joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c590
Capabilities:
Initialize winsock library

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x1a0
mov eax, 0x70
mov dword [esp + 0x1a8], ebx
mov dword [ebx], edx
call fcn.0041f040
mov dword [0x430030], eax
mov eax, ebx
xor ecx, ecx
lea edx, [esp + 0x19c]
mov dword [eax + 8], 0
mov eax, 1
call fcn.0041112e
cmp eax, 0xffffffff
jne 0x41c5e0
mov ecx, dword [0x430030]
mov dword [ecx], 0x6301
jmp 0x41c5ee
mov eax, dword [0x430030]
mov ebx, dword [esp + 0x19c]
mov dword [eax], ebx
mov ecx, dword [0x430030]
lea ebx, [esp + 0xc]
push ebx
inc dword [ecx]
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x41c61f
mov eax, dword [esp + 0x1a8]
mov dword [eax + 0x10], 0
add esp, 0x1a0
pop ebx
ret
push 0x4601a0
push 0
push 0
mov ebx, dword [esp + 0x1b4]
mov dword [ebx + 0x10], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [0x430030]
mov dword [ecx + 0x6c], eax
call fcn.0041c960
mov eax, ebx
add esp, 0x1a0
pop ebx
ret

Function at 0x41c960
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov ecx, dword [0x430030]
sub esp, 8
add ecx, 0xc
xor edx, edx
push edi
mov dword [ecx], edx
mov dword [ecx + 4], edx
push esi
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
push 0
mov ecx, dword [0x430030]
xor edx, edx
add ecx, 0x1c
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov ecx, dword [0x430030]
lea edx, [ecx + 0xe]
inc edx
mov edi, edx
mov edx, dword [ecx]
sar edx, 8
mov word [ecx + 0xc], 2
mov byte [ecx + 0xe], dl
mov ecx, edi
mov edx, dword [0x430030]
mov edx, dword [edx]
and edx, 0xff
mov byte [ecx], dl
mov ecx, dword [0x430030]
push 1
mov esi, ecx
push 2
call sub.WSOCK32.dll_socket
mov ecx, esi
cmp eax, 0xffffffff
mov dword [ecx + 4], eax
jne 0x41c9e0
pop esi
pop edi
add esp, 8
ret
mov ecx, dword [0x430030]
push 0x10
lea edx, [ecx + 0xc]
push edx
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll_bind
test eax, eax
je 0x41c9ff
pop esi
pop edi
add esp, 8
ret
mov ecx, dword [0x430030]
push 1
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll_listen
pop esi
pop edi
add esp, 8
ret
Function at 0x41ca16
Capabilities:
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
cmp dword [eax + 0x10], 0
je 0x41cc0a
cmp dword [eax + 8], 0
jne 0x41cc0a
mov edi, eax
mov esi, dword [ebp - 0x24]
add eax, 0
mov dword [ebp - 0x1c], 0x10
mov eax, dword [0x430030]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x128], 1
mov ebx, dword [eax + 4]
mov dword [ebp - 0x124], ebx
lea ebx, [ebp - 0x14]
push ebx
mov eax, dword [eax + 4]
push 0
lea ebx, [ebp - 0x128]
push 0
push ebx
push eax
call sub.WSOCK32.dll_select
mov ecx, dword [0x430030]
push ebx
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x41ca47
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [0x430030]
lea edx, [ecx + 0x1c]
push edx
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll_accept
mov ecx, dword [0x430030]
push 4
lea edx, [ebp - 0x18]
mov dword [ecx + 8], eax
push edx
push 0x80
mov word [ebp - 0x18], 1
mov word [ebp - 0x16], 5
push 0xffff
mov edx, dword [ecx + 8]
push edx
call sub.WSOCK32.dll_setsockopt
mov eax, dword [edi]
mov ecx, dword [eax + 8]
cmp byte [ecx + 0xb], 0
jne 0x41cc0a
mov edx, 1
call fcn.00419f88
mov eax, dword [0x430030]
cmp dword [eax + 8], 0xffffffff
jne 0x41cb23
mov edx, dword [eax + 4]
push edx
call sub.WSOCK32.dll_closesocket
mov ecx, dword [edi]
mov edx, 0x3e8
mov eax, ecx
mov ecx, dword [ecx]
call dword [ecx + 4]
call fcn.0041c960
jmp 0x41cbef
mov ebx, dword [edi]
mov eax, dword [0x430030]
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
mov dword [eax + 0x2c], ebx
je 0x41cb82
cmp dword [eax + 0x38], 0
jne 0x41cb5d
call fcn.0041c680
test eax, eax
jne 0x41cb5d
mov ebx, dword [0x430030]
mov edx, dword [ebx + 8]
push edx
call sub.WSOCK32.dll_closesocket
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x430030]
mov eax, dword [eax + 8]
call fcn.0041c7a3
test eax, eax
jne 0x41cb82
mov ebx, dword [0x430030]
mov edx, dword [ebx + 8]
push edx
call sub.WSOCK32.dll_closesocket
jmp 0x41cbef
mov eax, dword [0x430030]
cmp dword [eax + 8], 0
jbe 0x41cbac
cmp dword [eax + 0x20], 0
je 0x41cbac
mov edx, dword [eax + 0x20]
push edx
call sub.WSOCK32.dll_inet_ntoa
mov edx, eax
mov eax, dword [edi]
call fcn.00419ce0
mov dword [edi + 8], 1
mov eax, dword [0x430030]
mov edx, dword [eax + 0x20]
push edx
call sub.WSOCK32.dll_inet_ntoa
mov esi, dword [edi]
mov edx, dword [esi + 8]
add edx, 0x33
mov dword [ebp - 0x20], edx
cmp byte [eax], 0
je 0x41cbe2
mov ecx, eax
mov eax, eax
mov eax, eax
mov ebx, ecx
mov eax, edx
inc ecx
inc edx
mov bl, byte [ebx]
mov byte [eax], bl
cmp byte [ecx], 0
jne 0x41cbd0
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov byte [eax], 0
mov eax, dword [esi + 8]
mov byte [eax + 0x74], 1
cmp dword [edi + 0x10], 0
je 0x41cc0a
cmp dword [edi + 8], 0
je 0x41ca40
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41d018
Capabilities:
Log keystrokes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
test byte [ebp + 0x14], 1
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
je 0x41d042
push 0
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov al, 0x10
xor ecx, ecx
call fcn.0041d1b0
test byte [ebp + 0x14], 2
je 0x41d05d
push 0
push 0x11
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov al, 0x11
xor ecx, ecx
call fcn.0041d1b0
test byte [ebp + 0x14], 4
je 0x41d078
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov al, 0x12
xor ecx, ecx
call fcn.0041d1b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
or ah, 0x80
call fcn.0041d131
test byte [ebp + 0x14], 4
je 0x41d0a7
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov ecx, 2
mov al, 0x12
call fcn.0041d1b0
test byte [ebp + 0x14], 2
je 0x41d0c5
push 0
push 0x11
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
mov ecx, 2
mov al, 0x11
call fcn.0041d1b0
test byte [ebp + 0x14], 1
je 0x41d0e7
push 0
push 0x10
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dl, al
add esp, 0xc
mov ecx, 2
mov al, 0x10
pop ebp
jmp fcn.0041d1b0
add esp, 0xc
pop ebp
ret

Function at 0x41d131
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x430038], 0
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
je 0x41d161
cmp dword [0x43003c], 0
jne 0x41d161
cmp eax, 0x8001
jne 0x41d161
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, dword [0x430034]
cmp ecx, 0xffffffff
je 0x41d195
mov edx, dword [ebp + 8]
push 0
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x14]
push 0x10
push edx
mov byte [ebp - 0x14], 0
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov edx, dword [ebp + 0x10]
push 0
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_mouse_event]
mov esp, ebp
pop ebp
ret

Function at 0x41d1b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [0x430034]
push edi
cmp ebx, 0xffffffff
je 0x41d1f5
xchg ebx, eax
mov byte [esp + 0xc], 1
mov byte [esp + 0x10], bl
push 0
mov edi, ecx
mov byte [esp + 0x15], dl
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x20]
push ecx
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 8]
mov ecx, edi
mov eax, ebx
push 0
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
pop ebx
add esp, 0x18
ret
Function at 0x41d3e7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov dword [ebp + 8], eax
sub esp, 0x15c
mov dword [eax], edx
cmp byte [edx + 0x94], 0x80
je 0x41d51d
cmp byte [edx + 0x14], 0
jne 0x41d460
lea ebx, [ebp - 0x160]
mov edx, 0x100
mov eax, ebx
mov edi, ebx
mov esi, 0x46035c
call fcn.00411134
xor eax, eax
mov edx, ebx
or ecx, 0xffffffff
push 1
repne scasb al, byte es:[edi]
dec edi
xor eax, eax
movsw word es:[edi], word [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov esi, 0x460360
dec edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 0
movsw word es:[edi], word [esi]
push ebx
push 0x46036c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x41d51d
lea ebx, [ebp - 0x160]
mov edx, 0x100
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x4c], 0
mov eax, ebx
mov edi, ebx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0x460374
mov esi, 0x46035c
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x24], 0
mov word [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x1e], 0
call fcn.00411134
xor eax, eax
mov edx, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
xor eax, eax
movsw word es:[edi], word [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov esi, 0x460360
dec edi
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x50]
push ecx
movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
push 0
push 0
movsw word es:[edi], word [esi]
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41d51d
mov esi, dword [ebp - 0x60]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov esi, dword [ebp - 0x5c]
push esi
call ebx
add esp, 0x15c
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41d6b1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
lea eax, [ebp - 4]
mov dword [ebp + 0x10], ecx
push eax
mov dword [ebp + 0xc], edx
push 1
push 0
push 0x46038c
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41d6df
mov esp, ebp
xor eax, eax
pop ebp
ret
lea ecx, [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ecx
push edx
mov edx, dword [ebp + 0xc]
push 0
push 0
push edx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41d70d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
xor eax, eax
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
cmp byte [ecx], 0
setne al
and eax, 0xff
ret

Function at 0x41d7a4
Capabilities:
Create thread

Disassembly:
sub esp, 4
lea eax, [esp]
push eax
push 0
push edx
push 0x41d7c1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 4
ret
Function at 0x41db04
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0x41f0e0
push dword fs:[0]
mov dword fs:[0], esp
push 0xffffffffffffffdc
sub esp, 0xac
push ebx
mov ebx, eax
push edi
mov dword [ebp - 0x1c], 0x4619bc
push esi
mov dword [ebp + 8], ebx
mov dword [ebp - 0x24], 0
sub esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0
call fcn.0041bcf6
mov dword [ebp - 0x24], 1
mov dword [ebx], 0x461b50
mov eax, 0x454
call fcn.0041f040
add esp, 4
mov dword [0x430044], eax
push 0
push 0
push 0
push 0x4603c0
call dword [sym.imp.GDI32.dll_CreateDCA]
mov edx, eax
mov ecx, dword [0x430044]
sub esp, 4
mov eax, ebx
mov dword [ecx], edx
call fcn.0041daf2
mov dword [ebx + 0x18], eax
mov eax, ebx
call fcn.0041dae0
mov dword [ebx + 0x1c], eax
add esp, 4
mov ecx, dword [0x430044]
push 0xc
mov edx, dword [ecx]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, ebx
cmp eax, 0x10
mov esi, ecx
mov dword [ecx + 0x20], eax
jne 0x41dbc2
mov ecx, 0x10
jmp 0x41dbc7
mov ecx, 0x18
mov eax, esi
mov dword [eax + 0x24], ecx
mov eax, dword [0x430044]
mov edi, dword [eax]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [0x430044]
push 1
mov dword [ecx + 4], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 0x18]
push edi
mov edi, dword [ecx]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [0x430044]
push eax
mov edi, dword [ecx + 4]
mov dword [ecx + 8], eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x430044]
mov dword [ecx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [0x430044]
and eax, 0x80000000
add eax, 0xffffffff
sbb eax, eax
inc eax
mov dword [ecx + 0x444], eax
mov edx, dword [ebx + 0x24]
mov word [ecx + 0x26], dx
mov dword [ecx + 0x18], 0x28
mov edx, dword [ebx + 0x18]
sub esp, 4
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x20], 1
mov word [ecx + 0x24], 1
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov eax, dword [ebx + 0x24]
sar eax, 3
imul eax, dword [ebx + 0x18]
shl eax, 2
call fcn.0041f0d0
add esp, 4
mov dword [ebx + 0x28], eax
push 0x7f02
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0
call edi
mov ecx, dword [0x430044]
push 0x7f00
push 0
mov dword [ecx + 0x44c], eax
call edi
mov ecx, dword [0x430044]
mov dword [ecx + 0x448], eax
mov eax, 0x10
xor ecx, ecx
mov dword [ebp + eax*8 - 0xb8], ecx
mov dword [ebp + eax*8 - 0xb4], ecx
mov dword [ebp + eax*8 - 0xb0], ecx
mov dword [ebp + eax*8 - 0xac], ecx
sub eax, 2
jge 0x41dccc
lea edx, [ebp - 0xb8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xb8], 0x94
push edx
mov ecx, edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [0x430044]
pop esi
cmp dword [ebp - 0xb4], 5
setae dl
and edx, 0xff
mov eax, ebx
pop edi
mov dword [ecx + 0x450], edx
pop ebx
add esp, 0xb0
pop dword fs:[0]
mov esp, ebp
pop ebp
ret
Function at 0x423a70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0x428da5
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 4
push edi
call fcn.00426748
call fcn.0042674c
sub esp, 4
mov eax, 1
call fcn.00427520
add esp, 4
test eax, eax
jne 0x423abc
pop edi
mov eax, 8
add esp, 4
pop dword fs:[0]
mov esp, ebp
pop ebp
ret
call fcn.00424284
cmp eax, 0xffffffff
jne 0x423ada
pop edi
mov eax, 8
add esp, 4
pop dword fs:[0]
mov esp, ebp
pop ebp
ret
sub esp, 4
mov eax, 0x4282e0
call fcn.004291d0
call dword [sym.imp.KERNEL32.dll_GetVersion]
add esp, 4
shr eax, 0x1f
test eax, eax
je 0x423b0d
sub esp, 8
mov edx, dword [0x4c0324]
mov eax, 0x4c0320
call fcn.004274c0
add esp, 8
sub esp, 4
mov eax, 0x423b81
call fcn.00427690
sub esp, 4
xor eax, eax
call fcn.00427480
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add esp, 8
mov edi, eax
mov cl, byte [eax]
cmp cl, 0x20
je 0x423b4d
test cl, cl
je 0x423b4d
mov ecx, eax
mov eax, eax
mov eax, eax
inc ecx
mov al, byte [ecx]
cmp al, 0x20
je 0x423b4b
test al, al
jne 0x423b40
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 1
mov edx, edi
push edx
push 0
push eax
call fcn.0041d3a0
sub esp, 4
call fcn.00426610
add esp, 4
mov eax, 8
pop edi
add esp, 4
pop dword fs:[0]
mov esp, ebp
pop ebp
ret

Function at 0x4241e5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [0x4c02c0]
push ebx
push edi
sub esp, 0x10
mov edx, dword [ecx + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test eax, eax
jne 0x42427c
mov ecx, 0x64
mov edx, 1
mov eax, dword [0x43023c]
call fcn.00426a20
mov edi, eax
test eax, eax
je 0x424239
mov ecx, dword [0x4c02c0]
push eax
mov edx, dword [ecx + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x424248
mov edx, 0x220
mov eax, 0x46053c
call fcn.00421570
mov ecx, dword [0x4c02c0]
mov ebx, edi
mov ecx, dword [ecx + 8]
mov dword [ebx], ecx
mov dword [ebx + 0x34], 1
mov dword [ebx + 0x50], 0x8000
mov ecx, dword [0x43023c]
mov dword [ebx + 0x54], ecx
mov dword [ebx + 0x58], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x5c], eax
mov eax, edi
add esp, 0x10
pop edi
pop ebx
ret
Function at 0x425960
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [0x4c02c0]
push edi
sub esp, 0xc
mov edx, dword [ecx + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test eax, eax
jne 0x425997
call fcn.004241e5
mov edi, eax
test eax, eax
jne 0x425997
mov edx, 0x2e1
mov eax, 0x4605e4
call fcn.00421570
mov eax, edi
add esp, 0xc
pop edi
ret

Function at 0x425df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov dword [ebp + 0xc], edx
sub esp, 0x18
mov edx, dword [ebp + 0x14]
mov dword [ebp + 0x10], ecx
push edx
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x425e20
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], 2
jmp 0x425e41
mov eax, dword [ebp + 8]
cmp eax, 2
je 0x425e2d
cmp eax, 5
jne 0x425e38
mov eax, dword [ebp + 0x1c]
mov dword [eax], 3
jmp 0x425e41
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov ecx, dword [ebp + 0x10]
test cl, 0x80
je 0x425e58
and cl, 0x7f
mov esi, 0x80
mov dword [ebp + 0x10], ecx
xor eax, eax
jmp 0x425e5f
xor esi, esi
mov eax, 0x4c02f8
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edx
mov edx, 0x3fffffff
and edx, ecx
push eax
push edx
and ecx, 0xc0000000
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x425e97
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x425ec2
mov edx, esi
or ecx, 0xffffffff
or edx, dword [ebp + 0xc]
mov eax, ebx
call fcn.00425ecc
mov ecx, dword [ebp + 0x18]
cmp eax, 0xffffffff
mov dword [ecx], eax
je 0x425eb4
xor edi, edi
jmp 0x425ec2
mov edx, ebx
mov edi, 4
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x426070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov ebx, eax
push esi
mov dword [ebp + 0xc], edx
sub esp, 0x10
mov dword [ebp + 0x10], ecx
or edx, 0xffffffff
mov eax, 0x430210
call fcn.0041f5d8
mov edx, eax
mov eax, ebx
test edx, edx
je 0x4260a0
add esp, 0x10
mov eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [0x4c0304], eax
ja 0x4260b0
mov edi, 6
jmp 0x4260bd
mov ebx, dword [0x43009c]
xor edi, edi
mov ebx, dword [ebx + eax*8]
mov esi, ebx
mov eax, 0x430210
call fcn.0041f5e8
test eax, eax
je 0x4260d3
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp edi, 0
jne 0x426102
push 0
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426102
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x6d
jne 0x426102
xor edi, edi
add esp, 0x10
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x426295
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push edi
push esi
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x4301f8], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [0x430200], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4301fc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4301f4], eax
mov eax, dword [0x430200]
mov al, byte [eax]
cmp al, 0x3d
jne 0x4262fc
test al, al
je 0x4262e6
mov eax, dword [0x430200]
inc eax
mov dword [0x430200], eax
cmp byte [eax], 0
jne 0x4262d6
mov eax, dword [0x430200]
inc eax
mov dword [0x430200], eax
cmp byte [eax], 0
jne 0x4262c7
dec eax
mov dword [0x430200], eax
xor eax, eax
mov edi, dword [0x4301fc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, 2
mov eax, ecx
call fcn.0041e0c0
mov dword [0x4300a0], eax
test eax, eax
jne 0x42632b
add esp, 8
mov eax, 8
pop esi
pop edi
pop ebx
ret
mov esi, dword [0x4301fc]
xor eax, eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
mov edi, dword [0x4300a0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4300a0]
mov dword [esp + 4], ecx
cmp byte [ecx], 0
je 0x426382
nop
cmp byte [ecx], 0x20
jne 0x426378
mov byte [ecx], 0
inc ecx
cmp byte [ecx], 0
je 0x42637e
mov eax, eax
inc ecx
cmp byte [ecx], 0
jne 0x426370
jmp 0x42637e
inc ecx
cmp byte [ecx], 0
jne 0x426360
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
mov byte [ecx + 1], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, 0xff
and ecx, eax
mov byte [0x430230], cl
mov ecx, 0xff00
and ecx, eax
shr ecx, 8
mov byte [0x430238], cl
mov ecx, eax
shr ecx, 0x1f
mov dword [0x430098], ecx
cmp ecx, 1
jne 0x4263ce
shr eax, 0x1e
and eax, 1
add eax, 0xffffffff
sbb eax, eax
inc eax
mov dword [0x430098], eax
push 0
xor ecx, ecx
sub esp, 0xc
mov edx, 0x430210
xor eax, eax
call fcn.00425b70
add esp, 0x10
test eax, eax
je 0x4263ef
add esp, 8
pop esi
pop edi
pop ebx
ret
mov eax, 0x200
call fcn.0041e0c0
mov dword [0x43009c], eax
test eax, eax
jne 0x42640e
add esp, 8
mov eax, 8
pop esi
pop edi
pop ebx
ret
push 0xfffffffffffffff6
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
call ebx
mov ecx, dword [0x43009c]
push 0xfffffffffffffff5
mov dword [ecx], eax
mov ecx, dword [0x43009c]
mov dword [ecx + 4], reloc.WSOCK32.dll_closesocket
call ebx
mov ecx, dword [0x43009c]
push 0xfffffffffffffff4
mov dword [ecx + 8], eax
mov ecx, dword [0x43009c]
mov dword [ecx + 0xc], 0x40000003
call ebx
mov ecx, dword [0x43009c]
mov dword [ecx + 0x10], eax
or eax, 0xffffffff
mov ecx, dword [0x43009c]
mov dword [ecx + 0x14], 0x40000003
mov edx, dword [0x4c0304]
mov edi, dword [0x43009c]
shl edx, 3
sub edx, 0x18
add edi, 0x18
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
add esp, 8
xor eax, eax
pop esi
pop edi
pop ebx
ret