joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d6df
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
sete al
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43d7b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x43d725
cmp eax, 0x50
je 0x43d71d
cmp eax, 0xb7
jne 0x43d725
xor esi, esi
inc esi
jmp 0x43d7b6
cmp eax, 3
jne 0x43d7a8
movzx eax, word [ebx]
mov edi, esi
mov ecx, ebx
test ax, ax
je 0x43d7a1
push 0x5c
pop edx
cmp ax, dx
cmove edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x43d739
test edi, edi
je 0x43d7a1
push esi
xor eax, eax
push ebx
mov word [edi], ax
call fcn.0043ea78
mov esi, eax
push 0x5c
pop eax
mov word [edi], ax
test esi, esi
js 0x43d7b6
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x43d7b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43d7b6
push esi
push 0x457
push str.fileutil.cpp
call fcn.00436473
jmp 0x43d7b6
mov esi, 0x80070003
jmp 0x43d7b6
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x43d810
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
xor esi, esi
call fcn.0043daf5
test eax, eax
je 0x43d897
test byte [ebp - 4], 7
push ebx
mov ebx, 0x80070000
je 0x43d865
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x43d865
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43d865
push esi
push 0x5c7
jmp 0x43d88c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43d896
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43d896
push esi
push 0x5cd
push str.fileutil.cpp
call fcn.00436473
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43d8a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
xor eax, eax
mov ebx, esi
inc eax
cmp dword [ebp + 0x10], ebx
cmovne ebx, eax
cmp dword [ebp + 0x14], esi
je 0x43d8ba
or ebx, 2
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x43d9a9
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [ebp + 0x10], esi
jne 0x43d8f2
cmp edi, 0x50
je 0x43d8ea
cmp edi, 0xb7
jne 0x43d8f2
xor esi, esi
inc esi
jmp 0x43d9a8
cmp edi, 2
jne 0x43d90b
push esi
push dword [ebp + 8]
call fcn.0043daf5
test eax, eax
je 0x43d99a
push 3
pop edi
cmp edi, 3
jne 0x43d99a
mov eax, dword [ebp + 0xc]
mov edi, esi
mov edx, eax
movzx ecx, word [eax]
test cx, cx
je 0x43d993
mov dword [ebp + 0x10], 0x5c
cmp cx, word [ebp + 0x10]
cmove edi, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x43d92a
test edi, edi
je 0x43d993
push esi
xor ecx, ecx
push eax
mov word [edi], cx
call fcn.0043ea78
mov esi, eax
mov eax, dword [ebp + 0x10]
mov word [edi], ax
test esi, esi
js 0x43d9a8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x43d9a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43d9a8
push esi
push 0x4d7
push str.fileutil.cpp
call fcn.00436473
jmp 0x43d9a8
mov esi, 0x80070003
jmp 0x43d9a8
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x43e112
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x43e167
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43e167
push esi
push 0x120
push str.fileutil.cpp
call fcn.00436473
jmp 0x43e20e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x43e182
mov esi, 0x8007000e
push esi
push 0x124
jmp 0x43e158
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x43e1b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43e1b3
push esi
push 0x128
jmp 0x43e1e8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x45e388
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x43e1f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43e1f4
push esi
push 0x12d
push str.fileutil.cpp
call fcn.00436473
jmp 0x43e207
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
mov dword [ecx], edx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43e4d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43e516
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x43e520
add edi, dword [ebp - 4]
cmp edi, dword [ebp + 0x10]
jb 0x43e4e1
jmp 0x43e530
push esi
push 0x3f2
push str.fileutil.cpp
call fcn.00436473
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43ea78
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43eb3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43eab1
cmp eax, 3
je 0x43eab8
push esi
push edi
call fcn.0043eb46
test eax, eax
je 0x43eab8
xor esi, esi
jmp 0x43eb3e
movzx eax, word [edi]
mov ecx, edi
push ebx
xor ebx, ebx
test ax, ax
je 0x43eb2b
push 0x5c
pop edx
cmp ax, dx
cmove ebx, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x43eac8
test ebx, ebx
je 0x43eb2b
push dword [ebp + 0xc]
xor eax, eax
push edi
mov word [ebx], ax
call fcn.0043ea78
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x43eb3d
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43eb27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43eb17
xor esi, esi
inc esi
jmp 0x43eb3d
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x43eb3d
xor esi, esi
jmp 0x43eb3d
mov esi, 0x80070003
push esi
push 0x7d
push str.dirutil.cpp
call fcn.00436473
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x43eb46
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43eb6a
test al, 0x10
je 0x43eb6a
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43eb67
mov dword [ecx], eax
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x43fa21
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push str._ls.R
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
call fcn.0043a845
mov esi, eax
add esp, 0xc
test esi, esi
js 0x43fb2d
push 0
push 0x80
push 4
push 0
push 4
push 0xc0000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43faab
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0xcc
push str.dlutil.cpp
call fcn.00436473
jmp 0x43fb2d
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43faf3
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
je 0x43fadd
cmp ecx, 8
jb 0x43faae
cmp ecx, 8
je 0x43fae9
and dword [ebx], 0
and dword [ebx + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
or edi, 0xffffffff
jmp 0x43fb21
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0xd3
push str.dlutil.cpp
call fcn.00436473
cmp edi, 0xffffffff
je 0x43fb2d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43ffa3
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0
push dword [edi + 4]
push dword [edi]
push dword [ebp + 0xc]
call fcn.0043dfb3
mov esi, eax
test esi, esi
js 0x4400f9
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4400ca
cmp dword [ebp - 4], 0
je 0x4400f8
xor ebx, ebx
and dword [ebp + 0x10], ebx
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
sub eax, ebx
push eax
mov eax, dword [ebp + 0x20]
add eax, ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4400a4
add ebx, dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
je 0x440028
cmp ebx, dword [ebp - 4]
jb 0x43fff7
add dword [edi], ebx
push 0
pop eax
adc dword [edi + 4], eax
cmp dword [ebp + 0x14], 0xffffffff
je 0x440072
push eax
push eax
push eax
push eax
push dword [ebp + 0x14]
mov ebx, eax
mov dword [ebp - 8], eax
call fcn.0043dfb3
test eax, eax
js 0x440072
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx*8]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, dword [ebp - 8]
cmp dword [ebp - 8], 0
je 0x440072
cmp ebx, 8
jb 0x44004b
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x440098
cmp dword [eax], 0
je 0x440098
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.0043f905
mov esi, eax
test esi, esi
js 0x4400f8
cmp dword [ebp - 4], 0
jne 0x43ffcd
jmp 0x4400f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1b1
jmp 0x4400ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1a5
push str.dlutil.cpp
call fcn.00436473
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x24
Function at 0x440103
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.0043aa95
mov esi, eax
test esi, esi
js 0x44026c
xor eax, eax
push eax
push eax
push eax
push eax
push 0x45ecdc
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x440193
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x8f
push str.dlutil.cpp
call fcn.00436473
jmp 0x44026c
lea eax, [ebp - 4]
push eax
push 0x78
push str.DownloadTimeout
push 0x44f888
call fcn.0043f49d
mov eax, dword [ebp - 4]
test eax, eax
je 0x4401df
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.0043f978
mov esi, eax
test esi, esi
js 0x44026c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call fcn.0043fa21
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.0043f67b
mov esi, eax
test esi, esi
js 0x44025d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44025d
xor ecx, ecx
cmp word [eax], cx
je 0x44025d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x44026c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x440279
push eax
call fcn.0043af5b
test edi, edi
je 0x440284
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x440292
push dword [ebp - 8]
call fcn.0043af5b
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44265a
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], 4
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x20000005
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x4426ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x4426ab
push esi
push 0x23
push str.inetutil.cpp
call fcn.00436473
jmp 0x4426b7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
and dword [edx + 4], 0
mov dword [edx], ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4427f1
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x246c
call fcn.004323d0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2430], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x242c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x241c], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2428], eax
xor esi, esi
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x2424], eax
mov eax, dword [ebp + 0x1c]
push 0x3c
mov dword [ebp - 0x2420], eax
lea eax, [ebp - 0x246c]
push esi
push eax
call fcn.004292a0
add esp, 0xc
mov dword [ebp - 0x246c], 0x3c
cmp dword [ebp - 0x241c], esi
je 0x442883
lea eax, [ebp - 0x410]
mov dword [ebp - 0x2458], 0x101
mov dword [ebp - 0x245c], eax
mov ecx, 0x81
cmp dword [ebp - 0x2424], esi
je 0x4428a2
lea eax, [ebp - 0x108]
mov dword [ebp - 0x244c], ecx
mov dword [ebp - 0x2450], eax
cmp dword [ebp - 0x2420], esi
je 0x4428bc
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2444], ecx
mov dword [ebp - 0x2448], eax
mov ecx, 0x801
test ebx, ebx
je 0x4428d7
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x243c], ecx
mov dword [ebp - 0x2440], eax
test edi, edi
je 0x4428ed
lea eax, [ebp - 0x2418]
mov dword [ebp - 0x2434], ecx
mov dword [ebp - 0x2438], eax
lea eax, [ebp - 0x246c]
push eax
push 0x90000000
push esi
push dword [ebp - 0x2430]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x44293a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x61
push str.uriutil.cpp
call fcn.00436473
jmp 0x4429fe
mov ecx, dword [ebp - 0x242c]
test ecx, ecx
je 0x44294c
mov eax, dword [ebp - 0x2460]
mov dword [ecx], eax
mov eax, dword [ebp - 0x241c]
test eax, eax
je 0x442972
push dword [ebp - 0x2458]
push dword [ebp - 0x245c]
push eax
call fcn.0043aa95
mov esi, eax
test esi, esi
js 0x4429fe
mov eax, dword [ebp - 0x2428]
test eax, eax
je 0x442986
mov cx, word [ebp - 0x2454]
mov word [eax], cx
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x4429a8
push dword [ebp - 0x244c]
push dword [ebp - 0x2450]
push eax
call fcn.0043aa95
mov esi, eax
test esi, esi
js 0x4429fe
mov eax, dword [ebp - 0x2420]
test eax, eax
je 0x4429ca
push dword [ebp - 0x2444]
push dword [ebp - 0x2448]
push eax
call fcn.0043aa95
mov esi, eax
test esi, esi
js 0x4429fe
test ebx, ebx
je 0x4429e6
push dword [ebp - 0x243c]
push dword [ebp - 0x2440]
push ebx
call fcn.0043aa95
mov esi, eax
test esi, esi
js 0x4429fe
test edi, edi
je 0x4429fe
push dword [ebp - 0x2434]
push dword [ebp - 0x2438]
push edi
call fcn.0043aa95
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042928d
mov esp, ebp
pop ebp
ret 0x20
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6a3551d0
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x20100584
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403753
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
xor eax, eax
pop ecx
lea edi, [ebp - 0x7a3]
mov byte [ebp - 0x7a4], bl
mov byte [ebp - 0x54], bl
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x53]
push 0x100
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x1a]
push eax
lea eax, [ebp - 0x7a4]
push eax
call fcn.0040d880
lea eax, [ebp + 0x11a]
push 6
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0040d880
add esp, 0x2c
mov eax, dword [0x4269c0]
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x7a4]
push edx
lea edx, [ebp - 0xec0]
push edx
lea edx, [ebp - 0x10c8]
push edx
push eax
call dword [ecx + 0x28]
test al, al
je 0x403914
lea eax, [ebp - 0xec0]
mov byte [ebp - 0x43], 0x6f
push eax
mov byte [ebp - 0x2f], 0x2d
mov byte [ebp - 0x44], 0x63
mov byte [ebp - 0x36], 0x3d
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x26], 0x39
mov byte [ebp - 0x40], 0x33
mov byte [ebp - 0x2b], 0x33
mov byte [ebp - 0x41], 0x31
mov byte [ebp - 0x2e], 0x26
mov byte [ebp - 0x3f], 0x5b
mov byte [ebp - 0x33], 0x6e
mov byte [ebp - 0x35], 0x3c
mov byte [ebp - 0x3e], 0x4e
mov byte [ebp - 0x3d], 0x29
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x3b], 0x2b
mov byte [ebp - 0x3c], 0x2a
mov byte [ebp - 0x3a], 0x33
mov byte [ebp - 0x39], 0x4b
mov byte [ebp - 0x27], 0x3c
mov byte [ebp - 0x37], 0x40
mov byte [ebp - 0x38], 0x2c
mov byte [ebp - 0x34], 0x4d
mov byte [ebp - 0x32], 0x59
mov byte [ebp - 0x30], 0x58
mov byte [ebp - 0x2d], 0x5a
pop edx
Function at 0x405540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ecx + 4], 0
push esi
jne 0x405568
push 0x421a64
lea ecx, [ebp - 0xc]
call fcn.0040e64c
lea eax, [ebp - 0xc]
push 0x41fbd0
push eax
call fcn.0040e6f6
xor esi, esi
cmp dword [ecx + 0x3cc], esi
jle 0x405589
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dl, byte [edi]
xor byte [eax], dl
inc edi
inc eax
inc esi
cmp esi, dword [ecx + 0x3cc]
jl 0x405579
pop edi
pop esi
leave
ret 8

Function at 0x4056f2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp word [eax], 0x5a4d
jne 0x405807
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x405807
mov edi, 0x2000
mov ebx, dword [0x4180b4]
push 4
push edi
push dword [esi + 0x50]
push dword [esi + 0x34]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jne 0x40574a
push 4
push edi
push dword [esi + 0x50]
push eax
call ebx
test eax, eax
mov dword [ebp - 4], eax
je 0x405807
push 0x14
push 0
call dword [0x4180b0]
push eax
call dword [0x4180ac]
mov edi, eax
mov eax, dword [ebp - 4]
xor ecx, ecx
push 4
push 0x1000
mov dword [edi + 4], eax
mov dword [edi + 0xc], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x10], ecx
push dword [esi + 0x50]
push eax
call ebx
push 4
push 0x1000
push dword [esi + 0x54]
push dword [ebp - 4]
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebx + 0x3c]
add ecx, dword [esi + 0x54]
push ecx
push ebx
push eax
call fcn.0040d880
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, dword [ebp - 4]
push edi
push esi
mov dword [edi], eax
push ebx
mov dword [eax + 0x34], ecx
call fcn.00405815
mov ebx, dword [ebp - 4]
add esp, 0x18
mov eax, ebx
sub eax, dword [esi + 0x34]
je 0x4057cc
push eax
push edi
call fcn.0040597f
pop ecx
pop ecx
push edi
call fcn.004059f9
test eax, eax
pop ecx
je 0x405800
push edi
call fcn.004058c2
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x40580e
add eax, ebx
test eax, eax
je 0x405800
cmp byte [ebp + 0xc], 0
push 1
pop esi
je 0x40580b
push 0
push esi
push ebx
call eax
test eax, eax
jne 0x40580b
push edi
call fcn.00405b7f
pop ecx
xor eax, eax
jmp 0x405810
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret