joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c19
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
push 0x4f
cdq
pop ecx
idiv ecx
add dl, 0x6e
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x401c4d
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401cd2
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401cd2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret

Function at 0x401ce0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.1881496d9249d3b92ebbe5a1777
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x401d29
push str.2f8de02bca4507790f3524
call fcn.004294d3
jmp 0x401d61
test esi, esi
jbe 0x401d39
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.31dde66d994758ff33
jne 0x401d55
mov eax, str.a9fde319cdc9af157cfd3c41
push eax
push str.20d98977d7dd3f3fcf39134f17d
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x401dad
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.f9b14d9f5fa56a03cc03db
call fcn.004294d3
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x401df6
push str.9b274f07670bf9f3cec
call fcn.004294d3
jmp 0x401e2e
test esi, esi
jbe 0x401e06
push esi
push 0x61
push edi
call fcn.00431920
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.90a51ed94565d9a912f
jne 0x401e22
mov eax, str.efad7cafd92d3c0ba1cf5f490c
push eax
push str.fe2d89b1e97d4271d06fd6
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x401f1a
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.938b0b6da08b6349aba95c217
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.c13b487b846f9e599ea90d6fe44f1e
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x401f8b
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.77d1699d8997af6d
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x401f60
test eax, eax
jne 0x401f9b
push esi
push str.454f898fbe174c1311411ea360_d
jmp 0x401fa1
push eax
push str.a1d39845d195cd956829d98b7b6__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40201f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
cdq
mov ecx, 0xe3
idiv ecx
sub dl, 0x3d
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x402053
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4020da
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4020da
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret
Function at 0x402271
Capabilities:
Delete file

Disassembly:
push ecx
mov eax, dword [0x4542b0]
xor eax, esp
mov dword [esp], eax
push ebx
push esi
xor ebx, ebx
push ebx
mov esi, ecx
call fcn.0042a8e7
add eax, 0x348
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x18]
adc edx, ebx
pop ecx
mov dword [esi + 0x54], edx
cmp eax, ebx
je 0x4023b3
cmp eax, 1
je 0x4023b3
cmp eax, 2
je 0x4023b3
cmp eax, 0xa
je 0x4023b3
cmp eax, 4
je 0x402382
cmp eax, 5
je 0x402382
cmp eax, 6
je 0x402382
cmp eax, 0xc
je 0x402382
push 8
pop ecx
cmp eax, ecx
je 0x40237d
cmp eax, 0xe
je 0x40237d
push 0xf
pop ecx
cmp eax, ecx
jne 0x40232a
mov dword [esi + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x402311
dec eax
dec eax
je 0x402311
sub eax, 4
jne 0x402322
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.004013c9
call fcn.0040140c
mov dword [esi + 0x48], ebx
jmp 0x4023b6
push 0x10
pop ecx
cmp eax, ecx
jne 0x402371
mov dword [esi + 0x18], ecx
call fcn.0040472c
test eax, eax
je 0x402342
call fcn.0040147d
mov dword [esi + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x4023b6
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00409a52
call fcn.0040151d
jmp 0x4023b6
push 0x11
pop ecx
cmp eax, ecx
jne 0x4023b3
mov dword [esi + 0x18], ecx
jmp 0x402322
mov dword [esi + 0x18], ecx
jmp 0x4023b6
mov dword [esi + 0x18], 4
call fcn.004295cd
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.004295cd
cdq
idiv esi
cmp edx, esi
jg 0x4023ac
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x4023b6
call fcn.00401329
jmp 0x4023b6
mov dword [esi + 0x18], ebx
mov ecx, dword [esp + 8]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00428d2e
pop ecx
ret
Function at 0x402ffd
Capabilities:
Resolve dns

Disassembly:
push 0x3c
mov eax, 0x43eca4
call fcn.0042babd
mov esi, dword [ebp + 8]
xor edi, edi
cmp dword [esi + 0x4c], edi
jne 0x403020
mov eax, 0x80004005
call fcn.0042bb95
ret 8
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x38
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp + 0xc]
inc ecx
cmp ecx, eax
jae 0x403013
lea eax, [ebp - 0x28]
push eax
call fcn.00418584
push 2
pop ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov eax, esi
mov dword [ebp - 0x10], edi
call fcn.00403310
cmp dword [eax + 0x18], 0x10
jb 0x40305b
mov eax, dword [eax + 4]
jmp 0x40305e
add eax, 4
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push edi
push 0xf
push eax
call sub.DNSAPI.dll_DnsQuery_A
cmp eax, edi
je 0x403082
mov edi, 0x80004005
lea esi, [ebp - 0x28]
call fcn.004033ec
mov eax, edi
jmp 0x403018
mov esi, dword [ebp - 0x10]
call fcn.004012cd
mov dword [ebp - 4], ebx
jmp 0x4030f1
cmp word [esi + 8], 0xf
jne 0x4030ef
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.00403310
cmp dword [eax + 0x18], 0x10
jb 0x4030ac
mov eax, dword [eax + 4]
jmp 0x4030af
add eax, 4
push dword [esi + 4]
push eax
call fcn.00428ed2
pop ecx
pop ecx
test eax, eax
jne 0x4030ef
movzx ecx, word [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x48], ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00403193
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00403489
push edi
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call fcn.004035bd
mov esi, dword [esi]
cmp esi, edi
jne 0x40308f
cmp dword [ebp - 0x10], edi
je 0x40310f
push 1
push dword [ebp - 0x10]
call sub.DNSAPI.dll_DnsFree
mov dword [ebp - 0x10], edi
call fcn.00401219
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
xor esi, esi
sar eax, 5
test eax, eax
jbe 0x403071
push esi
lea eax, [ebp - 0x28]
call fcn.00403419
cmp dword [eax], 0xd
jne 0x403141
push esi
lea eax, [ebp - 0x28]
call fcn.00403419
add eax, 4
cmp dword [eax + 0x14], edi
jne 0x403154
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
inc esi
sar eax, 5
cmp esi, eax
jb 0x403122
jmp 0x403071
push esi
lea eax, [ebp - 0x28]
call fcn.00403419
push dword [ebp + 0xc]
mov esi, eax
mov eax, dword [ebp + 8]
add esi, 4
call fcn.00403310
push 0xffffffffffffffff
add eax, 0x1c
push edi
push esi
mov ecx, eax
call fcn.004034e3
jmp 0x403076
Function at 0x404781
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.508b88078f556b059
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x4047f1
push str.7379b079eeef9b8704a90
call fcn.004294d3
pop ecx
pop ecx
jmp 0x404861
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40480c
push str.fde73fef0d43cf63dd9db
jmp 0x404854
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x40483d
push eax
push ebx
push str.82df797100832b5fe971f69f6ec
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.5c4177d99aff7aa37f
call fcn.004294d3
add esp, 0x14
jmp 0x40485a
cmp eax, ebx
jne 0x40484f
push ebx
push str.9b79f1712519a1cd3b97b9e369
call fcn.004294d3
pop ecx
jmp 0x404859
push str.f0d9cdbb2857c799d3f38a6f86bd9
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x404b48
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.004291ed
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.3e95829fb3cf19b7
call fcn.004294d3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.84977dab9b959741d15d939393ad
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x404bb9
add esi, 0x1000
push esi
push edi
call fcn.004296cc
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.636b71dfb821545b670b5bc9ce8
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x404b8e
test eax, eax
jne 0x404bc9
push esi
push str.ec0b25e9ef297f3b9a65ba2d0cdf6d_d
jmp 0x404bcf
push eax
push str.c70b2c1dd7339669a93749ddfd9__d_
call fcn.004294d3
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x404d1e
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.5541a3e19e157717a7
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x404d8e
push str.ef91b41fb97103e19b3b5f97282beed
call fcn.004294d3
pop ecx
pop ecx
jmp 0x404dfe
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404da9
push str.4b4b3ffbfafd49298
jmp 0x404df1
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x404dda
push eax
push ebx
push str.88c329b1c295a2c32817335
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.cd65a1d1252b431b73b5
call fcn.004294d3
add esp, 0x14
jmp 0x404df7
cmp eax, ebx
jne 0x404dec
push ebx
push str.118336bfff83b1bd
call fcn.004294d3
pop ecx
jmp 0x404df6
push str.00715623fa75dca30a85
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret

Function at 0x404ef2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
cdq
mov ecx, 0x81
idiv ecx
sub dl, 0x4d
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x404f26
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404fad
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404fad
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret
Function at 0x405207
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
push 0x58
cdq
pop ecx
idiv ecx
add dl, 0x19
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x40523b
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4052c0
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4052c0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret

Function at 0x405476
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431920
push str.ce7b0a2b52cb89b926d
call fcn.004294d3
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x4054e6
push str.08d16579e999f4495
call fcn.004294d3
pop ecx
pop ecx
jmp 0x405556
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405501
push str.520f44d3366379098c69dc297badebc
jmp 0x405549
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x405532
push eax
push ebx
push str.b8ff762d731d46c1b4
mov byte [ebp + eax - 0x7c], bl
call fcn.004294d3
lea eax, [ebp - 0x7c]
push eax
push str.1873cb9b8b19db1b738
call fcn.004294d3
add esp, 0x14
jmp 0x40554f
cmp eax, ebx
jne 0x405544
push ebx
push str.50155605100b374f16e1f7
call fcn.004294d3
pop ecx
jmp 0x40554e
push str.225ba75568ad58b9fdb
call fcn.004294d3
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428d2e
add ebp, 0x370
leave
ret
Function at 0x405780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431920
add esp, 0xc
xor esi, esi
call fcn.004295cd
push 0x21
cdq
pop ecx
idiv ecx
add dl, 0x72
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x4057b4
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405839
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x405839
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428d2e
leave
ret

Function at 0x4059ba
Capabilities:
Parse url

Disassembly:
push 0x3c
mov eax, 0x43e22f
call fcn.0042babd
mov esi, ecx
xor ebx, ebx
push 0x3c
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00431920
mov eax, 0x2800
add esp, 0xc
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], 0x3c
jae 0x405a03
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x48]
push ecx
push ebx
push dword [ebp + 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x405a34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
mov eax, 0x80004005
call fcn.0042bb95
ret 0x1c
cmp dword [ebp - 0x34], ebx
je 0x405a1c
cmp dword [ebp - 0x40], ebx
je 0x405a1c
mov dx, word [ebp - 0x30]
cmp dx, bx
je 0x405a1c
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x405a1c
mov ecx, eax
dec ecx
je 0x405a7a
dec ecx
dec ecx
je 0x405a6e
dec ecx
je 0x405a6e
mov esi, 0x80004005
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
mov eax, esi
jmp 0x405a2c
mov dword [esi + 0x94], 3
jmp 0x405a84
mov dword [esi + 0x94], 1
push dword [ebp - 0x40]
mov ecx, esi
push dword [ebp - 0x44]
mov word [esi + 0x3c], dx
mov dword [esi + 0x1c], eax
call fcn.004037f1
push dword [ebp - 0x34]
lea ecx, [esi + 0x20]
push dword [ebp - 0x38]
call fcn.004037f1
push dword [ebp - 0x28]
lea ecx, [esi + 0x40]
push dword [ebp - 0x2c]
call fcn.004037f1
push dword [ebp - 0x20]
lea ecx, [esi + 0x5c]
push dword [ebp - 0x24]
call fcn.004037f1
push dword [ebp - 0x18]
lea ecx, [esi + 0x78]
push dword [ebp - 0x1c]
call fcn.004037f1
xor esi, esi
jmp 0x405a5f
Function at 0x40644e
Capabilities:
Set uefi variable

Disassembly:
push 0xc
mov eax, 0x440a3b
call fcn.0042babd
mov ebx, ecx
mov dword [ebp - 4], 1
call fcn.00407059
xor edi, edi
push edi
sub esp, 0x1c
lea eax, [ebp + 0x24]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.004031b5
sub esp, 0x1c
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004031b5
push ebx
mov byte [ebp - 4], 1
call fcn.0040635d
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x4064b1
dec eax
dec eax
je 0x4064b1
sub eax, 4
jne 0x4064c0
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00404781
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x10], 1
jne 0x406534
push edi
sub esp, 0x1c
lea eax, [ebp + 0x24]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.004031b5
sub esp, 0x1c
lea eax, [ebx + 0x38]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 3
call fcn.004031b5
push ebx
mov byte [ebp - 4], 1
call fcn.0040635d
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x406520
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov dword [ebp - 4], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jl 0x4064c3
xor esi, esi
jmp 0x40653e
cmp dword [ebp - 0x10], edi
jge 0x40655e
mov esi, 0x80004005
push edi
push 1
lea ecx, [ebp + 8]
call fcn.004035bd
push edi
push 1
lea ecx, [ebp + 0x24]
call fcn.004035bd
mov eax, esi
call fcn.0042bb95
ret 0x38
mov esi, ebx
call fcn.00406757
mov dword [ebp - 0x10], eax
call fcn.0040965a
test eax, eax
je 0x406576
call fcn.00404879
call fcn.004065a8
call fcn.004295cd
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.004295cd
cdq
idiv esi
cmp edx, esi
jg 0x40659e
mov eax, esi
cdq
idiv esi
cmp edx, edi
je 0x4065a3
call fcn.00404919
mov esi, dword [ebp - 0x10]
jmp 0x40653e