joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4145a7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46fd08]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.004379c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x414600
cmp dword [ebp - 0x110], 3
jae 0x414606
cmp dword [ebp - 0x114], 5
ja 0x414606
xor eax, eax
jmp 0x414609
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00436e4b
leave
ret

Function at 0x414615
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push 0x220
mov eax, 0x4520cf
call fcn.0043ca29
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov ecx, ebx
call fcn.0041611a
mov dword [ebp - 0x228], esi
call fcn.00413cde
test al, al
je 0x41473a
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00401ac4
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x224]
call fcn.00401513
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push edi
push dword [ebp - 0x224]
mov dword [ebp - 0x21c], edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x41471a
lea ecx, [ebp - 0x220]
call fcn.0040862c
cmp eax, edi
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
jne 0x41471a
push str.ProgramFilesDir
lea eax, [ebp - 0x220]
push eax
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x21c], 0x104
call fcn.0040edf8
test eax, eax
jne 0x41471a
mov eax, edi
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401513
mov byte [ebp - 4], 4
push dword [eax]
push str._ProgramFiles_
push ebx
call fcn.00408211
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
call fcn.00410215
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.0040862c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.00410215
xor edi, edi
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x41474c
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41476e
mov esi, dword [ebp + 8]
mov eax, 0x3fff
push eax
push eax
mov ecx, ebx
call fcn.0040c4d3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004052d6
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00410215
mov eax, ebx
call fcn.0043caac
ret
Function at 0x414df4
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x450ea6
call fcn.0043c9c0
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push str.en_us
call fcn.0041648a
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
push 0x460210
push 0x17
push edi
push 0x45b9ec
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jl 0x414e5e
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push dword [ebp + 8]
mov ebx, eax
add esi, 0x34
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push ebx
call dword [esi]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x414e6e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
call fcn.0043ca98
ret

Function at 0x414ebf
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x64
mov eax, 0x453806
call fcn.0043c9c0
mov esi, ecx
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x414ee2
mov eax, 0x80070057
jmp 0x41501a
lea eax, [ebp - 0x14]
push eax
call fcn.004147df
pop ecx
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x14]
mov eax, dword [edi - 0xc]
cmp eax, ebx
mov byte [ebp - 0xd], bl
jne 0x414f22
lea edi, [ebp - 0x1c]
mov byte [ebp - 0xd], 1
call fcn.00414ce1
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.00401ac4
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.00410215
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], ebx
je 0x414fe9
movzx ecx, byte [ebp - 0xd]
mov eax, dword [esi]
push ecx
push eax
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00414d8b
mov byte [ebp - 4], 2
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], 0x44
call fcn.004379c0
add esp, 0x1c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], 3
call fcn.0041611a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
call fcn.004139f8
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040c439
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x414fb5
xor esi, esi
jmp 0x414fc0
call fcn.00403063
mov esi, eax
cmp esi, ebx
jl 0x414fd0
push dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x2c]
call edi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00410215
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00410215
jmp 0x41500c
mov esi, dword [esi]
push 3
push ebx
push ebx
push esi
push 0x45f228
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x415005
xor esi, esi
jmp 0x41500c
call fcn.00408556
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00410215
mov eax, esi
call fcn.0043ca98
ret
Function at 0x415020
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x6c
mov eax, 0x452bc0
call fcn.0043c9c0
mov edi, 0x474b80
mov edx, 0x45ced4
mov ecx, edi
mov dword [ebp - 0x14], 0x80070057
call fcn.00402945
test eax, eax
je 0x41522d
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00401513
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ebx, [ebp - 0x10]
call fcn.00414615
pop ecx
mov dword [ebp - 4], 1
push 0x5c
mov esi, ebx
call fcn.0040838a
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.00408565
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004083ab
mov byte [ebp - 4], 3
call fcn.004081cd
push 0x22
mov ecx, ebx
call fcn.00403ed0
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x4150c5
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004086b1
mov edx, str.LaunchAs
mov ecx, edi
xor esi, esi
call fcn.00402945
cmp eax, ebx
je 0x415120
push str.AsInvoker
push eax
call fcn.00437da5
test eax, eax
pop ecx
pop ecx
jne 0x415120
inc esi
call fcn.004145a7
test al, al
je 0x415120
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.00415b01
add esp, 0xc
cmp byte [ebp + 8], bl
mov dword [ebp - 0x14], eax
je 0x415117
mov ecx, dword [0x4749f8]
push ebx
call fcn.0042bf89
cmp dword [ebp - 0x14], ebx
jge 0x4151f5
push 0x40
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], 0x44
call fcn.004379c0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0041611a
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004139f8
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov edi, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0040c439
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.0040c439
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41519a
mov dword [ebp - 0x14], ebx
jmp 0x4151a2
call fcn.00403063
mov dword [ebp - 0x14], eax
cmp byte [ebp + 8], bl
je 0x4151d4
mov ecx, dword [0x4749f8]
push ebx
call fcn.0042bf89
push 0xea60
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x4151d4
push ebx
push 0x414e9e
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp dword [ebp - 0x14], ebx
jl 0x4151e9
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.00410215
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004052d6
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004052d6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.00410215
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00410215
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00410215
mov eax, dword [ebp - 0x14]
call fcn.0043ca98
ret
Function at 0x415de1
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push 0x38
mov eax, 0x451fd8
call fcn.0043c9f3
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x415fc5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x415fc5
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
xor edi, edi
mov dword [ebp - 0x30], edi
add edi, 0x400
mov dword [ebp - 0x30], edi
lea eax, [ebp - 0x44]
call fcn.0041628e
mov esi, edi
shl esi, 2
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 0x44]
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x415e70
mov byte [ebp - 4], al
cmp dword [ebp - 0x44], ebx
je 0x415e69
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x40]
jae 0x415e60
inc dword [ebp - 0x1c]
jmp 0x415e53
push dword [ebp - 0x44]
call fcn.0043792e
pop ecx
mov eax, ebx
jmp 0x415fc7
cmp esi, dword [ebp - 0x28]
je 0x415e21
mov edi, dword [ebp - 0x28]
shr edi, 2
lea eax, [ebp - 0x44]
call fcn.0041628e
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x18], eax
jae 0x415fa2
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4]
push dword [eax]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x2c], edi
mov byte [ebp - 4], 2
cmp edi, ebx
je 0x415f88
lea ecx, [ebp - 0x14]
call fcn.0041611a
mov byte [ebp - 4], 3
mov esi, 0x7fff
push esi
lea ecx, [ebp - 0x14]
call fcn.0040c4d3
push esi
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x415f7c
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004052d6
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax - 0xc]
push 0x5c
lea esi, [ebp - 0x14]
call fcn.0040838a
sub ebx, eax
dec ebx
push ebx
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.004083ab
mov byte [ebp - 4], 4
mov eax, dword [eax]
push dword [ebp + 8]
push eax
call fcn.004385ad
pop ecx
pop ecx
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
call fcn.00410215
test bl, bl
je 0x415f7a
xor esi, esi
inc esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00410215
mov byte [ebp - 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x44], eax
je 0x415f76
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x40]
jae 0x415f6d
inc dword [ebp - 0x20]
jmp 0x415f60
push dword [ebp - 0x44]
call fcn.0043792e
pop ecx
mov eax, esi
jmp 0x415fc7
xor ebx, ebx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00410215
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x415f9a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], ebx
inc dword [ebp - 0x18]
jmp 0x415e86
mov byte [ebp - 4], 0
cmp dword [ebp - 0x44], ebx
je 0x415fc1
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jae 0x415fb8
inc dword [ebp - 0x24]
jmp 0x415fae
push dword [ebp - 0x44]
call fcn.0043792e
pop ecx
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.0043ca98
ret
Function at 0x4166f4
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416710
and dword [esi], eax
and dword [esi + 4], eax
jmp 0x416786
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
mov dword [ebp - 8], eax
call fcn.00425df5
xor ebx, ebx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x416733
mov dword [esi], ebx
jmp 0x416783
push eax
push dword [ebp - 8]
xor edi, edi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x416778
and dword [ebp - 8], ebx
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x45c4b0
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 4], 0x34
jb 0x416778
mov eax, dword [ebp - 8]
test eax, eax
je 0x416778
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov ebx, ecx
push dword [ebp - 0xc]
call fcn.00425dfa
pop ecx
mov dword [esi], edi
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop ebx
leave
ret
Function at 0x417550
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp byte [eax + 0x29], 0
je 0x41756a
mov eax, 1
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
xor edi, edi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
cmp eax, edi
jne 0x4175a2
mov ecx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 4], ecx
cmp eax, edi
push esi
mov esi, eax
jne 0x4176c2
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.InstallerData
push ecx
mov dword [ebp - 0xc], edi
call ebx
test eax, eax
jne 0x4175d7
mov edi, dword [ebp - 0xc]
test eax, eax
mov esi, eax
jne 0x4176b7
lea edx, [ebp + 0xc]
push edx
call fcn.00408c64
push 0x7fff
lea eax, [ebp + 0xc]
push eax
call fcn.0040d47e
test al, al
jne 0x41762a
lea ecx, [ebp + 0xc]
push ecx
call fcn.0040d4b6
test edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x417612
push edi
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x41761c
push eax
call esi
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
cmp byte [edx + 0x28], 0
jne 0x41769c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x10], 0x7fff
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ecx
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x41769c
mov edx, dword [ebp + 0xc]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x417640
call fcn.00408556
mov esi, eax
lea eax, [ebp + 0xc]
push eax
call fcn.0040d4b6
test edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x417687
push edi
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x4176d9
push eax
call ebx
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
add ecx, 0x10
mov dword [ebp - 0x10], ecx
call fcn.00417ff0
test eax, eax
jne 0x4176e7
lea ecx, [ebp + 0xc]
push ecx
call fcn.0040d4b6
test edi, edi
je 0x4176c2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00408556
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4176d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push ecx
mov ebx, eax
call fcn.00418180
cmp dword [ebx + 0xc], 0
mov dword [ebp + 8], eax
je 0x417723
mov esi, dword [ebx + 4]
test esi, esi
mov ebx, dword [ebx]
je 0x41772b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x417735
cmp dword [ebp + 8], 0
jne 0x4176e4
jmp 0x4176ae
push 0x80004005
call fcn.004017b4
mov eax, esi
jmp 0x41766a
Function at 0x4189b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x4189ea
call fcn.00403063
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x418a3e
call fcn.00403063
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x418e30
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 8
cmp dword [esi + 0x7c], eax
jne 0x418eab
push ebx
push edi
lea edi, [esi + 0x28]
mov ecx, edi
lea ebx, [eax + 1]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.0041d180
test eax, eax
jne 0x418e81
cmp dword [esi + 0x38], eax
je 0x418e81
mov edi, dword [edi + 0x14]
cmp dword [edi - 0xc], eax
je 0x418e6c
test edi, edi
je 0x418e6c
mov dword [esi + 0x40], eax
jmp 0x418e81
mov eax, dword [esi + 0x30]
test eax, eax
je 0x418e81
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x34]
mov ebx, 3
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x8c]
push 0
push ecx
push edx
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
test eax, eax
pop edi
pop ebx
jne 0x418ea8
call fcn.00403063
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x7c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41dad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov dl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x41db1b
movzx esi, dl
push edi
nop
mov ecx, dword [eax + 0x260]
mov edi, ecx
shr edi, 0x18
shl ecx, 8
xor edi, esi
xor ecx, dword [edi*4 + 0x46e040]
mov dword [eax + 0x260], ecx
mov ecx, dword [ebp - 4]
add ecx, ebx
cmp ecx, dword [eax + 0x38]
mov dword [ebp - 4], ecx
jl 0x41daf0
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x41dba9
sub ecx, ebx
je 0x41db8b
sub ecx, ebx
je 0x41db7f
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ef80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41ef93
mov dword [edi], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41f0fa
cmp dword [ebp + 0x10], 0
mov dword [esi + 0x13c4], 0
je 0x41f0fa
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jl 0x41f0fa
cmp byte [esi + 0x1390], 0
jne 0x41efe1
test edi, edi
je 0x41efd0
mov dword [edi], 0xffffffff
pop edi
mov dword [esi + 0x13c4], 0xffffffff
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [esi]
push eax
call fcn.0043b50d
add esp, 4
test eax, eax
je 0x41f00b
test edi, edi
je 0x41effa
mov dword [edi], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test ebx, ebx
jne 0x41f02a
test edi, edi
je 0x41f019
mov dword [edi], 0
pop edi
mov dword [esi + 0x13c4], 0
pop esi
pop ebx
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x1394]
mov dword [esi + 0x1398], ebx
push 0
lea ebx, [esi + 4]
push eax
mov dword [eax], ecx
mov dword [esi + 0x13a8], 0x1388
mov dword [esi + 0x13a4], ebx
call fcn.0041df00
cmp eax, 1
jne 0x41f0c9
jmp 0x41f060
mov eax, dword [esi + 0x13a8]
cmp eax, 0x1388
jae 0x41f099
mov edx, dword [esi]
push edx
mov edi, 0x1388
sub edi, eax
push edi
push 1
push ebx
call fcn.0043b69b
add esp, 0x10
cmp edi, eax
jne 0x41f0dc
mov eax, dword [esi]
push eax
call fcn.0043b50d
add esp, 4
test eax, eax
jne 0x41f0dc
mov edi, dword [ebp + 8]
cmp dword [esi + 0x1398], 0
je 0x41f00f
push 0
lea eax, [esi + 0x1394]
mov dword [esi + 0x13a8], 0x1388
push eax
mov dword [esi + 0x13a4], ebx
call fcn.0041df00
cmp eax, 1
je 0x41f060
test edi, edi
je 0x41f0cf
mov dword [edi], eax
pop edi
mov dword [esi + 0x13c4], eax
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x41f0e9
mov dword [eax], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test edi, edi
je 0x41f104
mov dword [edi], 0xfffffffe
test esi, esi
je 0x41f112
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
pop esi
pop ebx
pop ebp
ret 0x10