joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40581c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x40582f
xor eax, eax
jmp 0x40586a
test esi, esi
jne 0x405837
xor eax, eax
jmp 0x40586a
push esi
push ebx
call fcn.004ce170
add esp, 8
test eax, eax
jne 0x40584c
mov eax, 1
jmp 0x40586a
push esi
push ebx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x40585b
xor eax, eax
jmp 0x40586a
mov dword [0x4dd074], 0x630
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x4058f4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x200
push ebx
call fcn.00404efc
add esp, 8
push 4
push 0
push ebx
call sub.KERNEL32.dll_MoveFileExA
pop ebx
pop ebp
ret

Function at 0x405918
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
mov ecx, 0x50
lea eax, [ebp - 0x244]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x140]
push esi
mov esi, 0x4dd300
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x244]
push esi
mov esi, 0x4dd440
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x5cb75a
push esi
push eax
call fcn.00405870
add esp, 0xc
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x244]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x405a5d
lea ebx, [ebp - 0x10]
test ebx, ebx
jne 0x40598f
lea ebx, [ebp - 0x114]
mov al, byte [ebx]
test al, al
jne 0x40599b
lea ebx, [ebp - 0x114]
test ebx, ebx
je 0x405a57
mov al, byte [ebx]
test al, al
je 0x405a57
movsx edx, byte [ebx]
cmp edx, 0x2e
jne 0x4059c0
mov cl, byte [ebx + 1]
test cl, cl
je 0x405a42
movsx eax, byte [ebx]
cmp eax, 0x2e
jne 0x4059d8
movsx edx, byte [ebx + 1]
cmp edx, 0x2e
jne 0x4059d8
mov cl, byte [ebx + 2]
test cl, cl
je 0x405a42
lea eax, [ebp - 0x244]
push eax
call fcn.004cdfec
pop ecx
push eax
push ebx
call fcn.004cdfec
pop ecx
pop edx
add edx, eax
add edx, 2
cmp edx, 0x104
ja 0x405a57
test byte [ebp - 0x140], 0x10
je 0x405a24
push ebx
push esi
lea ecx, [ebp - 0x244]
push ecx
call fcn.00405870
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
call fcn.00405918
pop ecx
jmp 0x405a42
push ebx
push esi
lea edx, [ebp - 0x244]
push edx
call fcn.00405870
add esp, 0xc
lea ecx, [ebp - 0x244]
push ecx
call fcn.004058f4
pop ecx
lea eax, [ebp - 0x140]
push eax
push edi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x405982
push edi
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
push esi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x244]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x244]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0
push esi
push eax
call fcn.00405870
add esp, 0xc
lea edx, [ebp - 0x244]
push edx
call fcn.004058f4
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405b9c
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov byte [ebp - 1], 0
test esi, 0x200
je 0x405bc0
mov byte [ebp - 1], 1
test esi, 0x100
je 0x405bca
mov bl, 1
test esi, 0x200
jne 0x405be0
test esi, 0x100
jne 0x405be0
mov byte [ebp - 1], 1
mov bl, 1
test edi, edi
je 0x405d39
mov al, byte [edi]
test al, al
je 0x405d39
test esi, 0x1000
je 0x405c09
push edi
call fcn.00405b64
pop ecx
test al, al
jne 0x405d39
lea edx, [ebp - 0x108]
push edx
push edi
call fcn.00405ad4
add esp, 8
mov cl, byte [ebp - 0x108]
test cl, cl
je 0x405c52
lea eax, [ebp - 0x108]
push eax
call fcn.004cdfec
pop ecx
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
jne 0x405c52
lea ecx, [ebp - 0x108]
push ecx
call fcn.004cdfec
pop ecx
mov byte [ebp + eax - 0x109], 0
lea eax, [ebp - 0x248]
push eax
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x405ca7
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jne 0x405c9c
movsx eax, byte [ebp - 0x107]
cmp eax, 0x3a
jne 0x405c9c
mov dl, byte [ebp - 0x106]
test dl, dl
jne 0x405c9c
push edi
call sub.KERNEL32.dll_FindClose
mov eax, 1
jmp 0x405d3b
push edi
call sub.KERNEL32.dll_FindClose
jmp 0x405d39
mov dl, byte [ebp - 1]
test dl, dl
je 0x405cd6
test byte [ebp - 0x248], 0x10
je 0x405cd6
test esi, 0x2000
jne 0x405cd6
push edi
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x405d3b
mov eax, 1
jmp 0x405d3b
test bl, bl
je 0x405d1e
test byte [ebp - 0x248], 0x10
jne 0x405d1e
test esi, 0x2000
je 0x405d07
mov edx, dword [ebp - 0x22c]
test edx, edx
jne 0x405d07
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x405d07
push edi
call sub.KERNEL32.dll_FindClose
jmp 0x405d33
push edi
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x405d3b
mov eax, 1
jmp 0x405d3b
lea edx, [ebp - 0x248]
push edx
push edi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x405ca7
push edi
call sub.KERNEL32.dll_FindClose
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405d44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x405d9d
call fcn.00401270
push eax
push 0x5cb75c
push ebx
call fcn.004d26c8
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x405d9d
push ebx
push 0
push 0x5cb768
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
je 0x405d9d
mov eax, 1
jmp 0x405d9f
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406678
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
push ebx
push esi
push edi
or ebx, 0xffffffff
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 4], eax
test edi, edi
je 0x4067ca
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4067ca
lea ecx, [ebp - 4]
push ecx
push 0x20106
push 0
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x4066fd
cmp esi, 0xfffffffe
jne 0x4066cd
mov ebx, 1
jmp 0x4067ca
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
push edx
push 0
push 0xf013f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
je 0x4066fd
mov ebx, 0xffffff9b
jmp 0x4067ca
cmp esi, 0xfffffffe
jne 0x406724
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegDeleteValueA
test eax, eax
je 0x40671a
mov ebx, 0xffffff37
jmp 0x4067ca
mov ebx, 1
jmp 0x4067ca
mov eax, dword [ebp + 0x1c]
sub eax, 4
jne 0x406766
mov edx, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x406740
mov dword [ebp - 8], 4
jmp 0x406743
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push ecx
push eax
mov edx, dword [ebp + 0x1c]
push edx
push 0
push edi
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x4067ca
mov ebx, 1
jmp 0x4067ca
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4067ca
cmp esi, 0xffffffff
jne 0x4067a6
mov edx, dword [ebp + 0x1c]
sub edx, 7
je 0x406789
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004cdfec
pop ecx
mov dword [ebp - 8], eax
jmp 0x4067a9
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x14]
mov eax, edx
mov dl, byte [eax]
test dl, dl
jne 0x4067a0
mov cl, byte [eax + 1]
test cl, cl
je 0x4067a9
inc dword [ebp - 8]
inc eax
jmp 0x406793
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x4067ca
mov ebx, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x4067da
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40739c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test ebx, ebx
jne 0x4073bc
xor eax, eax
jmp 0x407416
test eax, eax
jne 0x4073c7
mov byte [ebx], 0
xor eax, eax
jmp 0x407416
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
mov ecx, dword [esi]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov dword [edx], ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x14]
push ecx
push edx
push 0
lea edx, [ebp - 4]
push edx
push ebx
mov edx, dword [edi]
push edx
push eax
call sub.ADVAPI32.dll_RegEnumValueA
test eax, eax
je 0x4073f9
mov byte [ebx], 0
xor eax, eax
jmp 0x407416
mov ecx, dword [ebp - 4]
mov byte [ebx + ecx], 0
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 8]
mov byte [eax + edx], 0
mov eax, 1
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
inc dword [edi]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x40c948
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffdc
mov eax, 0x4dd9d8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
call fcn.004d08c0
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x1024]
push edx
push 0x1000
push ecx
push 0x5cc533
push edi
push esi
call sub.KERNEL32.dll_GetPrivateProfileStringA
test eax, eax
jne 0x40ca17
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x40c9be
test ebx, ebx
je 0x40c9a3
mov byte [ebx], 0
mov dword [0x4dd074], 0x37
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40ca97
test ebx, ebx
je 0x40c9ea
mov ecx, dword [ebp + 0x14]
push esi
push edi
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
push edi
push esi
call fcn.0040c86c
mov dword [0x4dd074], 0x38
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40ca97
push 0
lea ecx, [ebp - 0x1024]
push ecx
call fcn.0040c6c8
add esp, 8
test ebx, ebx
je 0x40ca51
xor eax, eax
lea edi, [ebp - 0x1024]
or ecx, 0xffffffff
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [0x4dd074], 0x39
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40ca97
mov esp, ebp
mov edi, dword [ebp - 0x1030]
mov esi, dword [ebp - 0x102c]
mov ebx, dword [ebp - 0x1028]
pop ebp
ret 0x14
Function at 0x40cec0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov eax, 0x4dda28
push ebx
push esi
push edi
call fcn.004d08c0
mov word [ebp - 0x14], 8
lea edi, [ebp - 0x44]
mov esi, 0x4dda08
mov ecx, 8
lea eax, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 8
push 0x4dda00
push 0x1f
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x44]
push eax
call fcn.0040cd68
pop ecx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40cf49
mov esp, ebp
mov edi, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x48]
pop ebp
ret

Function at 0x40d3f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test bl, 0x10
je 0x40d413
push 5
push 0x2e5
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bl, 0x20
je 0x40d42b
push 5
push 0x2e6
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bl, 0x40
je 0x40d443
push 5
push 0x303
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bl, 0x80
je 0x40d45b
push 5
push 0x304
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bh, 1
je 0x40d473
push 5
push 0x305
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test bh, 2
je 0x40d48b
push 5
push 0x2f9
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x10000
je 0x40d4a6
push 0
push 0x2e5
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x20000
je 0x40d4c1
push 0
push 0x2e6
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x40000
je 0x40d4dc
push 0
push 0x303
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x80000
je 0x40d4f7
push 0
push 0x304
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x100000
je 0x40d512
push 0
push 0x305
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
test ebx, 0x200000
je 0x40d52d
push 0
push 0x2f9
push esi
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
pop ebp
ret
Function at 0x40d5a0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40d680
test esi, esi
je 0x40d680
mov dword [ebx + 0x10], esi
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40d5cc
push eax
call sub.GDI32.dll_DeleteObject
mov dl, byte [ebx + 0x64]
test dl, dl
jne 0x40d5dd
xor ecx, ecx
mov dword [ebx + 0x1c], ecx
jmp 0x40d67c
test byte [ebx + 0xe], 8
je 0x40d60f
push 0xffffffffffffffec
push esi
call sub.USER32.dll_GetWindowLongA
or eax, 0x8000080
push eax
push 0xffffffffffffffec
push esi
call sub.USER32.dll_SetWindowLongA
push 0xfffffffffffffff0
push esi
call sub.USER32.dll_GetWindowLongA
and eax, 0xefffffff
push eax
push 0xfffffffffffffff0
push esi
call sub.USER32.dll_SetWindowLongA
lea eax, [ebx + 0x64]
push eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.USER32.dll_LoadIconA
mov edi, eax
mov dword [ebx + 0x1c], edi
test edi, edi
jne 0x40d63e
push 0x5cc54b
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.USER32.dll_LoadIconA
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x40d65a
push 0x5cc54d
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.USER32.dll_LoadIconA
mov dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x1c]
push edx
push 0
push 0x80
push esi
call sub.USER32.dll_SendMessageA
mov ecx, dword [ebx + 0x1c]
push ecx
push 1
push 0x80
push esi
call sub.USER32.dll_SendMessageA
mov al, 1
jmp 0x40d682
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40f288
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee4
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
xor eax, eax
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 0x10], edx
xor ecx, ecx
mov dword [esp + 0x14], ecx
push 0x104
lea eax, [esp + 0x1c]
xor ebp, ebp
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x5cc5c1
lea edx, [esp + 0x1c]
push edx
call fcn.004cdf10
add esp, 8
push 0x5cc5ee
push 0x5cc5cf
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
jne 0x40f30a
push 0x5cc60e
push 0x5cc606
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov ebx, eax
push 0x5cc645
push 0x5cc626
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
test esi, esi
jne 0x40f33c
push 0x5cc661
push 0x5cc659
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
push 0x5cc694
push 0x5cc675
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
test edi, edi
jne 0x40f36e
push 0x5cc6ab
push 0x5cc6a3
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
test ebx, ebx
je 0x40f46b
test esi, esi
je 0x40f46b
test edi, edi
je 0x40f46b
push 0
lea eax, [esp + 0x1c]
push eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x40f402
push ebx
call fcn.004d8390
pop ecx
mov dword [esp], eax
mov edx, dword [esp]
push edx
push ebx
push 0
lea ecx, [esp + 0x24]
push ecx
call esi
test eax, eax
je 0x40f402
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push 0x5cc6ba
mov ecx, dword [esp + 0xc]
push ecx
call edi
test eax, eax
je 0x40f402
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x10]
mov edx, eax
shr edx, 0x10
shr eax, 0
and edx, 0xff
mov dword [esp + 0xc], edx
and eax, 0xff
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xc]
shr eax, 0x10
and ax, 0xffff
movzx edx, ax
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0xc]
cmp ecx, 6
jne 0x40f43e
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40f417
mov bp, 0x65
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x40f424
mov bp, 0x6b
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40f431
mov bp, 0x6c
mov eax, dword [esp + 0x10]
cmp eax, 3
jne 0x40f43e
mov bp, 0x6c
mov eax, dword [esp + 0xc]
cmp eax, 0xa
jne 0x40f45a
mov bp, 0x6e
mov eax, dword [esp + 0x14]
cmp eax, 0x55f0
jb 0x40f45a
mov bp, 0x6f
mov eax, dword [esp]
test eax, eax
je 0x40f46b
mov edx, dword [esp]
push edx
call fcn.004d8338
pop ecx
mov eax, ebp
add esp, 0x11c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40f538
Capabilities:
Check os version

Disassembly:
push ebx
push esi
add esp, 0xffffff60
xor ebx, ebx
mov word [0x5f61a0], 0
xor eax, eax
mov dword [esp + 4], 0x9c
lea edx, [esp + 4]
mov dword [0x5f61a4], eax
push edx
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
jne 0x40f572
call fcn.0040f478
jmp 0x40f775
movzx eax, word [esp + 8]
movzx ecx, word [esp + 0xc]
shl eax, 0x10
mov edx, dword [esp + 0x14]
or ecx, eax
sub edx, 1
mov dword [0x5f61a4], ecx
jb 0x40f701
je 0x40f6be
dec edx
jne 0x40f705
mov ecx, dword [esp + 8]
sub ecx, 5
je 0x40f698
dec ecx
je 0x40f5e7
sub ecx, 4
jne 0x40f6b8
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40f5cb
mov bx, 0x6e
jmp 0x40f5cf
mov bx, 0x7e0
mov eax, dword [esp + 0x10]
cmp eax, 0x55f0
jb 0x40f705
mov bx, 0x6f
jmp 0x40f705
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40f60d
mov dl, byte [esp + 0x9e]
cmp dl, 1
jne 0x40f604
mov bx, 0x65
jmp 0x40f705
mov bx, 0x7d8
jmp 0x40f705
cmp eax, 1
jne 0x40f62f
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40f626
mov bx, 0x6b
jmp 0x40f705
mov bx, 0x7d8
jmp 0x40f705
cmp eax, 2
jne 0x40f651
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40f648
mov bx, 0x6c
jmp 0x40f705
mov bx, 0x7dc
jmp 0x40f705
cmp eax, 3
jne 0x40f673
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40f66a
mov bx, 0x6c
jmp 0x40f705
mov bx, 0x7dc
jmp 0x40f705
cmp eax, 4
jne 0x40f681
mov bx, 0x6e
jmp 0x40f705
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x40f692
mov bx, 0x65
jmp 0x40f705
mov bx, 0x7d8
jmp 0x40f705
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40f6a4
mov bx, 0x7d0
cmp eax, 1
jne 0x40f6ad
mov bx, 0x64
cmp eax, 2
jne 0x40f705
mov bx, 0x7d3
jmp 0x40f705
mov bx, 4
jmp 0x40f705
mov eax, dword [esp + 8]
cmp eax, 4
jne 0x40f6d3
mov edx, dword [esp + 0xc]
test edx, edx
jne 0x40f6d3
mov bx, 0x5f
mov eax, dword [esp + 8]
cmp eax, 4
jne 0x40f6e9
mov edx, dword [esp + 0xc]
cmp edx, 0xa
jne 0x40f6e9
mov bx, 0x62
mov eax, dword [esp + 8]
cmp eax, 4
jne 0x40f705
mov edx, dword [esp + 0xc]
cmp edx, 0x5a
jne 0x40f705
mov bx, 0x63
jmp 0x40f705
mov bx, 3
cmp bx, 0x6c
jne 0x40f71b
call fcn.0040f288
mov ebx, eax
test bx, bx
jne 0x40f71b
mov bx, 0x6c
push 4
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerA
test eax, eax
je 0x40f738
push eax
call sub.ADVAPI32.dll_CloseServiceHandle
or word [0x5f61a0], 4
xor eax, eax
mov dword [esp], eax
push 0x5cc6c5
push 0x5cc6bc
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov esi, eax
test esi, esi
je 0x40f763
push esp
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
mov eax, dword [esp]
test eax, eax
je 0x40f772
or word [0x5f61a0], 0x10
movzx eax, bx
add esp, 0xa0
pop esi
pop ebx
ret
Function at 0x41087c
Capabilities:
Get memory capacity

Disassembly:
push ebx
add esp, 0xffffffa0
xor ebx, ebx
push 0x40
push 0
lea eax, [esp + 8]
push eax
call fcn.004cde6c
add esp, 0xc
mov dword [esp], 0x40
push 0x5cc863
push 0x5cc856
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x4108d0
push esp
call eax
test eax, eax
je 0x4108d0
push 0
push 0x100000
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
call fcn.004d59f7
mov ebx, eax
test ebx, ebx
jne 0x4108e5
lea eax, [esp + 0x40]
push eax
call sub.KERNEL32.dll_GlobalMemoryStatus
mov ebx, dword [esp + 0x48]
shr ebx, 0x14
mov eax, 4
mov edx, 7
cmp ebx, 0x1f4
jle 0x410901
mov eax, 5
mov edx, 0xf
cmp ebx, 0x3e8
jle 0x410913
mov eax, 6
mov edx, 0x1f
test edx, ebx
je 0x410920
mov ecx, eax
sar ebx, cl
inc ebx
mov ecx, eax
shl ebx, cl
mov eax, ebx
add esp, 0x60
pop ebx
ret

Function at 0x410928
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x10]
lea ecx, [ebp - 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push eax
push edx
push ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push eax
call sub.KERNEL32.dll_GetDiskFreeSpaceExA
test eax, eax
je 0x4109d6
test esi, 1
je 0x410999
mov eax, dword [ebp - 0x18]
test esi, 0x2000
mov ebx, eax
je 0x41097b
push 0
push 0x3b9aca00
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.004d59f7
mov ebx, eax
test esi, 0x1000
je 0x4109d6
push 0
push 0xf4240
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.004d59f7
mov ebx, eax
jmp 0x4109d6
mov eax, dword [ebp - 0x10]
test esi, 0x2000
mov ebx, eax
je 0x4109ba
push 0
push 0x3b9aca00
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004d59f7
mov ebx, eax
test esi, 0x1000
je 0x4109d6
push 0
push 0xf4240
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004d59f7
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4118c4
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.00411814
xor eax, eax
xor edx, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x110], edx
xor eax, eax
lea edx, [ebp - 0x10c]
jmp 0x4118fc
cmp ebx, dword [edx]
je 0x411904
inc eax
add edx, 4
cmp eax, dword [ebp - 0x110]
jb 0x4118f4
mov edx, dword [ebp - 0x110]
cmp eax, edx
jne 0x411920
cmp edx, 0x40
jae 0x411920
mov dword [ebp + eax*4 - 0x10c], ebx
inc dword [ebp - 0x110]
test esi, 8
je 0x411941
lea eax, [ebp - 8]
lea ecx, [ebp - 0x110]
push eax
push 0
push 0
push ecx
push 0
call sub.WSOCK32.dll_select
mov dword [ebp - 0xc], eax
test esi, 0x10
je 0x411962
lea eax, [ebp - 8]
lea edx, [ebp - 0x110]
push eax
push 0
push edx
push 0
push 0
call sub.WSOCK32.dll_select
mov dword [ebp - 0xc], eax
test esi, 0x20
je 0x411983
lea ecx, [ebp - 8]
lea eax, [ebp - 0x110]
push ecx
push eax
push 0
push 0
push 0
call sub.WSOCK32.dll_select
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
inc edx
jne 0x41198d
xor eax, eax
jmp 0x411992
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret