joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c8c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory
Read .ini file

Disassembly:
sub esp, 0x8a8
push ebx
push edi
push 0x2a
mov edi, edx
lea edx, [esp + 0x74]
pop ecx
call fcn.004255fb
lea eax, [esp + 0x90]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x412e31
lea eax, [esp + 0x70]
lea edx, [esp + 0x90]
push eax
mov ecx, edx
call fcn.0041e80a
test al, al
je 0x412e31
push 0x2c
lea edx, [esp + 0x58]
pop ecx
call fcn.004255fb
lea eax, [esp + 0x54]
push eax
lea edx, [esp + 0x94]
lea ecx, [esp + 0x4a4]
call fcn.0041e80a
test al, al
je 0x412e31
lea eax, [esp + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x412e31
push ebp
push 0x2d
lea edx, [esp + 0x30]
pop ecx
call fcn.004255fb
push 0x2e
lea edx, [esp + 0x44]
pop ecx
call fcn.004255fb
push 0x2f
pop ebp
lea edx, [esp + 0xc]
mov ecx, ebp
call fcn.004255fb
push esi
movzx eax, bl
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x24]
push 0xa
push eax
call fcn.004194ac
add esp, 0x10
cmp eax, 1
jl 0x412e2f
lea eax, [esp + 0x4a8]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, 0xffffffff
je 0x412e2f
lea eax, [esp + 0x4a8]
push eax
push 0x104
lea eax, [esp + 0x2a8]
push eax
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x412e24
mov ax, word [esp + 0x2a0]
lea ecx, [esp + 0x2a0]
test ax, ax
je 0x412de5
movzx edx, ax
cmp dx, bp
jne 0x412dd8
push 0x5c
pop eax
mov word [ecx], ax
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x412dcd
cmp esi, 1
jne 0x412e12
lea eax, [esp + 0x2a0]
push eax
lea edx, [esp + 0x9c]
lea ecx, [esp + 0x6b4]
call fcn.0041e80a
test al, al
je 0x412e24
lea ecx, [esp + 0x6b0]
jmp 0x412e19
lea ecx, [esp + 0x2a0]
mov edx, edi
call fcn.00412e3a
test al, al
je 0x412e2f
inc bl
cmp bl, 0xfa
jb 0x412d45
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x8a8
ret
Function at 0x412e3a
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x364
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push esi
push 0x404630
push ebx
push 0x11d
push 0x404648
push 0x40468c
mov ebp, edx
call fcn.0041a5ac
add esp, 0x18
lea edx, [esp + 0x10]
push 0x2b
pop ecx
call fcn.004255fb
lea eax, [esp + 0x10]
mov edx, esi
push eax
lea ecx, [esp + 0x16c]
call fcn.0041e80a
test al, al
je 0x412f29
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea eax, [esp + 0x180]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x412f29
push edi
push 0x30
lea edx, [esp + 0x28]
pop ecx
call fcn.004255ad
push ebx
lea eax, [esp + 0x14]
mov edi, 0x146
push eax
push edi
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412f0a
cmp dword [esp + 0x10], edi
jne 0x412f0a
test ebp, ebp
je 0x412f08
mov ecx, ebp
call fcn.004192d2
push ebx
mov edi, eax
lea eax, [esp + 0x14]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412f0a
cmp dword [esp + 0x10], edi
jne 0x412f0a
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test bl, bl
jne 0x412f29
lea ecx, [esp + 0x168]
call fcn.0041e322
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x364
ret
Function at 0x414aea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x480
push ebx
push edi
push 1
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor ebx, ebx
lea edx, [esp + 0x88]
push ebx
mov ecx, 0x2937498d
call fcn.00420763
lea edx, [esp + 0x88]
call fcn.00426504
test al, al
jne 0x414b52
push 0x4056a8
push 2
push 0x191
push 0x405608
push 0x405704
call fcn.0041a5ac
add esp, 0x14
xor al, al
jmp 0x414cf7
mov dl, 1
lea ecx, [esp + 0xf0]
call fcn.00414566
test al, al
jne 0x414b87
push 0x405660
push 2
push 0x199
push 0x405608
push 0x405704
call fcn.0041a5ac
add esp, 0x14
jmp 0x414ce7
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
setne byte [esp + 0xf]
test eax, eax
jne 0x414c64
lea edx, [esp + 0x10]
mov ecx, 0xa8
call fcn.004255fb
lea eax, [esp + 0x280]
push eax
push ebx
push ebx
push 0x25
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x414c64
lea eax, [esp + 0x10]
lea edx, [esp + 0x280]
push eax
mov ecx, edx
call fcn.0041e80a
test al, al
je 0x414c64
push 0x44
pop edx
push edx
push ebx
lea eax, [esp + 0x48]
push eax
call fcn.0041869b
lea eax, [esp + 0x88]
mov dword [esp + 0x40], edx
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x280]
lea eax, [esp + 0x30]
xor edx, edx
push eax
lea eax, [esp + 0x44]
push eax
push ebx
call fcn.0041a152
test eax, eax
je 0x414c64
push dword [esp + 0x38]
push 0x405718
push ebx
push 0x1b0
push 0x405608
push 0x405704
call fcn.0041a5ac
add esp, 0x18
push 0x1388
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0xf], 1
push ebx
push ebx
push ebx
push 0x1003
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov bl, byte [esp + 0xf]
cmp bl, 1
jne 0x414ce7
push 0x12c
push dword [esp + 0x254]
lea eax, [esp + 0xf8]
mov dword [esp + 0x1c], 0x414a4b
push 0x128
push dword [esp + 0xfc]
mov dword [esp + 0x20], eax
mov edx, 0x1b7740
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0x414a4e
push eax
mov ecx, edi
mov dword [esp + 0x30], 0x414a51
mov dword [esp + 0x34], 0x414a75
mov dword [esp + 0x38], 0x414ab2
mov dword [esp + 0x3c], 0x414ae5
mov dword [esp + 0x40], 0x414a4b
call fcn.00422ca1
mov dl, 1
lea ecx, [esp + 0xf0]
call fcn.004147ce
mov al, bl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41538a
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push edi
xor edi, edi
mov al, 1
mov byte [esp + 7], al
cmp dword [esp + 0x14], edi
jbe 0x41543d
push ebx
push ebp
push esi
lea ebx, [edx + 0xc]
mov esi, dword [ebx - 4]
test esi, esi
je 0x415428
movzx eax, byte [ebx]
mov ebp, dword [ebx - 0xc]
mov edx, ebp
mov dword [esp + 0x18], eax
call fcn.0041d58d
cmp eax, 0x1e
jb 0x415407
lea eax, [esp + 0x14]
push eax
push 0x40
push 0x1e
push ebp
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x415407
mov eax, dword [esp + 0x18]
push 0
add eax, 0xfffffffb
push eax
push esi
push ebp
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 0x1e
push ebp
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test esi, esi
jne 0x415428
push edi
push 0x405788
push 2
push 0x4e
push 0x4057d0
push 0x405818
mov byte [esp + 0x2b], 0
call fcn.0041a5ac
add esp, 0x18
inc edi
add ebx, 0x10
cmp edi, dword [esp + 0x20]
jb 0x4153a6
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0xc
ret 4

Function at 0x4154af
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, edx
mov dword [esp + 8], edi
cmp esi, dword [esp + 0x14]
je 0x4154e9
push dword [esp + 0x14]
push esi
push 0x405824
push 2
push 0x71
push 0x4057d0
push 0x405860
call fcn.0041a5ac
add esp, 0x1c
xor al, al
jmp 0x4155a2
push ebx
xor ebx, ebx
mov ecx, ebx
test esi, esi
je 0x415507
lea eax, [edi + 0xc]
cmp dword [eax - 0xc], ebx
je 0x41554b
mov dword [eax - 4], ebx
inc ecx
mov byte [eax], bl
add eax, 0x10
cmp ecx, esi
jb 0x4154f5
push ebp
push 0x40
imul eax, esi, 0x23
push 0x3000
push eax
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebp, eax
test ebp, ebp
je 0x41559e
test esi, esi
je 0x41558e
add edi, 8
mov edx, dword [edi - 8]
push ecx
push ebp
push dword [edi - 4]
call fcn.0041d5d1
test eax, eax
je 0x41556b
mov dword [edi], ebp
add ebp, eax
mov byte [edi + 4], al
inc ebx
add edi, 0x10
cmp ebx, esi
jb 0x415529
jmp 0x41558a
push ecx
push 0x405870
push 2
push 0x7c
push 0x4057d0
push 0x405860
call fcn.0041a5ac
add esp, 0x18
xor al, al
jmp 0x4155a1
push ebx
push 0x4058b0
push 2
push 0x8f
push 0x4057d0
push 0x405860
call fcn.0041a5ac
add esp, 0x18
mov edi, dword [esp + 0x10]
cmp ebx, esi
jne 0x415596
mov al, 1
jmp 0x4155a0
push esi
mov edx, edi
call fcn.0041538a
xor al, al
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 8
Function at 0x415a13
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebp
mov dword [esp + 8], edx
push esi
mov esi, ecx
push edi
sub eax, 0xa1
je 0x415a6e
push 3
pop ecx
sub eax, ecx
je 0x415a67
sub eax, ecx
je 0x415a60
sub eax, 0x15a
je 0x415a59
sub eax, ecx
je 0x415a52
sub eax, ecx
jne 0x415ae5
mov edi, 0x209
xor bl, bl
jmp 0x415a75
mov edi, 0x206
jmp 0x415a4e
mov edi, 0x203
jmp 0x415a4e
mov edi, 0xa9
jmp 0x415a73
mov edi, 0xa6
jmp 0x415a73
mov edi, 0xa3
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov dword [esp + 0x18], edx
cmp dword [esi + 0x16c], ecx
jne 0x415ad3
cmp dword [esi + 0x168], ebp
jne 0x415ad3
sub eax, dword [esi + 0x164]
cmp eax, 0x3e8
ja 0x415ad3
test bl, bl
jne 0x415ab3
push 0xffffffffffffffe6
push ecx
call dword [sym.imp.USER32.dll_GetClassLongW]
test al, 8
je 0x415acb
xor eax, eax
mov dword [esi + 0x168], eax
mov dword [esi + 0x164], eax
mov dword [esi + 0x16c], eax
mov eax, edi
jmp 0x415ae7
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esi + 0x168], ebp
mov dword [esi + 0x164], edx
mov dword [esi + 0x16c], ecx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4184bf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, edx
mov dword [ebp - 0x10], ecx
push esi
xor esi, esi
push edi
test byte [eax], 2
mov dword [ebp - 8], esi
je 0x4184e7
mov edx, dword [ecx + 8]
push dword [eax + 4]
mov ecx, dword [eax + 8]
call fcn.00416bef
jmp 0x4184f2
mov edx, dword [eax + 8]
mov ecx, dword [ecx + 8]
call fcn.0041e061
push eax
push 0x4062f0
push esi
push 0x497
mov edi, 0x405d68
mov dword [ebp - 0xc], eax
push edi
mov ebx, 0x406324
push ebx
call fcn.0041a5ac
add esp, 0x18
cmp dword [ebp - 0xc], esi
je 0x41857e
call fcn.004206cf
push 0x406348
push esi
push 0x4a0
push edi
push ebx
call fcn.0041a5ac
add esp, 0x14
lea eax, [ebp - 0x10]
push esi
push esi
push eax
push 0x41829a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
je 0x418561
push ecx
push ecx
lea edx, [ebp - 4]
call fcn.0041c4bd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40637c
push esi
push 0x4ab
push edi
push ebx
call fcn.0041a5ac
mov ecx, dword [ebp - 0xc]
add esp, 0x14
call fcn.00418601
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4199c8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
push edi
push 4
pop edi
xor edx, edx
mov dword [0x42a080], ecx
inc edx
push 8
mov ebx, edx
pop esi
mov eax, dword [edi + 0x42a07c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
lea edx, [ebx + 1]
mov dword [edi + 0x42a080], eax
mov ebx, edx
mov edi, esi
add esi, 4
cmp edx, 0x270
jl 0x4199dc
pop edi
pop esi
pop ebx
mov dword [0x42b078], edx
ret

Function at 0x419b0c
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
xor eax, eax
inc eax
push ebx
push esi
push edi
push 0xf0000040
push eax
push 0
push 0
lea eax, [esp + 0x24]
mov esi, edx
push eax
mov edi, ecx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x419ba9
push ebp
lea eax, [esp + 0x10]
xor ebp, ebp
push eax
push ebp
push ebp
push 0x8003
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, 1
jne 0x419b9d
push ebp
push dword [esp + 0x24]
mov dword [esp + 0x1c], 0x10
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
xor esi, esi
inc esi
cmp eax, esi
jne 0x419b93
push ebp
lea eax, [esp + 0x18]
push eax
push edi
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, esi
jne 0x419b93
cmp dword [esp + 0x14], 0x10
movzx ebx, bl
cmove ebx, esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebp
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0xc
ret 4
Function at 0x419bb4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0x42b078]
cmp esi, 0x270
jl 0x419ad6
push ebp
xor esi, esi
mov ebp, accept
push edi
mov edx, esi
mov edi, 0x42a6b4
mov eax, dword [edx*4 + 0x42a080]
mov ecx, dword [edi + edx*4 - 0x630]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x407134]
xor ecx, dword [edi + edx*4]
mov dword [edx*4 + 0x42a080], ecx
inc edx
cmp edx, 0xe3
jl 0x419a36
lea edi, [edx*4 + 0x42a080]
push ebx
mov ebx, dword [edi]
mov eax, ebx
mov ebx, dword [edi + 4]
mov ecx, eax
xor ecx, ebx
and ecx, ebp
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x407134]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0x42aa3c
jl 0x419a75
mov eax, dword [0x42aa3c]
mov ecx, dword [0x42a080]
and eax, 0x80000000
and ecx, ebp
or ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
pop ebx
pop edi
pop ebp
xor ecx, dword [eax*4 + 0x407134]
xor ecx, dword [0x42a6b0]
mov dword [0x42aa3c], ecx
mov ecx, dword [esi*4 + 0x42a080]
mov eax, ecx
shr eax, 0xb
inc esi
xor ecx, eax
mov dword [0x42b078], esi
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x42b060]
je 0x419bce
mov ecx, eax
mov dword [0x42b060], eax
call fcn.004199c8
jmp 0x419a13

Function at 0x419bf3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
push ebx
push edi
mov eax, ecx
xor edi, edi
cmp byte [0x4299fc], 0
mov ebx, edx
mov dword [esp + 8], eax
jne 0x419c47
push ebp
push esi
mov esi, edi
push 8
mov edx, esi
pop ebp
mov ecx, edx
mov eax, edx
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
sub ebp, 1
jne 0x419c12
mov dword [esi*4 + 0x42ac60], edx
inc esi
cmp esi, 0x100
jb 0x419c0d
mov eax, dword [esp + 0x10]
pop esi
pop ebp
mov byte [0x4299fc], 1
or ecx, 0xffffffff
test ebx, ebx
je 0x419c6a
movzx eax, byte [edi + eax]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x42ac60]
inc edi
mov eax, dword [esp + 8]
cmp edi, ebx
jb 0x419c4e
not ecx
pop edi
mov eax, ecx
pop ebx
pop ecx
ret

Function at 0x419cee
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov eax, edx
xor ebp, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov bl, byte [edi + 0x100]
mov bh, byte [edi + 0x101]
test eax, eax
je 0x419d48
push esi
inc bl
movzx esi, bl
mov dl, byte [esi + edi]
add bh, dl
movzx ecx, bh
mov al, byte [ecx + edi]
mov byte [esi + edi], al
mov byte [ecx + edi], dl
movzx ecx, byte [esi + edi]
movzx eax, dl
add ecx, eax
movzx eax, cl
mov ecx, dword [esp + 0x10]
mov al, byte [eax + edi]
xor byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x14]
jb 0x419d14
pop esi
mov byte [edi + 0x100], bl
mov byte [edi + 0x101], bh
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x419ef4
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x419f45
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x419f38
cmp dword [ebp - 0x10], ebx
jne 0x419f2d
inc esi
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x419f27
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41a0c9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
xor ebx, ebx
mov word [ebp - 4], ax
test esi, esi
jne 0x41a0f3
push 0x44
push ebx
lea eax, [ebp - 0x58]
push eax
call fcn.0041869b
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x14]
test esi, esi
push eax
lea eax, [ebp - 0x58]
cmovne eax, esi
test edx, edx
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push ebx
push 0x4000000
push ebx
push ebx
push ebx
cmovne eax, edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41a14a
cmp dword [ebp + 0x10], ebx
je 0x41a135
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
call fcn.0041863c
jmp 0x41a145
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 0xc]
jmp 0x41a14c
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x41a1a7
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push ebx
push edi
push 0x4063e4
mov dword [esp + 0xc], ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41a2a1
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4063f0
push edi
call esi
push 0x406408
push edi
mov dword [esp + 0x1c], eax
call esi
mov ebp, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41a298
test ebp, ebp
je 0x41a298
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ebx
push esi
push ecx
mov dword [esp + 0x20], ebx
call eax
test eax, eax
jne 0x41a212
mov dword [esp + 0x14], ebx
push 0x44
pop edx
xor eax, eax
push edx
mov word [esp + 0x14], ax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.0041869b
lea eax, [esp + 0x18]
mov dword [esp + 0x28], edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], ebx
push eax
mov eax, dword [esp + 0x1c]
push ebx
push eax
neg eax
sbb eax, eax
and eax, 0x400
or eax, 0x4000000
cmp dword [esp + 0x84], ebx
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
cmovne eax, dword [esp + 0x94]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x41a28b
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x18]
call esi
cmp dword [esp + 0x20], ebx
setne bl
cmp dword [esp + 0x14], 0
je 0x41a298
push dword [esp + 0x14]
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebp
pop edi
movzx eax, bl
pop ebx
add esp, 0x5c
ret 0x14

