joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414343
Capabilities:
Hide graphical window

Disassembly:
and dword [0x456d7c], 0
push 1
push dword [esp + 8]
mov byte [0x44f955], 1
mov byte [0x44f956], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401183
cmp dword [0x467228], 0
jne 0x414383
cmp byte [0x44f963], 0
je 0x41438c
cmp dword [0x44f95c], 0
jne 0x41439f
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x414473
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004154f0
cmp byte [0x458d88], 0
je 0x414502
cmp word [0x458d8a], 0
je 0x414502
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x458d8a
call fcn.00413034
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x414501
push dword [ebp + 8]
call fcn.0041a063
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x414506
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.004154f0
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.004066f9
mov esi, eax
test esi, esi
je 0x41455e
movzx ecx, word [esi]
push ecx
jmp 0x414549
add esi, 2
movzx eax, word [esi]
push eax
call fcn.00406815
test al, al
jne 0x414542
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
leave
ret 4
Function at 0x415fb3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415ff2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415ff2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415ff2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415ff2
cmp dword [ecx + 0x74], 0xe
jbe 0x415ff2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4283c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4283ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4283ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4010c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010d7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401108
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401104
cmp esi, eax
jae 0x401108
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4010f4
cmp esi, eax
jb 0x40110e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x401210
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x40d5d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x411428]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0x40fb1c
push 0x66
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401369
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401362
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40135b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x401354
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.00401a10
add eax, 0x10
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0x14], esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push eax
mov byte [esp + 0x3c], 2
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x401325
call fcn.004011b0
test eax, eax
jl 0x401329
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4012e8
call fcn.004011b0
push str.Excat_File_success_n
call fcn.0040215b
add esp, 4
test esi, esi
je 0x401300
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
call fcn.004019a0
lea eax, [esp + 0x28]
call fcn.004019a0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov esi, eax
jmp 0x4012cf
xor ecx, ecx
lea esi, [esp + 0x28]
call fcn.00401980
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Excat_File_Failed__5___d___ws_n
call fcn.0040215b
add esp, 0xc
lea eax, [esp + 0x10]
call fcn.004019a0
jmp 0x401376
push str.Excat_File_Failed_4_n
jmp 0x40136e
push str.Excat_File_Failed_3_n
jmp 0x40136e
push str.Excat_File_Failed_2_n
jmp 0x40136e
push str.Excat_File_Failed_1_n
call fcn.0040215b
add esp, 4
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40139e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x401450
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
push str.GetNativeSystemInfo
push str.kernel32.dll
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4014ac
lea ecx, [esp]
push ecx
call eax
xor eax, eax
cmp word [esp], 9
sete al
add esp, 0x24
ret
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp word [esp], 9
sete al
add esp, 0x24
ret

Function at 0x402220
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411428]
jne 0x40222a
repz ret
jmp fcn.004052e6

Function at 0x40222f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x40225c
call fcn.00402b8d
mov dword [eax], esi
call fcn.00402b7a
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00402b1b
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x402238
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40228b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402ba0
pop ecx
call fcn.00402b7a
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4022b2
test al, 1
je 0x4022b2
test byte [esp + 0xc], 2
je 0x4022b2
call fcn.00402b8d
mov dword [eax], 5
call fcn.00402b7a
mov dword [eax], 0xd
jmp 0x402282
xor eax, eax
pop esi
ret
Function at 0x405751
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x411438]
je 0x40576c
inc edi
cmp edi, 0x17
jb 0x40575d
cmp edi, 0x17
jae 0x4058ec
push ebp
push 3
call fcn.00409faf
cmp eax, 1
pop ecx
je 0x4058b8
push 3
call fcn.00409faf
test eax, eax
pop ecx
jne 0x4057a0
cmp dword [0x41101c], 1
je 0x4058b8
cmp ebx, 0xfc
je 0x4058eb
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x412398
push ebp
call fcn.00407531
add esp, 0xc
test eax, eax
je 0x4057d6
push esi
push esi
push esi
push esi
push esi
call fcn.00402a1f
add esp, 0x14
push 0x104
mov esi, 0x4123b1
push esi
push 0
mov byte [0x4124b5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40581a
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00407531
add esp, 0xc
test eax, eax
je 0x40581a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00402a1f
add esp, 0x14
push esi
call fcn.004075a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40585f
push esi
call fcn.004075a0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4126ac
push 0x40e80c
sub ecx, eax
push ecx
push eax
call fcn.00409efc
add esp, 0x14
test eax, eax
je 0x40585f
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00402a1f
add esp, 0x14
jmp 0x405861
xor esi, esi
push 0x40e808
push ebx
push ebp
call fcn.00409e8b
add esp, 0xc
test eax, eax
je 0x405881
push esi
push esi
push esi
push esi
push esi
call fcn.00402a1f
add esp, 0x14
push dword [edi*8 + 0x41143c]
push ebx
push ebp
call fcn.00409e8b
add esp, 0xc
test eax, eax
je 0x4058a3
push esi
push esi
push esi
push esi
push esi
call fcn.00402a1f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00409cce
add esp, 0xc
jmp 0x4058eb
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4058eb
cmp ebp, 0xffffffff
je 0x4058eb
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41143c]
push dword [esi]
call fcn.004075a0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x409cce
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00406260
xor ebx, ebx
cmp dword [0x4129d4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x409da4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x409e84
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x409e84
push eax
call fcn.004061f2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4129d4], eax
call esi
push eax
call fcn.004061f2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4129d8], eax
call esi
push eax
call fcn.004061f2
mov dword [0x4129dc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004054de
test eax, eax
pop ecx
pop ecx
je 0x409d72
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402a1f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x409da4
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004061f2
cmp eax, ebx
pop ecx
mov dword [0x4129e4], eax
je 0x409da4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004061f2
pop ecx
mov dword [0x4129e0], eax
mov eax, dword [0x4129e0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x409e29
cmp dword [0x4129e4], ecx
je 0x409e29
push eax
call fcn.00406269
push dword [0x4129e4]
mov esi, eax
call fcn.00406269
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x409e29
cmp edi, ebx
je 0x409e29
call esi
cmp eax, ebx
je 0x409df6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409df6
test byte [ebp - 0x18], 1
jne 0x409e29
lea eax, [ebp - 0x10]
push eax
call fcn.00405515
test eax, eax
pop ecx
je 0x409e11
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00402a1f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x409e20
or dword [ebp + 0x10], 0x200000
jmp 0x409e64
or dword [ebp + 0x10], 0x40000
jmp 0x409e64
mov eax, dword [0x4129d8]
cmp eax, dword [ebp - 8]
je 0x409e64
push eax
call fcn.00406269
cmp eax, ebx
pop ecx
je 0x409e64
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x409e64
mov eax, dword [0x4129dc]
cmp eax, dword [ebp - 8]
je 0x409e64
push eax
call fcn.00406269
cmp eax, ebx
pop ecx
je 0x409e64
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4129d4]
call fcn.00406269
cmp eax, ebx
pop ecx
je 0x409e84
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409e86
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c0dd
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x411428]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040c01c
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00404070
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x40c12c
cmp dword [ebp - 0x1c], 5
jb 0x40c144
jmp 0x40c140
cmp dword [ebp - 0x10], 1
jne 0x40c144
cmp dword [ebp - 0x1c], 4
ja 0x40c140
jne 0x40c144
cmp dword [ebp - 0x18], 0
jbe 0x40c144
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x40fadc
call fcn.0040beb2
test eax, eax
jge 0x40c165
mov byte [0x412b44], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00402220
add ebp, 0x78
leave
ret

Function at 0xc05000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xc0500a
jmp 0xc0700f
jmp fcn.009d2058
Function at 0x40340a
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov eax, 0xb
call sub.Kernel32.dll_CopyFileA
cmp dword [ebp - 4], esp
je 0x403449
push 0x12
push 0x4013655
push 6
call fcn.0040fc05
add esp, 0xc
jmp 0x40344e
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403454
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
mov eax, 0xc
call sub.Kernel32.dll_DeleteFileA
cmp dword [ebp - 4], esp
je 0x40348b
push 0x12
push 0x401366c
push 6
call fcn.0040fc05
add esp, 0xc
jmp 0x403490
mov esp, ebp
pop ebp
ret 4
Function at 0x402c9a
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx]
xor edx, edx
cmp eax, edx
jne 0x402ca6
xor al, al
jmp 0x402cd0
cmp dword [esp + 4], edx
je 0x402ca2
cmp dword [eax], 0xffffffff
je 0x402ca2
mov eax, dword [esp + 0xc]
push edx
push eax
push dword [esp + 0x10]
mov dword [eax], edx
push dword [esp + 0x10]
mov eax, dword [ecx]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
ret 0xc

Function at 0x403494
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x4340d7
call fcn.0041e435
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004014d1
and dword [ebp - 4], 0
push 0x24
lea ecx, [ebp - 0x2c]
call fcn.00402db1
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x4034c7
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4034e9
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004018cc
mov al, bl
call fcn.0041e4b8
ret
xor bl, bl
jmp 0x4034d5

Function at 0x40497e
Capabilities:
Set file attributes

Disassembly:
cmp dword [esp + 4], 0xffffffff
jne 0x404988
xor al, al
ret
and dword [esp + 4], 0xffffb1af
cmp dword [eax + 0x18], 8
jb 0x40499b
mov eax, dword [eax + 4]
jmp 0x40499e
add eax, 4
push dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x4049af
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x4049c3
mov eax, dword [esi]
jmp 0x4049c5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4049d7
mov al, 1
jmp 0x404a6e
cmp dword [edi + 0x18], 8
jb 0x4049e1
mov eax, dword [esi]
jmp 0x4049e3
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x404a6c
cmp dword [edi + 0x18], 8
jb 0x4049fc
mov eax, dword [esi]
jmp 0x4049fe
mov eax, esi
push ebx
push eax
lea ecx, [ebp - 0x20]
call fcn.004014af
push 0
lea eax, [ebp - 0x20]
call fcn.0040497e
pop ecx
mov bl, al
neg bl
push 0
sbb bl, bl
push 1
lea ecx, [ebp - 0x20]
inc bl
call fcn.004018cc
test bl, bl
pop ebx
jne 0x404a6c
cmp dword [edi + 0x18], 8
jb 0x404a36
mov eax, dword [esi]
jmp 0x404a38
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4049d0
cmp dword [edi + 0x18], 8
jb 0x404a4b
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x20]
call fcn.004014af
push dword [ebp - 4]
lea eax, [ebp - 0x20]
call fcn.0040497e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004018cc
xor al, al
pop esi
leave
ret
Function at 0x404a71
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x43d504]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x43e990], edi
je 0x404aa5
push 0xffffffffffffffff
push edi
push 0x43e97c
mov ecx, ebx
call fcn.0040176b
mov al, 1
jmp 0x404b44
push 0x20a
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call fcn.00419b30
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x404b42
push esi
push 0x410
lea eax, [ebp - 0x622]
push edi
push eax
mov word [ebp - 6], di
mov word [ebp - 0x624], di
call fcn.00419b30
add esp, 0xc
mov esi, 0x208
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, esi
pop esi
ja 0x404b2f
cmp eax, edi
je 0x404b2f
mov word [ebp + eax*2 - 0x624], di
lea eax, [ebp - 0x624]
jmp 0x404b35
lea eax, [ebp - 0x210]
push eax
mov ecx, ebx
call fcn.004017fe
jmp 0x404a9e
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00419b1f
leave
ret
Function at 0x404f7e
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x433db1
call fcn.0041e3cc
xor esi, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], esi
call fcn.004013f2
xor edi, edi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 1
je 0x4050c5
mov eax, dword [ebp + 8]
dec dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp + edi - 0x10], al
mov bl, byte [ebp - 0xf]
inc edi
inc dword [ebp + 8]
cmp edi, 3
jne 0x405021
mov al, byte [ebp - 0x10]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
mov cl, bl
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
mov byte [ebp - 0x11], al
xor edi, edi
movzx esi, byte [ebp + edi - 0x14]
call fcn.00404866
mov al, byte [eax]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.00404889
inc edi
cmp edi, 4
jl 0x404ffb
xor edi, edi
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x404fac
cmp edi, esi
je 0x4050c5
cmp edi, 3
jge 0x40504a
push 3
pop ecx
sub ecx, edi
push ecx
lea eax, [ebp + edi - 0x10]
push esi
push eax
call fcn.00419b30
mov bl, byte [ebp - 0xf]
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
shr cl, 2
mov byte [ebp - 0x14], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x12], bl
and al, 0x3f
lea ebx, [edi + 1]
cmp ebx, esi
mov byte [ebp - 0x11], al
mov dword [ebp - 0x10], esi
jle 0x4050ad
mov eax, dword [ebp - 0x10]
movzx esi, byte [ebp + eax - 0x14]
call fcn.00404866
mov al, byte [eax]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.00404889
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x405086
push 3
pop esi
cmp edi, esi
jge 0x4050c5
sub esi, edi
mov ecx, dword [ebp - 0x18]
push 0x3d
push 1
call fcn.00404889
dec esi
jne 0x4050b6
mov eax, dword [ebp - 0x18]
call fcn.0041e4a4
ret

Function at 0x4051d9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405206
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405206
xor al, al
jmp 0x405221
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.0041a420
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
leave
ret 4
Function at 0x405485
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, 0x100000
cmp dword [ebp + 0xc], eax
push ebx
push esi
jbe 0x40549a
mov dword [ebp + 0xc], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x20], ebx
je 0x40555f
jmp 0x405557
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 4], ecx
jae 0x40555f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea esi, [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.004051d9
test al, al
jne 0x4054fc
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push ebx
push dword [ebp - 0xc]
mov eax, edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00405287
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc], esp
push eax
call fcn.004014d1
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp eax, ebx
jne 0x40555f
mov ecx, dword [ebp + 8]
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
add eax, ecx
push eax
push dword [edi]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
add dword [ebp - 4], ecx
cmp eax, ebx
jne 0x4054ce
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
pop esi
mov dword [ecx], edx
pop ebx
leave
ret 0xc

Function at 0x405860
Capabilities:
Connect to http server

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
mov dword [esi + 8], 0
jne 0x405875
xor al, al
pop esi
ret 0x10
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x40588c
mov eax, dword [eax + 4]
jmp 0x40588f
add eax, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push 0
push 3
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esi]
push ecx
push eax
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x4058be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
xor eax, eax
cmp dword [esi + 4], eax
pop esi
setne al
ret 0x10