joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c326
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x437eac], 1
mov ebx, ecx
mov dword [ebp - 0xe8], ebx
jne 0x40340d
mov eax, dword [0x4362dc]
or dword [0x437eac], 1
push 0x42cd10
mov dword [0x437ea8], eax
call fcn.004122eb
add esp, 4
mov ecx, dword [0x437ea8]
cmp dword [ecx - 8], 0
je 0x40342a
mov edi, 0x437ea8
mov eax, ebx
call fcn.00402040
jmp 0x403642
push ebx
mov eax, 0x104
call fcn.00402770
lea edx, [ebp - 0xe0]
push edx
push eax
lea eax, [ebp - 0xdc]
push eax
push str.ProgrameModulesDir
push str.SOFTWARESogouSoftware
push 0x80000002
mov dword [ebp - 0xe0], 0x104
call dword [sym.imp.SHLWAPI.dll_S_utValueW]
test eax, eax
jne 0x403493
mov edi, ebx
call fcn.00402a90
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebx]
mov dword [edx - 8], eax
mov ecx, dword [ebx]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, 0x437ea8
call fcn.00402040
jmp 0x403642
mov eax, dword [0x4362dc]
mov dword [ebp - 0xdc], eax
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0
call fcn.00403670
test eax, eax
jne 0x4034e3
mov eax, dword [ebp - 0xdc]
lea ecx, [eax - 0xc]
cmp ecx, 0x4362cc
je 0x4034dc
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edi, dword [ebp - 0xdc]
cmp dword [edi - 0xc], 0
lea eax, [edi - 0xc]
mov dword [ebp - 0xe0], eax
jl 0x403507
push eax
mov dword [ebp - 0xe4], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x40352e
mov edx, dword [0x4362dc]
push edi
mov dword [ebp - 0xe4], edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
mov ebx, eax
lea esi, [ebp - 0xe4]
call fcn.004028d0
mov ebx, dword [ebp - 0xe8]
xor eax, eax
push 0xc6
push eax
lea ecx, [ebp - 0xd6]
mov byte [ebp - 4], 1
push ecx
mov word [ebp - 0xd8], ax
call fcn.00415d50
add esp, 0xc
push str.manifest.cfg
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.manifest.cfg
lea edx, [ebp - 0xe4]
push edx
mov esi, eax
call fcn.004029f0
mov esi, dword [ebp - 0xe4]
push esi
push 0x64
lea eax, [ebp - 0xd8]
push eax
push 0
Function at 0x403580
Capabilities:
Read .ini file

Disassembly:
test eax, eax
jg 0x4034dc
push esi
call fcn.00411ad6
add esp, 4
xor eax, eax
jmp 0x403647
push str.version
push str.modules
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x4035d5
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [esi - 0xc]
cmp ecx, 0x4362cc
je 0x4035b8
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x4035b8
push esi
call fcn.00411ad6
add esp, 4
add edi, 0xfffffff4
cmp edi, 0x4362cc
je 0x4034dc
mov esi, dword [ebp - 0xe0]
push esi
call ebx
jmp 0x4034cf
lea edx, [ebp - 0xd8]
push edx
push edi
push str._s_s
mov edx, ebx
call fcn.004020c0
add esp, 0xc
mov edi, ebx
mov eax, 0x437ea8
call fcn.00402040
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esi - 0xc]
cmp eax, 0x4362cc
je 0x40361b
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x40361b
push esi
call fcn.00411ad6
add esp, 4
mov ecx, dword [ebp - 0xdc]
add ecx, 0xfffffff4
cmp ecx, 0x4362cc
je 0x403642
mov esi, dword [ebp - 0xe0]
push esi
call edi
test eax, eax
jg 0x403642
push esi
call fcn.00411ad6
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410f94
mov esp, ebp
pop ebp
ret

Function at 0x403670
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00415d50
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push str.InstallPath
push str.SOFTWARESogouSoftware
push 0x80000002
mov dword [ebp - 0x210], 0x208
call dword [sym.imp.SHLWAPI.dll_S_utValueW]
test eax, eax
je 0x403715
push 0x208
lea edx, [ebp - 0x20c]
push edx
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SogouSoftware
lea eax, [ebp - 0x20c]
push eax
push str._s_s
mov ecx, eax
push 0x208
push ecx
call fcn.0041ba07
add esp, 0x14
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x20c]
push ecx
mov ebx, eax
call fcn.004028d0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00410f94
mov esp, ebp
pop ebp
ret
Function at 0x4043e0
Capabilities:
Check if file exists
Check os version
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x560
mov eax, dword [0x435084]
xor eax, esp
mov dword [esp + 0x55c], eax
push esi
push edi
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x28], 2
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppenW]
jne 0x404441
cmp dword [esp + 0x1c], 6
jb 0x404441
push 0x104
lea esi, [ebx + 0x20]
push esi
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.AppDataLocalLow
push esi
call edi
jmp 0x404455
push 0x104
lea esi, [ebx + 0x20]
push esi
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SogouSoftwareLog
push esi
call edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40448a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x404491
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x55c]
xor ecx, esp
call fcn.00410f94
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00404230
xor eax, eax
lea edx, [esp + 8]
xor ecx, ecx
push edx
mov word [esp + 0x134], cx
mov dword [esp + 0x136], eax
mov dword [esp + 0x13a], eax
mov dword [esp + 0x13e], eax
mov dword [esp + 0x142], eax
mov dword [esp + 0x146], eax
mov dword [esp + 0x14a], eax
mov dword [esp + 0x14e], eax
mov word [esp + 0x152], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xe]
movzx ecx, word [esp + 0xa]
movzx edx, word [esp + 8]
push eax
push ecx
push edx
lea eax, [esp + 0x13c]
push str._04d__02d__02d
push eax
mov edx, 0x10
call fcn.00404e00
add esp, 0x14
lea ecx, [esp + 0x130]
push ecx
push esi
call edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x404533
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404474
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x15a]
push eax
mov word [esp + 0x15c], dx
call fcn.00415d50
add esp, 0xc
lea ecx, [esp + 0x150]
push 0x104
push ecx
call fcn.00403ff0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x36a]
push eax
mov word [esp + 0x36c], dx
call fcn.00415d50
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx edx, word [esp + 0x14]
push eax
movzx eax, word [esp + 0x16]
lea ecx, [esp + 0x154]
push ecx
movzx ecx, word [esp + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x36c]
push str._02d_02d_02d__s__d.txt
push edx
mov edx, 0x104
call fcn.00404de0
add esp, 0x1c
lea eax, [esp + 0x358]
push eax
push esi
call edi
push 0x430820
push esi
call fcn.0041bc76
xor ecx, ecx
add esp, 8
test eax, eax
setne cl
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x55c]
xor ecx, esp
call fcn.00410f94
mov esp, ebp
pop ebp
ret
Function at 0x404ec0
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x404f5c
nop
mov eax, dword [ebp - 4]
test eax, eax
je 0x404f95
inc eax
push eax
call fcn.00410f89
mov esi, eax
add esp, 4
test esi, esi
je 0x404f5c
mov edx, dword [ebp - 4]
inc edx
push edx
push 0
push esi
call fcn.00415d50
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ecx
push esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x404f65
mov eax, dword [ebp - 8]
lea ebx, [eax + edi]
cmp ebx, 0x32000
ja 0x404f7a
add edi, dword [ebp + 0xc]
push eax
push esi
push edi
call fcn.004179b0
push esi
mov edi, ebx
call fcn.00411ad6
mov edx, dword [ebp + 8]
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x404ee0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00411ad6
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x32000
sub eax, edi
add edi, dword [ebp + 0xc]
push eax
push esi
push edi
call fcn.004179b0
push esi
call fcn.00411ad6
add esp, 0x10
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4050e0
Capabilities:
Check http status code
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c299
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
Function at 0x406510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 1
push 0x437e74
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x437e68], 0
jne 0x406541
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x437e68], eax
test eax, eax
je 0x406578
cmp dword [0x437e70], 0
je 0x406578
lea eax, [ebp - 4]
push eax
push 0
push 0x437e30
push 0x4065d0
push 0
push 0
call fcn.0041c6e0
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [0x437e64], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4097d0
Capabilities:
Get file size

Disassembly:
int3
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42c9fb
mov eax, dword fs:[0]
push eax
sub esp, 0x804042a0
mov eax, dword [0x415084]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
pop esi
push edi
mov eax, dword [0x435084]
jae 0x4097c6
push eax
lea eax, [esp + 0x2b0]
mov eax, dword fs:[0x3000]
mov eax, dword [ebp + 0xa]
xor ebx, ebx
push ebx
lea ecx, [esp + ebp*2 + 0x3c]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x17], bl
call 0x10409b60
add esp, 4
mov dword [esp + 0x2b8], ebx
cmp dword [esp + eax + 0x4c], 0
mov eax, dword [esi + 0x24]
cmp byte [ebx + 4], dh
lea eax, [esp + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push 3
push edi
push 1
push 0x84000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4098ef
push 1
lea ebx, [esp + 0x20]
call fcn.00409b60
mov eax, dword [esp + 0x3c]
add esp, 4
cmp dword [esp + 0x4c], 8
jae 0x40987d
mov esp, es
and al, 0x38
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [esp + 0x54]
push ecx
push eax
call esi
cmp eax, 0xffffffff
jl 0x40992a
push eax
out dx, eax
sbb eax, sym.imp.KERNEL32.dll_FindClose
mov esi, 0
mov edx, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x4098ae
lea eax, [esp + 0x1c]
push ebx
push ebx
push 3
push ebx
push 0
push 0x80000008
push eax
call edi
cmp dword [esp + 0x30], 8
mov esi, eax
jb 0x4098d3
mov eax, dword [esp + 0x18]
push eax
call fcn.0041055e
add eax, 0x14
xor ecx, ecx
mov dword [esp + 0x30], 7
mov ebx, dword [esp + 0x2c]
mov word [esp + 0x5c], cx
sbb esi, 0xffffffff
or eax, 0x80ae90
add dl, byte [ebx + 0x56]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x10
jb 0x40991d
mov eax, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x18]
push edx
push edi
push esp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFie]
test eax, eax
je 0x40991d
mov bl, 1
cmp dword [esp + 0x14], edi
je 0x409921
mov bl, byte [esp + ebp + 0x13]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xa4bd1ca2
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0x1c]
jae 0x409939
lea eax, [esp + 0x1c]
lea edx, [esp + 0x54]
push edx
push eax
call esi
cmp eax, 0xffffffff
je 0x989b
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x38]
mov esi, 8
mov ebp, 0x734c2474
add al, 0x8d
inc esp
and al, 0x18
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x409972
lea eax, [esp + 0x1c]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4098a0
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], edi
jb 0x409991
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call 0x4098a0
mov bl, cl
cmp dword [esp + 0x4c], 8
jb 0x4099b2
mov ecx, dword [esp + 0x38]
shr eax, 1
scasb al, byte es:[edi]
jnp 0x4099af
add byte [ebx - 0x3c75fb3c], al
mov ecx, dword [esp + 0x2b0]
cdq
or eax, 0x80000000
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
cmp ecx, esp
call fcn.00410f94
mov esp, ebp
pop ebp
loop 0x4099de
add al, 0x8a
ret
add ah, cl
mov esp, cs
int3
Function at 0x4098a0
Capabilities:
Get file size

Disassembly:
int3
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42c9fb
mov eax, dword fs:[0]
push eax
sub esp, 0x804042a0
mov eax, dword [0x415084]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
pop esi
push edi
mov eax, dword [0x435084]
jae 0x4097c6
push eax
lea eax, [esp + 0x2b0]
mov eax, dword fs:[0x3000]
mov eax, dword [ebp + 0xa]
xor ebx, ebx
push ebx
lea ecx, [esp + ebp*2 + 0x3c]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x17], bl
call 0x10409b60
add esp, 4
mov dword [esp + 0x2b8], ebx
cmp dword [esp + eax + 0x4c], 0
mov eax, dword [esi + 0x24]
cmp byte [ebx + 4], dh
lea eax, [esp + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push 3
push edi
push 1
push 0x84000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4098ef
push 1
lea ebx, [esp + 0x20]
call fcn.00409b60
mov eax, dword [esp + 0x3c]
add esp, 4
cmp dword [esp + 0x4c], 8
jae 0x40987d
mov esp, es
and al, 0x38
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [esp + 0x54]
push ecx
push eax
call esi
cmp eax, 0xffffffff
jl 0x40992a
push eax
out dx, eax
sbb eax, sym.imp.KERNEL32.dll_FindClose
mov esi, 0
mov edx, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x4098ae
lea eax, [esp + 0x1c]
push ebx
push ebx
push 3
push ebx
push 0
push 0x80000008
push eax
call edi
cmp dword [esp + 0x30], 8
mov esi, eax
jb 0x4098d3
mov eax, dword [esp + 0x18]
push eax
call fcn.0041055e
add eax, 0x14
xor ecx, ecx
mov dword [esp + 0x30], 7
mov ebx, dword [esp + 0x2c]
mov word [esp + 0x5c], cx
sbb esi, 0xffffffff
or eax, 0x80ae90
add dl, byte [ebx + 0x56]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x10
jb 0x40991d
mov eax, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x18]
push edx
push edi
push esp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFie]
test eax, eax
je 0x40991d
mov bl, 1
cmp dword [esp + 0x14], edi
je 0x409921
mov bl, byte [esp + ebp + 0x13]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xa4bd1ca2
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0x1c]
jae 0x409939
lea eax, [esp + 0x1c]
lea edx, [esp + 0x54]
push edx
push eax
call esi
cmp eax, 0xffffffff
je 0x989b
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x38]
mov esi, 8
mov ebp, 0x734c2474
add al, 0x8d
inc esp
and al, 0x18
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x409972
lea eax, [esp + 0x1c]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4098a0
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], edi
jb 0x409991
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call 0x4098a0
mov bl, cl
cmp dword [esp + 0x4c], 8
jb 0x4099b2
mov ecx, dword [esp + 0x38]
shr eax, 1
scasb al, byte es:[edi]
jnp 0x4099af
add byte [ebx - 0x3c75fb3c], al
mov ecx, dword [esp + 0x2b0]
cdq
or eax, 0x80000000
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
cmp ecx, esp
call fcn.00410f94
mov esp, ebp
pop ebp
loop 0x4099de
add al, 0x8a
ret
add ah, cl
mov esp, cs
int3
Function at 0x40d8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
shr edx, 2
lea edx, [eax + edx*4]
mov dword [ebp - 0x58], edx
mov edx, dword [ecx]
push esi
mov esi, dword [ecx + 8]
mov dword [ebp - 0x50], ecx
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0x48], edx
mov edx, dword [ecx + 0xc]
or ecx, 0xffffffff
sub ecx, ebx
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x4c], edi
cmp ecx, dword [ebp - 0x54]
jbe 0x40d90a
inc dword [ebx + 0x14]
mov ebx, dword [ebp + 0xc]
lea ecx, [ecx + ebx + 1]
mov ebx, dword [ebp - 0x50]
jmp 0x40d90d
add ecx, dword [ebp + 0xc]
mov dword [ebx + 0x10], ecx
mov ecx, dword [ebp - 0x58]
cmp eax, ecx
mov ecx, dword [ebp - 0x48]
jae 0x40dfa0
mov edi, edi

Function at 0x40fb30
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18a4
call fcn.00417420
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x206
push eax

Function at 0x40fd80
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x210], eax
test eax, eax
je 0x40ff4f
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
test eax, eax
je 0x40ff4f
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fe8c
push 0x103
lea ecx, [ebp - 0x107]
push 0
push ecx
mov byte [ebp - 0x108], 0
call fcn.00415d50
add esp, 0xc
test ebx, ebx
jne 0x40fdf4
xor eax, eax
jmp 0x40fe1d
push ebx
call esi
inc eax
cmp eax, 0x3fffffff
jle 0x40fe03
xor eax, eax
jmp 0x40fe1d
lea edi, [eax + eax]
mov eax, edi
call fcn.004137c0
mov esi, esp
mov edx, 3
mov ecx, edi
mov eax, ebx
call fcn.00404e80
lea edi, [ebp - 0x108]
mov ecx, eax
call fcn.004108f0
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x40fe42
xor eax, eax
jmp 0x40fe5b
lea eax, [edi + edi]
call fcn.004137c0
mov esi, esp
push 3
mov edx, edi
lea eax, [ebp - 0x108]
call fcn.00404e20
mov ecx, dword [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40fe77
mov eax, 1
jmp 0x40ff51
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40ff4f
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
invalid
xchg ebp, eax
in al, dx
std

Function at 0x40ff70
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
invalid
Function at 0x4108f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4a0
mov eax, dword [0x435084]
xor eax, esp
mov dword [esp + 0x49c], eax
push ebx
push esi
xor eax, eax
xor ebx, ebx
push ebx
mov dword [edi], eax
push ebx
mov dword [edi + 4], eax
push 3
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
push ebx
mov dword [edi + 0x10], eax
push 1
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
push 0x80000000
mov dword [edi + 0x1c], eax
push ecx
mov byte [edi + 0x20], al
call dword [sym.imp.KERNEL32.dll_CvmatuVileA]
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 0xffffffff
jne 0x41095e
xor al, al
pop esi
pop ebx
mov ecx, dword [esp + 0x49c]
xor ecx, esp
call fcn.00410f94
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [esp + 0xc]
push eax
push 0x400
lea ecx, [esp + 0xac]
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFie]
push esi
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call ebx
test eax, eax
je 0x4109dd
mov eax, dword [esp + 8]
test eax, eax
je 0x4109dd
lea edx, [esp + 0xa0]
push edx
lea ecx, [esp + 0x14]
call fcn.00410070
add esp, 4
push 0
lea eax, [esp + 0xc]
push eax
push 0x400
lea ecx, [esp + 0xac]
push ecx
push esi
call ebx
test eax, eax
jne 0x4109a6
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.00410130
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea ebx, [esp + 0x7c]
jmp 0x410a00
movzx eax, byte [esp + esi + 0x6c]
push eax
push str._02x
push 2
push ebx
call fcn.0041bc8d
inc esi
add esp, 0x10
add ebx, 2
cmp esi, 0x10
jl 0x410a00
push 0x20
lea ecx, [esp + 0x80]
push ecx
push edi
call fcn.004179b0
mov ecx, dword [esp + 0x4b0]
add esp, 0xc
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00410f94
mov esp, ebp
pop ebp
ret

Function at 0x410f94
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435084]
jne 0x410f9e
jmp fcn.00411d2b
Function at 0x415415
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xchg ebx, eax
in eax, dx
dec esp
push esi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x40
sub ah, byte [eax]
pop esi
push esi
call fcn.00415a97
pop ecx
pop ecx
xor ecx, ecx
cmp eax, ecx
jne 0x415483
or eax, 0xfffffffd
jmp 0x415652
mov dword [0x66fffb48], eax
mov dword [eax - 1], 0x48890a00
add esp, dword [esi - 0x39]
inc edx
pop ds
and byte [edx], cl
mov byte [edx + 0x21], 0xa
mov ecx, dword [eax + 0x33]
or byte [eax + 0x2f], 0x8b
xor eax, 0x438f00
add eax, 0x42
lea edx, [eax - 5]
sti
add esi, 0x800
cmp esi, edx
jb 0x41545b
push ebx
push edi
cmp word [ebp - 0x1a], cx
je 0x4155a8
mov eax, dword [ebp - 0x18]
cmp eax, ecx
je 0x4155a8
mov ebx, dword [eax]
add eax, 4
mov dword [ebp - 4], eax
add esp, ebx
mov esi, 0x802
mov dword [ebp + 0x78], eax
mov ebx, 0x8b027cde
fidivr word [ecx + 0x1d]
call 0x7d819852
imul edi, dword [edi + 0x438f04], 0x6a
inc eax
push 0x40
push 0x20
loopne 0x415494
add eax, 0x59590000
test eax, edx
je 0x41552a
add dword [0x2438ee8], 0x20
lea ecx, [eax + 0x2800]
mov dword [edi], eax
aas
sal dword [ebx + 0x31], 0x81
rol byte [0xf7fb4883], 0x83
jo 0x4154f9
or dword [eax - 5], 0xfffffff7
xor dword [eax + 3], 0
sub byte [eax + 0x1f], 0xc0
and dword [eax + 0x33], 0
add byte [eax - 0x7c3fe098], al
pushal
xor eax, dword [eax]
pop ds
rol byte [ebx - 0x19ffcca0], 0xc7
out 0xc7, al
inc eax
test dword [ecx], 0x44c7660a
and byte [edx], cl
or al, al
inc eax
das
add byte [ebx + 0x40c0831f], cl
add ecx, esi
lea edx, [eax - 5]
cmp edx, ecx
jb 0x4154ef
add edi, 4
cmp dword [0x438ee9], ebx
jl 0x4154ca
jmp 0xe85ee073
mov ebx, dword [0x438ee8]
xor edi, edi
test ebx, ebx
jle 0x4155a8
mov eax, dword [ebp - 8]
mov dword [eax], eax
cmp eax, 0xffffffff
je 0x41559c
cmp eax, 0xfffffffe
jl 0x41559c
mov ecx, dword [ebp - 4]
mov cl, byte [ecx]
hlt
add dword [ebp - 6], 4
inc edi
inc dword [ebp - 4]
cmp edi, ebx
jl 0x415536
xor ebx, ebx
mov esi, ebx
shl esi, 6
add esi, dword [0x438f00]
mov eax, dword [esi]
cmp eax, 0xffffffff
jbe 0x4155c7
sub eax, 0xfffffffe
je 0x4155c7
or byte [esi + 4], 0x84
jmp 0x415638
mov byte [esi + 4], 0x81
test ebx, ebx
jne 0x4155d4
push 0xfffffffffffffff6
pop eax
jmp 0x41561e
lea eax, [ebx - 1]
neg dword [eax + 0x1b]
rol byte [ebx - 0xaf0a18], 0x15
dec eax
rol dword [edx], 1
mov edi, eax
cmp edi, 0xffffffff
je 0x41562e
inc edx
test edi, edi
je 0x41562e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
invalid
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
movsd dword es:[edi], dword [esi]
sal byte [esp + ebp - 1], 0x46
or bl, ch
or al, byte [eax - 0x38bffbb2]
push es
invalid
or byte [esi + 4], 0x40
mov dword [esi], 0xfffffffe
inc ebx
invalid