Function at 0x41a2d7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push edx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41a2fe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x41a300
xor eax, eax
leave
ret 4
Function at 0x41a357
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
lea eax, [ebp - 0x250]
mov edx, 0x406444
push esi
push eax
mov esi, ecx
call fcn.0041e33f
test al, al
je 0x41a463
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_CharToOemW]
lea eax, [ebp - 0x354]
push eax
push esi
lea eax, [ebp - 4]
push 0x40644c
push eax
call fcn.004195b4
add esp, 0x10
cmp eax, 0xffffffff
je 0x41a458
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x250]
push ebx
push eax
call fcn.0041e184
mov ecx, dword [ebp - 4]
mov bl, al
call fcn.00418601
test bl, bl
pop ebx
je 0x41a458
lea eax, [ebp - 0x250]
push eax
push 0x40646c
lea eax, [ebp - 0x46c]
push 0x10e
push eax
call fcn.004194ac
add esp, 0x10
cmp eax, 0xffffffff
jle 0x41a458
mov esi, 0x104
lea eax, [ebp - 0x250]
push esi
push eax
push 0x40647c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x41a458
cmp eax, esi
jae 0x41a458
push 0x44
pop edx
push edx
xor esi, esi
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.0041869b
xor eax, eax
mov dword [ebp - 0x48], edx
mov word [ebp - 0x18], ax
lea edx, [ebp - 0x46c]
push esi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x1c], 1
push eax
push esi
lea ecx, [ebp - 0x250]
call fcn.0041a152
test eax, eax
setne al
jmp 0x41a465
lea ecx, [ebp - 0x250]
call fcn.0041e322
xor al, al
pop esi
leave
ret

Function at 0x41a468
Capabilities:
Get common file path
Get file size
Write file on windows

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
xor ebx, ebx
mov esi, 0x42aa48
push ebx
mov ecx, esi
call fcn.0041c3ac
push ebx
mov ebp, 0x80
push ebp
push 4
push ebx
push 1
push 0x40040000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a4ff
mov eax, dword [0x42b064]
test eax, eax
je 0x41a4b1
cmp eax, 3
jne 0x41a537
xor eax, eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [esp + 0x18]
push 0x40648c
mov ecx, edx
call fcn.0041e80a
push ebx
lea ecx, [esp + 0x1c]
call fcn.0041c3ac
push ebx
push ebp
push 4
push ebx
push 1
push 0xc0000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41a537
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x41a537
cmp dword [esp + 0x14], ebx
jne 0x41a537
cmp dword [esp + 0x10], ebx
jne 0x41a537
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0xbfbbef
push eax
push 3
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
Function at 0x41a859
Capabilities:
Connect to http server
Create http request

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push edi
xor ebp, ebp
not eax
push ebp
push ebp
and eax, 1
mov ebx, edx
push ebp
push eax
test ecx, ecx
mov eax, 0x406724
cmovne eax, ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x41a8c7
push esi
mov esi, ebp
mov ebp, 0x429384
push 4
lea eax, [esi + ebp]
push eax
push dword [esi + 0x429380]
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionA]
add esi, 8
cmp esi, 0x18
jb 0x41a88c
pop esi
xor ebp, ebp
push ebp
push ebp
push 3
push ebp
push ebp
push dword [esp + 0x24]
push ebx
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
jne 0x41a8c9
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop edi
pop ebp
pop ebx
ret 8

Function at 0x41a970
Capabilities:
Check http status code
Send data
Send http request

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, 0x8404f700
push esi
push edi
mov edi, edx
and ebp, 2
push edi
push 0x406820
push 0
push 0x86
push 0x4067b8
mov esi, 0x8444f700
mov ebx, ecx
push 0x406838
cmove esi, eax
call fcn.0041a5ac
add esp, 0x18
mov ecx, esi
or ecx, 0x800000
mov eax, 0x4062e4
test byte [esp + 0x20], 4
push 0
cmove ecx, esi
test byte [esp + 0x24], 1
push ecx
push 0x429398
push 0
push 0x4046e8
mov ecx, 0x4062ec
push edi
cmove eax, ecx
push eax
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x41aa54
push dword [esp + 0x1c]
xor ecx, ecx
test ebp, ebp
push dword [esp + 0x1c]
push 0x13
pop eax
cmove ecx, eax
mov eax, 0x406850
push ecx
xor ecx, ecx
test ebp, ebp
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x41aa4d
and dword [esp + 0x20], 0
lea eax, [esp + 0x1c]
push 0
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 4
push eax
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x41aa4d
cmp dword [esp + 0x20], 0xc8
jne 0x41aa4d
mov eax, esi
jmp 0x41aa56
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10