joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41de49
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x437e70], 2
push ebx
push esi
push edi
mov ebx, ecx
jae 0x41de5e
xor eax, eax
jmp 0x41de9b
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.WSOCK32.dll_setsockopt]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push 4
push eax
mov edi, 0xffff
push 0x1006
push edi
push dword [ebx + 4]
call esi
cmp eax, 0xffffffff
je 0x41de5a
lea eax, [ebp + 8]
push 4
push eax
push 0x1005
push edi
push dword [ebx + 4]
call esi
inc eax
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41dea2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
mov ebx, dword [esp + 0x10]
push edi
mov edi, 0x2000
mov eax, dword [esi + 0x2390]
lea ecx, [eax + ebp]
cmp ecx, edi
jle 0x41df1c
mov ecx, edi
sub ecx, eax
lea eax, [eax + esi + 0x68]
push ecx
push ebx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [esi + 0x68]
push 0
push edi
push eax
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_send]
mov ebp, dword [esi + 0x2390]
mov eax, dword [esp + 0x18]
sub ebx, ebp
add ebx, edi
and dword [esi + 0x2390], 0
lea ebp, [eax + ebp - 0x2000]
jmp 0x41df18
push 0
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
je 0x41df51
add ebx, edi
sub ebp, edi
cmp ebp, edi
ja 0x41df03
mov eax, dword [esi + 0x2390]
push ebp
push ebx
lea eax, [esi + eax + 0x68]
push eax
call sub.MSVCRT.dll_memcpy
add dword [esi + 0x2390], ebp
mov eax, dword [esi + 0x2390]
add esp, 0xc
push 0
push eax
lea eax, [esi + 0x68]
push eax
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jne 0x41df55
xor eax, eax
jmp 0x41df60
and dword [esi + 0x2390], 0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x41df67
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov eax, dword [esi + 0x2390]
mov dword [ebp + 8], ecx
add ecx, eax
mov edi, 0x2000
cmp ecx, edi
jle 0x41dfe9
mov ecx, edi
sub ecx, eax
lea eax, [eax + esi + 0x68]
push ecx
push ebx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [esi + 0x68]
push 0
push edi
push eax
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_send]
mov eax, dword [esi + 0x2390]
mov ecx, dword [ebp + 0xc]
and dword [esi + 0x2390], 0
sub ebx, eax
lea eax, [eax + ecx - 0x2000]
add ebx, edi
cmp eax, edi
mov dword [ebp + 8], eax
jbe 0x41dfe9
push 0
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
je 0x41e013
sub dword [ebp + 8], edi
add ebx, edi
cmp dword [ebp + 8], edi
ja 0x41dfce
mov eax, dword [esi + 0x2390]
push dword [ebp + 8]
lea eax, [esi + eax + 0x68]
push ebx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [esi + 0x2390], eax
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
xor eax, eax
jmp 0x41e00c
Function at 0x41e146
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WSOCK32.dll_recv]
ret 8
Function at 0x420b00
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, 0x427c98
call fcn.004268b0
sub esp, 0x10
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
cmp dword [esi + 0x1c], 0
je 0x420b3c
mov al, byte [ebp - 0xd]
push 0x42d7ec
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x14]
push eax
push 4
push esi
push 0x420895
push dword [0x43b71c]
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp - 0x14]
add esp, 0x18
test eax, eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
jne 0x420b7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x42d6d8
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [esi + 0x20]
call fcn.00420e64
pop ecx
push eax
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x420bab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x42d6d8
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x420bd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x42d6d8
push eax
call sub.MSVCRT.dll__CxxThrowException
push edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x422b4b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
sub ebx, dword [esi + 0x6c]
mov eax, dword [esi + 0x64]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x422bd3
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x422b96
mov eax, dword [esi + 0x38]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x422bb8
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x422c2e
mov ecx, dword [esi + 0x6c]
push ebx
add ecx, dword [esi + 0x64]
add ecx, dword [esi + 0x30]
push ecx
push eax
call fcn.00422c33
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x422c1a
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x422c2e
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x422b57
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x425efb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [esp + 8], 0
jne 0x425f05
xor eax, eax
ret
jmp fcn.00425f0a
Function at 0x401000
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push 0x40305c
push 0x202
call sub.ws2_32.dll_WSAStartup
push 0x11
push 2
push 2
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
jne 0x401039
push 0x10
push 0x402099
push 0x402088
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
mov dword [0x4031ea], eax
push 4
push 0x403004
push 0x20
push 0xffff
push eax
call sub.ws2_32.dll_setsockopt
push 0x40209e
call dword [sym.imp.msvcrt.dll_printf]
add esp, 4
ret

Function at 0x401061
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push dword [ebp + 8]
call sub.ws2_32.dll_ntohs
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], 0
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [0x4031ea]
call sub.ws2_32.dll_bind
cmp eax, 0xffffffff
jne 0x4010b2
push 0x10
push 0x402099
push 0x4020b1
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x14]
push eax
push 0x8004667e
push dword [0x4031ea]
call sub.ws2_32.dll_ioctlsocket
push str.Socket
call dword [sym.imp.msvcrt.dll_printf]
add esp, 4
xor eax, eax
inc eax
leave
ret 4

Function at 0x4010e2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
call sub.kernel32.dll_VirtualAlloc
leave
ret 4
Function at 0x401182
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push 0x4020d9
call dword [sym.imp.msvcrt.dll_printf]
add esp, 4
push 0x40304c
push 0x6987
push str.port
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x4031ee], eax
push 0x40304c
push 0x104
push 0x4031f2
push 0x4020ff
push str.srvName
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x400
push 0x404dba
push 0x4031f2
call fcn.00401113
push 0x404dba
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
push eax
push 0x404dba
push 0x4031f2
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
push 0x40304c
push 0x80
push 0x403422
push str.127.0.0.1
push str.srvIP
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x40304c
push 0x20
push 0x4032f6
push str.de_dust2
push str.srvMap
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x400
push 0x404dba
push 0x4032f6
call fcn.00401113
push 0x404dba
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
push eax
push 0x404dba
push 0x4032f6
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
push 0x40304c
push 0x6987
push str.destport
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x403316], eax
push 0x40304c
push 0x80
push 0x40331a
push str.119.147.145.176
push str.dest
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x40304c
push 0x20
push str.srvMaxPlayer
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x40339a], eax
push 0x40304c
push 0x1d
push str.srvPlayer
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x40339e], eax
push 0x40304c
push 1
push 0x40217a
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x403522], eax
push 0x40304c
push 0x80
push 0x4033a2
push str.cstrike
push str.GameDir
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x40304c
push 4
push 0x4051c2
push 0x402198
push str.Dedicated
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x40304c
push 4
push 0x4051be
push 0x40219d
push 0x40219a
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x40304c
push 0x80
push 0x4034a2
push str.www.ibelivecs.com
push str.GameDescription
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x400
push 0x404dba
push 0x4034a2
call fcn.00401113
push 0x404dba
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
push eax
push 0x404dba
push 0x4034a2
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
push 0x40304c
push 1
push str.SleepTime
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x404d2a], eax
push 0x40304c
push 0x3e8
push str.SendLoop
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x404d2e], eax
push 0x40304c
push 0x2f
push str.Proto
push str.NumberSrv
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [0x4051ba], eax
push 0x4021da
call dword [sym.imp.msvcrt.dll_printf]
add esp, 4
leave
ret
Function at 0x4016b7
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
lea edi, [0x403526]
mov al, byte [edi + 4]
cmp al, 0x54
jne 0x401745
push 0x19
push 0x403008
push 0x403526
call dword [sym.imp.msvcrt.dll_memcmp]
add esp, 0xc
or eax, eax
jne 0x401797
push dword [ebp + 0xc]
call sub.ws2_32.dll_inet_ntoa
push eax
push 0x40223b
call dword [sym.imp.msvcrt.dll_printf]
add esp, 8
call fcn.004018a6
or eax, eax
jne 0x401716
push 0x402248
call dword [sym.imp.msvcrt.dll_printf]
add esp, 4
leave
ret 0x10
mov ecx, eax
push ecx
push 0x10
lea eax, [ebp + 8]
push eax
push ecx
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
pop eax
push 0
push 0
push eax
push 0x401651
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x401797
cmp al, 0x67
jne 0x401797
push 0x17
push 0x403021
push 0x403526
call dword [sym.imp.msvcrt.dll_memcmp]
add esp, 0xc
or eax, eax
jne 0x401797
push dword [ebp + 0xc]
call sub.ws2_32.dll_inet_ntoa
push eax
push str._s_r_n
call dword [sym.imp.msvcrt.dll_printf]
add esp, 8
push 0x10
lea eax, [ebp + 8]
push eax
push 0
push dword [0x404d36]
push 0x404d3a
push dword [0x4031ea]
call sub.ws2_32.dll_sendto
leave
ret 0x10

Function at 0x40179b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x402258
call dword [sym.imp.msvcrt.dll_printf]
add esp, 4
mov dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0xfff
push 0x403526
push dword [0x4031ea]
call sub.ws2_32.dll_recvfrom
cmp eax, 0xffffffff
jne 0x4017ef
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x40180e
push 1
call sub.kernel32.dll_Sleep
jmp 0x40180e
cmp eax, 0
jbe 0x40180e
cmp dword [0x403526], 0xffffffff
jne 0x40180e
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004016b7
jmp 0x4017af
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x460a05
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x460a3d
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x460a2b
mov al, 1
jmp 0x460a87
cmp dword [ebx + 0x54], ecx
jne 0x460a34
mov al, 2
jmp 0x460a87
cmp dword [ebx + 0x7c], ecx
jne 0x460a87
mov al, 3
jmp 0x460a87
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x460a52
mov al, 4
jmp 0x460a87
cmp ecx, 5
jne 0x460a72
cmp ebx, 0
jne 0x460a60
mov al, 5
jmp 0x460a87
cmp ebx, 1
jne 0x460a69
mov al, 6
jmp 0x460a87
cmp ebx, 2
jne 0x460a72
mov al, 7
jmp 0x460a87
cmp ecx, 6
jne 0x460a7e
cmp ebx, 0
jne 0x460a80
mov al, 8
jmp 0x460a87
cmp ebx, 1
jne 0x460a87
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406411
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [esp + 0x30]
jg 0x40641b
lea eax, [esp + 0x18]
mov edi, dword [eax]
fld dword [esi + 0x4c]
sub esp, 8
fstp qword [esp]
mov dword [esp + 0x38], ebx

Function at 0x40642a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x2c], 0
call fcn.00401063
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
jge 0x406448
lea ecx, [esp + 0x24]
jmp 0x406454
cmp eax, ebx
lea ecx, [esp + 0x30]
jg 0x406454
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x40]
lea eax, [edi + edx]
mov edi, dword [esp + 0x34]
shl eax, 0x10
add eax, dword [ecx]
or eax, 0xff000000
cmp dword [edi + 0x10], 8
mov dword [esp + 0x4c], eax
jne 0x406485
mov ecx, dword [esp + 0x3c]
push ecx
push eax
call 0x462f00
add esp, 8
mov dword [esp + 0x4c], eax
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
test al, al
je 0x406fd2
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
test al, al
je 0x406fd2
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x5c]
pop esp
mov edi, dword [esp + 0x38]
sub ebx, dword [esp + 0x58]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x64]
push edx
push edi
mov dword [esp + 0x50], eax
and al, 0x50
call 0x463250
mov edx, dword [esp + 0x40]
sar dword [esp + 0x54], 2
and al, 0x54
add cl, byte [ecx - 0x72c7dbbc]
inc esp
and al, 0x48
push eax
lea ecx, [esp + 0x60]
push ecx

Function at 0x4064b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x2c], 0
call fcn.00401063
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
jge 0x406448
lea ecx, [esp + 0x24]
jmp 0x406454
cmp eax, ebx
lea ecx, [esp + 0x30]
jg 0x406454
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x40]
lea eax, [edi + edx]
mov edi, dword [esp + 0x34]
shl eax, 0x10
add eax, dword [ecx]
or eax, 0xff000000
cmp dword [edi + 0x10], 8
mov dword [esp + 0x4c], eax
jne 0x406485
mov ecx, dword [esp + 0x3c]
push ecx
push eax
call 0x462f00
add esp, 8
mov dword [esp + 0x4c], eax
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
test al, al
je 0x406fd2
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
test al, al
je 0x406fd2
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x5c]
pop esp
mov edi, dword [esp + 0x38]
sub ebx, dword [esp + 0x58]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x64]
push edx
push edi
mov dword [esp + 0x50], eax
and al, 0x50
call 0x463250
mov edx, dword [esp + 0x40]
sar dword [esp + 0x54], 2
and al, 0x54
add cl, byte [ecx - 0x72c7dbbc]
inc esp
and al, 0x48
push eax
lea ecx, [esp + 0x60]
push ecx
Function at 0x4064ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x2c], 0
call fcn.00401063
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
jge 0x406448
lea ecx, [esp + 0x24]
jmp 0x406454
cmp eax, ebx
lea ecx, [esp + 0x30]
jg 0x406454
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x40]
lea eax, [edi + edx]
mov edi, dword [esp + 0x34]
shl eax, 0x10
add eax, dword [ecx]
or eax, 0xff000000
cmp dword [edi + 0x10], 8
mov dword [esp + 0x4c], eax
jne 0x406485
mov ecx, dword [esp + 0x3c]
push ecx
push eax
call 0x462f00
add esp, 8
mov dword [esp + 0x4c], eax
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
test al, al
je 0x406fd2
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
test al, al
je 0x406fd2
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x5c]
pop esp
mov edi, dword [esp + 0x38]
sub ebx, dword [esp + 0x58]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x64]
push edx
push edi
mov dword [esp + 0x50], eax
and al, 0x50
call 0x463250
mov edx, dword [esp + 0x40]
sar dword [esp + 0x54], 2
and al, 0x54
add cl, byte [ecx - 0x72c7dbbc]
inc esp
and al, 0x48
push eax
lea ecx, [esp + 0x60]
push ecx

Function at 0x4064d7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x2c], 0
call fcn.00401063
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
jge 0x406448
lea ecx, [esp + 0x24]
jmp 0x406454
cmp eax, ebx
lea ecx, [esp + 0x30]
jg 0x406454
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x40]
lea eax, [edi + edx]
mov edi, dword [esp + 0x34]
shl eax, 0x10
add eax, dword [ecx]
or eax, 0xff000000
cmp dword [edi + 0x10], 8
mov dword [esp + 0x4c], eax
jne 0x406485
mov ecx, dword [esp + 0x3c]
push ecx
push eax
call 0x462f00
add esp, 8
mov dword [esp + 0x4c], eax
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
test al, al
je 0x406fd2
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
test al, al
je 0x406fd2
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x5c]
pop esp
mov edi, dword [esp + 0x38]
sub ebx, dword [esp + 0x58]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x64]
push edx
push edi
mov dword [esp + 0x50], eax
and al, 0x50
call 0x463250
mov edx, dword [esp + 0x40]
sar dword [esp + 0x54], 2
and al, 0x54
add cl, byte [ecx - 0x72c7dbbc]
inc esp
and al, 0x48
push eax
lea ecx, [esp + 0x60]
push ecx
Function at 0x42d7b0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cf32b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004bece4
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x42d832
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004bbbb4
mov eax, dword [eax]
push 0x513d44
push eax
call fcn.004ad2d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004bef6f
test bl, bl
je 0x42d832
push 0x513d44
lea ecx, [esp + 0xc]
call fcn.004bf34b
push 0x513d50
lea ecx, [esp + 0xc]
call fcn.004bf34b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42d86e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004bef6f
jmp 0x42d939
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x42d8f2
lea edx, [esp + 0x7c]
push 0x513d4c
push edx
call fcn.004ad2d4
add esp, 8
test eax, eax
je 0x42d8f2
lea eax, [esp + 0x7c]
push 0x513d48
push eax
call fcn.004ad2d4
add esp, 8
test eax, eax
je 0x42d8f2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42d882
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004bef6f
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42eb90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42ebf2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc