joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4205f1
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push edi
call fcn.00420363
pop ecx
test al, al
je 0x4206c1
push ebx
push 0x48
push 0x481b68
lea ebx, [esi + 0x48]
push esi
mov dword [ebp + 0xc], ebx
call fcn.004272f4
push 0x1000
push 0x481bb0
push ebx
call fcn.004272f4
add esp, 0x18
sar edi, 5
xor ecx, ecx
mov eax, ecx
mov ebx, dword [ebp + 8]
cdq
idiv edi
mov eax, dword [ebx + edx*4]
xor dword [esi + ecx*4], eax
inc ecx
cmp ecx, 0x12
jl 0x420638
and dword [ebp - 4], 0
mov edi, esi
and dword [ebp - 8], 0
push 9
pop ebx
lea eax, [ebp - 8]
mov ecx, esi
push eax
push eax
call fcn.00420511
push dword [ebp - 8]
call fcn.00424d25
push dword [ebp - 4]
mov dword [edi], eax
call fcn.00424d25
mov dword [edi + 4], eax
lea edi, [edi + 8]
pop ecx
pop ecx
sub ebx, 1
jne 0x420659
mov ebx, dword [ebp + 0xc]
mov edi, 0x200
lea eax, [ebp - 8]
mov ecx, esi
push eax
push eax
call fcn.00420511
push dword [ebp - 8]
call fcn.00424d25
push dword [ebp - 4]
mov dword [ebx], eax
call fcn.00424d25
mov dword [ebx + 4], eax
lea ebx, [ebx + 8]
pop ecx
pop ecx
sub edi, 1
jne 0x42068c
mov ecx, esi
call fcn.004205dd
mov al, 1
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x42e94a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 4]
mov eax, edi
mov esi, dword [ebx]
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x42e976
xor dword [esi], ecx
add esi, 4
dec eax
test eax, eax
jg 0x42e969
mov edi, dword [ebx + 4]
and edi, 3
sub edi, 1
je 0x42e991
sub edi, 1
je 0x42e98e
sub edi, 1
jne 0x42e993
mov al, byte [ebp + 0xa]
xor byte [esi + 2], al
xor byte [esi + 1], ch
xor byte [esi], cl
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4302c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x43034d
mov ebx, dword [ebp + 0xc]
test bl, 1
je 0x43033b
push 0x400
lea eax, [ebp - 0x404]
mov byte [ebp - 0x404], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0045f6e0
pop ecx
pop ecx
mov ecx, eax
lea eax, [ebp - 0x404]
cmp ecx, eax
jbe 0x43033b
cmp byte [ecx - 1], 0x5c
je 0x430321
mov byte [ecx], 0x5c
inc ecx
lea eax, [ebp - 4]
push esi
sub eax, ecx
push eax
push ecx
call fcn.0046d42f
add esp, 0xc
test eax, eax
jne 0x43034d
lea esi, [ebp - 0x404]
and ebx, 4
shl ebx, 3
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x43034f
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x43b854
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4aafb0], 0
jne 0x43b8c1
mov eax, dword [0x4aafb8]
mov byte [0x4aafb0], 1
test eax, eax
je 0x43b87b
push dword [ebp + 8]
call eax
pop ecx
jmp 0x43b8c1
cmp dword [0x4aafb4], 0
je 0x43b8c1
lea ecx, [ebp - 0xc]
call fcn.00406fdc
push 0
push 0x47d834
push 0
lea eax, [ebp - 0xc]
push eax
push bind
push dword [ebp + 8]
call fcn.004485d7
add esp, 0x18
lea ecx, [ebp - 0xc]
call fcn.0043b76d
push eax
call dword [0x4aafb4]
pop ecx
lea ecx, [ebp - 0xc]
call fcn.004071fe
push 1
call fcn.0046dc43
int3

Function at 0x43c869
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
and eax, 0xfffffffe
push ebx
cmp eax, 6
jg 0x43c88c
push 0xa1
call fcn.004479b9
xor bl, bl
jmp 0x43c92e
xor ebx, ebx
test byte [ebp + 0x14], 1
push esi
mov esi, 0x47c724
jne 0x43c8fc
cmp dword [ebp + 8], ebx
mov eax, esi
push str.thumbs.db
cmovne eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043f19d
mov ecx, esi
push ebx
cmp dword [eax], ebx
cmovne ecx, dword [eax]
push ecx
call fcn.0043e32e
add esp, 0x14
lea ecx, [ebp - 0xc]
call fcn.00423fb2
cmp dword [ebp + 8], ebx
mov eax, esi
push str.desktop.ini
cmovne eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043f19d
mov ecx, esi
push ebx
cmp dword [eax], ebx
cmovne ecx, dword [eax]
push ecx
call fcn.0043e32e
add esp, 0x14
lea ecx, [ebp - 0xc]
call fcn.00423fb2
push 0x5c
lea ecx, [ebp + 8]
call fcn.00424b04
cmp dword [ebp + 8], ebx
cmovne esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
test eax, eax
je 0x43c91d
mov bl, 1
jmp 0x43c92f
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jne 0x43c92f
push 3
call fcn.004479b9
pop ecx
lea ecx, [ebp + 8]
call fcn.00423fb2
mov al, bl
pop ebx
leave
ret
Function at 0x43d30f
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [esi]
push eax
call fcn.0043d2c9
pop ecx
test al, al
je 0x43d409
mov al, byte [esi]
xor ebx, ebx
mov byte [ebp + 8], al
lea eax, [ebp - 4]
push eax
push str.GetDiskFreeSpaceExA
mov word [ebp + 9], 0x5c3a
mov byte [ebp + 0xb], bl
mov dword [ebp - 4], ebx
call fcn.0043023b
push eax
call fcn.00430253
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x43d3ab
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp + 8]
push ecx
call eax
test eax, eax
je 0x43d3a1
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43d389
mov ecx, dword [ebp - 0x18]
xor eax, eax
add eax, dword [ebp - 0x1c]
mov dword [edx], eax
adc ecx, ebx
mov dword [edx + 4], ecx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x43d405
mov ecx, dword [ebp - 0x20]
xor eax, eax
add eax, dword [ebp - 0x24]
mov dword [edx], eax
adc ecx, ebx
mov dword [edx + 4], ecx
jmp 0x43d405
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x78
jne 0x43d409
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43d409
mov eax, dword [ebp - 8]
mul dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
mov ebx, edx
push edi
mov edi, eax
test esi, esi
je 0x43d3ec
push ebx
push edi
push 0
push dword [ebp - 0x10]
call fcn.00458ab0
mov dword [esi], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x43d404
push ebx
push edi
push 0
push dword [ebp - 0x14]
call fcn.00458ab0
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
mov al, 1
jmp 0x43d40b
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x43d55e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
movsx eax, byte [edi]
push eax
call fcn.0043d2c9
pop ecx
test al, al
je 0x43d5fd
push esi
lea edx, [ebx + 0x1c]
mov word [ebp + 9], 0x5c3a
lea ecx, [ebx + 0x20]
mov dword [edx], 0xff
and dword [ecx], 0
lea esi, [ebx + 0xc]
and dword [esi], 0
mov al, byte [edi]
mov edi, 0x3ff
mov byte [ebp + 8], al
xor eax, eax
push edi
mov byte [ebp + 0xb], al
mov byte [ebp - 0x404], al
mov byte [ebp - 0x804], al
lea eax, [ebp - 0x804]
push eax
push ecx
push edx
push esi
push edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov esi, dword [ebp - 4]
test eax, eax
push edi
lea eax, [ebp - 0x404]
mov ecx, esi
push eax
setne bl
call fcn.0042c128
push edi
lea eax, [ebp - 0x804]
push eax
lea ecx, [esi + 0x10]
call fcn.0042c128
mov al, bl
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x43d8f5
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0042e574
pop ecx
test al, al
je 0x43d90a
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ebp
ret
Function at 0x43d9ea
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0042e589
pop ecx
test al, al
je 0x43d9fe
xor al, al
pop ebp
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x43e00c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
lea ecx, [ebp - 0x18]
call fcn.00426589
mov ebx, bind
lea ecx, [ebp - 0x18]
push ebx
push dword [ebp + 0xc]
call fcn.0042c488
cmp dword [ebp - 0x14], 0
jg 0x43e051
lea eax, [ebp - 0xc]
push eax
call fcn.00447d34
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.00407495
lea ecx, [ebp - 0xc]
call fcn.00423fb2
xor esi, esi
xor eax, eax
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x18], 0
push ecx
mov word [ebp - 0x230], ax
mov eax, 0x47c724
cmovne eax, dword [ebp - 0x18]
push 0
push 0x4866b8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [ebp - 0x230], 0
jne 0x43e0c4
test byte [ebp + 0x14], 1
jne 0x43e15d
lea eax, [ebp - 0x24]
push eax
call fcn.00447d34
pop ecx
mov ecx, 0x47c724
cmp dword [eax], 0
cmovne ecx, dword [eax]
lea eax, [ebp - 0x230]
push eax
push 0
push 0x4866b8
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x24]
call fcn.00423fb2
push dword [ebp + 0x10]
call fcn.0042e574
pop ecx
test al, al
jne 0x43e136
lea ecx, [ebp - 0xc]
call fcn.00426589
push ebx
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0xc]
call fcn.0042c488
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.0043f268
cmp dword [ebp - 0xc], 0
mov eax, 0x47c724
pop ecx
cmovne eax, dword [ebp - 0xc]
pop ecx
push 0
sub esp, 0xc
mov ecx, esp
push eax
call fcn.00406f9c
lea eax, [ebp - 0x230]
push eax
call fcn.0043e7a8
add esp, 0x14
test al, al
jne 0x43e167
lea ecx, [ebp - 0xc]
call fcn.00423fb2
inc esi
cmp esi, 0x64
jl 0x43e053
mov ecx, dword [ebp + 8]
call fcn.00426589
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x230]
push ebx
push eax
call fcn.0042c488
lea ecx, [ebp - 0x18]
call fcn.00423fb2
mov eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp + 8]
call fcn.00426589
jmp 0x43e14e
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 8], ecx
lea ecx, [ebp - 0xc]
mov dword [esi], eax
call fcn.00423fb2
lea ecx, [ebp - 0x18]
call fcn.00423fb2
mov eax, esi
jmp 0x43e159
Function at 0x43e32e
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0042e574
pop ecx
test al, al
jne 0x43e3cc
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, 0x100
je 0x43e361
push esi
call fcn.0043ebfe
or eax, edx
pop ecx
jne 0x43e3d1
test bl, 1
jne 0x43e36f
push edi
push esi
call fcn.0043d92e
pop ecx
pop ecx
test bl, 2
jne 0x43e43f
test bl, bl
js 0x43e3d8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43e4fa
test ebx, 0x800
je 0x43e3aa
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x43e4fa
cmp eax, 3
je 0x43e4fa
test bl, 0x10
je 0x43e3d1
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x43e3d1
cmp eax, 3
je 0x43e3d1
push esi
or ebx, 2
call fcn.0042e574
pop ecx
test al, al
je 0x43e34e
call fcn.004479c7
xor al, al
pop edi
pop esi
pop ebx
leave
ret
lea ecx, [ebp - 0x10]
call fcn.00426589
push bind
push esi
lea ecx, [ebp - 0x10]
call fcn.0042c488
push edi
lea ecx, [ebp - 0x10]
call fcn.00422870
push edi
lea eax, [ebp - 0x3c]
push 0x1e
push eax
call fcn.0042735d
add esp, 0xc
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x10], edi
mov eax, 0x47c724
cmovne eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, 0x454
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
lea ecx, [ebp - 0x10]
neg ebx
sbb bl, bl
inc bl
jmp 0x43e536
call fcn.00446c34
test al, al
je 0x43e50f
mov eax, dword [0x4aafcc]
test eax, eax
je 0x43e463
push 4
push edi
push esi
call eax
test eax, eax
jne 0x43e4fa
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00447c48
mov edi, 0x47c720
mov dword [esp], str.wininit.exe
mov ecx, edi
cmp dword [eax], 0
cmovne ecx, dword [eax]
lea eax, [ebp - 0x10]
push ecx
push eax
call fcn.0043f0e3
mov ecx, edi
cmp dword [eax], 0
cmovne ecx, dword [eax]
push ecx
call fcn.0043e593
add esp, 0x10
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.00423fb2
lea ecx, [ebp - 0x1c]
call fcn.00423fb2
test bl, bl
je 0x43e501
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0043fa38
push 0
push 0x47d834
lea eax, [ebp - 0x10]
push 0
push eax
push eax
call fcn.004485a9
cmp dword [ebp - 0x10], 0
cmovne edi, dword [ebp - 0x10]
push edi
push 0x4866cc
call fcn.00442741
add esp, 0x24
lea ecx, [ebp - 0x10]
mov bl, al
call fcn.00423fb2
test bl, bl
je 0x43e501
mov al, 1
jmp 0x43e3d3
push dword [ebp - 4]
call fcn.004479b9
pop ecx
jmp 0x43e3d1
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0043fa38
mov ecx, 0x47c720
cmp dword [eax], edi
cmovne ecx, dword [eax]
push ecx
push 0x4866cc
call fcn.00442741
add esp, 0x10
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00423fb2
mov al, bl
jmp 0x43e3d3
Function at 0x44213d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
cmp byte [esi + 0x77], 0
jne 0x442162
push bind
push str.Read_access_denied
lea ecx, [esi + 0x50]
call fcn.0042c007
xor al, al
jmp 0x44218f
cmp byte [esi + 0x74], 0
push edi
je 0x442194
push dword [ebp + 0xc]
lea ecx, [esi + 0x38]
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax]
test al, al
jne 0x4421e6
push bind
push str.Read_past_end_of_file
lea ecx, [esi + 0x50]
call fcn.0042c007
xor al, al
pop edi
pop esi
leave
ret 8
cmp dword [esi + 0xc], 0
jne 0x4421a6
push bind
push str.File_not_open
jmp 0x442184
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push 0
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4421e1
lea eax, [ebp - 0x10]
push eax
call fcn.0044789c
pop ecx
push eax
lea ecx, [esi + 0x50]
call fcn.00407495
lea ecx, [ebp - 0x10]
call fcn.00423fb2
jmp 0x44218c
cmp edi, dword [ebp - 4]
jne 0x44217a
mov al, 1
jmp 0x44218e

Function at 0x442625
Capabilities:
Clear file content

Disassembly:
cmp byte [ecx + 0x78], 0
je 0x442651
cmp byte [ecx + 0x74], 0
je 0x44263c
add ecx, 0x38
call fcn.00423172
mov al, 1
ret
cmp dword [ecx + 0xc], 0
je 0x442651
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
ret
xor al, al
ret

Function at 0x44288c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
test edi, edi
je 0x4428b2
jns 0x4428bb
push bind
push str.Illegal_write_size
lea ecx, [esi + 0x4c]
call fcn.0042c007
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
cmp byte [esi + 0x74], 0
jne 0x4428d7
push bind
push str.Write_access_denied
lea ecx, [esi + 0x4c]
call fcn.0042c007
xor al, al
jmp 0x4428b4
cmp byte [esi + 0x70], 0
je 0x4428ee
lea ecx, [esi + 0x38]
mov eax, dword [ecx]
push edi
push dword [ebp + 8]
call dword [eax]
mov byte [esi + 0x71], 1
jmp 0x4428b2
cmp dword [esi + 8], 0
jne 0x442900
push bind
push str.File_not_open
jmp 0x4428cb
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], 0x100000
push eax
call fcn.00401882
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp + 8]
jmp 0x442954
cmp ebx, dword [ebp - 0xc]
jne 0x44299a
sub edi, ebx
mov dword [ebp + 0xc], edi
test edi, edi
jle 0x442983
add dword [ebp - 4], ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00401882
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp - 4]
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x442929
lea eax, [ebp - 0x18]
push eax
call fcn.0044789c
pop ecx
push eax
lea ecx, [esi + 0x4c]
call fcn.0042357c
lea ecx, [ebp - 0x18]
call fcn.00423fb2
jmp 0x4428d3
cmp byte [esi + 0x72], 0
je 0x4428b2
lea ecx, [esi - 4]
call fcn.00441649
jmp 0x4428b2
push bind
push str.Not_all_data_could_be_written
jmp 0x4428cb
Function at 0x442e7c
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov eax, 0x47a8c3
call fcn.004586d4
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor edi, edi
cmp dword [ebx], edi
je 0x442e9d
xor eax, eax
jmp 0x442f60
mov ecx, dword [0x4ab5e4]
mov eax, dword fs:[0x2c]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x4aafd8]
cmp eax, dword [esi + 4]
jg 0x442f6f
mov eax, dword [0x4aafe0]
cmp eax, dword [esi + 4]
jg 0x442fa3
mov dword [ebp - 4], edi
mov esi, dword [0x4aafd4]
test esi, esi
jne 0x442f0a
mov esi, 0x4aafd4
mov ecx, esi
call fcn.00401894
push esi
push 0x486cd8
push 1
push edi
push 0x486cc8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, dword [0x4aafd4]
test esi, esi
jne 0x442f0a
push 2
pop eax
jmp 0x442f60
mov eax, dword [0x4aafdc]
test eax, eax
jne 0x442f35
mov ecx, 0x4aafdc
call fcn.00401894
mov eax, dword [esi]
push 0x4aafdc
push esi
call dword [eax + 0x1c]
mov eax, dword [0x4aafdc]
test eax, eax
jne 0x442f35
push 3
jmp 0x442f07
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x1c]
cmp dword [ebx], edi
jne 0x442f44
push 4
jmp 0x442f07
or dword [ebp - 4], 0xffffffff
jmp 0x442f5e
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
push 0x4aafd8
call fcn.004591db
pop ecx
cmp dword [0x4aafd8], 0xffffffff
jne 0x442ebd
push 0x47ae4e
call fcn.004589a8
mov dword [esp], 0x4aafd8
call fcn.00459191
pop ecx
jmp 0x442ebd
mov esi, 0x4aafe0
push esi
call fcn.004591db
pop ecx
cmp dword [0x4aafe0], 0xffffffff
jne 0x442ece
push 0x47ae5e
call fcn.004589a8
push esi
call fcn.00459191
pop ecx
pop ecx
jmp 0x442ece
Function at 0x446a3f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [0x4ab278], 0
push edi
mov edi, 0x4ab280
jne 0x446b64
push ebx
push esi
xor ebx, ebx
mov byte [0x4ab278], 1
push ebx
push 0xbc
push edi
call fcn.0042735d
add esp, 0xc
mov dword [0x4ab280], 0x9c
call fcn.00446c58
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov dword [0x4ab338], eax
call esi
test eax, eax
jne 0x446aa5
push edi
mov dword [0x4ab280], 0x94
call esi
jmp 0x446b62
push 6
pop esi
cmp dword [0x4ab284], esi
jb 0x446af2
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.GetProductInfo
call fcn.0043023b
push eax
call fcn.00430253
add esp, 0xc
test al, al
je 0x446af2
movzx eax, word [0x4ab316]
push 0x4ab31c
push eax
movzx eax, word [0x4ab314]
push eax
push dword [0x4ab288]
push dword [0x4ab284]
call dword [ebp - 4]
cmp dword [0x4ab284], 5
jb 0x446b62
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.GetNativeSystemInfo
call fcn.0043023b
push eax
call fcn.00430253
add esp, 0xc
test al, al
je 0x446b62
lea eax, [ebp - 0x28]
push eax
call dword [ebp - 4]
mov eax, dword [ebp - 0x24]
mov dword [0x4ab320], eax
mov eax, dword [ebp - 0x20]
mov dword [0x4ab324], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x4ab328], eax
mov eax, dword [ebp - 0x18]
mov dword [0x4ab32c], eax
mov eax, dword [ebp - 0x14]
mov dword [0x4ab330], eax
cmp word [ebp - 0x28], si
je 0x446b5b
cmp word [ebp - 0x28], 9
mov byte [0x4ab334], bl
jne 0x446b62
mov byte [0x4ab334], 1
pop esi
pop ebx
mov eax, edi
pop edi
leave
ret
Function at 0x447cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
lea eax, [ebp - 0x108]
mov byte [ebp - 0x108], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00426589
mov edi, bind
lea eax, [ebp - 0x108]
push edi
push eax
mov ecx, esi
call fcn.0042c007
cmp dword [esi + 4], 0
jg 0x447d25
push edi
push 0x489498
mov ecx, esi
call fcn.0042c007
push 0x5c
mov ecx, esi
call fcn.00424953
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x447d34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00426589
mov edi, bind
lea eax, [ebp - 0x20c]
push edi
push eax
mov ecx, esi
call fcn.0042c488
cmp dword [esi + 4], 0
jg 0x447d8b
push edi
push str.c:_temp
mov ecx, esi
call fcn.0042c488
push 0x5c
mov ecx, esi
call fcn.00424b04
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x448e4d
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
jne 0x448e6a
mov dword [esi + 0x14], 0x2736
xor al, al
jmp 0x448fa7
cmp dword [esi + 0x20], 0xffffffff
jne 0x448e79
mov dword [esi + 0x14], 0x2726
jmp 0x448e63
push ebx
push edi
call fcn.0044a111
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x448e9e
mov ecx, dword [esi + 0xc]
shr ecx, 2
test cl, 1
jne 0x448eab
call fcn.00449606
mov edi, eax
test edi, edi
je 0x448eab
xor eax, eax
cmp dword [edi], ebx
cmovne eax, edi
mov edi, eax
test edi, edi
jne 0x448eb8
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00449934
jmp 0x448f1e
cmp dword [edi + 4], ebx
lea eax, [esi + 0x1c]
push eax
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
mov ecx, 0x47c720
cmovne ecx, dword [edi + 4]
push eax
push ecx
call fcn.00433e60
mov ebx, eax
push ebx
call fcn.004346fc
add esp, 0x14
test al, al
je 0x448f0c
push ebx
call fcn.00434574
push eax
push ebx
lea eax, [esi + 0x44]
push str.Failed_to_resolve_the_proxy_server__code__d:__s
push eax
call fcn.00425fa5
add esp, 0x14
mov dword [esi + 0x14], 0xfffffffe
xor al, al
jmp 0x448fa5
push dword [edi + 0x1c]
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004498df
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
sete bl
test eax, eax
jne 0x448f76
test edi, edi
je 0x448f76
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x18]
or dword [esi + 0x10], 3
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x10]
push eax
call fcn.00456d10
push eax
lea ecx, [edi + 0x10]
call fcn.00407495
lea ecx, [ebp - 0x10]
call fcn.00423fb2
push edi
mov ecx, esi
call fcn.00449b5b
test al, al
jne 0x448f76
mov dword [esi + 0x14], 0xfffffffe
xor bl, bl
mov ecx, dword [esi + 0x10]
mov eax, ecx
and eax, 0xfffffffe
or ecx, 1
test bl, bl
cmove ecx, eax
mov eax, ecx
or ecx, 2
and eax, 0xfffffffd
test bl, bl
cmove ecx, eax
mov dword [esi + 0x10], ecx
jne 0x448fa3
test edi, edi
jne 0x448fa3
mov ecx, esi
call fcn.0044abf6
mov al, bl
pop edi
pop ebx
pop esi
leave
ret