joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025ac
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4025df
push esi
call fcn.00402535
test al, al
pop ecx
je 0x4025d6
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push esi
lea eax, [ebp - 0x208]
push str._sutils.jar
push eax
call fcn.0040af5f
lea eax, [ebp - 0x208]
push eax
call fcn.00402535
add esp, 0x10
test al, al
pop esi
jne 0x402631
push str.utils.jar_is_not_found__extract_him
call fcn.004067b1
mov ecx, eax
call fcn.004067b7
push 0x417a28
lea eax, [ebp - 0x208]
push 0x8c
push eax
call fcn.00402257
add esp, 0xc
leave
ret
push str.utils.jar_is_found
call fcn.004067b1
mov ecx, eax
call fcn.004067b7
leave
ret

Function at 0x402644
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x402678
push edi
call fcn.00402535
test al, al
pop ecx
je 0x40266f
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push edi
lea eax, [ebp - 0x208]
push str._sLicense_ru.rtf
push eax
call fcn.0040af5f
mov esi, 0x417ac0
lea eax, [ebp - 0x208]
push esi
push 0xa0
push eax
call fcn.00402257
push edi
lea eax, [ebp - 0x208]
push str._sLicense_uk.rtf
push eax
call fcn.0040af5f
push esi
lea eax, [ebp - 0x208]
push 0xa2
push eax
call fcn.00402257
push edi
lea eax, [ebp - 0x208]
push str._sLicense_en.rtf
push eax
call fcn.0040af5f
push esi
lea eax, [ebp - 0x208]
push 0xa1
push eax
call fcn.00402257
add esp, 0x48
pop edi
pop esi
leave
ret

Function at 0x4026f0
Capabilities:
Check mutex on windows

Disassembly:
push str.zona_web_setup_mutex
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
ret
Function at 0x40289e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.00402535
xor edi, edi
pop ecx
test al, al
je 0x402932
push edi
push edi
push 3
push edi
push edi
push SysReAllocString
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4029a9
lea eax, [ebp + 0xc]
push edi
push eax
mov esi, 0x100
lea eax, [ebp - 0x308]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x208]
push esi
push eax
lea eax, [ebp - 0x308]
push dword [ebp + 0xc]
push eax
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [ebp + 0xc]
mov word [ebp + eax*2 - 0x208], di
lea eax, [ebp - 0x208]
push eax
call fcn.0040b3ff
test eax, eax
pop ecx
jne 0x40296f
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x208]
push eax
push 1
push edi
push edi
push dword [ebp - 4]
call fcn.0040b520
mov ecx, dword [ebp - 8]
xor esi, esi
add eax, ecx
push edi
adc edx, esi
push 0x2710
push edx
push eax
call fcn.0040b430
push edx
push eax
call fcn.0040284d
add esp, 0xc
push 0x208
call fcn.0040aa4c
push dword [ebp + 8]
mov esi, eax
push str.Software_s
push esi
call fcn.0040af5f
lea eax, [ebp - 0x208]
push eax
push str.installDate
push esi
push SysReAllocString
call fcn.00402401
push esi
call fcn.0040a7f0
add esp, 0x24
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402e5a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
lea eax, [ebp - 0x444]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call fcn.00402f55
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
test al, al
jne 0x402ea1
call fcn.0040304c
test eax, eax
jne 0x402ea1
push 0x30
push str.Zona
push 0x4180cc
push ebx
call esi
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
rep stosd dword es:[edi], eax
call fcn.00402f55
test al, al
pop edi
jne 0x402ecd
call fcn.0040304c
test eax, eax
mov dword [ebp - 0x30], str.open
jne 0x402ed4
mov dword [ebp - 0x30], str.runas
lea eax, [ebp - 0x444]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], str._asService
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x402f4f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x4c7
jne 0x402f17
push str.User_did_not_allow_elevation
jmp 0x402f3f
push eax
lea eax, [ebp - 0x23c]
push 0x418058
push eax
call fcn.0040af5f
add esp, 0xc
lea eax, [ebp - 0x23c]
push ebx
push ebx
push eax
push ebx
call esi
lea eax, [ebp - 0x23c]
push eax
call fcn.004067b1
mov ecx, eax
call fcn.0040685a
xor al, al
jmp 0x402f51
mov al, 1
pop esi
pop ebx
leave
ret
Function at 0x402f55
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push 0x44
pop ecx
xor eax, eax
lea edi, [ebp - 0x110]
mov dword [ebp - 0x114], 0x114
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
cmp dword [ebp - 0x110], 6
pop edi
sbb eax, eax
inc eax
leave
ret

Function at 0x40304c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x114
push ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
cmp dword [ebp - 0x120], 2
mov dword [ebp - 4], ebx
je 0x4030a0
mov dword [ebp - 8], 1
jmp 0x40314a
lea eax, [ebp - 4]
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40314a
lea eax, [ebp - 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 4]
mov dword [ebp - 0x1c], 0x201
mov dword [ebp - 0x18], 0x5000000
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0x10], 0x220
call edi
test eax, eax
jne 0x40314a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x40314a
push dword [ebp - 0xc]
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x40314a
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push esi
push 2
push dword [ebp - 4]
call edi
test eax, eax
je 0x403143
cmp dword [esi], ebx
jbe 0x403143
lea edi, [esi + 4]
lea eax, [ebp - 0x1c]
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40313b
mov dword [ebp - 8], 1
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x403124
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40315b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x59284
call fcn.0040af30
push ebx
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00404c28
pop ecx
lea ecx, [ebp - 0x19284]
call fcn.00401c13
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x274]
xor edi, edi
push 0x104
lea esi, [ebx + 0x19dc]
push eax
push edi
mov word [esi], di
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x403295
push edi
push edi
push 3
push edi
push edi
lea eax, [ebp - 0x274]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x403288
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x59284]
push 0x40000
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x40321d
cmp dword [ebp + 8], edi
je 0x40322c
push dword [ebp + 8]
lea eax, [ebp - 0x59284]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00404c50
add esp, 0xc
lea eax, [ebp - 0x59284]
lea ecx, [ebp - 0x19284]
push dword [ebp + 8]
push eax
call fcn.00401c62
jmp 0x4031cd
push ebx
push str.readFileForMD5
call fcn.00401ed4
pop ecx
pop ecx
jmp 0x40327d
lea ecx, [ebp - 0x19284]
call fcn.00401c96
test al, al
je 0x403250
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [ebp - 0x19284]
mov dword [eax], 1
call fcn.00401ca2
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00404d06
pop ecx
mov word [esi], di
pop ecx
movzx eax, byte [ebp + edi - 0x14]
push eax
push esi
push str._s_02x
push esi
call fcn.0040af5f
add esp, 0x10
inc edi
cmp edi, 0x10
jb 0x403262
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x403295
push ebx
push str.openFileForMD5AndTail
call fcn.00401ed4
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403650
Capabilities:
Get common file path
Get disk information
Write file on windows

Disassembly:
mov eax, 0x4132f0
call fcn.0040ae68
sub esp, 0x420
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x224]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
push 0x104
mov word [edi], bx
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x224]
push str._shd.vbs
push eax
call fcn.0040af5f
add esp, 0xc
lea eax, [ebp - 0x224]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
je 0x40379d
lea eax, [ebp - 0x1c]
push ebx
mov esi, str.Set_objWMIService__GetObject__winmgmts:._rootcimv2____n_Set_colItems__objWMIService.ExecQuery____n___Select__from_Win32_DiskDrive___n_For_Each_objItem_in_colItems__n_Wscript.Echo_objItem.SerialNumber__n_exit_for___do_the_first_cpu_only___n_Next
push eax
push esi
call fcn.0040b560
pop ecx
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, ebx
je 0x40379d
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x42c]
push str.cscript___NoLogo__s
push eax
call fcn.0040af5f
mov esi, dword [ebp + 0xc]
push esi
call fcn.0040aa4c
add esp, 0x10
mov dword [ebp + 0xc], eax
push esi
push eax
lea eax, [ebp - 0x42c]
push 1
push eax
call fcn.004021bc
add esp, 0x10
cmp eax, ebx
jne 0x403782
add esi, esi
push esi
push ebx
push edi
call fcn.0040b380
add esp, 0xc
push esi
push edi
push dword [ebp + 0xc]
call fcn.0040b560
pop ecx
push eax
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push edi
call fcn.00401f4e
cmp eax, ebx
pop ecx
jle 0x403782
push edi
call fcn.0040a9e0
cmp eax, 5
pop ecx
jbe 0x403782
push edi
push str.Volume
call fcn.00401fb2
pop ecx
test al, al
pop ecx
jne 0x403782
mov byte [ebp - 0x11], 1
push dword [ebp + 0xc]
call fcn.0040a7f0
pop ecx
jmp 0x403798
cmp byte [ebp - 0x11], bl
jne 0x4037c4
push ebx
push ebx
push ebx
lea eax, [ebp + 8]
push ebx
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov word [edi], 0x5f
add edi, 2
push 0xa
push edi
push dword [ebp + 8]
call fcn.0040aef4
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40483f
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2070
call fcn.0040af30
push ebx
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x70]
xor edi, edi
mov ebx, dword [esi]
push eax
mov dword [ebp - 4], edi
call fcn.00404c28
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2070]
push 0x2000
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4048f6
cmp dword [ebp - 4], 0
je 0x4048fd
lea eax, [ebp - 8]
push 0
push eax
lea eax, [ebp - 0x2070]
push dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x40493d
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jne 0x40493d
push eax
lea eax, [ebp - 0x2070]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00404c50
add edi, dword [ebp - 4]
add esp, 0xc
push dword [esi + 4]
push 0x64
push edi
call dword [sym.imp.KERNEL32.DLL_MulDiv]
cmp eax, 0x64
je 0x404862
cmp eax, dword [esi + 0xc]
je 0x404862
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x404862
push ebx
push eax
call ecx
jmp 0x404862
push str.InternetReadFile
jmp 0x404942
cmp edi, dword [esi + 4]
jne 0x40495c
lea eax, [ebp - 0x70]
mov byte [esi + 8], 1
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00404d06
mov eax, dword [esi + 0x14]
pop ecx
xor edi, edi
pop ecx
mov word [eax], di
movzx ecx, byte [ebp + edi - 0x18]
mov eax, dword [esi + 0x14]
push ecx
push eax
push str._s_02x
push eax
call fcn.0040af5f
add esp, 0x10
inc edi
cmp edi, 0x10
jb 0x40491d
jmp 0x40495c
push str.WriteFile
call fcn.004067b1
mov ecx, eax
call fcn.004067c8
mov ecx, esi
call fcn.004044bf
mov ecx, esi
call fcn.00404ac7
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x404963
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov dx, word [0x41b1f4]
push ebx
push esi
push edi
mov ebx, ecx
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x406]
mov word [ebp - 0x408], dx
rep stosd dword es:[edi], eax
mov esi, 0x200
push 0x7f
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
pop ecx
xor esi, esi
push esi
push 0x84400000
stosw word es:[edi], ax
push esi
push esi
xor eax, eax
lea edi, [ebp - 0x206]
push esi
mov word [ebp - 0x208], dx
push dword [ebp + 0xc]
rep stosd dword es:[edi], eax
push esi
push dword [ebp + 8]
stosw word es:[edi], ax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
cmp edi, esi
mov dword [ebp + 0xc], edi
jne 0x4049da
push str.HttpOpenRequest
jmp 0x404a87
push esi
push esi
push esi
push esi
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x4049f3
push str.HttpSendRequest
jmp 0x404a87
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x408]
push eax
push 5
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x404a7b
push esi
lea eax, [ebp - 0x408]
push esi
push eax
call fcn.0040b782
mov dword [ebx + 4], eax
mov edi, str.Content_MD5
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0040aa27
add esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x208]
push eax
push 0xffff
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [ebx + 0x10]
mov word [eax], si
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.0040aa5a
pop ecx
test eax, eax
pop ecx
je 0x404a76
lea eax, [ebp - 0x208]
push eax
push dword [ebx + 0x10]
call fcn.0040aa27
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
jmp 0x404aa3
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.HttpQueryInfo
call fcn.004067b1
mov ecx, eax
call fcn.004067c8
mov ecx, ebx
call fcn.004044bf
mov ecx, ebx
call fcn.00404ac7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x404b8e
Capabilities:
Create thread

Disassembly:
mov eax, 0x41337e
call fcn.0040ae68
push ecx
push esi
push str.httpget_start_asynch_loading
call fcn.004067b1
mov ecx, eax
call fcn.004067b7
mov esi, dword [ebp + 8]
push dword [esi + 4]
call fcn.004067b1
mov ecx, eax
call fcn.004067b7
push 0x18
call fcn.0040aa4c
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x404bda
push esi
call fcn.00404452
jmp 0x404bdc
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push 0x404b6e
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x404c28
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x405dc5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x41345a
call fcn.0040ae68
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00405d98
xor ebx, ebx
pop ecx
cmp dword [0x41dff8], ebx
mov edi, eax
jne 0x405e20
push 0x14
call fcn.0040aa4c
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
cmp esi, ebx
mov dword [ebp - 4], ebx
je 0x405e14
mov al, byte [ebp + 0xb]
lea ecx, [esi + 4]
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00405eee
jmp 0x405e16
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov dword [0x41dff8], esi
movzx eax, di
push str.i18n
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x405e90
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push esi
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
shl eax, 2
push eax
call fcn.0040aa4c
mov edi, eax
pop ecx
lea eax, [esi + esi]
push eax
push edi
push esi
push dword [ebp - 0x10]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push eax
push edi
push dword [ebp + 8]
mov word [edi + eax*2], bx
mov ecx, dword [0x41dff8]
call fcn.00405e9f
push edi
call fcn.0040a7f0
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40686b
Capabilities:
Get common file path

Disassembly:
push dword [esp + 8]
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push dword [esp + 4]
push dword [esp + 0xc]
push 0x417284
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
ret 8
Function at 0x406897
Capabilities:
Delete file
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40018
call fcn.0040af30
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 8], ecx
je 0x4069e2
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateFileW]
push esi
push esi
push 4
push esi
lea eax, [ecx + 4]
push esi
push 0x40000000
push eax
mov dword [ebp - 4], eax
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x4069e2
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0xffffffff
je 0x406914
and ax, 0xfc00
cmp eax, 0x32000
jbe 0x406914
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push esi
push esi
push 4
push esi
push esi
push 0x40000000
push dword [ebp - 4]
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x4069e2
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
push dword [ebp + 8]
call fcn.0040a9e0
push dword [ebp + 0xc]
mov ebx, eax
call fcn.0040a9e0
add ebx, eax
lea eax, [ebx + ebx + 0x800]
push eax
call fcn.0040aa4c
push dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [ebp - 8]
mov word [ebx], si
push dword [eax + 0x20c]
movzx eax, word [ebp - 0xa]
push dword [ebp + 8]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x18]
push eax
push str.__d__d__d__d:_d:_d:_d___s_:___s__:__s_r_n
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x40018]
push 0x40000
push eax
push ebx
call fcn.00401f0c
add esp, 0x48
lea eax, [ebp - 0x40018]
push eax
call fcn.0040b560
pop ecx
mov dword [ebp + 0xc], eax
push 2
push esi
push esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x40018]
push dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call fcn.0040a7f0
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4071a2
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], ecx
xor eax, eax
mov edx, dword [ecx]
mov edi, dword [eax + 0x4188e0]
mov dword [eax + edx], edi
add eax, 4
cmp eax, 0x48
jl 0x4071b2
xor eax, eax
mov edx, 0x100
mov edi, dword [ecx + 4]
mov ebx, dword [eax + 0x418928]
mov dword [eax + edi], ebx
add eax, 4
dec edx
jne 0x4071cc
cmp eax, 0x1000
jl 0x4071c7
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
jmp 0x4071f3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov ecx, dword [ebp - 4]
add ecx, eax
lea eax, [esi + 1]
cdq
idiv ebx
mov dword [ebp + 0xc], ecx
xor ecx, ecx
lea eax, [esi + 2]
add dword [ebp - 4], 4
mov cl, byte [edx + edi]
cdq
idiv ebx
mov ch, byte [esi + edi]
shl ecx, 8
movzx eax, byte [edx + edi]
or ecx, eax
lea eax, [esi + 3]
cdq
idiv ebx
shl ecx, 8
movzx eax, byte [edx + edi]
or ecx, eax
mov eax, dword [ebp + 0xc]
xor dword [eax], ecx
lea eax, [esi + 4]
cdq
idiv ebx
cmp dword [ebp - 4], 0x48
mov esi, edx
jl 0x4071f0
mov esi, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00406abe
mov eax, dword [esi]
mov ecx, dword [ebp - 8]
mov dword [edi + eax], ecx
mov eax, dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword [edi + eax + 4], ecx
add edi, 8
cmp edi, 0x48
jl 0x40724b
push 4
pop edi
mov ebx, 0x80
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00406abe
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 8]
mov dword [edi + eax - 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0xc]
mov dword [edi + eax], ecx
add edi, 8
dec ebx
jne 0x40727b
cmp edi, 0x1004
jl 0x407276
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x407da3
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
call fcn.004077b4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [esi + 0x10]
call fcn.00402b6e
pop ecx
pop ecx
push 0
push 0
push 0x10
mov ecx, esi
call fcn.004077b4
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret

Function at 0x408bcc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 8]
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push dword [ebp + 0xc]
push esi
call fcn.0040a9fd
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x44]
push eax
lea eax, [ebp - 0x208]
push 0x417284
push eax
call fcn.0040af5f
push 0x408b71
push 0
lea eax, [ebp - 0x208]
push esi
push eax
push str.partnerUtilId
push 0
call fcn.004043cf
push eax
call fcn.00404b00
push esi
call fcn.00402535
add esp, 0x30
test al, al
jne 0x408c3f
and word [esi], 0
pop esi
leave
ret

Function at 0x409489
Capabilities:
Create thread

Disassembly:
push ecx
xor eax, eax
cmp byte [ecx + 4], al
jne 0x4094a9
lea edx, [esp]
mov byte [ecx + 4], 1
push edx
push eax
push ecx
push 0x40946c
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ecx
ret