joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x41b14b]
shl eax, 2
mov dword [0x41b14f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0040c260
pop edx
call fcn.0040b568
call fcn.0040c264
push 0
call fcn.0040d260
pop ecx
push 0x41b0f4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x41b153], eax
push 0
jmp fcn.00417a80

Function at 0x4036f8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x348
call fcn.0040b478
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x403725
call fcn.00415d78
mov dword [eax], 8
xor eax, eax
jmp 0x40388b
cmp byte [esi + 1], 0
jne 0x403749
cmp byte [esi], 0x5c
jne 0x403749
call fcn.0040e0d4
add al, 0x40
lea esi, [ebp - 4]
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
push esi
call fcn.0040c4a8
pop ecx
add eax, 5
push eax
call fcn.0040b478
pop ecx
mov edi, eax
mov dword [ebx + 0x200], edi
test edi, edi
jne 0x40377f
push ebx
call fcn.0040b488
pop ecx
call fcn.00415d78
mov dword [eax], 8
xor eax, eax
jmp 0x40388b
push esi
push dword [ebx + 0x200]
call fcn.0040c478
add esp, 8
push dword [ebx + 0x200]
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4037c3
push dword [ebx + 0x200]
call fcn.0040b488
pop ecx
push ebx
call fcn.0040b488
pop ecx
call fcn.00415d78
mov dword [eax], 2
xor eax, eax
jmp 0x40388b
test al, 0
je 0x4037ec
push dword [ebx + 0x200]
call fcn.0040b488
pop ecx
push ebx
call fcn.0040b488
pop ecx
call fcn.00415d78
mov dword [eax], 0x2d
xor eax, eax
jmp 0x40388b
mov edx, dword [ebx + 0x200]
cmp byte [edx + 1], 0x3a
jne 0x40382b
mov ecx, dword [ebx + 0x200]
cmp byte [ecx + 2], 0
je 0x403816
mov eax, dword [ebx + 0x200]
cmp byte [eax + 2], 0x5c
jne 0x40382b
cmp byte [eax + 3], 0
jne 0x40382b
push 0x41bed0
push dword [ebx + 0x200]
call fcn.0040c39c
add esp, 8
jmp 0x40383e
push str..
push dword [ebx + 0x200]
call fcn.0040c39c
add esp, 8
lea edx, [ebx + 0x208]
push edx
push dword [ebx + 0x200]
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
mov dword [ebx + 0x204], esi
cmp esi, 0xffffffff
jne 0x403889
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x403889
push dword [ebx + 0x200]
call fcn.0040b488
pop ecx
push ebx
call fcn.0040b488
pop ecx
call fcn.00415d78
mov dword [eax], 5
xor eax, eax
jmp 0x40388b
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x403cf3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 4]
push edx
push 0
push esi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x403d40
cmp dword [ebp - 4], 1
jne 0x403d40
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x14]
jae 0x403d40
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push 0
push 0
push esi
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x403d40
xor eax, eax
jmp 0x403d45
mov eax, 1
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4041bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf8
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov byte [eax], 0
push pe_nt_image_headers32
lea edx, [ebp - 0x404]
push edx
call fcn.00405bce
add esp, 8
test al, al
jne 0x4041ee
xor eax, eax
jmp 0x4043ad
call fcn.00405a57
cmp eax, 2
jne 0x404239
call fcn.00405a76
push eax
push str._s_bin
lea edx, [ebp - 0x404]
push edx
call fcn.00410194
add esp, 0xc
lea ecx, [ebp - 0x404]
push 1
push 0x41c470
push ecx
push 0x41c46b
call fcn.00409ebe
add esp, 0x10
test eax, eax
je 0x404235
mov al, 1
jmp 0x404237
mov eax, ebx
mov ebx, eax
call fcn.004025ae
mov esi, eax
test esi, esi
je 0x404277
cmp dword [esi], 0
je 0x404277
xor edi, edi
jmp 0x404271
push 0
push 0x41c470
push dword [esi + edi*4]
push 0x41c46b
call fcn.00409ebe
add esp, 0x10
test eax, eax
je 0x40426c
mov al, 1
jmp 0x40426e
mov eax, ebx
mov ebx, eax
inc edi
cmp dword [esi + edi*4], 0
jne 0x40424d
test bl, bl
je 0x4043ab
push str.java.library.path
call fcn.004034e6
pop ecx
test al, al
jne 0x404392
push 0x104
lea edx, [ebp - 0x508]
push edx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea ecx, [ebp - 0x508]
push ecx
call fcn.0040c774
add esp, 8
mov byte [eax], 0
lea eax, [ebp - 0x508]
push 1
push 0x41c470
push eax
push 0x41c46b
call fcn.00409ebe
add esp, 0x10
push 1
push 0x41c470
push 0x41c484
push 0x41c46b
call fcn.00409ebe
add esp, 0x10
push 0x104
lea edx, [ebp - 0x508]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 1
lea ecx, [ebp - 0x508]
push 0x41c470
push ecx
push 0x41c46b
call fcn.00409ebe
add esp, 0x10
push 0x104
lea eax, [ebp - 0x508]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 1
lea edx, [ebp - 0x508]
push 0x41c470
push edx
push 0x41c46b
call fcn.00409ebe
add esp, 0x10
push 0x41c46b
call fcn.00416428
pop ecx
mov esi, eax
push esi
call fcn.0040c4a8
pop ecx
add eax, 0x19
push eax
call fcn.0040b478
pop ecx
mov ebx, eax
mov byte [ebx], 0
push str._Djava.library.path
push ebx
call fcn.0040c39c
add esp, 8
push esi
push ebx
call fcn.0040c39c
add esp, 8
push 0
push ebx
call fcn.004071ae
add esp, 8
push ebx
call fcn.0040b488
pop ecx
push 0x41c46b
call fcn.00416428
pop ecx
push eax
push str.PATH_s
call sym.jbuilder.exe__ut_tproda
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4043b4
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040c4a8
pop ecx
cmp eax, 1
jae 0x4043d5
xor eax, eax
jmp 0x40448a
lea edx, [ebp - 0x204]
push edx
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x4043f5
push str.Unable_to_determine_temporary_path_n
call sym.jbuilder.exe__ut_tproda
pop ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0x41c4c7
lea eax, [ebp - 0x204]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
jne 0x40441e
push str.Unable_to_create_temporary_file_n
call sym.jbuilder.exe__ut_tproda
pop ecx
push 0
push 0x80
push 5
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x404]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40444e
push str.Unable_to_open_temporary_file_n
call sym.jbuilder.exe__ut_tproda
pop ecx
push 0
lea eax, [ebp - 4]
push eax
push esi
call fcn.0040c4a8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea edx, [ebp - 0x404]
push edx
call fcn.0040c4a8
pop ecx
push eax
call fcn.0040b478
pop ecx
lea ecx, [ebp - 0x404]
push ecx
call fcn.0040c608
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40449d
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
xor edi, edi
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov ebx, eax
jmp 0x4044cc
push ebx
call fcn.0040c4a8
pop ecx
mov esi, eax
push 0x3d
push ebx
call fcn.0040c3d8
add esp, 8
test eax, eax
je 0x4044c9
cmp ebx, eax
je 0x4044c9
inc edi
inc esi
add ebx, esi
cmp byte [ebx], 0
jne 0x4044ac
push ebx
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
shl edi, 9
push edi
call fcn.0040b478
pop ecx
mov esi, eax
mov byte [esi], 0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov ebx, eax
jmp 0x404526
push ebx
call fcn.0040c4a8
pop ecx
mov edi, eax
push 0x3d
push ebx
call fcn.0040c3d8
add esp, 8
test eax, eax
je 0x404523
cmp ebx, eax
je 0x404523
push ebx
push esi
call fcn.0040c39c
add esp, 8
push 0x41c50b
push esi
call fcn.0040c39c
add esp, 8
inc edi
add ebx, edi
cmp byte [ebx], 0
jne 0x4044ef
push esi
call fcn.0040aa67
pop ecx
mov edi, eax
push esi
call fcn.0040b488
pop ecx
push edi
call fcn.0040c4a8
pop ecx
test eax, eax
jbe 0x40454f
push edi
call fcn.004043b4
pop ecx
mov ebp, eax
push edi
call fcn.0040b488
pop ecx
push ebx
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404563
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jne 0x404588
xor eax, eax
jmp 0x40458e
lea eax, [ebp - 0x200]
mov esp, ebp
pop ebp
ret

Function at 0x40464d
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov ax, 2
push esp
push eax
call sub.WSOCK32.DLL_WSAStartup
add esp, 0x190
ret
Function at 0x40874d
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
je 0x40878a
push dword [ebp + 0x14]
push 0x41e13c
lea eax, [ebp - 0x20]
push eax
call fcn.00410194
add esp, 0xc
lea edx, [ebp - 0x20]
test edx, edx
je 0x40878a
movzx eax, bx
lea ecx, [ebp - 0x20]
inc ebx
mov dword [ebp + eax*4 - 0x10], ecx
test esi, esi
je 0x408796
movzx edx, bx
mov dword [ebp + edx*4 - 0x10], esi
inc ebx
test edi, edi
je 0x4087a2
movzx ecx, bx
mov dword [ebp + ecx*4 - 0x10], edi
inc ebx
cmp dword [ebp + 0x20], 0
je 0x4087b3
movzx eax, bx
mov edx, dword [ebp + 0x20]
inc ebx
mov dword [ebp + eax*4 - 0x10], edx
call fcn.00408ef6
push eax
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov esi, eax
test esi, esi
je 0x4087e1
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push 0
push dword [ebp + 0xc]
push 0
mov dx, word [ebp + 8]
push edx
push esi
call sub.ADVAPI32.DLL_ReportEventA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408be2
Capabilities:
Delete registry key
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
lea edx, [ebp - 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], eax
push edx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesEventLogApplication
push connect
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
je 0x408c3f
cmp dword [ebp + 0xc], 0
jne 0x408c81
push ebx
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLogApplication
push str.Unable_to_open_registry_key__s__Win32_error__ld__n
push 0x41fa10
call fcn.0040e624
add esp, 0x10
xor eax, eax
jmp 0x408da4
push edi
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegDeleteKeyA
push dword [ebp - 0xc]
mov ebx, eax
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
je 0x408c81
cmp ebx, 2
je 0x408c81
cmp dword [ebp + 0xc], 0
jne 0x408c81
push ebx
push edi
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventLogApplication
push str.Unable_to_delete_registry_key__s_s__Win32_error__ld__n
push 0x41fa10
call fcn.0040e624
add esp, 0x14
xor eax, eax
jmp 0x408da4
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov esi, eax
test esi, esi
jne 0x408cbe
cmp dword [ebp + 0xc], 0
jne 0x408da1
call sub.KERNEL32.DLL_GetLastError
push eax
push str.Unable_to_open_SCM__Win32_error__ld__n
push 0x41fa10
call fcn.0040e624
add esp, 0xc
xor eax, eax
jmp 0x408da4
push 0x10000
push edi
push esi
call sub.ADVAPI32.DLL_OpenServiceA
mov edi, eax
test edi, edi
jne 0x408cff
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
cmp dword [ebp + 0xc], 0
jne 0x408da1
call sub.KERNEL32.DLL_GetLastError
push eax
push str.Unable_to_open_service__Win32_error__ld__n
push 0x41fa10
call fcn.0040e624
add esp, 0xc
xor eax, eax
jmp 0x408da4
push esi
call sub.ADVAPI32.DLL_LockServiceDatabase
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x408d3e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
push edi
call sub.ADVAPI32.DLL_CloseServiceHandle
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
cmp dword [ebp + 0xc], 0
jne 0x408da1
push ebx
push str.Unable_to_lock_SCM__Win32_error__ld__n
push 0x41fa10
call fcn.0040e624
add esp, 0xc
xor eax, eax
jmp 0x408da4
push edi
call sub.ADVAPI32.DLL_DeleteService
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetLastError
push dword [ebp - 8]
mov ebx, eax
call sub.ADVAPI32.DLL_UnlockServiceDatabase
test eax, eax
jne 0x408d72
call sub.KERNEL32.DLL_GetLastError
push eax
push str.Unable_to_unlock_SCM__Win32_error__ld__n
push 0x41fa10
call fcn.0040e624
add esp, 0xc
push edi
call sub.ADVAPI32.DLL_CloseServiceHandle
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
cmp dword [ebp - 4], 0
jne 0x408da1
cmp dword [ebp + 0xc], 0
jne 0x408da1
push ebx
push str.Unable_to_delete_the_service__Win32_error__ld__n
push 0x41fa10
call fcn.0040e624
add esp, 0xc
xor eax, eax
jmp 0x408da4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409a44
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0040c2f8
add esp, 0xc
push dword [ebp + 8]
call sub.WSOCK32.DLL_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x409a74
xor eax, eax
jmp 0x409b12
mov word [ebp - 0x10], 2
mov dx, word [ebp + 0xc]
push edx
call sub.WSOCK32.DLL_htons
mov word [ebp - 0xe], ax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x409aba
push str.Cant_create_socket_n
push 0x41fa10
call fcn.0040e624
add esp, 8
xor eax, eax
jmp 0x409b12
push 0x10
lea edx, [ebp - 0x10]
push edx
push ebx
call sub.WSOCK32.DLL_connect
push 0
push esi
call fcn.0040c4a8
pop ecx
push eax
push esi
push ebx
call sub.WSOCK32.DLL_send
inc eax
jne 0x409af0
push str.Cant_send_message_n
push 0x41fa10
call fcn.0040e624
add esp, 8
xor eax, eax
jmp 0x409b12
push ebx
call sub.WSOCK32.DLL_closesocket
test eax, eax
je 0x409b10
push str.Error_on_closing_socket_n
push 0x41fa10
call fcn.0040e624
add esp, 8
xor eax, eax
jmp 0x409b12
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409b4f
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [0x4223d8]
call sub.USER32.DLL_ShowWindow
push dword [0x4223d8]
call sub.USER32.DLL_UpdateWindow
ret

Function at 0x409dd8
Capabilities:
Get memory capacity

Disassembly:
push ebx
add esp, 0xffffffa0
push 0x41ef04
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
test ebx, ebx
jne 0x409df2
xor eax, eax
xor edx, edx
jmp 0x409e45
push str.GlobalMemoryStatusEx
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
jne 0x409e1e
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
push ebx
call sub.KERNEL32.DLL_FreeLibrary
mov eax, dword [esp + 8]
xor edx, edx
jmp 0x409e45
mov dword [esp + 0x20], 0x40
lea ecx, [esp + 0x20]
push ecx
call eax
test eax, eax
jne 0x409e37
xor eax, eax
xor edx, edx
jmp 0x409e45
push ebx
call sub.KERNEL32.DLL_FreeLibrary
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esp, 0x60
pop ebx
ret
Function at 0x40adfb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREInprise_CorporationApplication_Server4.0
push connect
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
je 0x40ae2e
xor eax, eax
jmp 0x40ae82
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
push edx
push 0
push ecx
push 0
push esi
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x40ae6b
cmp dword [ebp - 8], 1
jne 0x40ae6b
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x40ae6b
lea edx, [ebp - 0xc]
push edx
push edi
push 0
push 0
push esi
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
jmp 0x40ae70
mov ebx, 1
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
je 0x40ae80
xor eax, eax
jmp 0x40ae82
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bf24
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x40d6e4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0040eccc
test byte [ebp + 0xd], 0xc0
jne 0x40d708
mov eax, dword [0x41ff60]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x40d715
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40d742
je 0x40d754
sub ecx, 0x100
je 0x40d762
sub ecx, 0x100
je 0x40d769
sub ecx, 0x100
je 0x40d75b
jmp 0x40d770
sub ecx, 0x600
je 0x40d769
sub ecx, 0x100
je 0x40d754
jmp 0x40d770
mov edi, 1
jmp 0x40d775
mov edi, 2
jmp 0x40d775
mov edi, 4
jmp 0x40d775
mov edi, 5
jmp 0x40d775
mov edi, 3
test byte [ebp + 0xd], 1
je 0x40d79c
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x41f9d8]
test al, 0x80
je 0x40d795
mov ebx, 0x80
jmp 0x40d7ae
mov ebx, 1
jmp 0x40d7ae
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40d7ae
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40d7c0
je 0x40d7c9
dec eax
je 0x40d7d2
jmp 0x40d7db
mov dword [ebp - 4], connect
jmp 0x40d7ea
mov dword [ebp - 4], 0x40000000
jmp 0x40d7ea
mov dword [ebp - 4], 0xc0000000
jmp 0x40d7ea
push 1
call fcn.0040f0c4
pop ecx
mov ebx, eax
jmp 0x40d8da
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x40d806
sub eax, 0x10
je 0x40d80d
sub eax, 0x10
je 0x40d816
sub eax, 0x10
je 0x40d81f
jmp 0x40d81f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40d826
mov dword [ebp - 8], 1
jmp 0x40d826
mov dword [ebp - 8], 2
jmp 0x40d826
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40d893
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40d888
test byte [ebp + 0xd], 1
je 0x40d883
mov ebx, 0x50
jmp 0x40d888
mov ebx, 2
push ebx
call fcn.0040f0c4
pop ecx
mov ebx, eax
jmp 0x40d8da
mov edi, esi
push edi
call fcn.0040d648
pop ecx
test eax, eax
je 0x40d8a7
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40d8b3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0040edec
add esp, 8
mov ebx, eax
inc eax
jne 0x40d8da
push 4
call fcn.0040f0c4
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0040ed00
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40da9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0040eccc
test byte [ebp + 0xd], 0xc0
jne 0x40dac0
mov eax, dword [0x41ff60]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x40dacd
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40dafa
je 0x40db0c
sub ecx, 0x100
je 0x40db1a
sub ecx, 0x100
je 0x40db21
sub ecx, 0x100
je 0x40db13
jmp 0x40db28
sub ecx, 0x600
je 0x40db21
sub ecx, 0x100
je 0x40db0c
jmp 0x40db28
mov edi, 1
jmp 0x40db2d
mov edi, 2
jmp 0x40db2d
mov edi, 4
jmp 0x40db2d
mov edi, 5
jmp 0x40db2d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x40db54
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x41f9d8]
test al, 0x80
je 0x40db4d
mov ebx, 0x80
jmp 0x40db66
mov ebx, 1
jmp 0x40db66
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40db66
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40db78
je 0x40db81
dec eax
je 0x40db8a
jmp 0x40db93
mov dword [ebp - 4], connect
jmp 0x40dba2
mov dword [ebp - 4], 0x40000000
jmp 0x40dba2
mov dword [ebp - 4], 0xc0000000
jmp 0x40dba2
push 1
call fcn.0040f0c4
pop ecx
mov ebx, eax
jmp 0x40dc92
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x40dbbe
sub eax, 0x10
je 0x40dbc5
sub eax, 0x10
je 0x40dbce
sub eax, 0x10
je 0x40dbd7
jmp 0x40dbd7
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40dbde
mov dword [ebp - 8], 1
jmp 0x40dbde
mov dword [ebp - 8], 2
jmp 0x40dbde
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0x40dc4b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40dc40
test byte [ebp + 0xd], 1
je 0x40dc3b
mov ebx, 0x50
jmp 0x40dc40
mov ebx, 2
push ebx
call fcn.0040f0c4
pop ecx
mov ebx, eax
jmp 0x40dc92
mov edi, esi
push edi
call fcn.0040d648
pop ecx
test eax, eax
je 0x40dc5f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40dc6b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0040edec
add esp, 8
mov ebx, eax
inc eax
jne 0x40dc92
push 4
call fcn.0040f0c4
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0040ed00
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret