joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4084bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x489c20]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea ecx, [ebp - 0x78]
push ecx
xor eax, eax
xor ebx, ebx
inc ebx
push ebx
push eax
push str.SOFTWAREMicrosoft.NETFrameworkpolicy_v2.0
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
call esi
test eax, eax
jne 0x408514
push dword [ebp - 0x78]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x80]
push eax
push ebx
push 0
push str.SOFTWAREMicrosoft.NETFrameworkpolicy_v2.0.50727
push edi
call esi
test eax, eax
jne 0x408533
push dword [ebp - 0x80]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x70], eax
jne 0x40853f
cmp dword [ebp - 0x6c], eax
je 0x4085a9
lea ecx, [ebp - 0x70]
push ecx
push ebx
push eax
push str.SOFTWAREMicrosoft.NETFramework_
push edi
call esi
test eax, eax
jne 0x4085a9
xor esi, esi
push 0x206
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x7c], 0x104
call fcn.00450bc0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push str.InstallRoot
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4085a0
cmp dword [ebp - 0x6c], ebx
jne 0x4085a0
cmp word [ebp - 0x68], si
je 0x4085a0
mov dword [ebp - 0x74], ebx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1a0]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044eff8
add ebp, 0x1a4
leave
ret
Function at 0x4085c4
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x1c
mov eax, 0x46e279
call fcn.00450afd
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x47cfd0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00401e71
test eax, eax
je 0x4086c0
call fcn.004084bf
test eax, eax
je 0x4086c0
lea eax, [ebp - 0x10]
push eax
push 3
push ebx
push str.SOFTWAREMicrosoft.NETFramework_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x40865d
push 4
pop edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
mov esi, str.NoGuiFromShim
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x14], ebx
jne 0x40865d
push dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8003
call esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x28], esp
mov edi, esp
call fcn.0040130b
add eax, 0x10
mov dword [edi], eax
call fcn.004083a4
pop ecx
cmp eax, ebx
je 0x40869a
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call esi
cmp dword [ebp - 0x24], ebx
jne 0x4086c0
cmp dword [ebp - 0x14], ebx
jne 0x4086b7
push str.NoGuiFromShim
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401464
mov eax, dword [ebp - 0x1c]
call fcn.00450b9c
ret
Function at 0x408759
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0xc8
lea ebp, [esp - 4]
mov eax, dword [0x489c20]
xor eax, ebp
mov dword [ebp + 0xc8], eax
push 0x14
mov eax, 0x46f4d4
call fcn.00450afd
xor esi, esi
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 4], esi
push 0xc6
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.00450bc0
add esp, 0xc
push str.SoftwareWondershare_
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x20], 0x64
mov dword [ebp - 0x1c], esi
call fcn.004019b7
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xd4]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00408cfe
push 0x47cf18
lea eax, [ebp - 0x10]
push eax
call fcn.00408b2d
xor edi, edi
call fcn.0040c8f8
test eax, eax
je 0x4087e9
mov edi, 0x200
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
or edi, 0x20019
push edi
push esi
push esi
push esi
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x408839
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push str.Version
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.00406a3c
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401464
mov eax, dword [ebp + 0xd4]
add eax, 0xfffffff0
call fcn.00401464
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc8]
xor ecx, ebp
call fcn.0044eff8
add ebp, 0xcc
leave
ret
Function at 0x408882
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x489c20]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x14
mov eax, 0x46f499
call fcn.00450afd
xor esi, esi
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 4], esi
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.00450bc0
add esp, 0xc
push str.SoftwareWondershare_
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x20], 0x104
mov dword [ebp - 0x1c], esi
call fcn.004019b7
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x214]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00408cfe
push 0x47cf18
lea eax, [ebp - 0x10]
push eax
call fcn.00408b2d
xor edi, edi
call fcn.0040c8f8
test eax, eax
je 0x408912
mov edi, 0x200
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
or edi, 0x20019
push edi
push esi
push esi
push esi
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x408962
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push str.InstallName
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.00406a3c
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401464
mov eax, dword [ebp + 0x214]
add eax, 0xfffffff0
call fcn.00401464
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0044eff8
add ebp, 0x20c
leave
ret
Function at 0x4089ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x489c20]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x14
mov eax, 0x46f499
call fcn.00450afd
xor esi, esi
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 4], esi
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push esi
push eax
call fcn.00450bc0
add esp, 0xc
push str.SoftwareWondershare_
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x20], 0x104
mov dword [ebp - 0x1c], esi
call fcn.004019b7
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x214]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00408cfe
push 0x47cf18
lea eax, [ebp - 0x10]
push eax
call fcn.00408b2d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push dword [ebp - 0x10]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x408a79
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push str.Intstall
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.00406a3c
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401464
mov eax, dword [ebp + 0x214]
add eax, 0xfffffff0
call fcn.00401464
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0044eff8
add ebp, 0x20c
leave
ret
Function at 0x40a354
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub eax, 0x111
push ebx
push esi
push edi
push 1
mov esi, ecx
pop ebx
je 0x40a44c
sub eax, 0x7f53
je 0x40a428
dec eax
je 0x40a3f7
dec eax
je 0x40a3d7
dec eax
je 0x40a3b6
sub eax, 0x155
je 0x40a3a9
sub eax, 0x604
jne 0x40a4b4
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
lea edi, [esi + 0x278]
call fcn.0040c3d5
jmp 0x40a4af
or word [0x48ceda], 0x10
jmp 0x40a497
xor edi, edi
push edi
push edi
push 0x8064
call fcn.00424113
push edi
push edi
push 0x8065
mov ecx, esi
call fcn.00424113
jmp 0x40a4af
mov eax, esi
call fcn.0040a97b
lea eax, [esi + 0x278]
call fcn.0040c367
push ebx
push ebx
mov ecx, esi
call fcn.00423dd0
jmp 0x40a4af
mov edi, dword [esi + 0x730]
call fcn.00405cdd
mov eax, esi
call fcn.0040a7a4
xor edi, edi
push edi
push edi
push esi
push 0x40bc8b
push edi
push edi
call fcn.0045029e
add esp, 0x18
mov dword [esi + 0x754], eax
jmp 0x40a4af
xor edi, edi
cmp dword [esi + 0x750], edi
jne 0x40a4af
push edi
push edi
push esi
push 0x40bc7d
push edi
push edi
call fcn.0045029e
add esp, 0x18
mov dword [esi + 0x750], eax
jmp 0x40a4af
cmp dword [ebp + 0xc], 0x208
jne 0x40a4b4
cmp dword [esi + 0x748], 4
jne 0x40a46a
mov ecx, dword [esi + 0x730]
push ebx
call fcn.00405efc
mov eax, dword [esi + 0x770]
dec eax
je 0x40a48d
dec eax
je 0x40a483
dec eax
jne 0x40a495
or word [0x48cedc], 8
jmp 0x40a495
or word [0x48ceda], 8
jmp 0x40a495
or word [0x48ced8], 8
mov ecx, esi
call fcn.0040bca1
lea eax, [esi + 0x278]
call fcn.0040c367
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10
Function at 0x40b3e9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
mov ecx, dword [esi + 0x65c]
mov eax, dword [ecx]
push edi
push 1
call dword [eax + 0xcc]
xor ebx, ebx
jmp 0x40b423
push 0xa
push dword [esi + 0x750]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40b423
cmp dword [esi + 0x740], ebx
je 0x40b42d
cmp dword [esi + 0x740], ebx
je 0x40b409
jmp 0x40b453
push dword [esi + 0x750]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esi + 0x730]
mov ecx, dword [edi]
mov dword [esi + 0x750], ebx
call fcn.0040604d
mov ecx, dword [edi]
call fcn.00406269
cmp dword [esi + 0x75c], ebx
jne 0x40b473
push ebx
push ebx
push esi
push 0x40bc9c
push ebx
push ebx
call fcn.0045029e
add esp, 0x18
mov dword [esi + 0x75c], eax
cmp dword [esi + 0x758], ebx
jne 0x40b493
push ebx
push ebx
push esi
push 0x40bc97
push ebx
push ebx
call fcn.0045029e
add esp, 0x18
mov dword [esi + 0x758], eax
mov eax, dword [esi + 0x730]
cmp dword [eax + 0xf4], ebx
je 0x40b4ce
sub esp, 0x1c
add eax, 0xe0
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esi + 0x6b0], bl
mov byte [esi + 0x744], bl
call fcn.00406a5e
mov edi, dword [esi + 0x658]
call fcn.0040b1b6
jmp 0x40b4ee
mov byte [esi + 0x6b0], 1
mov byte [esi + 0x744], 1
jmp 0x40b4ee
cmp byte [esi + 0x744], bl
jne 0x40b4f8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x740], ebx
je 0x40b4de
jmp 0x40b521
push 1
cmp byte [esi + 0x6b0], bl
jne 0x40b511
mov ecx, dword [esi + 0x658]
mov eax, dword [ecx]
call dword [eax + 0xcc]
push ebx
mov esi, dword [esi + 0x65c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xcc]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c1b6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov esi, eax
mov ebx, ecx
call fcn.0044fba3
and dword [ebp - 4], 0
pop ecx
mov dword [0x48cde0], eax
lea eax, [ebp - 4]
push eax
push esi
mov dword [0x48cde4], edx
mov dword [0x48cdfc], esi
call fcn.0040be72
mov eax, dword [ebp - 4]
dec eax
je 0x40c23c
dec eax
je 0x40c214
mov eax, dword [ebx + 0x730]
lea esi, [ebp - 4]
call fcn.00408d99
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401464
jmp 0x40c22e
lea edi, [ebx + 0x730]
mov esi, dword [edi]
push dword [esi + 0x2c0]
call fcn.0040640d
mov ecx, dword [edi]
call fcn.0040604d
mov dword [0x48cdf8], 3
xor eax, eax
jmp 0x40c26c
push 2
pop ecx
mov dword [ebx + 0x748], ecx
mov dword [0x48cdf8], 4
lea eax, [ebx + 0x730]
mov edx, dword [eax]
mov dword [edx + 0x2e4], ecx
mov edi, dword [eax]
call fcn.00405cdd
call fcn.00407bd5
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c7b9
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x46f431
call fcn.00450b66
xor edi, edi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], edi
xor ebx, ebx
inc ebx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00401c8e
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x21c], ebx
call fcn.00450bc0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x2e
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40c860
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004039d0
push 0x47cf18
push esi
call fcn.00406cd8
cmp dword [ebp + 0x1c], edi
je 0x40c84a
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x40c847
lea eax, [ebp + 0xc]
push eax
jmp 0x40c84f
push 0x47c8c4
push esi
call fcn.00406cd8
push 0x47cf18
push esi
call fcn.00406cd8
cmp dword [esi + 0x18], 8
jb 0x40c86b
mov eax, dword [esi + 4]
jmp 0x40c86e
lea eax, [esi + 4]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.00401fd6
mov eax, esi
call fcn.00450bb0
ret

Function at 0x40c931
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0xe4
lea ebp, [esp - 4]
mov eax, dword [0x489c20]
xor eax, ebp
mov dword [ebp + 0xe4], eax
push 0x34
mov eax, 0x46f3df
call fcn.00450afd
mov eax, dword [ebp + 0xf0]
mov dword [ebp - 0x14], eax
xor edi, edi
xor eax, eax
mov dword [ebp - 0x10], edi
push 0xc6
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push edi
push eax
call fcn.00450bc0
add esp, 0xc
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x24], edi
xor esi, esi
call fcn.0040c8f8
test eax, eax
je 0x40c995
mov esi, 0x200
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
or esi, 0x20019
push esi
push edi
push edi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x40c9e6
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push str.Version
push dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.00406a3c
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], edi
jne 0x40ca0f
push 0x47c934
lea ecx, [ebp - 0x40]
call fcn.00406a3c
mov byte [ebp - 4], bl
mov dword [ebp - 0x10], ebx
jmp 0x40ca12
lea eax, [ebp]
mov ecx, dword [ebp - 0x14]
push eax
call fcn.00406a5e
or dword [ebp - 0x10], 2
test byte [ebp - 0x10], bl
je 0x40ca2e
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.00401fd6
push edi
push ebx
lea ecx, [ebp]
call fcn.00401fd6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xe4]
xor ecx, ebp
call fcn.0044eff8
add ebp, 0xe8
leave
ret
Function at 0x40cf2d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x489c20]
xor eax, ebp
mov dword [ebp + 0x94], eax
push edi
push 0x114
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.00450bc0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40cf79
cmp dword [ebp - 0x7c], 6
jb 0x40cf79
inc edi
mov ecx, dword [ebp + 0x94]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0044eff8
add ebp, 0x98
leave
ret

Function at 0x40da25
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0xf0
lea ebp, [esp - 4]
mov eax, dword [0x489c20]
xor eax, ebp
mov dword [ebp + 0xf0], eax
push 0x34
mov eax, 0x46ed96
call fcn.00450afd
mov eax, dword [ebp + 0x100]
push 0x47deb4
push dword [ebp + 0xfc]
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
call fcn.00455953
xor ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x40daa2
cmp esi, ebx
je 0x40da9b
lea edi, [ebp - 0x40]
call fcn.0040e415
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0040227d
push ebx
push 1
mov ecx, edi
call fcn.00401fd6
xor al, al
jmp 0x40db9d
cmp edi, ebx
je 0x40daad
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
jmp 0x40dab0
mov dword [ebp - 0x1c], ebx
push 9
xor eax, eax
pop ecx
mov word [ebp + 0xc8], ax
lea edi, [ebp + 0xca]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x18]
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.004026c2
push 2
push ebx
push dword [ebp - 0x10]
call fcn.004559f4
push dword [ebp - 0x10]
call fcn.00455c16
push ebx
push ebx
push dword [ebp - 0x10]
mov esi, eax
call fcn.004559f4
add esp, 0x1c
xor edi, edi
cmp esi, ebx
je 0x40db5c
push esi
call fcn.0044e4ef
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 1
push esi
push eax
call fcn.00455f24
push esi
push dword [ebp - 0x14]
xor ebx, ebx
call fcn.0040e1d8
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044e4ef
push esi
push dword [ebp - 0x14]
mov ebx, eax
call fcn.0040e1d8
mov ecx, dword [ebp - 0x18]
add esp, 0x28
push edi
push ebx
call fcn.00401f62
push ebx
call fcn.0044f119
push dword [ebp - 0x14]
call fcn.0044f119
pop ecx
pop ecx
xor ebx, ebx
push edi
push esi
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp]
push str._s_d_bytes_to__d_wide_chars
push eax
call fcn.00455f41
mov ecx, dword [ebp - 0x20]
add esp, 0x14
cmp ecx, ebx
je 0x40db86
lea eax, [ebp]
push eax
call fcn.004039d0
push dword [ebp - 0x10]
call fcn.00456050
mov eax, dword [ebp - 0x24]
pop ecx
cmp eax, ebx
je 0x40db9b
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xf0]
xor ecx, ebp
call fcn.0044eff8
add ebp, 0xf4
leave
ret
Function at 0x40dbc0
Capabilities:
Write file on windows

Disassembly:
push ebp
sub esp, 0xf0
lea ebp, [esp - 4]
mov eax, dword [0x489c20]
xor eax, ebp
mov dword [ebp + 0xf0], eax
push 0x50
mov eax, 0x46ed66
call fcn.00450afd
mov eax, dword [ebp + 0x100]
push 0x47def4
push dword [ebp + 0xfc]
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], edi
mov bl, 1
call fcn.00455953
xor edx, edx
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, edx
jne 0x40dc40
cmp dword [ebp - 0x10], edx
je 0x40dc39
lea edi, [ebp - 0x5c]
call fcn.0040e415
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
xor esi, esi
push esi
push eax
mov dword [ebp - 4], esi
call fcn.0040227d
push esi
push 1
mov ecx, edi
call fcn.00401fd6
xor al, al
jmp 0x40dd3c
cmp edi, edx
je 0x40dc4b
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
jmp 0x40dc4e
mov dword [ebp - 0x1c], edx
xor eax, eax
push 9
mov word [ebp + 0xc8], ax
pop ecx
lea edi, [ebp + 0xca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x14]
xor edi, edi
mov dword [ebp - 0x20], eax
cmp eax, edx
je 0x40dcca
cmp dword [esi + 0x18], 8
lea ebx, [esi + 4]
jb 0x40dc7d
mov eax, dword [ebx]
jmp 0x40dc7f
mov eax, ebx
push edx
push edx
call fcn.0040e0de
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.0044e4ef
add esp, 0xc
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x18], eax
jb 0x40dc9f
mov ebx, dword [ebx]
push edi
push eax
mov eax, ebx
call fcn.0040e0de
push dword [ebp - 0x14]
push 1
push edi
push dword [ebp - 0x18]
call fcn.0045622e
push dword [ebp - 0x18]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
call fcn.0044f119
add esp, 0x1c
push edi
lea eax, [ebp + 0xc8]
push eax
push dword [ebp - 0x20]
lea eax, [ebp]
push str._d_wide_chars_to__s_d_bytes
push eax
call fcn.00455f41
mov esi, dword [ebp - 0x10]
add esp, 0x14
test esi, esi
je 0x40dcf8
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004039d0
test bl, bl
jne 0x40dd25
test esi, esi
je 0x40dd25
lea edi, [ebp - 0x40]
call fcn.0040e415
push 0xffffffffffffffff
xor edi, edi
push 0
inc edi
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0040227d
push 0
push edi
lea ecx, [ebp - 0x40]
call fcn.00401fd6
push dword [ebp - 0x14]
call fcn.00456050
mov eax, dword [ebp - 0x24]
pop ecx
test eax, eax
je 0x40dd3a
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xf0]
xor ecx, ebp
call fcn.0044eff8
add ebp, 0xf4
leave
ret
Function at 0x41639a
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x46f02e
call fcn.00450b66
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x4164ac
cmp byte [esi + 0x42], bl
je 0x4164ac
mov eax, dword [esi]
mov edi, 0xffff
push edi
mov ecx, esi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x4163d6
xor al, al
jmp 0x4164ae
push ebx
push 8
lea ecx, [ebp - 0x30]
call fcn.004161a2
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.004162e2
mov ecx, eax
call fcn.0041625c
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.004162e2
mov ecx, eax
call fcn.0041625c
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x416446
dec eax
je 0x41644a
dec eax
dec eax
je 0x4164a8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004032a5
mov al, bl
jmp 0x4164ae
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.004162e2
mov ecx, eax
call fcn.0041625c
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x41648a
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.004162e2
mov ecx, eax
call fcn.0041625c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0045622e
add esp, 0x10
cmp edi, eax
jne 0x416434
cmp byte [esi + 0x42], 0
je 0x4164a8
test edi, edi
jne 0x4163e4
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.0041634c
jmp 0x4163e4
mov bl, 1
jmp 0x416436
mov al, 1
call fcn.00450bb0
ret

Function at 0x4166d1
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x489c20]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x416717
mov eax, dword [esp]
cmp al, 2
jne 0x416711
shr eax, 8
cmp al, 2
jne 0x416711
xor eax, eax
inc eax
jmp 0x416719
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0044eff8
mov esp, ebp
pop ebp
ret