joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a80f
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.f1290b4ff3152007d7c7
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40a87f
push str.57eb0d0541035dfd4395
call fcn.00428d27
pop ecx
pop ecx
jmp 0x40a8ef
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40a89a
push str.f15551c354c53dc1102b46b71
jmp 0x40a8e2
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40a8cb
push eax
push ebx
push str.22f14b1d7e0bc253402
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.681374a3e0d51d81bf1d
call fcn.00428d27
add esp, 0x14
jmp 0x40a8e8
cmp eax, ebx
jne 0x40a8dd
push ebx
push str.4ccdf6933fbbf3b180
call fcn.00428d27
pop ecx
jmp 0x40a8e7
push str.ba37dcfdc521ebabea0bec
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret

Function at 0x40a907
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431170
add esp, 0xc
xor esi, esi
call fcn.00428e21
cdq
mov ecx, 0x84
idiv ecx
add dl, 0x45
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x40a93b
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a9c2
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40a9c2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428582
leave
ret
Function at 0x40aaf3
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.748d91c96f73b63942f9f861c
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.6973338b21bd0e11cf3178e3b
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40ab64
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.0bc19debe0138683c7dd
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40ab39
test eax, eax
jne 0x40ab74
push esi
push str.87ef683d3995f1a33c939c4f6ddd8_d
jmp 0x40ab7a
push eax
push str.ed2d0dc780695111f3cba26d__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40abca
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.41911c33a23334e35ba9e43307e3c
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.d939e9f99eed9fd13dc70257d82f6
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40ac3b
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.52eb33e90a4b3771c9f
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40ac10
test eax, eax
jne 0x40ac4b
push esi
push str.761959f30a87fc3f551f_d
jmp 0x40ac51
push eax
push str.097506c1dc85d6214cf1__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40ac5e
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.7957a7adcb89a941
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.6b1fdeb9fedb0cff78c74d39796f
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40accf
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.8157b4bbfd093313c0fdf07f1a19
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40aca4
test eax, eax
jne 0x40acdf
push esi
push str.17f3c75b460fc891d5_d
jmp 0x40ace5
push eax
push str.9ab50c9fe9c96e71ed63a5bb4985__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40acf2
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.85715d8fa1ed2a09dfe7
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.3a792a6b187b4bf7925f0
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40ad63
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.19f372dbcb99ca5f98e99b0b6049ef
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40ad38
test eax, eax
jne 0x40ad73
push esi
push str.1edfbb71ee0367d5c69dc2e78c0b5f0_d
jmp 0x40ad79
push eax
push str.57530d67026b1701d237b__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40ad86
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.550377dd4ff16137cebdd87da12b7e
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40adf6
push str.ac8d98b7e93b4b09f46bb
call fcn.00428d27
pop ecx
pop ecx
jmp 0x40ae66
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ae11
push str.da7f066102c1fbe77a7fa1fd1d97c0f
jmp 0x40ae59
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40ae42
push eax
push ebx
push str.b58f655be99bbf453eefc659
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.7833b455e25ba4e71bc70e6ff7f920b
call fcn.00428d27
add esp, 0x14
jmp 0x40ae5f
cmp eax, ebx
jne 0x40ae54
push ebx
push str.943d417f443d5b5d7b4f215dfbe9eb0
call fcn.00428d27
pop ecx
jmp 0x40ae5e
push str.bdb9057d1639edcf84093b3fb551bf
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret
Function at 0x40aec5
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.b16701f5c9854c05aa5d
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.888752831b153ea7
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40af36
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.a73313bbae5bf42d3e7f7589d2
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40af0b
test eax, eax
jne 0x40af46
push esi
push str.a35f216d3a0180ed9f8bf9679b0bb75_d
jmp 0x40af4c
push eax
push str.8e4d25b7191d6ddb4f334__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40afe7
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.95e5dc0b57adb2ef8
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.56d197e19d79963be3
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40b058
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.2c593be12b59481de02fbd
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40b02d
test eax, eax
jne 0x40b068
push esi
push str.ed879089f5d3dc5f61533513ec_d
jmp 0x40b06e
push eax
push str.30cb8841386fcc174ce__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40b07b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.2627b8fd74dba8030ea5bd4be10
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40b0c4
push str.0b973355c2b3512d7ed
call fcn.00428d27
jmp 0x40b0fc
test esi, esi
jbe 0x40b0d4
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.ead3c89bf6ad339f4f2f8dad858dc
jne 0x40b0f0
mov eax, str.ebf12115780534814e17db93ce3b274
push eax
push str.40fb9017f2c7b68794
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40b2dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.e19d97b74f25380bfaaf
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.f7f9d95f34fddb0d1
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x40b34d
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.9c77b7bfab6f63abd57b335ff7
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x40b322
test eax, eax
jne 0x40b35d
push esi
push str.fe11c783bb4d5ff120e_d
jmp 0x40b363
push eax
push str.70972a770007f1afd20f6bc35d8b__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40b370
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.ba01ea6dc0dfaccb282dd1f174c1
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40b3b9
push str.a75f52f399b9fe3566372e3515116
call fcn.00428d27
jmp 0x40b3f1
test esi, esi
jbe 0x40b3c9
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.f8eb5fb30ef16d4f49
jne 0x40b3e5
mov eax, str.06f13d41c007dae9e38b752f177b9d4
push eax
push str.136decaf21179fbb3b15628d
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40b5b7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.f511a3859b0f411f68bfe4c1
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40b600
push str.392baceb6019a71b8cd19657092d44
call fcn.00428d27
jmp 0x40b638
test esi, esi
jbe 0x40b610
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.92edb8032231313f0dab048500f1
jne 0x40b62c
mov eax, str.82959bd94f8d4ad15745f30d289f08
push eax
push str.54df611deadbd919275b3f87848dc9b
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40b845
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.f6c1202726cd04aba6875bf5028172c
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40b8b5
push str.97b7ee4f8579f88559a75bc367c
call fcn.00428d27
pop ecx
pop ecx
jmp 0x40b925
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b8d0
push str.a49dbf33625d5003720b79d9
jmp 0x40b918
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40b901
push eax
push ebx
push str.9b43b3e1c35f953b797d2e9d1b6
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.2541582df0fd98b1b68b5bfd
call fcn.00428d27
add esp, 0x14
jmp 0x40b91e
cmp eax, ebx
jne 0x40b913
push ebx
push str.0a894a035e679023781
call fcn.00428d27
pop ecx
jmp 0x40b91d
push str.db3f5f316b035f6f1de9e52585
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret

Function at 0x40b93d
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.3e67c6fb8fa5ae5188abf56d5f1
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40b9ad
push str.c7f5c989e331776be2014bdb3351284
call fcn.00428d27
pop ecx
pop ecx
jmp 0x40ba1d
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40b9c8
push str.2c43fa853ecd8025bf6bee17396d7a
jmp 0x40ba10
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40b9f9
push eax
push ebx
push str.36df7bc9c9fbdaf33e43370
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.b72718ede195ec139
call fcn.00428d27
add esp, 0x14
jmp 0x40ba16
cmp eax, ebx
jne 0x40ba0b
push ebx
push str.de49478500f946f9a83dcb8b69
call fcn.00428d27
pop ecx
jmp 0x40ba15
push str.83bb41a52e0f5cbf41c5d8cbf5475
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret
Function at 0x40bb6b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.b827564b40e5fe6168ef6f977a89a
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40bbb4
push str.9c712a65a9dddadb378fd8cbbbf
call fcn.00428d27
jmp 0x40bbec
test esi, esi
jbe 0x40bbc4
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.e13d0f2767954da78bbd45756d
jne 0x40bbe0
mov eax, str.fd130e5770cda1053a77dd2b
push eax
push str.a2f1b37f012f23f17a8b12
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40bbf1
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.95f7a9eb1d090a19f5950987f
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40bc61
push str.06fdf44b15f905ff81
call fcn.00428d27
pop ecx
pop ecx
jmp 0x40bcd1
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40bc7c
push str.6c61e2a1a11bcd5b2f6d
jmp 0x40bcc4
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40bcad
push eax
push ebx
push str.bb1934c910a1e9bb
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.21cdbd4b437165f72
call fcn.00428d27
add esp, 0x14
jmp 0x40bcca
cmp eax, ebx
jne 0x40bcbf
push ebx
push str.6ca180c9659f2f97531523c3
call fcn.00428d27
pop ecx
jmp 0x40bcc9
push str.85a15969a24711e39
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret
Function at 0x40c00c
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.38b38d27782d34d960f3a4213a8b
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40c07c
push str.6913110bdcb5a8d9c9672
call fcn.00428d27
pop ecx
pop ecx
jmp 0x40c0ec
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40c097
push str.2d61fa49bb798613ea2d27
jmp 0x40c0df
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40c0c8
push eax
push ebx
push str.0bfbb0f1fd2b79092e2
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.3d5d5fc9d94395ff0225
call fcn.00428d27
add esp, 0x14
jmp 0x40c0e5
cmp eax, ebx
jne 0x40c0da
push ebx
push str.e1d3e4bb1471236fc5f3f24f2a
call fcn.00428d27
pop ecx
jmp 0x40c0e4
push str.24cbb98bc13f0e2959bd44
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret

Function at 0x40c2e1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431170
add esp, 0xc
xor esi, esi
call fcn.00428e21
push 0x28
cdq
pop ecx
idiv ecx
add dl, 0x45
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x40c315
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c39a
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40c39a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428582
leave
ret