joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4193c8]
jne 0x4095fe
repz ret
jmp fcn.0040fe4c

Function at 0x4152e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e6cc
and dword [ebp - 4], 0
cmp dword [0x43b71c], 0
mov ebx, eax
jne 0x415396
push 0x40349c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x415447
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403490
push edi
call esi
test eax, eax
je 0x415447
push eax
call fcn.0040e65a
mov dword [esp], 0x403480
push edi
mov dword [0x43b71c], eax
call esi
push eax
call fcn.0040e65a
mov dword [esp], 0x40346c
push edi
mov dword [0x43b720], eax
call esi
push eax
call fcn.0040e65a
mov dword [esp], 0x403450
push edi
mov dword [0x43b724], eax
call esi
push eax
call fcn.0040e65a
pop ecx
mov dword [0x43b72c], eax
test eax, eax
je 0x415396
push 0x403438
push edi
call esi
push eax
call fcn.0040e65a
pop ecx
mov dword [0x43b728], eax
mov eax, dword [0x43b728]
cmp eax, ebx
je 0x4153ee
cmp dword [0x43b72c], ebx
je 0x4153ee
push eax
call fcn.0040e6d5
push dword [0x43b72c]
mov esi, eax
call fcn.0040e6d5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4153ee
test edi, edi
je 0x4153ee
call esi
test eax, eax
je 0x4153e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4153e5
test byte [ebp - 0xc], 1
jne 0x4153ee
or dword [ebp + 0x10], 0x200000
jmp 0x415427
mov eax, dword [0x43b720]
cmp eax, ebx
je 0x415427
push eax
call fcn.0040e6d5
pop ecx
test eax, eax
je 0x415427
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x415427
mov eax, dword [0x43b724]
cmp eax, ebx
je 0x415427
push eax
call fcn.0040e6d5
pop ecx
test eax, eax
je 0x415427
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43b71c]
call fcn.0040e6d5
pop ecx
test eax, eax
je 0x415447
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415449
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4150ba
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00415139
jae 0x4150c6
xor ecx, ecx
call fcn.00415139
jae 0x4150f0
xor eax, eax
call fcn.00415139
jae 0x415101
mov al, 0x10
call fcn.00415139
adc al, al
jae 0x4150e2
jne 0x41512e
stosb byte es:[edi], al
jmp 0x4150c7
call fcn.00415145
dec ecx
loop 0x41510d
mov eax, ebp
call fcn.00415143
jmp 0x41512f
lodsb al, byte [esi]
shr eax, 1
je 0x415155
adc ecx, 2
mov ebp, eax
jmp 0x41512f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00415143
cmp eax, 0x7d00
jae 0x41512d
cmp eax, 0x500
jae 0x41512e
cmp eax, 0x7f
ja 0x41512f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4150c7
pop ebp
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x105617c9
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x112c5837
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401424
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.004067ee
test eax, eax
jne 0x40152d
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401499
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401509
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4014d4
test edi, edi
jne 0x401509
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.00401424
test eax, eax
jne 0x4014de
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014ac
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406e1f
test eax, eax
jne 0x40151a
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x40152d
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x40152d
push 0
push esi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x4037dd
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x4037fc
mov eax, dword [0x41f15c]
test eax, eax
je 0x4037f4
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x41f15c], 0
ret
cmp dword [0x41f15c], 0
je 0x40380d
push 0
call fcn.00406721
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x7ef660]
jbe 0x403840
push 0
push 0x403c0c
push 0
push 0x6f
push dword [0x7e75d4]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x41f15c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x406319
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406333
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4

Function at 0x406339
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x40985c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov word [ebp - 0x20], 1
mov dword [ebp - 0x10], 0x40984c
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4063a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4063b1
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
je 0x4063ab
xor eax, eax
jmp 0x4063b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 4
Function at 0x4066ae
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
xor eax, eax
cmp ecx, esi
pop esi
cmova ecx, eax
test ecx, ecx
je 0x4066e4
cmp word [ebp + ecx*2 - 0x23e], 0x5c
jne 0x4066e7
xor eax, eax
inc eax
push dword [ebp + 8]
lea eax, [eax*2 + 0x4092c8]
push eax
lea eax, [ebp - 0x23c]
lea eax, [eax + ecx*2]
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esp, ebp
pop ebp
ret 4

Function at 0x406751
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406774
push dword [esp + 8]
push dword [esp + 8]
call fcn.0040681c
pop ecx
pop ecx
inc dword [0x7ef6d0]
ret 8

Function at 0x40681c
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, 0x400
mov dword [0x7de708], 0x55004e
mov ebp, 0x7de708
mov dword [0x7de70c], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x406873
push 1
push 0
push esi
call fcn.00406e54
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x406957
cmp eax, ebx
jg 0x406957
push ebx
mov esi, 0x7ddf08
push esi
push dword [esp + 0x20]
call edi
test eax, eax
je 0x406957
cmp eax, ebx
jg 0x406957
push esi
push ebp
push str._ls_ls_r_n
push 0x7ddb08
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x7ef604]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.004063b7
push 4
push 0xc0000000
push esi
call fcn.00406e54
mov ebx, eax
mov dword [esp + 0x10], ebx
cmp ebx, 0xffffffff
je 0x406957
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x406950
push esi
push edi
push ebx
call fcn.00406e81
test eax, eax
je 0x406950
push str._Rename__r_n
push edi
call fcn.00407079
test eax, eax
jne 0x40695d
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x7ddb08
lea eax, [ecx + edi]
push eax
call fcn.00406bdb
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406f48
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x4099d0
add eax, 0xa
push eax
call fcn.00407079
mov ecx, eax
test ecx, ecx
je 0x406921
lea edx, [edi + esi]
lea eax, [edx + ebp]
cmp edx, ecx
jbe 0x406991
sub eax, edx
mov dword [esp + 0x1c], eax
mov ebx, eax
mov al, byte [edx]
mov byte [ebx + edx], al
dec edx
cmp edx, ecx
ja 0x406983
mov ebx, dword [esp + 0x10]
sub ecx, edi
inc ecx
jmp 0x406923
Function at 0x406ab4
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.004070cc
mov edi, eax
cmp edi, 0xffffffff
je 0x406af7
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406adf
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x406ae7
xor eax, eax
inc eax
jmp 0x406af9
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x406ad6
test byte [ebp + 0xc], 4
jne 0x406af7
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x406b5d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x7d9b00
push ebx
call fcn.0040705d
push ebx
call fcn.004070f4
mov esi, eax
test esi, esi
jne 0x406b7e
xor eax, eax
jmp 0x406bd6
push esi
call fcn.00407269
test byte [0x7ef600], 0x80
je 0x406b9a
movzx eax, word [esi]
test ax, ax
je 0x406b7a
cmp eax, 0x5c
je 0x406b7a
sub esi, ebx
sar esi, 1
jmp 0x406bb4
call fcn.00406afe
test eax, eax
je 0x406bae
test byte [eax], 0x10
je 0x406b7a
push ebx
call fcn.0040723c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x406ba0
call fcn.00406a85
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebx
ret 4

Function at 0x406bfb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x7d5ab0], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x7d5ab0
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406c3a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x406c40
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x260
push ebx
mov ebx, dword [esp + 0x26c]
push esi
mov esi, dword [esp + 0x26c]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406b5d
mov dword [esp + 0xc], eax
test bl, 8
je 0x406c82
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x7ef6c8], eax
jmp 0x406e13
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x1c], ebp
je 0x406c9f
test eax, eax
je 0x406dc3
test bl, 2
je 0x406dc3
push esi
push 0x7d5af8
call fcn.0040705d
test ebp, ebp
je 0x406cc0
push str..
push 0x7d5af8
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x406cc6
push esi
call fcn.0040723c
xor eax, eax
cmp word [esi], ax
jne 0x406cd7
cmp word [0x7d5af8], 0x5c
jne 0x406ce3
push 0x4092c8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
push eax
push 0x7d5af8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x406db1
mov ebp, dword [esp + 0x14]
push 0x2e
pop eax
cmp word [esp + 0x4c], ax
jne 0x406d33
cmp word [esp + 0x4e], 0
je 0x406d8c
cmp word [esp + 0x4e], ax
jne 0x406d33
cmp word [esp + 0x50], 0
je 0x406d8c
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x1c]
call fcn.0040705d
test byte [esp + 0x20], 0x10
je 0x406d5a
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406d8c
push ebx
push esi
call fcn.00406c40
jmp 0x406d8c
push edi
push esi
call fcn.00406ab4
test eax, eax
jne 0x406d84
test edi, edi
je 0x406d7c
push esi
push 0xfffffffffffffff1
call fcn.00406235
xor eax, eax
push eax
push esi
call fcn.00406751
jmp 0x406d8c
inc dword [0x7ef6c8]
jmp 0x406d8c
push esi
push 0xfffffffffffffff2
call fcn.00406235
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406d15
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x406dbf
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov word [eax - 2], cx
mov eax, dword [esp + 0x10]
test ebp, ebp
pop ebp
je 0x406e13
test eax, eax
je 0x406e03
push esi
call fcn.00406afe
test eax, eax
je 0x406e13
push esi
call fcn.00406a85
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406ab4
test eax, eax
jne 0x406e0b
test edi, edi
je 0x406e03
push esi
push 0xfffffffffffffff1
call fcn.00406235
xor eax, eax
push eax
push esi
call fcn.00406751
jmp 0x406e13
inc dword [0x7ef6c8]
jmp 0x406e13
push esi
push 0xffffffffffffffe5
call fcn.00406235
pop edi
pop esi
pop ebx
add esp, 0x260
ret 8

Function at 0x406e54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x406eb2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x4008
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004067ee
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406f24
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x4006], ax
pop esi
jne 0x406f24
cmp dword [ebp + 0x18], 1
je 0x406f29
cmp dword [ebp + 0x18], 2
je 0x406f29
xor eax, eax
mov word [edi], ax
pop edi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x406f30
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406f95
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x4099b0]
dec edi
mov dword [ebp - 8], eax
mov eax, dword [0x4099b4]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406fe1
test edi, edi
jne 0x406fa2
mov word [esi], ax
jmp 0x406fe3
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4070cc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4070ee
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x40735e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7df15c], 0
push esi
jne 0x407396
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
dec esi
jne 0x40736f
mov dword [ecx*4 + 0x7df158], edx
inc ecx
cmp ecx, 0x100
jl 0x40736a
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x4073c0
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x7df158]
inc esi
dec edx
jne 0x4073a8
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x402a50
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498180
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4cff04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
test esi, esi
jne 0x402abc
push 0x10
push 0x49cf30
push str.Callback_pointer_is_null
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp + 0x10], edi
cmp edi, 0xffffffff
jne 0x402afd
push 0x4c30a4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], str.Failed_to_create_file
push eax
call fcn.0043e0b1
push 0x2454
call fcn.00420b7b
add esp, 4
test eax, eax
je 0x402b1d
push dword [ebp + 0x14]
mov ecx, eax
push esi
call fcn.004029e0
mov esi, eax
jmp 0x402b1f
xor esi, esi
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x20]
mov dword [esi + 8], eax
lea eax, [esi + 0x18]
push 0x104
push eax
mov dword [ebp - 0x14], esi
mov dword [esi + 0x14], edi
call fcn.0044a6e7
add esp, 0xc
push 0x10000000
push 0
push 0
push 0
push str.UniKey_Downloader
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x18], eax
mov dword [esi + 0xc], eax
test eax, eax
jne 0x402b74
push 0x4c30a4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], str.InternetOpen_returned_NULL
push eax
call fcn.0043e0b1
push 0x402a30
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
jne 0x402b9a
push 0x4c30a4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], str.Failed_to_setup_callback
push eax
call fcn.0043e0b1
push str.InternetOpenUrl
lea eax, [esi + 0x224c]
push 0x100
push eax
call fcn.0044a6e7
add esp, 0xc
push esi
push 0
push 0
push 0
push dword [ebp + 8]
push dword [esi + 0xc]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
jne 0x402c49
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x402c49
push 0x4c30a4
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], str.Failed_to_connect
push eax
call fcn.0043e0b1
push 0x10
push 0x49cf30
push dword [ebp - 0x30]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
je 0x402c16
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x402c24
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x402c40
push 0x2454
push eax
call fcn.00420bae
add esp, 8
mov dword [ebp - 0x14], 0
mov eax, 0x402c46
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402c60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00402c70
Function at 0x402c70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x402c8a
push 0
push eax
call edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x402c96
push 0
push eax
call edi
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x402ca6
push eax
call edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x402cb0
push eax
call edi
mov eax, dword [esi + 0x14]
cmp eax, 0xffffffff
je 0x402cbf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x220], 1
jne 0x402d07
mov ecx, dword [esi + 0x2450]
test ecx, ecx
jne 0x402cd6
xor eax, eax
jmp 0x402ce1
imul eax, dword [esi + 0x244c], 0x64
xor edx, edx
div ecx
push dword [esi + 4]
push eax
mov eax, dword [esi]
push 1
push str.Success
call eax
add esp, 0x10
push 0x2454
push esi
call fcn.00420bae
add esp, 8
pop edi
pop esi
pop ebp
ret 4
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2454
push esi
call fcn.00420bae
add esp, 8
pop edi
pop esi
pop ebp
ret 4

Function at 0x4033c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push str.InternetReadFileEx
push 0x100
lea eax, [esi + 0x224c]
mov dword [ebp - 4], ecx
push eax
call fcn.0044a6e7
mov ebx, dword [sym.imp.WININET.dll_InternetReadFileExW]
lea edi, [esi + 0x224]
add esp, 0xc
lea eax, [esi + 0x24c]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
push esi
movups xmmword [edi + 0x10], xmm0
push 1
movq qword [edi + 0x20], xmm0
push edi
push dword [esi + 0x10]
mov dword [edi], 0x28
mov dword [esi + 0x23c], 0x2000
mov dword [esi + 0x238], eax
call ebx
test eax, eax
je 0x403453
nop word [eax + eax]
cmp dword [esi + 0x23c], 0
je 0x403478
mov ecx, dword [ebp - 4]
push esi
call fcn.00403540
test al, al
je 0x4034aa
push esi
push 1
push edi
push dword [esi + 0x10]
call ebx
test eax, eax
jne 0x403430
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x403482
mov ecx, dword [esi + 0x2450]
mov dword [esi + 0x220], 2
test ecx, ecx
jne 0x40348d
xor eax, eax
jmp 0x403498
mov dword [esi + 0x220], 1
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
imul eax, dword [esi + 0x244c], 0x64
xor edx, edx
div ecx
push dword [esi + 4]
push eax
mov eax, dword [esi]
push 2
push str.Download_failed
call eax
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8