joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ae53
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
push 0x19
cdq
pop ecx
idiv ecx
add dl, 0x4b
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, ecx
jl 0x40ae87
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40af0b
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40af0b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret

Function at 0x40af19
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.e4c905518401777b9d5bbe
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40af62
push str.582b689d3ac7662b793d8f
call fcn.004294d3
jmp 0x40af9a
test esi, esi
jbe 0x40af72
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.4f0be0e7318d7fd55baf5deb5
jne 0x40af8e
mov eax, str.489db72979cd8a6544efeeb70a11ff4
push eax
push str.6417f9f32075bd0bddd5a33539b
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40afe6
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.bfa1714710d38c9722697c71f73b
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40b056
push str.0e37d2830b59328b9f492bed1fbfb
call fcn.004294d3
pop ecx
pop ecx
jmp 0x40b0c6
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b071
push str.f17fb83fa2a9ad4f1
jmp 0x40b0b9
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40b0a2
push eax
push ebx
push str.94178dc177eb03499
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.f7b9fe79ed07ffd5f759
call fcn.004294d3
add esp, 0x14
jmp 0x40b0bf
cmp eax, ebx
jne 0x40b0b4
push ebx
push str.a3c90281bd431b299e
call fcn.004294d3
pop ecx
jmp 0x40b0be
push str.6fff534f7f33ba6b8
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x40b0de
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.3c4173b162ed436fcaa9a09faa
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40b127
push str.29c7bd6f9e9bd60b10c1e7edcd6b59
call fcn.004294d3
jmp 0x40b15f
test esi, esi
jbe 0x40b137
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.485bf0112ee732e53e474b69b60fe05
jne 0x40b153
mov eax, str.11ad53df906902d31f5b2ad730
push eax
push str.38c5989b9ee920f348d500
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40b375
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.0f93dc6989bd9121ec
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.d7cd41b39c9b9a756c
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40b3e6
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.4309df33fb9fd76d2531bb4392517b
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40b3bb
test eax, eax
jne 0x40b3f6
push esi
push str.4cb96bc3664b3ea3712fe_d
jmp 0x40b3fc
push eax
push str.b5250627d121310f5e11c28ddcfb16e__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40b8ab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
cdq
mov ecx, 0x8d
idiv ecx
add dl, 0x20
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x40b8df
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40b966
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40b966
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret
Function at 0x40b974
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.4ebdfb874a53da4bc1b
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40b9e4
push str.94e58397d22dd3bdcefb05d5ee6
call fcn.004294d3
pop ecx
pop ecx
jmp 0x40ba54
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b9ff
push str.426d3aaf383d207789751c51e1a5
jmp 0x40ba47
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40ba30
push eax
push ebx
push str.e28f1b83bf4fc6cb
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.daad2a3b6687ad27f1953abf7dd1b3
call fcn.004294d3
add esp, 0x14
jmp 0x40ba4d
cmp eax, ebx
jne 0x40ba42
push ebx
push str.729598c7005196b3da67311da467c
call fcn.004294d3
pop ecx
jmp 0x40ba4c
push str.4f8fba51e48fb8af0c99c55f8d65a
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x40ba6c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.926beead44e9c2910
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40bab5
push str.afef5ad16293b2ed885f3c676
call fcn.004294d3
jmp 0x40baed
test esi, esi
jbe 0x40bac5
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.c959f0c7e41da615
jne 0x40bae1
mov eax, str.1de938df21197b737
push eax
push str.6155d187af9142f7541
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40bb35
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.23bd03f1309767b99c79bbb3c1ef2
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.e92fb80b2a3dcf37a5f127ab0c2
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40bba6
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.0e5772b9ec9fde2f6e91858b82
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40bb7b
test eax, eax
jne 0x40bbb6
push esi
push str.71892e0bf547d83978d_d
jmp 0x40bbbc
push eax
push str.abcb7b19c347d4d53cc19ea1ddf5d__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40bc69
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.d221e021028be8753
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.465d26db6733269d756f36a9
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40bcda
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.d87b1ab79bdbab4d05451
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40bcaf
test eax, eax
jne 0x40bcea
push esi
push str.4807b8a3856b099d_d
jmp 0x40bcf0
push eax
push str.9bff8b698033a29bdb73__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40bd79
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.7495292b8967d4957dcb
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.37f727b910a59f234
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40bdea
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.4a4f5df7f7b357c12d
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40bdbf
test eax, eax
jne 0x40bdfa
push esi
push str.d72336919ec5458bda7189f3932d89_d
jmp 0x40be00
push eax
push str.689bbb91babbeaf90f__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40be0d
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.c1db22d36001ce0dc181a341e
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.696fcc55b19fe2271
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40be7e
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.21c7e23b5e3f8ff7efddbde1a41334a
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40be53
test eax, eax
jne 0x40be8e
push esi
push str.8fb978274679fd97c7571c9d05a10e_d
jmp 0x40be94
push eax
push str.c255bf51af3d76b5f6__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40bee4
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.2975b13b1b47c66fc0f13
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40bf54
push str.963d5101da91b9af2ccb9681b
call fcn.004294d3
pop ecx
pop ecx
jmp 0x40bfc4
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40bf6f
push str.eaafe4ef41631a4fd50f23
jmp 0x40bfb7
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40bfa0
push eax
push ebx
push str.278143a532b1370961e5
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.ba3f0365f88d8f2b
call fcn.004294d3
add esp, 0x14
jmp 0x40bfbd
cmp eax, ebx
jne 0x40bfb2
push ebx
push str.0b5d9c337d47b8a91e91
call fcn.004294d3
pop ecx
jmp 0x40bfbc
push str.eabf6a353fcb98850
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x40c095
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00431920
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
je 0x40c0e8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428d2e
leave
ret
Function at 0x40c199
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.11d7fcd3cc05145b666f88
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40c1e2
push str.5c0fe0a1023551f57e297c8df
call fcn.004294d3
jmp 0x40c21a
test esi, esi
jbe 0x40c1f2
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.39df674f3a2b40eb7c13f
jne 0x40c20e
mov eax, str.f8ab541fdd1b6cfdc63f839fc4639a4
push eax
push str.bccdf4d98999b98df075c
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40c21f
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.f8f91f7ba3d3759590df06b
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40c28f
push str.f2530325b2b7a04f7b73b
call fcn.004294d3
pop ecx
pop ecx
jmp 0x40c2ff
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40c2aa
push str.d989a36399613b1fcf951
jmp 0x40c2f2
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40c2db
push eax
push ebx
push str.875537017071c527b4
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.647b545f15150fad20174
call fcn.004294d3
add esp, 0x14
jmp 0x40c2f8
cmp eax, ebx
jne 0x40c2ed
push ebx
push str.66d7b22fe9f76f016d2113ede169c3
call fcn.004294d3
pop ecx
jmp 0x40c2f7
push str.0c4da7850a03faf3404983
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret
Function at 0x40c566
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.c8a77237aa7b18b3e
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.0bf719f17bed719f7f7143997
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40c5d7
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.72a354b13bc32cbffd935c971463125
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40c5ac
test eax, eax
jne 0x40c5e7
push esi
push str.c57fe7c7c8c3f72d7_d
jmp 0x40c5ed
push eax
push str.a87bddb760e13d278bf3360d30__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40c643
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
push 0x34
cdq
pop ecx
idiv ecx
add dl, 0x5e
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x40c677
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c6fc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40c6fc
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret
Function at 0x40c8b2
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.86939a9bb04999cb7e010e13cb296
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40c922
push str.9ebb3a038fc162a70cf346ef
call fcn.004294d3
pop ecx
pop ecx
jmp 0x40c992
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40c93d
push str.9ef144439c3b57e78
jmp 0x40c985
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40c96e
push eax
push ebx
push str.c985accf27d96ad99cdd
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.2cd3048330dd6079c6fbf94fdf2
call fcn.004294d3
add esp, 0x14
jmp 0x40c98b
cmp eax, ebx
jne 0x40c980
push ebx
push str.5493ccafc9f730abb2cd14
call fcn.004294d3
pop ecx
jmp 0x40c98a
push str.4a330cb9281538a1bd03f4
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x40cb49
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.2647b80591c5ba737
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40cbb9
push str.a95d46eb613b09c138ad85cf969
call fcn.004294d3
pop ecx
pop ecx
jmp 0x40cc29
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40cbd4
push str.918d887b3385bdcf4c0d2be33
jmp 0x40cc1c
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40cc05
push eax
push ebx
push str.b27599ff5e1f6ced4cdbae6d927d255
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.2ac935e98e059b992a
call fcn.004294d3
add esp, 0x14
jmp 0x40cc22
cmp eax, ebx
jne 0x40cc17
push ebx
push str.9ad9eadf72c329177
call fcn.004294d3
pop ecx
jmp 0x40cc21
push str.70a10435745f628b1df1145f
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret