joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406545
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
mov dword [ebp - 0x21c], eax
xor esi, esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.00406512
mov ebx, eax
cmp ebx, esi
je 0x4065ad
cmp dword [ebp - 0x214], esi
je 0x4065a6
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x406648
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4065d5
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.00406545
mov dword [ebp - 0x220], eax
cmp eax, esi
jne 0x406659
lea eax, [ebp - 0x228]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x4065b5
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], esi
je 0x406620
push dword [ebp - 0x214]
call ebx
mov dword [ebp - 0x214], esi
push dword [ebp - 0x21c]
mov dword [ebp - 0x210], esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
cmp dword [ebp - 0x214], esi
je 0x406646
push dword [ebp - 0x214]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret 4
cmp dword [ebp - 0x214], esi
je 0x40666d
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x220]
jmp 0x406648
Function at 0x407763
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40777a
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4077af
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x4077ab
cmp edi, eax
jae 0x4077af
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40779d
cmp edi, eax
jb 0x4077b3
xor eax, eax
jmp 0x4077bc
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x4093cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi]
push ebx
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20119
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x409439
cmp dword [ebp - 4], edi
je 0x409439
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x409439
push dword [ebp - 8]
push edi
push dword [ebp + 0x18]
call fcn.00596530
add esp, 0xc
mov dword [esi], edi
xor eax, eax
jmp 0x40943b
mov eax, ebx
pop edi
pop ebx
leave
ret

Function at 0x40943f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
mov ebx, 0x20106
push ebx
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
cmp eax, 5
jne 0x409496
push dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.004091d8
pop ecx
test eax, eax
jne 0x4094c1
push esi
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jne 0x4094c1
cmp dword [ebp - 4], esi
je 0x4094c1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409855
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
lea ebp, [esp - 0x3e8]
sub esp, 0x468
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x3e4], eax
push esi
call fcn.004807e6
xor esi, esi
test eax, eax
jne 0x4098eb
push 0x206
mov word [ebp + 0x1dc], ax
lea eax, [ebp + 0x1de]
push esi
push eax
call fcn.00596530
push dword [ebp + 0x3f4]
lea eax, [ebp + 0x1dc]
push str.__flag
push dword [ebp + 0x3f0]
push str.__dword
push 2
push str.__class
push str._s_d__s_d__s_d
push 0x103
push eax
call fcn.0058f42f
add esp, 0x30
push 5
push esi
lea eax, [ebp + 0x1dc]
push eax
push 0x63c060
push str.runas
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40998d
push edi
xor eax, eax
push 0x40e
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2a]
push esi
push eax
call fcn.00596530
push dword [ebp + 0x3f4]
lea eax, [ebp - 0x2c]
push str.__flag
push dword [ebp + 0x3f0]
push str.__dword
push 2
push str.__class
push 0x63c060
push str.__s___s_d__s_d__s_d
push 0x207
push eax
call fcn.0058f42f
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00596530
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
add esp, 0x40
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
je 0x40998d
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
mov ecx, dword [ebp + 0x3e4]
xor ecx, ebp
pop esi
call fcn.0058f3cf
add ebp, 0x3e8
leave
ret 8
Function at 0x40a723
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
cdq
push 3
pop ecx
idiv ecx
lea eax, [ebx + 2]
xor esi, esi
mov dword [ebp - 8], edx
cdq
idiv ecx
lea eax, [eax*4 + 1]
push eax
call fcn.0058e040
pop ecx
mov ecx, eax
test ecx, ecx
je 0x40a815
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
jle 0x40a7d2
cdq
push 3
pop ebx
idiv ebx
mov eax, dword [ebp - 4]
test edx, edx
jne 0x40a777
movzx edx, byte [eax + edi]
shr edx, 2
jmp 0x40a7bd
cmp edx, 1
jne 0x40a797
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 3
shl edx, 4
shr ebx, 4
mov dl, byte [edx + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40a7c3
cmp edx, 2
jne 0x40a7c7
movzx edx, byte [eax + edi - 1]
movzx ebx, byte [eax + edi]
and edx, 0xf
shr ebx, 6
mov dl, byte [ebx + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
movzx edx, byte [eax + edi]
inc esi
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], dl
inc esi
mov ebx, dword [ebp + 8]
inc eax
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x40a761
cmp dword [ebp - 8], 1
jne 0x40a7f3
movzx eax, byte [edi + ebx - 1]
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
jmp 0x40a80b
cmp dword [ebp - 8], 2
jne 0x40a811
movzx eax, byte [edi + ebx - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
inc esi
mov byte [ecx + esi], 0x3d
inc esi
mov byte [ecx + esi], 0
pop esi
mov eax, ecx
pop ebx
leave
ret

Function at 0x40b5f0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
xor ebx, ebx
mov esi, 0x103
push esi
lea eax, [ebp - 0x77]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], bl
call fcn.00596530
add esp, 0xc
push esi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x40b69a
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x40b69a
push 2
pop ecx
cmp cx, word [eax + 8]
jne 0x40b69a
mov eax, dword [eax + 0xc]
cmp eax, ebx
je 0x40b69a
cmp dword [eax], ebx
je 0x40b69a
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
cmp eax, ebx
je 0x40b69a
push eax
lea ebx, [ebp - 0x80]
call fcn.0047f402
push dword [eax]
push 0x5db9e0
push 0x3e
push edi
call fcn.0058f42f
mov eax, dword [ebp - 0x80]
add esp, 0x14
add eax, 0xfffffff0
call fcn.00407b6b
cmp word [edi], 0
je 0x40b69a
mov dword [ebp - 0x7c], 1
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp - 0x7c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
add ebp, 0x90
leave
ret
Function at 0x40d271
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x214], 0
push ebx
push esi
push edi
push eax
mov edi, ecx
mov dword [ebp - 0x218], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d31f
call fcn.0040fa4b
lea eax, [edi + 0x20]
call fcn.0040fa9c
xor esi, esi
inc esi
push esi
mov dword [edi + 0x3c], esi
call fcn.0040d164
pop ecx
call fcn.00470045
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00596530
add esp, 0xc
call fcn.00404063
push eax
push 0x5dddbc
mov ecx, 0x104
lea edi, [ebp - 0x210]
call fcn.00405374
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x218]
mov ebx, edi
call fcn.0042d9b3
add esp, 0xc
test eax, eax
je 0x40d319
mov dword [ebp - 0x214], esi
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret 8
Function at 0x40e0d8
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x5bcf47
call fcn.00598f2b
xor ebx, ebx
push 1
mov dword [ebp - 0x14], ebx
call fcn.0040d164
pop ecx
mov edi, eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e1cb
push ebx
mov eax, edi
call fcn.0046ffe2
test eax, eax
je 0x40e1cb
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push str.select__from_bookmark_main_where_bm_type__0_limit__u_
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00404f66
pop ecx
pop ecx
push dword [ebp - 0x10]
push edi
call fcn.0047016d
mov ebx, eax
test ebx, ebx
je 0x40e1c0
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov ecx, esi
lea esi, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call fcn.0040c2a6
mov byte [ebp - 4], 1
jmp 0x40e19a
push 5
lea edi, [ebp - 0x1c]
call fcn.00470212
test eax, eax
je 0x40e19a
push ebx
push 6
lea edi, [ebp - 0x18]
call fcn.00470212
test eax, eax
je 0x40e19a
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004da934
mov dword [ebp - 0x14], 1
push ebx
call fcn.004701be
push ebx
test eax, eax
jne 0x40e16a
call fcn.004701db
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x14]
call fcn.00599003
ret 4
Function at 0x40e2b9
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x5bcf1c
call fcn.00598f2b
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp word [esi], bx
je 0x40e3d2
push 1
call fcn.0040d164
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40e3d2
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e3d2
push ebx
mov eax, edi
call fcn.0046ffe2
test eax, eax
je 0x40e3d2
mov eax, dword [0x63696c]
mov ecx, 0x63696c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp + 0x14]
push eax
cmp dword [ebp + 0x14], ebx
je 0x40e348
call fcn.004275de
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
push dword [ecx]
push dword [eax]
lea eax, [ebp - 0x10]
push str.select__from_bookmark_main_where_bm_url___s_and_bm_type__0_and_bm_parent___d_
call fcn.00404f66
add esp, 0x14
jmp 0x40e363
call fcn.004275de
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x10]
push str.select__from_bookmark_main_where_bm_url___s_and_bm_type__0_
call fcn.00404f66
add esp, 0x10
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.00407b6b
push dword [ebp - 0x10]
push edi
call fcn.0047016d
mov esi, eax
cmp esi, ebx
je 0x40e3c7
jmp 0x40e3ae
push dword [ebp + 0xc]
push ebx
push esi
call fcn.004701ef
test eax, eax
je 0x40e3ae
push dword [ebp + 8]
push 3
push esi
call fcn.004701ef
test eax, eax
je 0x40e3ae
mov edi, dword [ebp + 0x10]
push esi
push 5
call fcn.00470212
cmp eax, ebx
jne 0x40e3ba
push esi
call fcn.004701be
test eax, eax
jne 0x40e382
jmp 0x40e3c1
mov dword [ebp - 0x14], 1
push esi
call fcn.004701db
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x14]
call fcn.00599003
ret 0x10

Function at 0x40e3dd
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x5c09a4
call fcn.00598f2b
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp word [esi], bx
je 0x40e492
push 1
call fcn.0040d164
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40e492
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e492
push ebx
mov eax, edi
call fcn.0046ffe2
test eax, eax
je 0x40e492
mov eax, dword [0x63696c]
mov ecx, 0x63696c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push str.select__from_bookmark_main_where_bm_parent___d_and_bm_title___s_and_bm_type___d_
call fcn.00404f66
add esp, 0x10
push dword [ebp - 0x10]
push edi
call fcn.0047016d
mov esi, eax
cmp esi, ebx
je 0x40e487
jmp 0x40e46e
push dword [ebp + 0x10]
push ebx
push esi
call fcn.004701ef
test eax, eax
jne 0x40e47a
push esi
call fcn.004701be
test eax, eax
jne 0x40e460
jmp 0x40e481
mov dword [ebp - 0x14], 1
push esi
call fcn.004701db
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x14]
call fcn.00599003
ret 0xc
Function at 0x412a1f
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov esi, ecx
push 0xfeeb
push dword [esi + 4]
call edi
push 0xfeee
push dword [esi + 4]
call edi
push 0xfeed
push dword [esi + 4]
call edi
push 0xfee5
push dword [esi + 4]
call edi
push dword [esi + 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x412a7e
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
ret

Function at 0x412b23
Capabilities:
Find taskbar

Disassembly:
push dword [0x63f33c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x412b70
push 0x5d0be4
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x412b70
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push str.ReBarWindow32
push 0
push eax
call esi
test eax, eax
je 0x412b6f
push 0
push str.MSTaskSwWClass
push 0
push eax
call esi
mov dword [0x63f33c], eax
pop esi
mov eax, dword [0x63f33c]
ret
Function at 0x4146f4
Capabilities:
Read file via mapping

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0xf001f
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
ret 4

Function at 0x417bef
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ecx
push esi
push edi
mov edi, 0xa000
push edi
mov dword [esp + 0xc], edi
call fcn.0058e040
mov esi, eax
pop ecx
test esi, esi
je 0x417cc9
push ebp
push edi
push 0
push esi
call fcn.00596530
mov eax, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], eax
lea eax, [esp + 0xc]
push eax
push esi
push str.cookie:
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov ebp, eax
test ebp, ebp
je 0x417cc1
push ebx
mov ebx, dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
mov eax, dword [esi + 4]
test eax, eax
je 0x417c92
push 0x637f58
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x417c92
push dword [0x638058]
push 0x637fd8
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNA]
test eax, eax
je 0x417c92
push dword [esi + 4]
call ebx
test eax, eax
jne 0x417c92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x417c92
push 0
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFileA]
push dword [esi + 4]
call ebx
push edi
push 0
push esi
mov dword [esp + 0x1c], edi
call fcn.00596530
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi], eax
lea eax, [esp + 0x10]
push eax
push esi
push ebp
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x417c41
push ebp
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
pop ebx
push esi
call fcn.0058f3c4
pop ecx
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x418b3e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
push esi
push edi
mov dword [ebp - 8], eax
cmp dword [ebp + 8], eax
je 0x418c1c
cmp dword [ebp + 0x14], eax
je 0x418c1c
lea edi, [ebx + 2]
push edi
call fcn.0058e040
mov esi, eax
pop ecx
test esi, esi
je 0x418c17
push edi
push 0
push esi
call fcn.00596530
push ebx
push dword [ebp + 8]
push esi
call fcn.005965b0
push ebx
call fcn.00418e2e
push dword [ebp + 0x10]
mov ecx, esi
push ebx
mov dword [ebp + 8], eax
call fcn.00418e13
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push 0x10
pop edi
push 5
push dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push 0
push 0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
and dword [ebp - 4], 0
push 0x5dec60
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call fcn.0059308d
add esp, 0xc
test eax, eax
jne 0x418c09
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push 1
push edi
push eax
call fcn.00593819
push dword [ebp - 4]
push ebx
push 1
push esi
call fcn.00593819
push dword [ebp - 4]
call fcn.00593912
add esp, 0x24
push esi
call fcn.0058f807
pop ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
jmp 0x418c1e
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x418c22
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418d0e
push 0x5dec58
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
call fcn.0059308d
add esp, 0xc
test eax, eax
jne 0x418d0b
push 2
push esi
push dword [ebp - 4]
call fcn.0059316a
push dword [ebp - 4]
call fcn.0059338c
push esi
push esi
push dword [ebp - 4]
mov ebx, eax
call fcn.0059316a
add esp, 0x1c
cmp ebx, 0x10
jb 0x418d02
push dword [ebp - 4]
xor eax, eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push 0x10
push eax
call fcn.0059369a
add esp, 0x10
cmp dword [ebp - 0x18], 0x10
jne 0x418d02
mov edi, dword [ebp - 0x10]
lea eax, [edi + 0x10]
cmp ebx, eax
jne 0x418d02
lea ebx, [edi + 2]
push ebx
call fcn.0058e040
mov esi, eax
pop ecx
test esi, esi
je 0x418d02
push ebx
push 0
push esi
call fcn.00596530
push dword [ebp - 4]
xor ebx, ebx
push edi
inc ebx
push ebx
push esi
call fcn.0059369a
push dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.00418e13
push edi
call fcn.00418e2e
add esp, 0x28
cmp eax, dword [ebp - 0xc]
jne 0x418d02
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call fcn.00593912
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418d6c
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418e0e
push 0x5dec58
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
call fcn.0059308d
add esp, 0xc
test eax, eax
jne 0x418e0c
push 2
push esi
push dword [ebp - 4]
call fcn.0059316a
push dword [ebp - 4]
call fcn.0059338c
push esi
push esi
push dword [ebp - 4]
mov ebx, eax
call fcn.0059316a
add esp, 0x1c
cmp ebx, 0x10
jb 0x418e03
push dword [ebp - 4]
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.0059369a
add esp, 0x10
cmp dword [ebp - 0x14], 0x10
jne 0x418e03
mov eax, dword [ebp - 0xc]
add eax, 0x10
cmp ebx, eax
jne 0x418e03
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dword [ecx], eax
inc esi
push dword [ebp - 4]
call fcn.00593912
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418e13
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp ecx, eax
je 0x418e2d
cmp dword [esp + 4], eax
jbe 0x418e2d
mov dl, byte [esp + 8]
xor byte [eax + ecx], dl
inc eax
cmp eax, dword [esp + 4]
jb 0x418e1f
ret