joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b17ba
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x4b18f0
push ebx
mov edx, dword [edx + 0x1050]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x4b18cb
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x4b1819
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x4b17f5
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x4b4be2
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x4b4c03
mov eax, 0x8876086c
jmp 0x4b4ce5
cmp dword [ebp + 0x7c], esi
je 0x4b4c7d
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x4b4c5d
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004ce570
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x4b4c7d
push esi
push 0x10000000
push 3
push esi
push 1
push connect
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x4b4c96
push esi
push 0x10000000
push 3
push esi
push 1
push connect
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x4b4cd6
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x4b4cd6
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x4b4cd6
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x4b4ce3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x4b4ce5
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x4b91b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4b91dd
push esi
call fcn.004bf378
cmp byte [esi + 0x40], 0
pop ecx
je 0x4b91d6
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4b924c
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x4b9241
mov eax, dword [esi + 8]
test eax, eax
je 0x4b91fe
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x4b923d
cmp eax, 2
je 0x4b9241
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4b91f3
cmp eax, 3
je 0x4b9222
cmp eax, 1
jne 0x4b91f3
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x4b91f3
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4b91f3
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x4b926a
cmp eax, 0xcc
je 0x4b926a
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.004b9083
pop esi
ret
Function at 0x4c0c73
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4c0c81
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x4c0d55
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4ea1d8]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4ea1d8]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4ea1d8]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4ea1d8]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4ea1d8]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4ea1d8]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x4ea1d8]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x4ea1d8]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x4c0c9e
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x4c0d75
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x4ea1d8]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x4c0d5b
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x4ccd49
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x52382c]
jne 0x4ccd53
repz ret
jmp fcn.004d1842

Function at 0x4d9a62
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4d9a89
call fcn.004d2991
mov dword [eax], esi
call fcn.004d297e
push 0x16
pop esi
mov dword [eax], esi
call fcn.004d292c
mov eax, esi
jmp 0x4d9ade
test dword [ebp + 0xc], 0xfffffff9
jne 0x4d9a6f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4d9ab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004d29a4
pop ecx
call fcn.004d297e
mov eax, dword [eax]
jmp 0x4d9ade
test al, 0x10
jne 0x4d9adc
test al, 1
je 0x4d9adc
test byte [ebp + 0xc], 2
je 0x4d9adc
call fcn.004d2991
mov dword [eax], 5
call fcn.004d297e
mov dword [eax], 0xd
jmp 0x4d9aad
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4df3cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x52382c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004d4406
and dword [ebp - 0x14], 0
cmp dword [0x4228c80], 0
mov dword [ebp - 0x18], eax
jne 0x4df47f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4df527
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4df527
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4228c80], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4228c84], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4228c88], eax
call edi
push eax
call esi
mov dword [0x4228c90], eax
test eax, eax
je 0x4df47f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4228c8c], eax
mov eax, dword [0x4228c8c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4df4d8
cmp dword [0x4228c90], ecx
je 0x4df4d8
push eax
call esi
push dword [0x4228c90]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4df4d8
test ebx, ebx
je 0x4df4d8
call edi
test eax, eax
je 0x4df4cf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4df4cf
test byte [ebp - 8], 1
jne 0x4df4d8
or dword [ebp + 0x10], 0x200000
jmp 0x4df50b
mov eax, dword [0x4228c84]
cmp eax, dword [ebp - 0x18]
je 0x4df50b
push eax
call esi
test eax, eax
je 0x4df50b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4df50b
mov eax, dword [0x4228c88]
cmp eax, dword [ebp - 0x18]
je 0x4df50b
push eax
call esi
test eax, eax
je 0x4df50b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4228c80]
call esi
test eax, eax
je 0x4df527
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4df529
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ccd49
leave
ret
Function at 0x4059ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push edi
sub eax, dword [0x4235c7]
mov eax, dword [ebp + 0xc]
or dword [0x417e4d], edx
mov dword [ebp - 0x10], eax
mov dword [0x417e55], 0x17
cmp dword [0x417e55], 0
je 0x405a58
cmp dword [0x417e55], 6
jne 0x405a2a
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x417e45
push 0x80ed
push 0x67be
push 0x6b4c
push dword [ebp - 0x20]
call dword [sym.imp.kernel32.dll_FormatMessageW]
cmp dword [0x417e55], 7
jne 0x405a46
sub ecx, ecx
or ecx, dword [0x417e55]
dec ecx
mov dword [0x417e55], ecx
mov ecx, dword [0x417e55]
dec ecx
mov dword [0x417e55], ecx
jmp 0x4059ed
mov eax, dword [ebp + 8]
or dword [0x417e41], 0x3fc5
mov dword [ebp + 8], 0xf89c8538
sub ecx, ecx
add ecx, dword [0x4235c3]
and dword [0x41abd6], ecx
mov dword [ebp - 0x20], 0xf89c853b
mov edx, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, 0x7510859
sub edx, eax
adc ecx, ecx
mov ecx, 0x32729f
movzx edi, word [0x41510d]
sbb dword [0x4235cf], edi
add edx, ecx
add dword [0x412354], 0x1575
mov dword [ebp - 8], edx
jmp 0x405c03
mov edx, dword [ebp + 8]
and dword [0x4235d7], 0
jmp 0x405c24
sub edi, edi
or edi, dword [0x4235d7]
inc edi
mov dword [0x4235d7], edi
cmp dword [0x4235d7], 0x11
jae 0x405c52
cmp dword [0x4235d7], 0x1a
jne 0x405c47
push dword [ebp - 0x1c]
call dword [sym.imp.COMDLG32.DLL_GetOpenFileNameA]
jmp 0x405c15
sub edx, eax
add edx, ecx
jmp 0x405da8
mov dword [ebp + 0xc], edx
inc edi
jmp 0x405efe
mov dword [ebp - 4], 0xf89c85d8
xor edi, edi
xor edi, dword [0x415109]
adc edi, dword [0x4235bf]
mov dword [0x415109], edi
mov dword [ebp - 0x28], 0xf89c853a
mov dword [ebp - 0x2c], 0xf89c853d
adc edi, edi
mov dword [ebp - 0x30], 0xf89c853c
or dword [0x4235cf], edx
mov dword [ebp - 0x34], 0xf89c853f
mov dword [0x417e41], 0x15
cmp dword [0x417e41], 0
je 0x405fad
cmp dword [0x417e41], 5
jne 0x405f7b
push 0x43a6
push str.UZM_KTIB
push str.DBA_UM7C_LO6BM
push 0x400000
call dword [sym.imp.kernel32.dll_FindResourceExA]
cmp dword [0x417e41], 6
jne 0x405f95
mov edi, dword [0x417e41]
dec edi
mov dword [0x417e41], edi
mov edi, dword [0x417e41]
dec edi
mov dword [0x417e41], edi
jmp 0x405f47
mov dword [ebp - 0x38], 0xf89c853e
and dword [0x412364], 0xe44
mov dword [ebp - 0x3c], 0xf89c8531
or dword [0x417e49], 0x6f97
mov edx, dword [ebp + 8]
and dword [0x417e55], 0
jmp 0x405fee
mov edi, dword [0x417e55]
inc edi
mov dword [0x417e55], edi
cmp dword [0x417e55], 0x14
jae 0x40601e
cmp dword [0x417e55], 0x1c
jne 0x406013
push 0x67ac
call dword [sym.imp.COMDLG32.DLL_GetSaveFileNameW]
jmp 0x405fe1
sub edx, eax
mov edi, dword [ebp - 0x10]
add edx, ecx
cmp edi, edx
mov dword [0x412368], 0x5602
je 0x407427
mov dword [0x415109], 0xf2d
jmp 0x406193
push ebx
jmp 0x40715e
Function at 0x403e62
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
xor esi, esi
mov ebx, esi
cmp eax, dword [edi + 8]
jne 0x403fd5
push 0x802
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x403fe2
push 0x802
push esi
push ebx
call sub.MSVCR100.dll_memset
mov edx, dword [edi + 0x20]
add esp, 0xc
lea ecx, [edi + 8]
test edx, edx
jne 0x403ec9
push esi
push ecx
push 0x800
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403fd8
jmp 0x403ede
mov eax, dword [edx]
push ecx
push 0x800
push ebx
push edx
call dword [eax + 0xc]
test eax, eax
js 0x403fd8
lea eax, [edi + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x403fd8
cmp dword [edi + 0x14], esi
jne 0x403f35
movsx edx, byte [ebx]
cmp edx, 0xff
jne 0x403f0e
movsx eax, byte [ebx + 1]
cmp eax, 0xfe
jne 0x403f0e
xor eax, eax
inc eax
mov dword [edi + 0x18], eax
jmp 0x403f2c
cmp edx, 0xfe
jne 0x403f29
movsx eax, byte [ebx + 1]
cmp eax, 0xff
jne 0x403f29
xor eax, eax
inc eax
mov dword [edi + 0x1c], eax
jmp 0x403f09
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [edi + 0x14], eax
lea eax, [edi + 8]
cmp dword [edi + 0x18], esi
je 0x403f3e
shr ecx, 1
mov dword [eax], ecx
cmp dword [edi + 0x1c], esi
je 0x403f6f
mov eax, dword [eax]
lea eax, [eax*2 - 2]
test eax, eax
je 0x403f6f
dec eax
shr eax, 1
inc eax
lea edx, [ebx + 1]
mov dword [ebp - 8], eax
mov edi, eax
mov cl, byte [edx - 1]
mov al, byte [edx]
mov byte [edx - 1], al
mov byte [edx], cl
add edx, 2
dec edi
jne 0x403f5c
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], esi
je 0x403f83
push dword [edi + 0x10]
call fcn.00403feb
mov dword [edi + 0x10], ebx
mov ebx, esi
jmp 0x403fc5
mov eax, dword [0x4091b4]
test al, 1
jne 0x403fa4
or eax, 1
mov dword [0x4091b4], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, eax
mov dword [0x4091b0], ecx
jmp 0x403faa
mov ecx, dword [0x4091b0]
push 0x800
push dword [edi + 0x10]
push dword [edi + 8]
push ebx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [edi + 8], eax
test eax, eax
je 0x403fd8
cmp dword [ebp - 4], esi
je 0x403fd2
cmp dword [edi + 0x18], esi
je 0x403fd2
xor esi, esi
inc esi
mov dword [edi + 0xc], esi
xor esi, esi
inc esi
test ebx, ebx
je 0x403fe2
push ebx
call fcn.00403feb
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x404114
Capabilities:
Download url
Parse url
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x437c
call fcn.00406c0a
mov eax, dword [0x40202c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x38
lea eax, [ebp - 0x4378]
push esi
push eax
mov dword [ebp - 0x437c], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
test edi, edi
je 0x404284
cmp word [edi], si
je 0x404284
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll__wcsnicmp]
push 7
push edi
push 0x401b4c
call ebx
add esp, 0xc
test eax, eax
je 0x404199
push 8
push edi
push 0x401b5c
call ebx
add esp, 0xc
test eax, eax
je 0x404199
push 6
push edi
push 0x401b70
call ebx
add esp, 0xc
test eax, eax
jne 0x404283
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp word [eax], si
je 0x4041a8
add eax, 2
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_CreateUrlCacheEntryW]
test eax, eax
je 0x404283
xor eax, eax
mov word [ebp - 0x22a4], ax
mov word [ebp - 0x1258], ax
mov word [ebp - 0x32f0], ax
lea eax, [ebp - 0x1258]
mov dword [ebp - 0x436c], eax
lea eax, [ebp - 0x22a4]
mov dword [ebp - 0x4350], eax
lea eax, [ebp - 0x32f0]
mov dword [ebp - 0x4348], eax
lea eax, [ebp - 0x437c]
push eax
push esi
mov ebx, 0x825
push esi
push edi
mov dword [ebp - 0x437c], 0x3c
mov dword [ebp - 0x4368], ebx
mov dword [ebp - 0x434c], ebx
mov dword [ebp - 0x4344], ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x40425b
lea eax, [ebp - 0x4340]
push eax
lea eax, [ebp - 0x433c]
push eax
push 0x80000000
lea eax, [ebp - 0x437c]
push eax
mov dword [ebp - 0x4340], ebx
call dword [sym.imp.WININET.dll_InternetCreateUrlW]
test eax, eax
je 0x404283
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x433c]
push eax
push esi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x404283
lea eax, [ebp - 0x20c]
push eax
call fcn.00406670
mov esi, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00406887
leave
ret 4

Function at 0x404385
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
push edi
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x4043ba
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x4043f3
mov edx, dword [ebp - 4]
test edi, edi
jne 0x4043c7
test esi, esi
jmp 0x4043e1
test esi, esi
je 0x4043ea
cmp edx, 1
je 0x4043d5
cmp edx, 2
jne 0x4043ea
mov ecx, dword [edi]
cmp ecx, 2
jb 0x4043e3
cmp word [ecx + esi - 2], bx
je 0x4043ea
mov eax, 0x8000ffff
jmp 0x4043f3
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4043f3
mov dword [ecx], edx
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x405a64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x40202c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 3
push ebx
xor edi, edi
mov dword [ebp - 0x40c], 0x201
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_UrlIsW]
test eax, eax
je 0x405ad3
push 0x402
lea eax, [ebp - 0x408]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_PathCreateFromUrlW]
test eax, eax
js 0x405acd
lea esi, [ebp - 0x408]
xor edi, edi
test esi, esi
jne 0x405ad5
mov esi, ebx
push 1
push 0
push esi
push 0x401fa0
push 0x401168
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x405af6
mov edi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406887
leave
ret 4
Function at 0x4066c2
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
jne 0x406708
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4067ba
and esi, 0xffff
or esi, 0x80070000
jmp 0x4067ba
cmp dword [ebp - 4], 1
jle 0x4067a4
push dword [ebx + 4]
push 0x40200c
call dword [sym.imp.MSVCR100.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4067a4
cmp dword [ebp - 4], 4
mov dword [ebp - 8], edi
jl 0x4067a4
mov eax, dword [ebx + 8]
push 3
pop esi
push dword [ebx + 0xc]
mov dword [ebp - 0xc], eax
push 0x402018
call dword [sym.imp.MSVCR100.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40675b
cmp dword [ebp - 4], 6
jne 0x4067a4
mov eax, dword [ebx + 0x10]
push 5
mov dword [ebp - 8], eax
pop esi
lea eax, [esi + 1]
cmp eax, dword [ebp - 4]
jne 0x4067a4
push edi
push dword [ebx + esi*4]
call fcn.00403fff
mov edi, eax
test edi, edi
jne 0x406779
mov esi, 0x80004005
jmp 0x4067a9
lea esi, [edi + 8]
push esi
push dword [edi]
call fcn.00404296
cmp dword [esi], 0
jne 0x406790
mov eax, dword [ebp - 8]
test eax, eax
jne 0x406793
mov eax, dword [ebp - 0xc]
push dword [esi]
push eax
push dword [edi + 4]
push dword [edi]
call fcn.00404f77
mov esi, eax
jmp 0x4067a9
mov esi, 0x80070057
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
je 0x4067ba
push edi
call fcn.0040407f
xor eax, eax
test esi, esi
sets al
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4067c9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x40202c], eax
je 0x4067eb
cmp dword [0x40202c], ebx
jne 0x406884
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x40202c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x40202c], esi
test esi, esi
jne 0x40685a
mov dword [0x40202c], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x40202c
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x40202c]
not eax
mov dword [0x40918c], eax
pop esi
pop ebx
leave
ret
Function at 0x406887
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40202c]
jne 0x406cb9
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4092e0], eax
mov dword [0x4092dc], ecx
mov dword [0x4092d8], edx
mov dword [0x4092d4], ebx
mov dword [0x4092d0], esi
mov dword [0x4092cc], edi
mov word [0x4092f8], ss
mov word [0x4092ec], cs
mov word [0x4092c8], ds
mov word [0x4092c4], es
mov word [0x4092c0], fs
mov word [0x4092bc], gs
pushfd
pop dword [0x4092f0]
mov eax, dword [ebp]
mov dword [0x4092e4], eax
mov eax, dword [ebp + 4]
mov dword [0x4092e8], eax
lea eax, [ebp + 8]
mov dword [0x4092f4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x409230], 0x10001
mov eax, dword [0x4092e8]
mov dword [0x4091e4], eax
mov dword [0x4091d8], 0xc0000409
mov dword [0x4091dc], 1
mov eax, dword [0x40202c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x40918c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x409228], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x402038
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x409228], 0
jne 0x406da5
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret