joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100086a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001dba0
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x101b100c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xac], ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x9c]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x100086f5
xor eax, eax
jmp 0x100087c1
push esi
call fcn.1000b3ad
mov edi, eax
add esp, 4
mov dword [ebp - 0xb0], edi
test edi, edi
je 0x100086ee
push edi
push esi
mov dword [ebp - 4], 0
push dword [ebp - 0x9c]
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x1000873b
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xa8]
push 0x101af06c
push eax
call fcn.1000cc30
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x101ad310
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x100087b3
cmp dword [ebp - 0xa0], 0x34
jne 0x100087b3
mov ebx, dword [ebp - 0xac]
push 0x34
push dword [ebp - 0xa4]
lea eax, [ebx + 4]
push eax
call fcn.1001d010
movzx eax, word [ebx + 0x10]
add esp, 0xc
movzx ecx, word [ebx + 0x12]
movzx edx, word [ebx + 0xc]
movzx esi, word [ebx + 0xe]
push eax
push ecx
push edx
push esi
lea eax, [ebp - 0x98]
push str._d._d._d._d
push eax
call fcn.10008900
add esp, 0x18
lea eax, [ebp - 0x98]
lea ecx, [ebx + 0x38]
push eax
call fcn.10004bd0
push edi
call fcn.1000b3b6
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000a89d
mov esp, ebp
pop ebp
ret 8

Function at 0x10009280
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x104], 0
je 0x10009292
xor eax, eax
pop esi
ret 8
push 0x104
push 0
push esi
call fcn.1000d180
add esp, 0xc
push 0x104
push esi
push dword [0x101b2524]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1000928c
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
je 0x1000928c
push str.log_
push 0x104
push esi
call fcn.100114d1
push str.UpdaterCoreLib.log
push 0x104
push esi
call fcn.100114d1
add esp, 0x18
push esi
call fcn.10009300
cmp eax, 0x100000
jbe 0x100092fa
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop esi
ret 8

Function at 0x10009300
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009341
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x10009db0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101b100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10009e1c
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x10009e32
push str.MyDeleteFile_DeleteFileW__TRUE
push 0
call fcn.10009180
push eax
call fcn.100095e0
add esp, 0xc
push eax
push str.UPDATEFILEREPAIR::MyDeleteFile
push str.....projectUpdaterCoreLibUpdateFileRepair.cpp
push 0x95
call fcn.10009180
mov ecx, eax
call fcn.10009350
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a89d
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1000d180
add esp, 0xc
lea eax, [ebp - 0x210]
push ebx
push 0x104
push eax
call fcn.1000df77
add esp, 0xc
lea eax, [ebp - 0x210]
push str..del
push 0x104
push eax
call fcn.1000dfdb
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x210]
add esp, 0xc
push 1
push eax
push ebx
call esi
test eax, eax
lea edi, [ebp - 0x210]
push 4
cmove edi, ebx
push 0
push edi
call esi
mov esi, eax
mov ecx, str.TRUE
mov eax, str.FALSE
test esi, esi
push edi
cmove ecx, eax
push ecx
push str.MyDeleteFile__S___S
push 0
call fcn.10009180
push eax
call fcn.100095e0
add esp, 0x14
push eax
push str.UPDATEFILEREPAIR::MyDeleteFile
push str.....projectUpdaterCoreLibUpdateFileRepair.cpp
push 0xa2
call fcn.10009180
mov ecx, eax
call fcn.10009350
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a89d
mov esp, ebp
pop ebp
ret
Function at 0x10009fd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x101b100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call fcn.1000d180
add esp, 0xc
lea eax, [ebp - 0x210]
push esi
push 0x104
push eax
call fcn.1000df77
add esp, 0xc
lea eax, [ebp - 0x210]
push str.checkupdate.dll
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1000a0ea
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x214], 0
push eax
xorps xmm0, xmm0
lea eax, [ebp - 0x210]
push eax
movups xmmword [ebp - 0x22c], xmm0
movq qword [ebp - 0x21c], xmm0
call fcn.1000a570
test eax, eax
je 0x1000a0df
push dword [ebp - 0x214]
push str.Shenzhen_DriveTheLife_Software_Technology_Co.Ltd
call fcn.1001135c
add esp, 8
test eax, eax
jne 0x1000a0df
lea ecx, [ebp - 0x22c]
call fcn.10009970
lea ecx, [ebp - 0x210]
call fcn.10009f00
test eax, eax
jne 0x1000a0cb
lea eax, [ebp - 0x210]
push eax
push str._CheckUpdateFile___SafeCheckupdateFile____S__FALSE
push 0
call fcn.10009180
push eax
call fcn.100095e0
add esp, 0x10
push eax
push str.UPDATEFILEREPAIR::CheckUpdateFile
push str.....projectUpdaterCoreLibUpdateFileRepair.cpp
push 0x118
jmp 0x1000a116
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a89d
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x22c]
call fcn.10009970
lea eax, [ebp - 0x210]
push eax
push str._CheckUpdateFile__CheckSignature___S__FALSE
push 0
call fcn.10009180
push eax
call fcn.100095e0
add esp, 0x10
push eax
push str.UPDATEFILEREPAIR::CheckUpdateFile
push str.....projectUpdaterCoreLibUpdateFileRepair.cpp
push 0x112
call fcn.10009180
mov ecx, eax
call fcn.10009350
lea ecx, [ebp - 0x210]
call fcn.10009db0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000a89d
mov esp, ebp
pop ebp
ret

Function at 0x1000a140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101b100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.1000d180
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1000df77
add esp, 0x18
lea eax, [ebp - 0x20c]
push str.checkupdate.dll
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000a1c1
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a89d
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0x1888a0
push 0x10023cb8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1000a89d
mov esp, ebp
pop ebp
ret
Function at 0x1000a200
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101b100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.1000d180
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push dword [0x101b2524]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1000a276
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x1000a276
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.AppUpdate
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1000a2ca
lea eax, [ebp - 0x210]
push eax
push str._PathIsDirectory____S__FALSE
push 0
call fcn.10009180
push eax
call fcn.100095e0
add esp, 0x10
push eax
push str.UPDATEFILEREPAIR::RepairUpdate
push str.....projectUpdaterCoreLibUpdateFileRepair.cpp
push 0x147
call fcn.10009180
mov ecx, eax
call fcn.10009350
lea ecx, [ebp - 0x210]
call fcn.10009db0
lea ecx, [ebp - 0x210]
call fcn.10009fd0
test eax, eax
lea eax, [ebp - 0x210]
push eax
je 0x1000a325
push str._CheckUpdateFile____S__TRUE
push 0
call fcn.10009180
push eax
call fcn.100095e0
add esp, 0x10
push eax
push str.UPDATEFILEREPAIR::RepairUpdate
push str.....projectUpdaterCoreLibUpdateFileRepair.cpp
push 0x14e
call fcn.10009180
mov ecx, eax
call fcn.10009350
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a89d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a33d
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x210]
call fcn.1000a140
mov esi, eax
mov ecx, str.TRUE
mov eax, str.FALSE
test esi, esi
cmove ecx, eax
lea eax, [ebp - 0x210]
push ecx
push eax
push str._UnZip___S____S_
push 0
call fcn.10009180
push eax
call fcn.100095e0
add esp, 0x14
push eax
push str.UPDATEFILEREPAIR::RepairUpdate
push str.....projectUpdaterCoreLibUpdateFileRepair.cpp
push 0x159
call fcn.10009180
mov ecx, eax
call fcn.10009350
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000a89d
mov esp, ebp
pop ebp
ret
Function at 0x401aa0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401adf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401adf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401adf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401adf
cmp dword [ecx + 0x74], 0xe
jbe 0x401adf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406bd0
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x406c1b
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00406d6b
test al, al
jne 0x406c15
sub edx, 2
cmp edx, edi
jne 0x406bfb
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x406c3d
lea eax, [edi + 2]
cmp edx, eax
je 0x406c3d
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00406b1c
add esp, 0x10
jmp 0x406d37
push esi
lea ecx, [ebp - 0x255]
call fcn.00406d6b
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406c80
push dword [ebp - 0x25c]
jmp 0x406c2d
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x406cbd
cmp word [ebp - 0x226], 0
je 0x406cde
cmp word [ebp - 0x226], ax
jne 0x406cbd
cmp word [ebp - 0x224], 0
je 0x406cde
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00406b1c
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x406d2a
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406c97
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x406d12
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x406d37
push 0x40694c
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00409870
add esp, 0x10
jmp 0x406d07
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040126a
leave
ret

Function at 0x408866
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
Function at 0x4088a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5a], 0x41
call fcn.004084b2
push eax
push esi
push dword [ebp + 8]
call fcn.00408467
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
Function at 0x401850
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.WS2_32.dll_WSAStartup
sub esp, 8
test eax, eax
je 0x401880
mov eax, 2
add esp, 0x1ac
ret
mov eax, dword [esp + 0x10]
cmp al, 2
je 0x40189c
call sub.WS2_32.dll_WSACleanup
mov eax, 2
add esp, 0x1ac
ret
shr ax, 8
cmp al, 2
jne 0x401888
call fcn.00403d14
jmp 0x401876

Function at 0x4018ac
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x65d008]
lea edx, [eax + 1]
mov dword [0x65d008], edx
test eax, eax
jne 0x40196c
push ebx
sub esp, 0x58
mov dword [sub.msvcrt.dll_malloc], 0x599320
mov dword [sub.msvcrt.dll_free], 0x599338
mov dword [sub.msvcrt.dll_realloc], 0x599328
mov dword [sub.msvcrt.dll__strdup], 0x5942a0
mov dword [section..data], 0x599340
test byte [esp + 0x60], 1
jne 0x401970
test byte [esp + 0x60], 2
je 0x40191c
call fcn.00401850
test eax, eax
je 0x40191c
mov eax, 2
add esp, 0x58
pop ebx
ret
call sub.KERNEL32.dll_GetACP
mov ebx, eax
mov dword [esp], 0x5a3160
call sub.msvcrt.dll_getenv
test eax, eax
je 0x40197c
call fcn.00404108
test eax, eax
jne 0x40190f
mov dword [esp], 0
call sym.curl.exe_libssh2_init
test eax, eax
jne 0x40190f
test byte [esp + 0x60], 4
je 0x40195d
mov dword [0x65d010], 1
mov eax, dword [esp + 0x60]
mov dword [0x65d00c], eax
xor eax, eax
jmp 0x401914
xor eax, eax
ret
call fcn.004048b0
test eax, eax
je 0x40190f
jmp 0x4018ff
test ebx, ebx
je 0x401933
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.CHARSETcp_u
mov dword [esp + 4], 0x3c
lea ebx, [esp + 0x14]
mov dword [esp], ebx
call sym.curl.exe_curl_msnprintf
mov dword [esp], ebx
call sub.msvcrt.dll__putenv
jmp 0x401933
Function at 0x40512c
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], 0
test eax, eax
je 0x4051c0
mov esi, dword [esp + 0x54]
test esi, esi
je 0x405153
mov ebx, dword [esp + 0x58]
test ebx, ebx
jne 0x405164
mov ebx, 0x5a
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x5a4d7d
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x405153
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
test eax, eax
je 0x4051cc
mov ebx, 0x5a
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4051b4
mov dword [esp], eax
call dword [0x59b00c]
mov dword [esp + 0x28], 0
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x405158
xor ebx, ebx
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call sub.msvcrt.dll_ftell
mov ebx, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_fseek
test eax, eax
jne 0x405196
cmp ebx, 0x100000
ja 0x405196
mov dword [esp], ebx
mov eax, ebx
sar eax, 0x1f
mov dword [esp + 4], eax
call fcn.00414acc
mov ebx, eax
cmp dword [esp + 0x58], eax
ja 0x405196
lea eax, [eax + 1]
mov dword [esp], eax
call dword [0x59b010]
mov edi, eax
test eax, eax
je 0x405196
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fread
dec eax
je 0x405257
mov ebx, 0x5a
mov dword [esp], edi
call dword [0x59b00c]
jmp 0x40519b
cmp dword [esp + 0x58], ebx
jne 0x40527d
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
xor ebx, ebx
test eax, eax
je 0x405249
jmp 0x405244
mov byte [edi + ebx], 0
mov dword [esp + 4], str._____BEGIN_PUBLIC_KEY_____
mov dword [esp], edi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x405244
mov ebx, eax
sub ebx, edi
je 0x4052a1
cmp byte [eax - 1], 0xa
jne 0x405244
lea ebp, [ebx + 0x1a]
mov dword [esp + 4], str._n_____END_PUBLIC_KEY_____
lea eax, [edi + ebp]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x405244
sub eax, edi
mov dword [esp + 0x1c], eax
sub eax, ebx
sub eax, 0x19
mov dword [esp], eax
call dword [0x59b010]
mov ebx, eax
test eax, eax
je 0x405244
xor ecx, ecx
cmp dword [esp + 0x1c], ebp
jbe 0x4052f3
mov al, byte [edi + ebp]
cmp al, 0xa
je 0x4052f0
cmp al, 0xd
je 0x4052f0
mov byte [ebx + ecx], al
inc ecx
inc ebp
jmp 0x4052db
mov byte [ebx + ecx], 0
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0041abf8
mov ebp, eax
mov dword [esp], ebx
call dword [0x59b00c]
test ebp, ebp
jne 0x405244
mov edx, dword [esp + 0x58]
cmp edx, dword [esp + 0x2c]
jne 0x405244
mov dword [esp + 8], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
jmp 0x405269
Function at 0x407e54
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edx, [eax + 0x20]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], eax
add eax, 0x40
mov dword [ebx], eax
mov dword [ebx + 0x58], sub.msvcrt.dll_fwrite
mov dword [ebx + 0x64], sub.msvcrt.dll_fread
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], 0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0xa4], 0
mov dword [ebx + 0xc8], 0xffffffff
mov dword [ebx + 0xcc], 0xffffffff
mov dword [ebx + 0x48], 0xffffffff
mov dword [ebx + 0x4c], 0xffffffff
mov dword [ebx + 0x30], 0xffffffff
mov dword [ebx + 0x130], 1
mov dword [ebx + 0x324], 1
mov dword [ebx + 0x204], 1
mov dword [ebx + 0x208], 1
mov dword [ebx + 0x20c], 0
mov dword [ebx + 0x198], 1
mov dword [ebx + 0x17c], 0x3c
mov dword [ebx + 0x164], 5
mov dword [ebx + 0xc], 0x438
mov dword [ebx + 0x178], 0
mov dword [ebx + 0x24], 1
mov dword [ebx + 0x28], 1
mov dword [ebx + 0x1c4], 1
mov dword [ebx + 0x140], 1
mov dword [ebx + 0x144], 1
mov dword [ebx + 0x238], 0xffffffff
mov dword [ebx + 0x170], 1
mov dword [ebx + 0x244], 0x1a4
mov dword [ebx + 0x248], 0x1ed
mov dword [ebx + 0x310], 0xffffffff
mov dword [ebx + 0x314], 0xf3fffbef
mov dword [ebx + 0x318], 0
lea eax, [ebx + 0x2f4]
mov edx, str.rcmd
call fcn.0040716c
test eax, eax
jne 0x40803d
mov dword [esp], str.CURL_CA_BUNDLE
call sub.msvcrt.dll_getenv
mov edx, eax
lea eax, [ebx + 0x2a0]
call fcn.0040716c
mov dword [ebx + 0x32c], 0
mov dword [ebx + 0x330], 0
mov dword [ebx + 0x334], 0
mov dword [ebx + 0x344], 0
mov dword [ebx + 0x34c], 0x3c
mov dword [ebx + 0x348], 0x3c
mov dword [ebx + 0x354], 1
mov dword [ebx + 0x358], 1
mov dword [ebx + 0x35c], 0x3e8
add esp, 0x18
pop ebx
ret

Function at 0x40d850
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, eax
mov eax, dword [eax + 0x1e0]
test eax, eax
je 0x40d888
mov esi, dword [ebx + 0x16c]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
add esp, 0x34
pop ebx
pop esi
ret
cmp edx, 2
ja 0x40d8e8
mov eax, dword [ebx + 0x168]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 2
lea eax, [edx + edx*2 + 0x5a5a74]
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x168]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
call sub.msvcrt.dll_fwrite
xor eax, eax
add esp, 0x34
pop ebx
pop esi
ret
xor eax, eax
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x40d974
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
cmp eax, 0xffffffff
je 0x40d9b0
mov edx, dword [esp + 0x2c]
mov dword [edx], eax
xor eax, eax
add esp, 0x1c
ret
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x40d9c4
mov eax, 0x38
jmp 0x40d9ab
mov ax, 0x51
jmp 0x40d9ab

Function at 0x40e128
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x40]
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esi + eax*4 + 0x154]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov ebx, eax
mov dword [edi], 0
cmp eax, 0xffffffff
je 0x40e17c
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.WS2_32.dll_WSAGetLastError
mov ebp, eax
cmp eax, 0x2733
je 0x40e1c4
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0040227c
mov dword [esp + 8], eax
mov dword [esp + 4], str.Send_failure:__s
mov eax, dword [esi]
mov dword [esp], eax
call fcn.0040dcf0
mov eax, dword [esi]
mov dword [eax + 0x8644], ebp
mov dword [edi], 0x37
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi], 0x51
xor ebx, ebx
jmp 0x40e172