joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc41
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.caefa611fac39045c359c43b1
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40cc8a
push str.9241c65d660bdd63d511323
call fcn.004294d3
jmp 0x40ccc2
test esi, esi
jbe 0x40cc9a
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.e3c73e7babfba38d51f9073
jne 0x40ccb6
mov eax, str.17d9b46bb8bd429b
push eax
push str.212166092b1706fdbf01cd2f33
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40ce2f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.c4d748e7eea5758dcecb760370
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40ce78
push str.4b97c2a50e45cb6b1ccfd38d5e73
call fcn.004294d3
jmp 0x40ceb0
test esi, esi
jbe 0x40ce88
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.542132513e13efbd8453d0b
jne 0x40cea4
mov eax, str.bacb7b4f791755a702a76
push eax
push str.9713eb2f1fedefe1b15fe541
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40ceb5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.e0ebb8a533b748a95
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40cefe
push str.b04fcbbdf94ff361f5af3297
call fcn.004294d3
jmp 0x40cf36
test esi, esi
jbe 0x40cf0e
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.cc73247f24bf182fb925dcdd7
jne 0x40cf2a
mov eax, str.5d43bad3a1d9118368b5b36399e7e
push eax
push str.6af5f2492983011bd3e15abd250
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40d183
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
cdq
mov ecx, 0x82
idiv ecx
sub dl, 0x46
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x40d1b7
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d23e
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40d23e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret
Function at 0x40eca6
Capabilities:
Check mutex on windows

Disassembly:
lea eax, [esi + 0x180]
cmp dword [eax + 0x18], 0x10
jb 0x40ecb7
mov eax, dword [eax + 4]
jmp 0x40ecba
add eax, 4
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x17c], eax
test eax, eax
jne 0x40ecdc
mov dword [esi + 0x308], 1
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ecd9
and dword [esi + 0x308], 0
push 0
call fcn.0042aef3
int3

Function at 0x40ed99
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x4542b0]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x40edce
dec eax
dec eax
je 0x40edce
sub eax, 4
jne 0x40edd6
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x194]
xor ecx, esp
xor eax, eax
call fcn.00428d2e
add esp, 0x19c
ret

Function at 0x40f0a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0
mov eax, 0x43e7f1
call fcn.0042babd
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x40f0c0
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40f0e7
mov esi, 0x80004005
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
mov eax, esi
call fcn.0042bb95
ret 0x1c
xor esi, esi
jmp 0x40f0d1

Function at 0x40f0eb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00438db0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xfff
mov dword [ebp - 0x1014], eax
xor edi, edi
lea eax, [ebp - 0x100b]
push edi
push eax
mov byte [ebp - 0x100c], 0
call fcn.00431920
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call esi
push 2
pop ebx
sub eax, ebx
je 0x40f144
sub eax, ebx
je 0x40f144
sub eax, 4
jne 0x40f154
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call fcn.0040a022
lea eax, [ebp - 0x100c]
push eax
mov edi, 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x1010], eax
call esi
sub eax, ebx
je 0x40f17c
sub eax, ebx
je 0x40f17c
sub eax, 4
jne 0x40f18d
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.0040a0c2
cmp dword [ebp - 0x1010], 0
jne 0x40f19d
mov eax, 0x80004005
jmp 0x40f1db
cmp dword [ebp - 0x1010], edi
jae 0x40f196
mov ecx, dword [ebp - 0x1014]
lea eax, [ebp - 0x100c]
push eax
add ecx, 0x19c
call fcn.00403575
call esi
sub eax, ebx
je 0x40f1cc
sub eax, ebx
je 0x40f1cc
sub eax, 4
jne 0x40f1d9
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.0042709a
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
leave
ret 4
Function at 0x4101e9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e05a
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.00438db0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0xfff
lea eax, [ebp - 0x100f]
push ebx
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0x1010], bl
call fcn.00431920
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [ebp + 0x20], 0x10
jae 0x410246
lea eax, [ebp + 0xc]
mov esi, 0x1000
push esi
lea ecx, [ebp - 0x1010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, ebx
jne 0x410289
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428d2e
leave
ret 0x1c
cmp eax, esi
jb 0x4102a1
mov esi, 0x80004005
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
mov eax, esi
jmp 0x41026e
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.00403575
xor esi, esi
jmp 0x410292
Function at 0x412b4b
Capabilities:
Copy file

Disassembly:
push 0x7c
mov eax, 0x44044d
call fcn.0042babd
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push dword [esi + 0x74]
add edi, 0x2c0
mov eax, edi
mov dword [ebp - 0x10], edi
call fcn.0041800c
cmp dword [eax + 0x3c], 0
jne 0x412b80
mov eax, 0x80004005
jmp 0x412c76
push 0x10
pop ebx
cmp dword [esi + 0x70], ebx
jb 0x412b8d
mov ecx, dword [esi + 0x5c]
jmp 0x412b90
lea ecx, [esi + 0x5c]
mov eax, dword [ebp + 8]
add eax, 0x244
cmp dword [eax + 0x18], ebx
jb 0x412ba2
mov eax, dword [eax + 4]
jmp 0x412ba5
add eax, 4
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [esi + 0x74]
test eax, eax
mov eax, edi
jne 0x412c6b
call fcn.0041800c
add eax, 0x38
inc dword [eax]
push dword [esi + 0x74]
mov eax, edi
call fcn.0041800c
cmp dword [eax + 0x38], 3
jle 0x412b76
push dword [esi + 0x74]
mov eax, edi
call fcn.0041800c
cmp dword [eax + 0x18], ebx
jb 0x412bea
mov eax, dword [eax + 4]
jmp 0x412bed
add eax, 4
push eax
lea eax, [ebp - 0x30]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x14], esp
push 0x3b
push 0x44918c
call fcn.004081ed
lea edi, [ebp - 0x88]
call fcn.00427366
and dword [ebp - 4], 0
call fcn.004274a1
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], ebx
jb 0x412c28
mov eax, dword [eax + 4]
jmp 0x412c2b
add eax, 4
mov ebx, dword [ebp + 8]
push eax
push 1
call fcn.0040eded
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004035bd
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x88]
call fcn.00404654
mov eax, dword [ebp + 0xc]
push dword [eax + 0x74]
mov eax, dword [ebp - 0x10]
call fcn.0041800c
and dword [eax + 0x3c], 0
jmp 0x412b76
call fcn.0041800c
and dword [eax + 0x38], 0
xor eax, eax
call fcn.0042bb95
ret 8
Function at 0x41c959
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov ecx, dword [esi + 0x40]
push ebx
xor al, al
push edi
mov bl, 1
cmp ecx, 0xffffffff
je 0x41caef
mov edi, 0x10000000
cmp ecx, 0x7c
je 0x41caef
cmp ecx, 0x29
jne 0x41c99b
cmp dword [esi + 0x10], 0
jne 0x41caef
test dword [esi + 0x44], edi
jne 0x41c99b
push 5
call fcn.00428442
pop ecx
jmp 0x41cad8
cmp ecx, 0x2e
jne 0x41c9b7
push 5
lea eax, [esi + 0x18]
push eax
call fcn.0041cbd2
mov eax, esi
call fcn.0041c931
jmp 0x41cad8
cmp ecx, 0x5c
jne 0x41ca16
mov eax, esi
call fcn.0041c931
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x41c9ea
cmp byte [esi + 0x3e], 0x62
jne 0x41c9ea
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0041cbd2
mov eax, esi
call fcn.0041c931
jmp 0x41cadf
test eax, eax
je 0x41ca0a
cmp byte [esi + 0x3e], 0x42
jne 0x41ca0a
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0041cbd2
mov eax, dword [esi + 0x1c]
add eax, 8
or dword [eax], 1
jmp 0x41c9de
mov eax, esi
call fcn.0041d640
jmp 0x41cad8
cmp ecx, 0x5b
jne 0x41ca40
mov eax, esi
call fcn.0041c931
mov eax, esi
call fcn.0041d5f5
cmp dword [esi + 0x40], 0x5d
je 0x41c9ab
push 4
call fcn.00428442
pop ecx
jmp 0x41c9ab
cmp ecx, 0x28
jne 0x41ca6c
mov eax, esi
call fcn.0041c931
mov eax, esi
call fcn.0041d70a
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x41ca63
push 5
call fcn.00428442
pop ecx
mov eax, esi
call fcn.0041c931
jmp 0x41cad4
cmp ecx, 0x5e
jne 0x41ca78
push 2
jmp 0x41c9d5
cmp ecx, 0x24
jne 0x41ca84
push 3
jmp 0x41c9d5
cmp ecx, 0x2a
je 0x41cacc
cmp ecx, 0x2b
je 0x41cacc
cmp ecx, 0x3f
je 0x41cacc
cmp ecx, 0x7b
je 0x41cacc
cmp ecx, 0x7d
jne 0x41caa9
test dword [esi + 0x44], edi
jne 0x41caa9
push 6
jmp 0x41c990
cmp ecx, 0x5d
jne 0x41caba
test dword [esi + 0x44], edi
jne 0x41caba
push 4
jmp 0x41c990
movzx eax, byte [esi + 0x3e]
push eax
lea eax, [esi + 0x18]
call fcn.0041d8a0
jmp 0x41c9ab
push 0xa
call fcn.00428442
pop ecx
test bl, bl
je 0x41cadf
mov eax, esi
call fcn.0041d7d8
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x41c971
pop edi
pop ebx
pop ecx
ret
Function at 0x41ef64
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.6bc7ffdfa2313e49842df9dd8
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x41efd4
push str.65cb8bcf90453ebf2193c8b115
call fcn.004294d3
pop ecx
pop ecx
jmp 0x41f044
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41efef
push str.e5b77ea97c4357ff3d8bbf854b23f
jmp 0x41f037
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x41f020
push eax
push ebx
push str.d291d893365b567b2f0dca5d
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.afe1366155998123fec531831147196
call fcn.004294d3
add esp, 0x14
jmp 0x41f03d
cmp eax, ebx
jne 0x41f032
push ebx
push str.7b919655e2e3ef11
call fcn.004294d3
pop ecx
jmp 0x41f03c
push str.05a7137dbe57f4951
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x41f0a3
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.5e7d54470b8d09b359b3e
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.5c6be563d48de2af37c702e9e7a7
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x41f114
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.cef1a90be92572835acd70
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x41f0e9
test eax, eax
jne 0x41f124
push esi
push str.56a186053b0ff339e2_d
jmp 0x41f12a
push eax
push str.df9d3bd5660351555__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41f190
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.a9313a83ddeffae3e647d5b
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x41f1d9
push str.04e96a3bd72b830fcb1f241fc8
call fcn.004294d3
jmp 0x41f211
test esi, esi
jbe 0x41f1e9
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.a69bb67bdda73029fb6
jne 0x41f205
mov eax, str.1bcbf4477d5132930a
push eax
push str.916dfab979f33ad16ce5677f78
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x41f216
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.b47fc21be279d3a9ff9d1a1f98e5358
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.5711bb637cf9f56f39b
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x41f287
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.b169e667446761db
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x41f25c
test eax, eax
jne 0x41f297
push esi
push str.6ba968a141e597777d_d
jmp 0x41f29d
push eax
push str.332b164d9df17f43d07563cb61e1d__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x424108
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x43e4a8
call fcn.0042babd
mov esi, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x424133
dec eax
dec eax
je 0x424133
sub eax, 4
je 0x424133
xor eax, eax
jmp 0x42413d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
dec eax
jne 0x42414a
call fcn.0041f3f4
call fcn.00426054
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov ecx, 0x104
cdq
idiv ecx
xor edi, edi
test eax, eax
jbe 0x4241a0
push edi
mov eax, esi
call fcn.0042529e
cmp dword [eax + 0x18], 0x10
jb 0x424171
mov eax, dword [eax + 4]
jmp 0x424174
add eax, 4
cmp dword [ebp + 0x20], 0x10
mov ecx, dword [ebp + 0xc]
jae 0x424180
lea ecx, [ebp + 0xc]
push eax
push ecx
call fcn.00428ed2
pop ecx
pop ecx
test eax, eax
je 0x4241a7
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov ecx, 0x104
cdq
idiv ecx
inc edi
cmp edi, eax
jb 0x42415e
mov esi, 0x80004005
jmp 0x4241c1
sub esp, 0x1c
lea eax, [ebp + 0x24]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004031b5
push edi
push esi
call fcn.004241e3
mov esi, eax
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
push 0
push 1
lea ecx, [ebp + 0x24]
call fcn.004035bd
mov eax, esi
call fcn.0042bb95
ret 0x38
Function at 0x425f5c
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.787b75c142e35207f0dd9ff79
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x425fcc
push str.db3bfbe1b7bf269f7ef
call fcn.004294d3
pop ecx
pop ecx
jmp 0x42603c
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x425fe7
push str.8b95733b681b436bcb898d63c017aa
jmp 0x42602f
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x426018
push eax
push ebx
push str.61e9970366b9eeeb234786
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.010b3c47e7ef2d45e
call fcn.004294d3
add esp, 0x14
jmp 0x426035
cmp eax, ebx
jne 0x42602a
push ebx
push str.c47d23a909bd7895c5359e
call fcn.004294d3
pop ecx
jmp 0x426034
push str.0e619755a7b5ecbfd385347
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x4261a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
cdq
mov ecx, 0x9a
idiv ecx
sub dl, 0x22
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x4261d4
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42625b
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x42625b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret
Function at 0x426269
Capabilities:
Initialize winsock library
Set uefi variable

Disassembly:
sub esp, 0x19c
mov eax, dword [0x4542b0]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
push esi
mov esi, edi
call fcn.00403180
lea esi, [edi + 0x20]
call fcn.00403180
xor ebx, ebx
xor eax, eax
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov word [edi + 0x1c], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x4262c4
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.00425f5c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x4262d7
dec eax
dec eax
je 0x4262d7
sub eax, 4
jne 0x4262ef
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
lea eax, [esp + 8]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
call fcn.00401270
test eax, eax
je 0x42630c
call fcn.00426054
mov ecx, dword [esp + 0x19c]
pop esi
pop ebx
xor ecx, esp
mov eax, edi
call fcn.00428d2e
add esp, 0x19c
ret
Function at 0x42633d
Capabilities:
Get geographical location

Disassembly:
push 0x2c
mov eax, 0x43dc54
call fcn.0042bb26
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 0x20]
mov dword [ebp - 4], 1
call fcn.004034e3
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0x24]
push eax
mov ecx, edi
call fcn.004034e3
call fcn.004295cd
cdq
push 0xa
pop ecx
idiv ecx
mov esi, edx
call fcn.004295cd
cdq
push 0xa
pop ecx
idiv ecx
cmp esi, edx
setl al
test al, al
je 0x4263a6
movzx eax, al
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
call fcn.004397d0
fstp dword [ebp - 0x18]
fld dword [ebp - 0x18]
jmp 0x4263b3
fldz
call fcn.004396a0
fstp dword [ebp - 0x18]
fld dword [ebp - 0x18]
call fcn.004398c0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esi, 0x400
test eax, eax
je 0x4263e9
push 4
lea eax, [ebp - 0x18]
push eax
push 0x20001009
push esi
call ebx
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x58
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call fcn.004260d2
mov ax, word [ebp + 0x40]
mov word [edi + 0x1c], ax
call fcn.004295cd
cdq
push 0xa
pop ecx
idiv ecx
mov dword [ebp - 0x18], edx
call fcn.004295cd
cdq
push 0xa
pop ecx
idiv ecx
cmp dword [ebp - 0x18], edx
setl al
test al, al
je 0x42642a
movzx eax, al
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
call fcn.004397d0
fstp dword [ebp - 0x18]
fld dword [ebp - 0x18]
jmp 0x426437
fldz
call fcn.004396a0
fstp dword [ebp - 0x18]
fld dword [ebp - 0x18]
call fcn.004398c0
test eax, eax
je 0x426457
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.0042611b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x42646e
dec eax
dec eax
je 0x42646e
sub eax, 4
je 0x42646e
xor eax, eax
jmp 0x42647e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
inc eax
dec eax
jne 0x4264a3
push 4
lea eax, [ebp - 0x18]
push eax
push 0x20001009
push esi
call ebx
push 0x20
lea eax, [ebp - 0x38]
push eax
push 0x58
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call fcn.00426054
mov eax, dword [ebp + 0x44]
push 0
push 1
lea ecx, [ebp + 8]
mov dword [edi + 0x3c], eax
call fcn.004035bd
push 0
push 1
lea ecx, [ebp + 0x24]
call fcn.004035bd
xor eax, eax
call fcn.0042bba9
ret 0x40