joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4097f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x100
lea eax, [esp]
push esi
mov esi, dword [esp + 0x10c]
push esi
push str.Key_Pressed_code:_d
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
mov edx, dword [0x51852c]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.004239b0
mov eax, dword [0x430fdc]
add esp, 0x14
test eax, eax
jl 0x409874
cmp esi, 0x30
jb 0x40984c
cmp esi, 0x39
ja 0x40984c
cmp eax, 0xcccccb2
jge 0x40984c
lea eax, [eax + eax*4]
lea ecx, [esi + eax*2 - 0x30]
mov dword [0x430fdc], ecx
jmp 0x409874
push 4
add eax, 0x100
push 0x430fdc
push 0x192
mov dword [0x430fdc], eax
call fcn.00410130
add esp, 0xc
mov dword [0x430fdc], 0xffffffff
cmp esi, 0x41
jb case.0x40989a.75
cmp esi, 0x5a
ja case.0x40989a.75
lea eax, [esi - 0x43]
cmp eax, 0x26
ja case.0x40989a.75
xor edx, edx
mov dl, byte [eax + 0x409a3c]
jmp dword [edx*4 + 0x409a18]
mov al, byte [0x5189f6]
cmp al, 0x1e
jb 0x4098be
cmp al, 0x28
jae 0x4098be
cmp dword [0x443bdc], 0x3f2
jne 0x409a10
push 0
push 0
push 0x190
call fcn.00410130
add esp, 0xc
pop esi
add esp, 0x100
ret
mov al, byte [0x5189f6]
cmp al, 0x1e
jb 0x4098f4
cmp al, 0x28
jae 0x4098f4
cmp dword [0x443bdc], 0x3f2
jne 0x409a10
push 0
push 0
push 0x191
call fcn.00410130
add esp, 0xc
pop esi
add esp, 0x100
ret
mov al, byte [0x5189f6]
cmp al, 0x1e
jb 0x40992a
cmp al, 0x28
jae 0x40992a
cmp dword [0x443bdc], 0x3f2
jne 0x409a10
push 0
push 0
push 0x39
call fcn.00410130
add esp, 0xc
pop esi
add esp, 0x100
ret
push 0x1f4
call fcn.00410ad0
add esp, 4
pop esi
add esp, 0x100
ret
mov eax, dword [0x430fd8]
inc eax
mov dword [0x430fd8], eax
dec eax
je 0x4099b7
dec eax
je 0x4099a0
dec eax
je 0x409989
mov eax, dword [0x443104]
push 6
push eax
mov dword [0x430fd8], 0
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x100
ret
mov ecx, dword [0x443104]
push 9
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x100
ret
mov edx, dword [0x443104]
push 3
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x100
ret
mov eax, dword [0x443104]
push 9
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x100
ret
call fcn.0040fba0
push 0xffffffffffffffff
call fcn.00408910
add esp, 4
jmp case.0x40989a.75
mov al, byte [0x5189f6]
cmp al, 0x1e
jb 0x4099f7
cmp al, 0x28
jae 0x4099f7
cmp dword [0x443bdc], 0x3f2
jne case.0x40989a.75
mov dword [0x430fdc], 0
mov ecx, dword [0x518528]
push ecx
call fcn.00410af0
add esp, 4
pop esi
add esp, 0x100
ret
Function at 0x40fa90
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x190
mov eax, 0x50dd5a
push ebx
push esi
mov esi, str.localhost
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40faca
test cl, cl
je 0x40fac6
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40faca
add eax, 2
add esi, 2
test cl, cl
jne 0x40faa2
xor eax, eax
jmp 0x40facf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fae9
push 0x517754
push 0x5187e0
call fcn.00423210
add esp, 8
mov esi, eax
jmp 0x40fb13
lea eax, [esp + 8]
push eax
push 0x202
call sub.WSOCK32.dll_WSAStartup
push 0x50dd5a
call sub.WSOCK32.dll_gethostbyname
mov ecx, dword [eax + 0xc]
mov esi, 1
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [0x517754], eax
mov ecx, dword [0x518530]
push 0x517758
push ecx
call fcn.00423420
add esp, 8
cmp eax, 0xffffffff
jne 0x40fb4c
mov edx, dword [0x51852c]
push str.ERROR:_Creating_socket
push edx
call fcn.004239b0
add esp, 8
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x190
ret
mov ax, word [0x50dd58]
mov ecx, dword [0x517754]
mov edx, dword [0x517758]
push eax
push ecx
push edx
call fcn.00423460
add esp, 0xc
test eax, eax
je 0x40fb8c
mov eax, dword [0x51852c]
push str.ERROR:_Connecting
push eax
call fcn.004239b0
add esp, 8
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x190
ret
mov eax, esi
pop esi
pop ebx
add esp, 0x190
ret

Function at 0x4108f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push esi
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x7f00
push 0
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x20], eax
mov eax, dword [0x517750]
push 0x7f00
push 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0x410c30
mov dword [esp + 0x34], str.LoadImage
call dword [sym.imp.USER32.dll_LoadIconW]
lea ecx, [esp + 8]
mov dword [esp + 0x1c], eax
push ecx
call dword [sym.imp.USER32.dll_RegisterClassW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
cmp dword [0x5189f8], 0x12e
je 0x4109bc
mov edx, dword [0x517750]
push 0
push edx
push 0
push 0
push eax
push edi
push 0
push 0
push 0x90000000
push 0x4401b4
push str.LoadImage
push 8
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, esi
pop edi
pop esi
add esp, 0x28
ret
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
Function at 0x410a10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x518530]
push 0xeb
push eax
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x518520], 1
jne 0x410a2d
xor eax, eax
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push 0
call esi
push 1
mov edi, eax
call esi
mov ecx, dword [0x517750]
push 0
push ecx
push 0
push 0
push eax
push edi
push 0
push 0
push 0x90000000
push 0x4401b4
push 0x431984
push 8
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x4319a0]
push edx
push 0x476a20
push 0
push 0
push 0xffffffffffffffff
push 0
push 0x352
call fcn.004257a0
mov eax, dword [0x51775c]
push 4
push 0x518520
push 0x7d9
push 0
push eax
mov dword [0x518520], 1
call fcn.004237a0
add esp, 0x30
mov eax, esi
pop edi
pop esi
ret

Function at 0x411020
Capabilities:
Copy file

Disassembly:
sub esp, 0x210
push ebx
push esi
push edi
mov edi, dword [esp + 0x224]
test edi, edi
je 0x411166
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push edi
call ebx
add esp, 4
test eax, eax
je 0x411166
mov esi, dword [esp + 0x220]
test esi, esi
je 0x411166
push esi
call ebx
add esp, 4
test eax, eax
je 0x411166
push edi
call fcn.00424b40
add esp, 4
test eax, eax
je 0x411166
lea eax, [esp + 0x14]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
push 1
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.00423bd0
push esi
call ebx
lea eax, [esi + eax*2 - 2]
add esp, 0x18
cmp eax, esi
jb 0x4110af
cmp word [eax], 0x5c
je 0x4110af
sub eax, 2
cmp eax, esi
jae 0x4110a2
add eax, 2
lea edx, [esp + 0x14]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscat]
push esi
call fcn.00423fe0
lea eax, [esp + 0x20]
fstp st(0)
push eax
call fcn.00423fe0
mov eax, dword [esp + 0x238]
add esp, 0x10
test eax, eax
fstp st(0)
je 0x4110fe
push 0
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
neg eax
add esp, 0x210
ret
push esi
call fcn.00423fe0
fstp qword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
call fcn.00423fe0
fcomp qword [esp + 0x14]
add esp, 8
fnstsw ax
test ah, 0x40
je 0x411148
push esi
call fcn.00424ca0
mov edi, eax
lea eax, [esp + 0x18]
push eax
call fcn.00424ca0
add esp, 8
cmp edi, eax
jne 0x411148
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x210
ret
lea ecx, [esp + 0x14]
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
neg eax
add esp, 0x210
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret
Function at 0x423210
Capabilities:
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x454
lea eax, [esp + 0x2c4]
push ebx
push ebp
push esi
push edi
push eax
push 0x202
xor ebp, ebp
call sub.WSOCK32.dll_WSAStartup
mov esi, dword [esp + 0x468]
push ebp
push ebp
lea ecx, [esp + 0xdc]
push 0x100
push ecx
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
inc eax
push eax
push esi
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edi, [esp + 0xd4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1d4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
je 0x42329e
mov ecx, dword [0x51852c]
push 0x437438
push ecx
call fcn.004239b0
add esp, 8
mov cl, byte [esp + 0xd4]
mov al, 0x5c
cmp cl, al
jne 0x4232b4
cmp byte [esp + 0xd5], al
je 0x4232ca
lea edx, [esp + 0xd4]
push edx
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
je 0x42339d
lea eax, [esp + 0x1d4]
push 0x437434
push eax
call dword [sym.imp.MSVCRT.dll_strtok]
mov esi, eax
add esp, 8
test esi, esi
je 0x4232e9
push esi
jmp 0x4232ef
mov esi, str.Serverstation
push esi
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x4233bb
call sub.WSOCK32.dll_WSAGetLastError
mov ebp, eax
test ebp, ebp
je 0x4233b2
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.MSVCRT.dll_mbstowcs]
add esp, 0xc
cmp ebp, 0x2af9
jne 0x423345
lea edx, [esp + 0x14]
push str._not_found
push edx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
jmp 0x423380
cmp ebp, 0x2afc
jne 0x423367
lea eax, [esp + 0x14]
lea ecx, [esp + 0x14]
push eax
push str._s_:_Not_connected__no_data_record_found
push ecx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
jmp 0x423380
lea edx, [esp + 0x14]
push ebp
push edx
lea eax, [esp + 0x1c]
push str._s_:_Not_connected__function_failed_with_error:__d
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
mov edx, dword [0x51852c]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.004239b0
mov esi, dword [esp + 0x18]
add esp, 8
or ebp, 0xffffffff
jmp 0x4233df
push str.localhost
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x4233bb
call sub.WSOCK32.dll_WSAGetLastError
mov esi, dword [esp + 0x10]
or ebp, 0xffffffff
jmp 0x4233df
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
mov ecx, dword [esi]
push ecx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea edx, [esp + 0x98]
push 0x43734c
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
test esi, esi
je 0x423412
test ebx, ebx
je 0x423412
mov eax, dword [esi]
mov esi, dword [esp + 0x46c]
push str.localhost
mov dword [esi], eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x423412
mov ecx, dword [eax + 0xc]
mov eax, dword [esi]
mov edx, dword [ecx]
mov ecx, dword [edx]
cmp eax, ecx
mov eax, 1
jne 0x423414
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x454
ret
Function at 0x423420
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [esp + 8]
cmp eax, 0xffffffff
mov dword [ecx], eax
jne 0x423439
or eax, eax
ret
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x423457
push 0x33
push 0x40a
push ecx
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x423457
or eax, eax
ret
xor eax, eax
ret

Function at 0x423460
Capabilities:
Connect socket

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov word [esp], 2
push eax
call sub.WSOCK32.dll_htons
mov ecx, dword [esp + 0x18]
mov word [esp + 2], ax
mov eax, dword [esp + 0x14]
lea edx, [esp]
push 0x10
push edx
push eax
mov dword [esp + 0x10], ecx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x4234a3
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4234a5
xor eax, eax
add esp, 0x10
ret

Function at 0x4234b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x100
push esi
mov esi, dword [esp + 0x108]
push 1
push esi
call sub.WSOCK32.dll_shutdown
push 0
lea eax, [esp + 8]
push 0x100
push eax
push esi
call sub.WSOCK32.dll_recv
test eax, eax
je 0x4234f7
cmp eax, 0xffffffff
je 0x4234f7
push 0
lea ecx, [esp + 8]
push 0x100
push ecx
push esi
call sub.WSOCK32.dll_recv
test eax, eax
jne 0x4234dc
push 2
push esi
call sub.WSOCK32.dll_shutdown
push esi
call sub.WSOCK32.dll_closesocket
pop esi
add esp, 0x100
ret

Function at 0x423510
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xbb8
test eax, eax
push ebx
push esi
je 0x423644
push 0
lea ecx, [esp + 0xc]
push 0xbb8
push ecx
push eax
call sub.WSOCK32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
je 0x423628
test ebx, ebx
je 0x423644
mov eax, dword [0x5185a0]
test eax, eax
jne 0x423579
push 0x2800
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [0x5185a0], eax
test eax, eax
je 0x423644
mov dword [0x5185b0], 0x2800
jmp 0x4235f2
mov edx, dword [0x5185b8]
mov ecx, dword [0x5185b0]
lea esi, [edx + ebx]
cmp esi, ecx
jbe 0x4235b8
add ecx, 0x2800
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
test eax, eax
je 0x423644
mov ecx, dword [0x5185b0]
mov dword [0x5185a0], eax
add ecx, 0x2800
jmp 0x4235ec
mov esi, ecx
sub esi, edx
sub esi, ebx
cmp esi, 0x2800
jbe 0x4235f2
add ecx, 0xffffd800
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
test eax, eax
je 0x423644
mov ecx, dword [0x5185b0]
mov dword [0x5185a0], eax
sub ecx, 0x2800
mov dword [0x5185b0], ecx
mov edx, dword [0x5185b8]
push edi
mov ecx, ebx
lea esi, [esp + 0xc]
lea edi, [edx + eax]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x5185b8]
pop edi
add eax, ebx
pop esi
mov dword [0x5185b8], eax
mov eax, ebx
pop ebx
add esp, 0xbb8
ret
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x423644
mov ecx, dword [0x51852c]
push eax
push ecx
call fcn.00424cf0
add esp, 8
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xbb8
ret
Function at 0x423650
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x5185c0]
push esi
test eax, eax
jne 0x4236bc
mov ecx, dword [0x5185bc]
test ecx, ecx
je 0x4236bc
mov eax, dword [esp + 8]
test eax, eax
je 0x4236bc
cmp eax, 0xffffffff
je 0x4236bc
push 0
push ecx
mov ecx, dword [0x5185a8]
push ecx
push eax
call sub.WSOCK32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x4236a3
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x42369e
mov dword [0x5185c0], 1
or eax, 0xffffffff
pop esi
ret
mov edx, dword [0x5185a8]
push 0x5185bc
push esi
push edx
call fcn.00423970
add esp, 0xc
mov eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x424b40
Capabilities:
Create directory

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x214]
test esi, esi
push edi
je 0x424c94
cmp word [esi], 0
je 0x424c94
mov edi, dword [sym.imp.MSVCRT.dll__waccess]
push 0
push esi
call edi
add esp, 8
cmp eax, 0xffffffff
je 0x424b82
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esp + 8]
test eax, eax
je 0x424ba5
mov word [eax], 0
lea edx, [esp + 0xc]
push 0
push edx
call edi
add esp, 8
cmp eax, 0xffffffff
jne 0x424b74
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x10]
push 0
push eax
call ebx
test eax, eax
jne 0x424c79
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
lea esi, [esp + eax*2 + 0x12]
add esp, 4
mov eax, esi
jmp 0x424be8
mov eax, dword [esp + 0xc]
sub eax, 2
lea edx, [esp + 0x10]
cmp eax, edx
mov dword [esp + 0xc], eax
jbe 0x424c0c
cmp word [eax], 0x5c
je 0x424c0c
sub eax, 2
lea ecx, [esp + 0x10]
cmp eax, ecx
mov dword [esp + 0xc], eax
ja 0x424bf7
mov word [eax], 0
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
cmp eax, edx
jbe 0x424c79
lea eax, [esp + 0x10]
push 0
push eax
call edi
add esp, 8
cmp eax, 0xffffffff
je 0x424be4
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
cmp eax, ecx
jbe 0x424c79
sub eax, 2
jmp 0x424c43
mov eax, dword [esp + 0xc]
add eax, 2
cmp eax, esi
mov dword [esp + 0xc], eax
jae 0x424c5f
cmp word [eax], 0
je 0x424c5f
add eax, 2
cmp eax, esi
mov dword [esp + 0xc], eax
jb 0x424c4e
mov word [eax], 0x5c
mov eax, dword [esp + 0xc]
cmp eax, esi
jae 0x424c79
lea edx, [esp + 0x10]
push 0
push edx
call ebx
test eax, eax
jne 0x424c3f
lea eax, [esp + 0x10]
push 0
push eax
call edi
add esp, 8
neg eax
sbb eax, eax
pop ebx
pop edi
inc eax
pop esi
add esp, 0x20c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret

Function at 0x425290
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
test esi, esi
je 0x425341
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, 1
jb 0x425341
push ebx
push esi
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
jne 0x4252c7
mov ebx, 1
push edi
mov edi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x42533b
mov ax, word [edi]
cmp ax, 0x72
jne 0x42531c
push esi
push 1
lea eax, [esp + 0x18]
push 2
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp ax, 0xfeff
je 0x42533b
push esi
push eax
call dword [sym.imp.MSVCRT.dll_ungetwc]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
cmp ax, 0x77
je 0x42532c
cmp ax, 0x61
jne 0x42533b
test ebx, ebx
jne 0x42533b
push esi
push 0xfeff
call dword [sym.imp.MSVCRT.dll_fputwc]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret
Function at 0x425350
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
push ebx
push esi
push 0x430d64
push eax
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4253d8
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x14]
push 2
push ecx
mov dword [esp + 0x1c], ebx
call edi
add esp, 0x10
cmp word [esp + 0xc], 0xfeff
je 0x4253bd
push esi
push 1
lea edx, [esp + 0x18]
push 0x100
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x10]
push ebx
push 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4253c2
mov ebx, 1
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x104
ret
mov eax, ebx
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x4254f0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x228
push esi
lea eax, [esp + 0x18]
push edi
push eax
mov dword [esp + 0x20], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x2c]
sub eax, 0
je 0x425664
dec eax
je 0x425655
dec eax
jne 0x4256a0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x138]
push str.INFO:_RESTARTING__Windows__u._u
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
mov esi, dword [esp + 0x244]
lea ecx, [esp + 0x140]
push ecx
push esi
call fcn.004239b0
add esp, 0x18
lea edx, [esp + 8]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
test eax, eax
jne 0x42558b
push str.ERROR:_RESTARTING__Windows__OpenProcessToken_
push esi
call fcn.004239b0
add esp, 8
push 0
call edi
push ebx
lea eax, [esp + 0x14]
push ebp
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 2
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test eax, eax
je 0x4255e7
push str.ERROR:_RESTARTING__Windows__AdjustTokenPrivileges__enable_
push esi
call fcn.004239b0
add esp, 8
push 0
call edi
mov eax, dword [esp + 0x240]
push eax
push 1
push 5
push str.SYSTEM_SHUTDOWN
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test eax, eax
jne 0x425616
push str.ERROR:_RESTARTING__Windows__InitiateSystemShutdown_
push esi
call fcn.004239b0
add esp, 8
push 0
call edi
mov edx, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0
push edx
mov dword [esp + 0x38], 0
call ebx
call ebp
pop ebp
pop ebx
test eax, eax
je 0x4256a0
push str.ERROR:_RESTARTING__Windows__AdjustTokenPrivileges__disable_
push esi
call fcn.004239b0
add esp, 8
push 0
call edi
pop edi
pop esi
add esp, 0x228
ret
mov eax, dword [esp + 0x234]
push str.INFO:_RESTARTING__Windows_95
push eax
jmp 0x425671
mov ecx, dword [esp + 0x234]
push str.INFO:_RESTARTING__Windows_3.1
push ecx
call fcn.004239b0
mov eax, dword [esp + 0x240]
add esp, 8
cmp eax, 1
push 0
jne 0x425698
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
add esp, 0x228
ret
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
add esp, 0x228
ret
Function at 0x425d70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x84]
dec eax
je 0x425e37
dec eax
jne 0x425e6f
and dword [0x51f408], 0
cmp dword [ebp - 0x90], 4
ja 0x425db8
push 3
jmp 0x425e34
push 5
pop eax
cmp dword [ebp - 0x90], eax
jne 0x425e20
cmp dword [ebp - 0x8c], 0
je 0x425e71
cmp dword [ebp - 0x8c], 1
jne 0x425ddd
push 7
jmp 0x425e34
cmp dword [ebp - 0x8c], 2
jne 0x425e6f
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x425e0e
lea ecx, [ebp - 0xb8]
push ecx
call eax
xor eax, eax
cmp word [ebp - 0xb8], 9
sete al
add eax, 8
leave
ret
cmp dword [ebp - 0x90], 6
jne 0x425e6f
cmp dword [ebp - 0x8c], 0
jne 0x425e6f
push 0xa
pop eax
leave
ret
push 4
mov dword [0x51f408], 1
pop eax
cmp dword [ebp - 0x90], eax
jb 0x425e6f
cmp dword [ebp - 0x8c], 0
jne 0x425e59
push 2
jmp 0x425e34
cmp dword [ebp - 0x8c], 0xa
je 0x425e71
cmp dword [ebp - 0x8c], 0x5a
jne 0x425e6f
push 6
jmp 0x425e34
xor eax, eax
leave
ret

Function at 0x42688a
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0xf4240
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0042db80
mov ecx, eax
mov esi, edx
mov eax, dword [ebp + 8]
cdq
push edx
push eax
push esi
push ecx
call fcn.0042d9c0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
sbb ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jl 0x4268fe
jg 0x4268fc
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jb 0x4268fe
jmp 0x426900
jmp 0x4268ce
pop esi
leave
ret 4