joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406757
Capabilities:
Check os version
Read data from internet
Receive data
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4409f3
mov eax, dword fs:[0]
push eax
mov eax, 0x1018
call fcn.00438db0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, eax
push 0
shr edi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp edi, eax
jbe 0x4067b4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.004049dc
jmp 0x4067b6
xor edi, edi
call fcn.004295cd
call fcn.004295cd
mov dword [ebp - 0x1020], edi
call ebx
mov ebx, eax
push edi
shr ebx, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp ebx, eax
jbe 0x4067ec
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.00404a7c
call fcn.004017d4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x4067ff
dec eax
dec eax
je 0x4067ff
sub eax, 4
jne 0x406809
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
or dword [ebp - 4], 0xffffffff
jmp 0x4068c6
lea eax, [ebp - 0x1020]
push eax
push 0xff6
lea eax, [ebp - 0x1018]
push eax
push dword [esi + 0xb0]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [ebp - 0x1020], edi
ja 0x40691c
cmp dword [esi + 0xb4], edi
je 0x406957
mov ebx, esi
call fcn.004065a8
lea eax, [esi + 0xbc]
mov ecx, dword [eax]
lea edx, [ecx + 1]
mov dword [eax], edx
cmp ecx, 0xa
ja 0x4068d9
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 0x8c]
lea eax, [esi + 0x1c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x101c], esp
push eax
call fcn.004031b5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1024], esp
push esi
mov dword [ebp - 4], 4
call fcn.004031b5
or dword [ebp - 4], 0xffffffff
push esi
call fcn.0040635d
test eax, eax
jl 0x4068c4
push 0
call fcn.0042a8e7
and dword [esi + 0xb8], 0
pop ecx
lea eax, [esi + 0x70]
call fcn.004031e5
xor edi, edi
cmp dword [esi + 0xc0], edi
jne 0x406812
mov ebx, esi
call fcn.004065a8
call fcn.004295cd
cdq
push 0xa
pop ecx
idiv ecx
mov edi, edx
call fcn.004295cd
cdq
push 0xa
pop ecx
idiv ecx
cmp edi, edx
setl al
test al, al
je 0x406966
movzx eax, al
mov dword [ebp - 0x101c], eax
fild dword [ebp - 0x101c]
call fcn.004397d0
fstp dword [ebp - 0x101c]
fld dword [ebp - 0x101c]
jmp 0x406979
push dword [ebp - 0x1020]
lea eax, [ebp - 0x1018]
push eax
lea eax, [esi + 0x70]
call fcn.00408211
mov ecx, dword [ebp - 0x1020]
lea eax, [esi + 0xb8]
add dword [eax], ecx
mov ecx, dword [esi + 0xb4]
mov eax, dword [eax]
cmp ecx, edi
je 0x4068c6
cmp eax, ecx
jb 0x4068c6
mov dword [esi + 0xc4], 1
jmp 0x4068d9
fldz
call fcn.004396a0
fstp dword [ebp - 0x101c]
fld dword [ebp - 0x101c]
call fcn.004398c0
dec eax
jne 0x40698b
call fcn.00404ac3
call fcn.00404b48
mov eax, dword [esi + 0xc4]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428d2e
leave
ret
Function at 0x406c2d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [ebx + 0xc4], edi
jne 0x406c52
push edi
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
mov eax, 0x80004005
jmp 0x406d2c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
dec eax
dec eax
je 0x406c68
dec eax
dec eax
je 0x406c68
sub eax, 4
jne 0x406c7d
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.00404d1e
call fcn.00404e16
call fcn.004295cd
cdq
push 0x14
pop ecx
idiv ecx
inc edx
mov dword [ebp - 4], edx
call fcn.004295cd
mov ecx, dword [ebp - 4]
cdq
idiv ecx
cmp edx, ecx
jg 0x406ca4
mov eax, ecx
cdq
idiv ecx
cmp edx, edi
je 0x406ca9
call fcn.00404e87
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x406cb5
lea eax, [ebp + 0xc]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
call esi
dec eax
dec eax
je 0x406cdd
dec eax
dec eax
je 0x406cdd
sub eax, 4
jne 0x406ce7
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
cmp dword [ebp - 4], 0xffffffff
je 0x406d1b
cmp dword [ebx + 0x88], 0x10
mov ecx, dword [ebx + 0x84]
mov dword [ebp - 8], edi
jb 0x406d04
mov eax, dword [ebx + 0x74]
jmp 0x406d07
lea eax, [ebx + 0x74]
push edi
lea edx, [ebp - 8]
push edx
push ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x406d31
push edi
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
mov eax, 0x80004005
pop esi
pop edi
leave
ret 0x1c
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x84]
je 0x406d50
mov esi, 0x80004005
push edi
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
mov eax, esi
jmp 0x406d2b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x406d41
Function at 0x407059
Capabilities:
Set uefi variable

Disassembly:
push 0x94
mov eax, 0x440633
call fcn.0042babd
mov ebx, ecx
call fcn.004065a8
mov eax, ebx
call fcn.004031e5
lea eax, [ebx + 0x1c]
call fcn.004031e5
lea eax, [ebx + 0x38]
call fcn.004031e5
lea eax, [ebx + 0x54]
call fcn.004031e5
lea eax, [ebx + 0x70]
call fcn.004031e5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov esi, eax
call fcn.0042a8e7
mov dword [ebp - 0x10], esi
fild dword [ebp - 0x10]
pop ecx
mov edi, eax
test esi, esi
jge 0x4070b8
fadd qword [0x44b078]
call fcn.004396a0
mov dword [ebp - 0x10], edi
fild dword [ebp - 0x10]
test edi, edi
jge 0x4070cd
fadd qword [0x44b078]
fcompp
fnstsw ax
test ah, 5
jp 0x4070e8
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.00405037
call fcn.0040c39c
call fcn.004295cd
call fcn.004295cd
or dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0x90]
call fcn.004084ec
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x10], esp
push 0xa
push str.kLI_
call fcn.004081ed
lea edi, [ebp - 0xa0]
call fcn.00427366
mov dword [ebp - 4], 2
call fcn.00427666
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 0x10
jb 0x40713f
mov eax, dword [eax + 4]
jmp 0x407142
add eax, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403193
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebx + 0x90]
mov byte [ebp - 4], 4
call fcn.00408485
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004035bd
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.004035bd
lea esi, [ebp - 0xa0]
call fcn.00404654
push edi
mov dword [ebx + 0xa8], edi
mov dword [ebx + 0xac], edi
mov dword [ebx + 0xb0], edi
call fcn.0042a8e7
pop ecx
mov dword [ebx + 0xbc], edi
mov dword [ebx + 0xb4], edi
mov dword [ebx + 0xb8], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x4071d4
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.0040507e
mov dword [ebx + 0x8c], edi
mov dword [ebx + 0xc0], edi
mov dword [ebx + 0xc4], edi
xor eax, eax
call fcn.0042bb95
ret
Function at 0x40782c
Capabilities:
Set console window title

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0xc
mov eax, 0x43e18e
call fcn.0042babd
mov eax, dword [ebp + 0x250]
mov dword [ebp - 0x14], eax
xor edi, edi
mov dword [ebp - 4], edi
push edi
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
call fcn.00403957
mov byte [ebp - 4], 1
xor esi, esi
cmp dword [ebp + 0x244], edi
jbe 0x407912
mov byte [ebp - 0xd], 0
mov ebx, esi
lea eax, [ebp - 0xd]
and ebx, 3
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40788f
sub eax, edx
je 0x4078d5
push 0x103
lea eax, [ebp + 0x121]
push edi
push eax
mov byte [ebp + 0x120], cl
call fcn.00431920
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
je 0x4078d5
lea eax, [ebp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edi, esi
lea eax, [ebp + 0x230]
call fcn.004082f1
mov edx, dword [ebp + 0x24c]
movsx eax, byte [eax]
mov ecx, ebx
shl ecx, 3
shr edx, cl
xor ebx, ebx
inc ebx
lea edi, [ebp]
movsx ecx, dl
xor ecx, eax
push ecx
call fcn.004085fd
inc esi
xor edi, edi
cmp esi, dword [ebp + 0x244]
jb 0x407884
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
push edi
lea eax, [ebp]
push eax
call fcn.004034e3
push edi
push 1
lea ecx, [ebp]
call fcn.004035bd
push edi
push 1
lea ecx, [ebp + 0x230]
call fcn.004035bd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00428d2e
add ebp, 0x228
leave
ret 0x24
Function at 0x4098de
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.c72d2531433b8143bda16879f
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40994e
push str.82eb23572a0f48d1133181ff8631d
call fcn.004294d3
pop ecx
pop ecx
jmp 0x4099be
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409969
push str.7d83b94f7e2514d7378dd7
jmp 0x4099b1
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40999a
push eax
push ebx
push str.2db14de7edf3e5a7695f
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.aeb31f4db97f0ccb7ba509bb10f5a2
call fcn.004294d3
add esp, 0x14
jmp 0x4099b7
cmp eax, ebx
jne 0x4099ac
push ebx
push str.bef12cbfcfe121bbf7d11a8d2bbdd2d
call fcn.004294d3
pop ecx
jmp 0x4099b6
push str.0625f371b22db5f3ef1fe8f932a
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x409b5a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
cdq
mov ecx, 0xe7
idiv ecx
add dl, 0xb
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x409b8e
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409c15
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x409c15
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret
Function at 0x409cbf
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.ceab03ad55259ea95a
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x409d08
push str.1c4b0c5dc0833ddf03cb55e9da412
call fcn.004294d3
jmp 0x409d40
test esi, esi
jbe 0x409d18
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.15a3338f9361e58f3ef
jne 0x409d34
mov eax, str.eb5914c1affd19c32463bd97941d41f
push eax
push str.bdebbb2dc8577be3927bf3e7b5
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x409f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
cdq
mov ecx, 0xee
idiv ecx
add dl, 0x60
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x409f44
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409fcb
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x409fcb
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret
Function at 0x40a202
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.2a276d853069999dbdc751
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40a272
push str.5a11bdab45455c15402d
call fcn.004294d3
pop ecx
pop ecx
jmp 0x40a2e2
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40a28d
push str.ac0f421b0dafb2b119d719bd525bf67
jmp 0x40a2d5
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40a2be
push eax
push ebx
push str.d3d383e5485f80c1
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.4117f165a7919523ec17189dcdbd
call fcn.004294d3
add esp, 0x14
jmp 0x40a2db
cmp eax, ebx
jne 0x40a2d0
push ebx
push str.efff7a491a4daa03a67d3d97a489
call fcn.004294d3
pop ecx
jmp 0x40a2da
push str.c8915021225ffc415a
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x40a39a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.305b941f44752b676e1fa1
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40a3e3
push str.6ba12c5df28bbdbfde4
call fcn.004294d3
jmp 0x40a41b
test esi, esi
jbe 0x40a3f3
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.e42de0f9b391b13f
jne 0x40a40f
mov eax, str.036b534ba98f30f3689993176eb9
push eax
push str.e51dfee17eb74c315fb10
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40a467
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.0e5d2dfbe8cd3fbb
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.0dcf9de5976ddd57647
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40a4d8
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.51a71c5f09a9dad598095aa7ff03
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40a4ad
test eax, eax
jne 0x40a4e8
push esi
push str.9d99a5615e556aed25_d
jmp 0x40a4ee
push eax
push str.bda5ba0d07096d5796ffb737e65bf__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40a665
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.e4617ceb9d6f805d818b99eb
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40a6ae
push str.dd25591ff9355045cb03e95d377dd2e
call fcn.004294d3
jmp 0x40a6e6
test esi, esi
jbe 0x40a6be
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.b83bfa4d7ce59411858
jne 0x40a6da
mov eax, str.50013ed163f3b8b7234508f5482f
push eax
push str.561136130d658bcd44673c8936314b
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40a6eb
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.e177ca13e19fc63d
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40a734
push str.ccabd1357c27487d174dbd4
call fcn.004294d3
jmp 0x40a76c
test esi, esi
jbe 0x40a744
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.59f57b356165e46d006b6b87
jne 0x40a760
mov eax, str.57e96e3d320ba4211fbf981dcabbc
push eax
push str.25931f13fdbf231986511cb7
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40a7e2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.2305cc99fb77af7107a980f174214e
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40a82b
push str.828d697954bded2de6
call fcn.004294d3
jmp 0x40a863
test esi, esi
jbe 0x40a83b
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.cacb456b4393b6676fe37fe3
jne 0x40a857
mov eax, str.e969cb0702cd2b7b8fd15c8
push eax
push str.5659aca78a971c17fc0
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40aa3e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.eb9172cd103fc651014
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40aa87
push str.21f9356b4a79f67d24
call fcn.004294d3
jmp 0x40aabf
test esi, esi
jbe 0x40aa97
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.2cfdf31bf745b89917077
jne 0x40aab3
mov eax, str.951d822fa49b8dcd38bd7cc5f
push eax
push str.653f6e399051ebd3a959407d
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40ac4b
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.4f39a49f6041b2458
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40acbb
push str.59950567337778958fbd199d05593
call fcn.004294d3
pop ecx
pop ecx
jmp 0x40ad2b
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40acd6
push str.91532adfaa39770f23418c
jmp 0x40ad1e
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40ad07
push eax
push ebx
push str.b09dcce97961cacf4165ced
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.a1857b25c0d77ee302b97b
call fcn.004294d3
add esp, 0x14
jmp 0x40ad24
cmp eax, ebx
jne 0x40ad19
push ebx
push str.b6ffa9addd535235ab7741d5baabb
call fcn.004294d3
pop ecx
jmp 0x40ad23
push str.3189119bf6239037e957e
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x40ad43
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.849f1aff138dc6ade755
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.84d57b8d1b594bf7367d7ca7a8517cb
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40adb4
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.e78dbd093735ffbb0c631195e6eb
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40ad89
test eax, eax
jne 0x40adc4
push esi
push str.daedb015c5cbaef736ef0d7913d_d
jmp 0x40adca
push eax
push str.744941d1aa0d9d3de4df3bbd79bd1__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret