa8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test bl, 0x10
je 0x40dacb
push 5
push 0x2e5
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bl, 0x20
je 0x40dae3
push 5
push 0x2e6
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bl, 0x40
je 0x40dafb
push 5
push 0x303
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bl, 0x80
je 0x40db13
push 5
push 0x304
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bh, 1
je 0x40db2b
push 5
push 0x305
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bh, 2
je 0x40db43
push 5
push 0x2f9
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x10000
je 0x40db5e
push 0
push 0x2e5
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x20000
je 0x40db79
push 0
push 0x2e6
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x40000
je 0x40db94
push 0
push 0x303
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x80000
je 0x40dbaf
push 0
push 0x304
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x100000
je 0x40dbca
push 0
push 0x305
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x200000
je 0x40dbe5
push 0
push 0x2f9
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
pop ebp
ret
Function at 0x40dc58
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40dd38
test esi, esi
je 0x40dd38
mov dword [ebx + 0x10], esi
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40dc84
push eax
call sub.GDI32.dll_DeleteObject
mov dl, byte [ebx + 0x64]
test dl, dl
jne 0x40dc95
xor ecx, ecx
mov dword [ebx + 0x1c], ecx
jmp 0x40dd34
test byte [ebx + 0xe], 8
je 0x40dcc7
push 0xffffffffffffffec
push esi
call sub.USER32.dll_GetWindowLongA
or eax, 0x8000080
push eax
push 0xffffffffffffffec
push esi
call sub.USER32.dll_SetWindowLongA
push 0xfffffffffffffff0
push esi
call sub.USER32.dll_GetWindowLongA
and eax, 0xefffffff
push eax
push 0xfffffffffffffff0
push esi
call sub.USER32.dll_SetWindowLongA
lea eax, [ebx + 0x64]
push eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.USER32.dll_LoadIconA
mov edi, eax
mov dword [ebx + 0x1c], edi
test edi, edi
jne 0x40dcf6
push 0x5e552b
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.USER32.dll_LoadIconA
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x40dd12
push 0x5e552d
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.USER32.dll_LoadIconA
mov dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x1c]
push edx
push 0
push 0x80
push esi
call sub.USER32.dll_SendMessageA
mov ecx, dword [ebx + 0x1c]
push ecx
push 1
push 0x80
push esi
call sub.USER32.dll_SendMessageA
mov al, 1
jmp 0x40dd3a
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40f940
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee4
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
xor eax, eax
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 0x10], edx
xor ecx, ecx
mov dword [esp + 0x14], ecx
push 0x104
lea eax, [esp + 0x1c]
xor ebp, ebp
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x5e55a1
lea edx, [esp + 0x1c]
push edx
call fcn.004d2e40
add esp, 8
push 0x5e55ce
push 0x5e55af
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
jne 0x40f9c2
push 0x5e55ee
push 0x5e55e6
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov ebx, eax
push 0x5e5625
push 0x5e5606
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
test esi, esi
jne 0x40f9f4
push 0x5e5641
push 0x5e5639
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
push 0x5e5674
push 0x5e5655
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
test edi, edi
jne 0x40fa26
push 0x5e568b
push 0x5e5683
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
test ebx, ebx
je 0x40fb23
test esi, esi
je 0x40fb23
test edi, edi
je 0x40fb23
push 0
lea eax, [esp + 0x1c]
push eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x40faba
push ebx
call fcn.004dd2c0
pop ecx
mov dword [esp], eax
mov edx, dword [esp]
push edx
push ebx
push 0
lea ecx, [esp + 0x24]
push ecx
call esi
test eax, eax
je 0x40faba
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push 0x5e569a
mov ecx, dword [esp + 0xc]
push ecx
call edi
test eax, eax
je 0x40faba
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x10]
mov edx, eax
shr edx, 0x10
shr eax, 0
and edx, 0xff
mov dword [esp + 0xc], edx
and eax, 0xff
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xc]
shr eax, 0x10
and ax, 0xffff
movzx edx, ax
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0xc]
cmp ecx, 6
jne 0x40faf6
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40facf
mov bp, 0x65
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x40fadc
mov bp, 0x6b
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40fae9
mov bp, 0x6c
mov eax, dword [esp + 0x10]
cmp eax, 3
jne 0x40faf6
mov bp, 0x6c
mov eax, dword [esp + 0xc]
cmp eax, 0xa
jne 0x40fb12
mov bp, 0x6e
mov eax, dword [esp + 0x14]
cmp eax, 0x55f0
jb 0x40fb12
mov bp, 0x6f
mov eax, dword [esp]
test eax, eax
je 0x40fb23
mov edx, dword [esp]
push edx
call fcn.004dd268
pop ecx
mov eax, ebp
add esp, 0x11c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40fbf0
Capabilities:
Check os version

Disassembly:
push ebx
push esi
add esp, 0xffffff60
xor ebx, ebx
mov word [0x60fde0], 0
xor eax, eax
mov dword [esp + 4], 0x9c
lea edx, [esp + 4]
mov dword [0x60fde4], eax
push edx
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
jne 0x40fc2a
call fcn.0040fb30
jmp 0x40fe39
movzx eax, word [esp + 8]
movzx ecx, word [esp + 0xc]
shl eax, 0x10
mov edx, dword [esp + 0x14]
or ecx, eax
sub edx, 1
mov dword [0x60fde4], ecx
jb 0x40fdb9
je 0x40fd76
dec edx
jne 0x40fdbd
mov ecx, dword [esp + 8]
sub ecx, 5
je 0x40fd50
dec ecx
je 0x40fc9f
sub ecx, 4
jne 0x40fd70
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40fc83
mov bx, 0x6e
jmp 0x40fc87
mov bx, 0x7e0
mov eax, dword [esp + 0x10]
cmp eax, 0x55f0
jb 0x40fdbd
mov bx, 0x6f
jmp 0x40fdbd
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40fcc5
mov dl, byte [esp + 0x9e]
cmp dl, 1
jne 0x40fcbc
mov bx, 0x65
jmp 0x40fdbd
mov bx, 0x7d8
jmp 0x40fdbd
cmp eax, 1
jne 0x40fce7
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40fcde
mov bx, 0x6b
jmp 0x40fdbd
mov bx, 0x7d8
jmp 0x40fdbd
cmp eax, 2
jne 0x40fd09
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40fd00
mov bx, 0x6c
jmp 0x40fdbd
mov bx, 0x7dc
jmp 0x40fdbd
cmp eax, 3
jne 0x40fd2b
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40fd22
mov bx, 0x6c
jmp 0x40fdbd
mov bx, 0x7dc
jmp 0x40fdbd
cmp eax, 4
jne 0x40fd39
mov bx, 0x6e
jmp 0x40fdbd
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40fd4a
mov bx, 0x65
jmp 0x40fdbd
mov bx, 0x7d8
jmp 0x40fdbd
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40fd5c
mov bx, 0x7d0
cmp eax, 1
jne 0x40fd65
mov bx, 0x64
cmp eax, 2
jne 0x40fdbd
mov bx, 0x7d3
jmp 0x40fdbd
mov bx, 4
jmp 0x40fdbd
mov eax, dword [esp + 8]
cmp eax, 4
jne 0x40fd8b
mov edx, dword [esp + 0xc]
test edx, edx
jne 0x40fd8b
mov bx, 0x5f
mov eax, dword [esp + 8]
cmp eax, 4
jne 0x40fda1
mov edx, dword [esp + 0xc]
cmp edx, 0xa
jne 0x40fda1
mov bx, 0x62
mov eax, dword [esp + 8]
cmp eax, 4
jne 0x40fdbd
mov edx, dword [esp + 0xc]
cmp edx, 0x5a
jne 0x40fdbd
mov bx, 0x63
jmp 0x40fdbd
mov bx, 3
cmp bx, 0x6c
jne 0x40fdd3
call fcn.0040f940
mov ebx, eax
test bx, bx
jne 0x40fdd3
mov bx, 0x6c
push 4
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerA
test eax, eax
je 0x40fdf0
push eax
call sub.ADVAPI32.dll_CloseServiceHandle
or word [0x60fde0], 4
push 0x5e56a5
push 0x5e569c
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x40fe36
xor eax, eax
mov dword [esp], eax
push esp
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x40fe36
mov edx, dword [esp]
test edx, edx
je 0x40fe2e
or word [0x60fde0], 0x10
jmp 0x40fe36
or word [0x60fde0], 0x20
movzx eax, bx
add esp, 0xa0
pop esi
pop ebx
ret
Function at 0x411164
Capabilities:
Get memory capacity

Disassembly:
push ebx
add esp, 0xffffffa0
xor ebx, ebx
push 0x40
push 0
lea eax, [esp + 8]
push eax
call fcn.004d2d9c
add esp, 0xc
mov dword [esp], 0x40
push 0x5e584d
push 0x5e5840
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x4111b8
push esp
call eax
test eax, eax
je 0x4111b8
push 0
push 0x100000
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
call fcn.004da927
mov ebx, eax
test ebx, ebx
jne 0x4111cd
lea eax, [esp + 0x40]
push eax
call sub.KERNEL32.dll_GlobalMemoryStatus
mov ebx, dword [esp + 0x48]
shr ebx, 0x14
mov eax, 4
mov edx, 7
cmp ebx, 0x1f4
jle 0x4111e9
mov eax, 5
mov edx, 0xf
cmp ebx, 0x3e8
jle 0x4111fb
mov eax, 6
mov edx, 0x1f
test edx, ebx
je 0x411208
mov ecx, eax
sar ebx, cl
inc ebx
mov ecx, eax
shl ebx, cl
mov eax, ebx
add esp, 0x60
pop ebx
ret

Function at 0x411210
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push eax
push edx
push ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push eax
call sub.KERNEL32.dll_GetDiskFreeSpaceExA
test eax, eax
je 0x4112be
test esi, 1
je 0x411281
mov eax, dword [ebp - 0x18]
test esi, 0x2000
mov ebx, eax
je 0x411263
push 0
push 0x3b9aca00
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.004da927
mov ebx, eax
test esi, 0x1000
je 0x4112be
push 0
push 0xf4240
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.004da927
mov ebx, eax
jmp 0x4112be
mov eax, dword [ebp - 0x10]
test esi, 0x2000
mov ebx, eax
je 0x4112a2
push 0
push 0x3b9aca00
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004da927
mov ebx, eax
test esi, 0x1000
je 0x4112be
push 0
push 0xf4240
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004da927
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4121ac
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004120fc
xor eax, eax
xor edx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x110], edx
xor eax, eax
lea edx, [ebp - 0x10c]
jmp 0x4121e4
cmp ebx, dword [edx]
je 0x4121ec
inc eax
add edx, 4
cmp eax, dword [ebp - 0x110]
jb 0x4121dc
mov edx, dword [ebp - 0x110]
cmp eax, edx
jne 0x412208
cmp edx, 0x40
jae 0x412208
mov dword [ebp + eax*4 - 0x10c], ebx
inc dword [ebp - 0x110]
test esi, 8
je 0x412229
lea eax, [ebp - 8]
lea ecx, [ebp - 0x110]
push eax
push 0
push 0
push ecx
push 0
call sub.WSOCK32.dll_select
mov dword [ebp - 0xc], eax
test esi, 0x10
je 0x41224a
lea eax, [ebp - 8]
lea edx, [ebp - 0x110]
push eax
push 0
push edx
push 0
push 0
call sub.WSOCK32.dll_select
mov dword [ebp - 0xc], eax
test esi, 0x20
je 0x41226b
lea ecx, [ebp - 8]
lea eax, [ebp - 0x110]
push ecx
push eax
push 0
push 0
push 0
call sub.WSOCK32.dll_select
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
inc edx
jne 0x412275
xor eax, eax
jmp 0x41227a
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412708
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x412721
mov byte [ebp - 0xa], 0
jmp 0x412725
mov byte [ebp - 0xa], 1
mov edx, dword [ebp + 0x18]
test edx, edx
jne 0x412733
mov dword [ebp + 0x18], 0x1388
call fcn.00401298
mov dword [ebp - 8], eax
xor esi, esi
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [ebp + 0x20]
mov edx, dword [eax]
test edx, edx
je 0x412753
mov ecx, dword [ebp + 0x20]
xor eax, eax
mov dword [ecx], eax
mov dl, byte [ebp - 9]
cmp dl, 1
je 0x41281a
lea ecx, [ebp - 4]
push ecx
push 0x4004667f
push edi
call sub.WSOCK32.dll_ioctlsocket
inc eax
jne 0x412781
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x41281a
mov eax, dword [ebp - 4]
test eax, eax
je 0x4127e4
push 0
mov edx, dword [ebp + 0x10]
sub edx, ebx
push edx
mov ecx, dword [ebp + 0xc]
add ecx, ebx
push ecx
push edi
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x4127af
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x41281a
jmp 0x4127e4
add esi, eax
add ebx, eax
mov dl, byte [ebp - 0xa]
test dl, dl
jne 0x4127be
test esi, esi
jne 0x41281a
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x4127cc
mov edx, dword [ebp + 0x1c]
cmp esi, edx
jae 0x41281a
test eax, eax
jne 0x4127e4
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x41281a
mov eax, dword [ebp + 0x20]
mov dword [eax], 1
jmp 0x41281a
push 0
push 0
call fcn.00401400
add esp, 8
push 0
push 0
call fcn.00401400
add esp, 8
call fcn.00401298
mov edx, dword [ebp - 8]
sub eax, edx
mov ecx, dword [ebp + 0x18]
cmp eax, ecx
jbe 0x412753
mov byte [ebp - 9], 1
jmp 0x412753
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412874
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.00401298
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
test ecx, ecx
je 0x4128a0
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dword [eax], edx
cmp edi, 0x1b58
jle 0x4128af
mov esi, 0x1b58
jmp 0x4128b1
mov esi, edi
push 0
push esi
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x4128d4
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x412924
jmp 0x412913
add ebx, eax
test eax, eax
jne 0x4128f7
push 0
call sub.USER32.dll_MessageBeep
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
test eax, eax
je 0x4128f3
mov edx, dword [ebp + 0x18]
mov dword [edx], 1
mov eax, ebx
jmp 0x412926
cmp edi, ebx
jne 0x4128ff
mov eax, ebx
jmp 0x412926
add dword [ebp - 4], eax
mov esi, edi
sub esi, ebx
cmp esi, 0x1b58
jle 0x412913
mov esi, 0x1b58
call fcn.00401298
mov edx, dword [ebp - 8]
sub eax, edx
cmp eax, 0x3a98
jbe 0x4128b1
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret