joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471230
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf258
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x4fa008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [0x4fee94]
push str.Try_allow_to_receive_the__u_windows_message
push dword [esi]
mov dword [ebp - 0x10], ebx
call fcn.004054f0
add esp, 8
cmp dword [0x4fed30], 0
jne 0x47129a
push 0x4fed30
mov dword [0x4fed30], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
neg eax
sbb eax, eax
and dword [0x4fed30], eax
cmp dword [0x4fed34], 6
jb 0x471395
push str.user32.dll
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.DynamicLibrary.0
mov dword [ebp - 0x18], 0
call fcn.00420380
mov dword [ebp - 4], 0
push str.user32.dll_successfully_loaded.
push dword [esi]
call fcn.004054f0
mov edi, dword [ebp - 0x18]
add esp, 8
push str.ChangeWindowMessageFilterEx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x47132a
push str.ChangeWindowMessageFilter
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x4713b8
push str.The_ChangeWindowMessageFilter___function_successfully_found.
push dword [esi]
call fcn.004054f0
add esp, 8
push 1
push dword [ebp - 0x10]
call ebx
cmp eax, 1
jne 0x4713d7
push str.The_ChangeWindowMessageFilter___function_successfully_executed.
jmp 0x47136c
push str.The_ChangeWindowMessageFilterEx___function_successfully_found.
push dword [esi]
call fcn.004054f0
add esp, 8
push 0
push 1
push ebx
push dword [ebp + 0xc]
call dword [ebp - 0x14]
cmp eax, 1
je 0x471367
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402f80
mov byte [ebp - 4], 2
push str.Cant_allow_to_receive_the__d_windows_message_by_the_ChangeWindowMessageFilterEx___function.
jmp 0x4713f0
push str.The_ChangeWindowMessageFilterEx___function_successfully_executed.
push dword [esi]
call fcn.004054f0
add esp, 8
test edi, edi
je 0x4713a4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.The_allowMessage___function_call_is_ignored.
push dword [esi]
call fcn.004054f0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x30]
push str.Cant_load_the_ChangeWindowMessageFilterEx___or_ChangeWindowMessageFilter___functions.
push eax
call fcn.00404c10
add esp, 8
lea eax, [ebp - 0x30]
push 0x4f7f80
push eax
call fcn.00499368
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402f80
mov byte [ebp - 4], 1
push str.Cant_allow_to_receive_the__d_windows_message_by_the_ChangeWindowMessageFilter___function.
lea eax, [ebp - 0x2c]
push eax
call fcn.004038a0
add esp, 8
lea ecx, [ebp - 0x2c]
push esi
call fcn.00403130
push eax
lea ecx, [ebp - 0x58]
call fcn.0041ccd0
push 0x4f80ac
lea eax, [ebp - 0x58]
push eax
call fcn.00499368
int3
Function at 0x477fb0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf871
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4fa008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ebx, [ecx + 4]
mov dword [ecx], 0
mov dword [ebp - 0x14], ebx
mov dword [ebx + 4], vtable.Rect.0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebp - 4], 0
lea edi, [ebx + 0x1c]
mov dword [ebp - 0x18], edi
lea esi, [edi + 4]
mov dword [edi], vtable.StringStorage.0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
push 1
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00403ad0
mov ecx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push 0x4cd35c
push ecx
call fcn.0049ae30
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, edi
mov byte [ebp - 4], 2
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi]
push dword [esi + 0x20]
call dword [eax + 4]
movzx eax, byte [esi + 0x2c]
mov byte [ebx + 0x2c], al
movzx eax, byte [esi + 0x2d]
mov byte [ebx + 0x2d], al
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x10]
mov eax, dword [0x4fee74]
mov dword [ebx + 0x38], vtable.Rect.0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], vtable.Region.0
mov dword [ebx + 0x50], eax
mov eax, dword [0x4fee78]
mov dword [ebx + 0x54], eax
lea eax, [ebx + 0x60]
mov dword [ebx + 0x58], 0x4fee84
push eax
mov dword [ebx + 0x5c], vtable.LocalMutex.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000fb0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1000fb1d
pop dword [ebp - 4]
mov eax, 0x1000fb1d
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x40cb5
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x29a4bf59
sub ecx, 0x29a47507
xor edi, edi
add edi, eax
mov edx, 0x1004bc00
add edx, dword [ebp - 4]
mov esi, 0x3a03b5ba
sub esi, 0xe94cd60a
mov ebx, dword [edx]
xor ebx, esi
mov dword [edi], ebx
add edi, 0xc0230d45
add edi, 0x3fdcf2bf
add edx, 0x221673d4
sub edx, 0x221673d0
loop 0x1000fb6e
add eax, 0x11c1b
xor ebx, ebx
add ebx, eax
add eax, 0xc9eb44ec
add eax, 0x3614bb19
mov ecx, 0xa1b33bbe
add ecx, 0x6e4cc442
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000fb0e
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000fb0e
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000fb0e
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.1000fb0e
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000fb0e
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret
Function at 0x6d7c1a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6d7c1adb
cmp byte [esi + ebx - 1], 0xa
je 0x6d7c1aaf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6d7c6084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6d7c2030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x6d7c6094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x6d7c21f0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x6d7c6094]
movzx eax, al
bt eax, esi
jae 0x6d7c2250
mov ecx, dword [0x6d7c6084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x6d7c20f6
test byte [0x6d7c3030], 8
jne 0x6d7c2190
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x6d7c3040], 8
jne 0x6d7c2140
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x6d7c20c5
cmp esi, 3
jbe 0x6d7c2100
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + str.0Qm6Qm:Qm_QmGCC:__GNU__13.2.0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x6d7c20c5
mov ecx, dword [0x6d7c6094]
test ecx, ecx
je 0x6d7c2230
mov dword [esp], 0x6d7c3040
call dword [0x6d7c6094]
test al, 8
je 0x6d7c209c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x6d7c209c
mov ebx, dword [0x6d7c6094]
test ebx, ebx
je 0x6d7c2210
mov dword [esp], 0x6d7c3030
call dword [0x6d7c6094]
test al, 8
je 0x6d7c2089
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x6d7c208f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x6d7c6094
call sym._load_func.part.0
jmp 0x6d7c2050
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x6d7c6094
call sym._load_func.part.0
jmp 0x6d7c219a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x6d7c6094
call sym._load_func.part.0
jmp 0x6d7c214e
mov eax, 0xffffffff
jmp 0x6d7c20f6
Function at 0x40188a
Capabilities:
Check if file exists
Delete file
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x418004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
push ecx
lea ecx, [ebp - 0x250]
call fcn.00401015
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00403dc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edi, [ebp - 0x20c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4018df
push 7
pop ecx
mov esi, str.aisinolove.dll
lea eax, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401978
push str.aisinolove1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], ebx
push eax
mov dword [ebp - 0x210], ebx
call fcn.00404a87
lea eax, [ebp - 0x20c]
mov dword [esp], 0x415ce8
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00404b70
pop ecx
pop ecx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x250]
call fcn.0040108a
lea ecx, [ebp - 0x214]
call fcn.00401000
cmp dword [ebp - 0x214], ebx
je 0x401978
push dword [ebp - 0x214]
call fcn.00404c2d
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.fnzprog
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4019a9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
inc esi
jmp 0x4019c1
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.004014c9
push ebx
push 1
lea ecx, [ebp - 0x250]
call fcn.004014c9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004019f2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x415fa3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x415fb2
pop dword [ebp - 0x10]
mov eax, 0x415fb2
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x40414
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x7c03dcc1
add ecx, 0x83fc74f0
xor esi, esi
add esi, eax
mov edi, 0x2d53ba47
sub edi, 0x2d106647
add edi, dword [ebp - 0x10]
mov ebx, 0x43846f88
add ebx, 0x3ab4f35c
xor dword [ebp - 0xc], ebx
mov edx, dword [edi]
add dword [ebp - 0xc], 0xfac4021a
add edx, ebx
xor dword [ebp - 4], 0x8fbbefaa
mov dword [esi], edx
sub dword [ebp - 8], 0x51b121ff
add esi, 0x892bc913
add esi, 0x76d436f1
add edi, 0xfa7d6630
add edi, 0x58299d4
loop 0x416009
add eax, 0x16c42c2b
sub eax, 0x16c2f294
mov ebx, eax
add eax, 0x2151b3b6
sub eax, 0x2151b3b1
mov ecx, 0xf496de0d
sub ecx, 0xf456de0d
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40f7b0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x5d7c7c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40f9c3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f9c3
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f7e3
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x40f9c3
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call fcn.00512920
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00512920
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push 0x5865cc
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f864
test al, 1
je 0x40f864
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x40f9a9
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40f99d
nop dword [eax]
test byte [ebp - 0x664], 0x10
je 0x40f918
cmp word [ebp - 0x638], 0x2e
jne 0x40f8d7
mov ax, word [ebp - 0x636]
test ax, ax
je 0x40f982
cmp ax, 0x2e
jne 0x40f8d7
cmp word [ebp - 0x634], 0
je 0x40f982
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00512920
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040f7b0
add esp, 4
jmp 0x40f980
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00512920
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f96f
test al, 1
je 0x40f96f
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40f8a0
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004acb88
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004acb88
mov esp, ebp
pop ebp
ret
Function at 0x40f9e0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40fa38
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fa38
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40fa18
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40fa38
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40fa33
test al, 0x10
je 0x40fa33
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40fa38
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x410130
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x410167
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.delete__s_succ__error_code_d
call fcn.0044d3f0
add esp, 0xc
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41015f
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4101aa
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4101aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.delete__s_succ__error_d
call fcn.0044d3f0
add esp, 0xc
mov eax, 1
pop esi
pop ebp
ret
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x435e70
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x435e86
mov eax, 1
pop edi
pop ebp
ret 4
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x435f44
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435f44
push esi
call fcn.004a6910
add esp, 4
test eax, eax
je 0x435f44
cmp dword [edi + 0xc], 0
jne 0x435f17
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0xc], eax
test eax, eax
je 0x435f3b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi + 0xc]
mov dword [edi + 0x10], eax
call esi
push str.zlib_uncompress
push dword [edi + 0xc]
mov dword [edi + 0x14], eax
call esi
push str.zlib_compress
push dword [edi + 0xc]
mov dword [edi + 0x1c], eax
call esi
push str.zlib_compressBound
push dword [edi + 0xc]
mov dword [edi + 0x20], eax
call esi
mov dword [edi + 0x24], eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x435f17
call eax
mov dword [edi + 0x18], eax
cmp dword [edi + 0x14], 0
je 0x435f3b
cmp dword [edi + 0x10], 0
je 0x435f3b
cmp dword [edi + 0x18], 0
je 0x435f3b
pop esi
mov dword [edi + 4], 1
mov eax, 1
pop edi
pop ebp
ret 4
mov eax, dword [edi + 4]
pop esi
pop edi
pop ebp
ret 4
pop esi
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x4373b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x437403
push edi
push ebx
call fcn.0042abe0
mov edi, dword [ebp + 0xc]
push edi
push ebx
push str.call_exe_begin__path__s__cmd__s_
call fcn.0044d3f0
add esp, 0xc
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
push ebx
call fcn.0042ade0
push dword [ebp + 0x14]
push edi
push ebx
push eax
push str.call_exe_return___d___path__s___cmd__s___sync__d_
call fcn.0044d3f0
add esp, 0x14
pop edi
pop ebx
pop ebp
ret

Function at 0x438bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c5f2
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d7c7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x240], esi
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x23c], 0
call fcn.00512920
add esp, 0xc
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x234], 0x208
call fcn.0040cdc0
mov ecx, eax
test ecx, ecx
je 0x438d39
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
mov dword [ebp - 0x23c], 1
je 0x438c5a
push 1
jmp 0x438c5c
push 2
push eax
call fcn.00438d50
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x438c6d
mov eax, dword [eax]
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x238]
push ecx
push str.VendorID
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x230]
call fcn.00410a90
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438ca7
sub ecx, edx
sar ecx, 1
je 0x438d1d
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0040d900
mov ecx, esi
call fcn.0043cca0
mov ecx, esi
call fcn.0043cba0
mov eax, dword [esi]
mov ecx, 0x588c48
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x438d06
test dx, dx
je 0x438d02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x438d06
add eax, 4
add ecx, 4
test dx, dx
jne 0x438ce0
xor eax, eax
jmp 0x438d0b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x438d1d
push 7
push 0x586318
mov ecx, esi
call fcn.0040d900
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004acb88
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040ae00
int3
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7b5537ef
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x30c77a5d
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1003ebe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003ebf3
test al, 0x10
jne 0x1003ebf3
mov al, 1
ret
xor al, al
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx