joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c5b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.6a2120bf487d1a57c5f
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.9ae961b54b5b81a57cefc8ef622ffa
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40c625
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.12fb586548c7ea1f1187d06
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40c5fa
test eax, eax
jne 0x40c635
push esi
push str.df01e79f3a3dcd578_d
jmp 0x40c63b
push eax
push str.cf5341356af7cb5f7__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40c8e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431170
add esp, 0xc
xor esi, esi
call fcn.00428e21
cdq
mov ecx, 0xbe
idiv ecx
add dl, 0x19
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x40c918
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c99f
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40c99f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428582
leave
ret

Function at 0x40c9ad
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.1f6d117f761bfcab9d2
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.9ff9f199bb23dda7499f18894
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40ca1e
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.2d65f7753e93363b31973c5b
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40c9f3
test eax, eax
jne 0x40ca2e
push esi
push str.41a13053e11fdd79ac1ba_d
jmp 0x40ca34
push eax
push str.7dffaee75b51da138db52f7__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40e82c
Capabilities:
Check mutex on windows

Disassembly:
lea eax, [esi + 0x180]
cmp dword [eax + 0x18], 0x10
jb 0x40e83d
mov eax, dword [eax + 4]
jmp 0x40e840
add eax, 4
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x17c], eax
test eax, eax
jne 0x40e862
mov dword [esi + 0x308], 1
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40e85f
and dword [esi + 0x308], 0
push 0
call fcn.0042a743
int3

Function at 0x40e87e
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x4542b0]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor edi, edi
push edi
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x40e8b9
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
lea eax, [esp + 8]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00428582
add esp, 0x19c
ret
Function at 0x40e9c8
Capabilities:
Check for time delay via gettickcount
Set uefi variable

Disassembly:
push 0x520
mov eax, 0x43df9d
call fcn.0042b376
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4b8], eax
xor ebx, ebx
lea eax, [ebp - 0x4a9]
mov byte [ebp - 0x4a9], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e9f1
sub eax, esi
je 0x40ea06
call fcn.0040a0a5
call fcn.0040a139
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push ebx
mov edi, eax
call fcn.0042a13f
mov dword [ebp - 0x4b0], edi
fild dword [ebp - 0x4b0]
pop ecx
mov dword [ebp - 0x4b4], eax
test edi, edi
jge 0x40ea33
fadd qword [0x44a9c8]
call fcn.00438ef0
fild dword [ebp - 0x4b4]
mov eax, dword [ebp - 0x4b4]
test eax, eax
jge 0x40ea4e
fadd qword [0x44a9c8]
fcompp
fnstsw ax
test ah, 5
jp 0x40ea67
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.0040a1cd
call fcn.00401d8f
call esi
push ebx
mov esi, eax
call fcn.0042a13f
mov dword [ebp - 0x4b0], esi
fild dword [ebp - 0x4b0]
pop ecx
mov edi, eax
test esi, esi
jge 0x40ea8a
fadd qword [0x44a9c8]
call fcn.00438ef0
mov dword [ebp - 0x4b0], edi
fild dword [ebp - 0x4b0]
test edi, edi
jge 0x40eaa5
fadd qword [0x44a9c8]
fcompp
fnstsw ax
test ah, 5
jp 0x40eab8
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4a8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x3ff
lea eax, [ebp - 0x40f]
push ebx
push eax
mov byte [ebp - 0x410], bl
call fcn.00431170
add esp, 0xc
push dword [ebp - 0x49c]
lea eax, [ebp - 0x4d4]
push dword [ebp - 0x4a0]
push dword [ebp - 0x4a4]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4b0], esp
push 8
push 0x4480c8
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.00427269
cmp dword [eax + 0x18], 0x10
jb 0x40eb42
mov eax, dword [eax + 4]
jmp 0x40eb45
add eax, 4
push eax
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.0042a272
add esp, 0x18
push ebx
push 1
lea ecx, [ebp - 0x4d4]
call fcn.0040329c
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x52c]
call fcn.00417161
mov ecx, dword [ebp - 0x4b8]
lea eax, [ebp - 0x410]
push eax
add ecx, 0x1b8
call fcn.00403254
xor eax, eax
call fcn.0042b3f9
ret 4

Function at 0x40eb99
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 0x1c], 0x10
mov eax, dword [esp + 8]
jae 0x40eba8
lea eax, [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40ebcd
mov esi, 0x80004005
push 0
push 1
lea ecx, [esp + 0x10]
call fcn.0040329c
mov eax, esi
pop esi
ret 0x1c
xor esi, esi
jmp 0x40ebba
Function at 0x40ebd1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00438600
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfff
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call fcn.00431170
add esp, 0xc
lea eax, [ebp - 0x1004]
push eax
mov esi, 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40ec24
mov eax, 0x80004005
jmp 0x40ec5c
cmp eax, esi
jae 0x40ec1d
lea eax, [ebp - 0x1004]
push eax
lea ecx, [edi + 0x19c]
call fcn.00403254
call fcn.004094e1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x40ec52
dec eax
dec eax
je 0x40ec52
sub eax, 4
jne 0x40ec5a
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00428582
leave
ret
Function at 0x40fdd5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d876
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.00438600
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0xfff
lea eax, [ebp - 0x100f]
push ebx
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0x1010], bl
call fcn.00431170
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [ebp + 0x20], 0x10
jae 0x40fe32
lea eax, [ebp + 0xc]
mov esi, 0x1000
push esi
lea ecx, [ebp - 0x1010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, ebx
jne 0x40fe75
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0040329c
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428582
leave
ret 0x1c
cmp eax, esi
jb 0x40fe8d
mov esi, 0x80004005
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0040329c
mov eax, esi
jmp 0x40fe5a
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.00403254
xor esi, esi
jmp 0x40fe7e
Function at 0x412516
Capabilities:
Copy file

Disassembly:
push 0x7c
mov eax, 0x43fc46
call fcn.0042b30d
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push dword [esi + 0x74]
add edi, 0x2c0
mov eax, edi
mov dword [ebp - 0x10], edi
call fcn.004174cd
cmp dword [eax + 0x3c], 0
jne 0x41254b
mov eax, 0x80004005
jmp 0x412643
push 0x10
pop ebx
cmp dword [esi + 0x70], ebx
jb 0x412558
mov ecx, dword [esi + 0x5c]
jmp 0x41255b
lea ecx, [esi + 0x5c]
mov eax, dword [ebp + 8]
add eax, 0x244
cmp dword [eax + 0x18], ebx
jb 0x41256d
mov eax, dword [eax + 4]
jmp 0x412570
add eax, 4
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [esi + 0x74]
test eax, eax
mov eax, edi
jne 0x412638
call fcn.004174cd
add eax, 0x38
inc dword [eax]
push dword [esi + 0x74]
mov eax, edi
call fcn.004174cd
cmp dword [eax + 0x38], 3
jle 0x412541
push dword [esi + 0x74]
mov eax, edi
call fcn.004174cd
cmp dword [eax + 0x18], ebx
jb 0x4125b5
mov eax, dword [eax + 4]
jmp 0x4125b8
add eax, 4
push eax
lea eax, [ebp - 0x30]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x14], esp
push 0x3b
push str._DRTSNT
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
and dword [ebp - 4], 0
mov ecx, eax
call fcn.00427269
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], ebx
jb 0x4125f5
mov eax, dword [eax + 4]
jmp 0x4125f8
add eax, 4
mov ebx, dword [ebp + 8]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.0040329c
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x88]
call fcn.00417161
mov eax, dword [ebp + 0xc]
push dword [eax + 0x74]
mov eax, dword [ebp - 0x10]
call fcn.004174cd
and dword [eax + 0x3c], 0
jmp 0x412541
call fcn.004174cd
and dword [eax + 0x38], 0
xor eax, eax
call fcn.0042b3e5
ret 8
Function at 0x41be5a
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov ecx, dword [esi + 0x40]
push ebx
xor al, al
push edi
mov bl, 1
cmp ecx, 0xffffffff
je 0x41bff0
mov edi, 0x10000000
cmp ecx, 0x7c
je 0x41bff0
cmp ecx, 0x29
jne 0x41be9c
cmp dword [esi + 0x10], 0
jne 0x41bff0
test dword [esi + 0x44], edi
jne 0x41be9c
push 5
call fcn.00427c96
pop ecx
jmp 0x41bfd9
cmp ecx, 0x2e
jne 0x41beb8
push 5
lea eax, [esi + 0x18]
push eax
call fcn.0041c0d3
mov eax, esi
call fcn.0041be32
jmp 0x41bfd9
cmp ecx, 0x5c
jne 0x41bf17
mov eax, esi
call fcn.0041be32
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x41beeb
cmp byte [esi + 0x3e], 0x62
jne 0x41beeb
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0041c0d3
mov eax, esi
call fcn.0041be32
jmp 0x41bfe0
test eax, eax
je 0x41bf0b
cmp byte [esi + 0x3e], 0x42
jne 0x41bf0b
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0041c0d3
mov eax, dword [esi + 0x1c]
add eax, 8
or dword [eax], 1
jmp 0x41bedf
mov eax, esi
call fcn.0041cb41
jmp 0x41bfd9
cmp ecx, 0x5b
jne 0x41bf41
mov eax, esi
call fcn.0041be32
mov eax, esi
call fcn.0041caf6
cmp dword [esi + 0x40], 0x5d
je 0x41beac
push 4
call fcn.00427c96
pop ecx
jmp 0x41beac
cmp ecx, 0x28
jne 0x41bf6d
mov eax, esi
call fcn.0041be32
mov eax, esi
call fcn.0041cc0b
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x41bf64
push 5
call fcn.00427c96
pop ecx
mov eax, esi
call fcn.0041be32
jmp 0x41bfd5
cmp ecx, 0x5e
jne 0x41bf79
push 2
jmp 0x41bed6
cmp ecx, 0x24
jne 0x41bf85
push 3
jmp 0x41bed6
cmp ecx, 0x2a
je 0x41bfcd
cmp ecx, 0x2b
je 0x41bfcd
cmp ecx, 0x3f
je 0x41bfcd
cmp ecx, 0x7b
je 0x41bfcd
cmp ecx, 0x7d
jne 0x41bfaa
test dword [esi + 0x44], edi
jne 0x41bfaa
push 6
jmp 0x41be91
cmp ecx, 0x5d
jne 0x41bfbb
test dword [esi + 0x44], edi
jne 0x41bfbb
push 4
jmp 0x41be91
movzx eax, byte [esi + 0x3e]
push eax
lea eax, [esi + 0x18]
call fcn.0041cda1
jmp 0x41beac
push 0xa
call fcn.00427c96
pop ecx
test bl, bl
je 0x41bfe0
mov eax, esi
call fcn.0041ccd9
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x41be72
pop edi
pop ebx
pop ecx
ret
Function at 0x41e415
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.1eef7b2938af8dd957ffc4072a63
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x41e485
push str.5e1918178acf73f50a7d8f4fec79438
call fcn.00428d27
pop ecx
pop ecx
jmp 0x41e4f5
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41e4a0
push str.827b2c796b61925d2327ccf1f2efef
jmp 0x41e4e8
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x41e4d1
push eax
push ebx
push str.a755bda554ef29bdd
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.0ad348c57adb29b1
call fcn.00428d27
add esp, 0x14
jmp 0x41e4ee
cmp eax, ebx
jne 0x41e4e3
push ebx
push str.9395cca90b49403f43b373af509
call fcn.00428d27
pop ecx
jmp 0x41e4ed
push str.99117c9fad97e8a72aedf1913d9f206
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret

Function at 0x41e5de
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.71ef42f522f1fdbd217baca
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.0d93af11ce852441473130d9bf
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x41e64f
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.9eed29872c85178565710
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x41e624
test eax, eax
jne 0x41e65f
push esi
push str.bb574a839fe18f81_d
jmp 0x41e665
push eax
push str.ccafad87e6d34b4b81377857ffa__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41e712
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.d777d05b6a49dc8fdbe
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x41e782
push str.2309c7015fe5be4581dd0d4
call fcn.00428d27
pop ecx
pop ecx
jmp 0x41e7f2
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41e79d
push str.3bfd58035a4303e55
jmp 0x41e7e5
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x41e7ce
push eax
push ebx
push str.e22b49b39ea51817725301
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.94d76f214b0b3ddffd07f67feba9
call fcn.00428d27
add esp, 0x14
jmp 0x41e7eb
cmp eax, ebx
jne 0x41e7e0
push ebx
push str.f667d50b08b788c999b58c6f392
call fcn.00428d27
pop ecx
jmp 0x41e7ea
push str.04ef406b549582a1fdbd2e11
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret

Function at 0x41e9ad
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.b1db33091afd3583b02f9d510
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x41ea1d
push str.bf6b03ef016525636c25e
call fcn.00428d27
pop ecx
pop ecx
jmp 0x41ea8d
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ea38
push str.51d33035a30f59e7db116ad1f4b5
jmp 0x41ea80
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x41ea69
push eax
push ebx
push str.e6c1b9fb32591379b04b3ca
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.af230ea5c3e5e53908
call fcn.00428d27
add esp, 0x14
jmp 0x41ea86
cmp eax, ebx
jne 0x41ea7b
push ebx
push str.48871e4702b55c47135d9
call fcn.00428d27
pop ecx
jmp 0x41ea85
push str.d0495ea3c7c153bbce3526
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret
Function at 0x41eb95
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.8607bd5d00f7282d4fdb26c5c697ce
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.50cde8df5a2d0b9b51a9b14dba536f5
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x41ec06
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.b405b565934f005f1
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x41ebdb
test eax, eax
jne 0x41ec16
push esi
push str.b8cff0a1e76fca9963458817a_d
jmp 0x41ec1c
push eax
push str.7983022fff2948291ec1b209af__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x41ecfe
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.d0a70807b735812396d78d97caa1d5
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x41ed47
push str.711de6e9f40def69c9ddb6
call fcn.00428d27
jmp 0x41ed7f
test esi, esi
jbe 0x41ed57
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.2d6b5a637489e0cf1239a81f415
jne 0x41ed73
mov eax, str.9133e8116751605d
push eax
push str.6b15f7a3aee73caf99
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x41eeb2
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.1039af9100a18c8bc661ef7
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x41ef22
push str.b02fbf09bd256b296f01a5
call fcn.00428d27
pop ecx
pop ecx
jmp 0x41ef92
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ef3d
push str.e0cfed274bc56959972f6
jmp 0x41ef85
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x41ef6e
push eax
push ebx
push str.00ddeea71b4593d70dc
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.b91d957fa513340dca6348756a
call fcn.00428d27
add esp, 0x14
jmp 0x41ef8b
cmp eax, ebx
jne 0x41ef80
push ebx
push str.7347a3b7a9316cc55ceb373715eb
call fcn.00428d27
pop ecx
jmp 0x41ef8a
push str.a96b27cd99b1543beddf578f3f8d3
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret

Function at 0x41f246
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.6579b9738a692bbf1a6928
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x41f2b6
push str.3651689becdd35a3e60d92
call fcn.00428d27
pop ecx
pop ecx
jmp 0x41f326
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41f2d1
push str.6e2d08c52a2f452b
jmp 0x41f319
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x41f302
push eax
push ebx
push str.dd0bea878e75bdddd
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.beed54afedabdfd3ee
call fcn.00428d27
add esp, 0x14
jmp 0x41f31f
cmp eax, ebx
jne 0x41f314
push ebx
push str.e32d2c35b9efa3a745b37a5562f71
call fcn.00428d27
pop ecx
jmp 0x41f31e
push str.0981c7517c8d653994ef
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret