joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4547c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x47fc00]
cmp dword [eax + 0x30], 0
je 0x45486e
cmp dword [ebx + 0x94], 0
jne 0x454868
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x454754
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x454868
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45482e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x454868
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a550
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45483d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45534c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x455381
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040462c
jmp 0x45538e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404590
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45642c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45646d
mov eax, esi
call fcn.0043c978
test al, al
je 0x45646d
mov eax, dword [ebx + 0x84]
call fcn.0043c674
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45646d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043c674
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x479248
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049dc
xor eax, eax
push ebp
push 0x47930e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ebx, [ebp - 0xc]
mov dword [ebx], esi
mov eax, dword [ebp - 4]
call fcn.004047f4
mov esi, eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp esi, 4
jl 0x4792b2
mov edi, dword [ebx]
lea eax, [ebp - 4]
call fcn.00404a44
mov edx, esi
test edx, edx
jns 0x47929b
add edx, 3
sar edx, 2
mov dword [ebp - 0x10], edx
mov ebx, dword [ebp - 0x10]
dec ebx
test ebx, ebx
jl 0x4792b2
inc ebx
xor dword [eax], edi
add eax, 4
dec ebx
jne 0x4792aa
xor edi, edi
mov eax, dword [ebp - 0x10]
shl eax, 2
inc eax
mov ebx, esi
sub ebx, eax
jl 0x4792ed
inc ebx
mov esi, eax
lea eax, [ebp - 4]
call fcn.00404a44
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp + edi - 0xc]
mov byte [eax + esi - 1], dl
inc edi
and edi, 0x80000003
jns 0x4792e9
dec edi
or edi, 0xfffffffc
inc edi
inc esi
dec ebx
jne 0x4792c4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404590
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479315
lea eax, [ebp - 4]
call fcn.0040453c
ret

Function at 0x47a61c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x480bd4
mov eax, ebx
mov edx, 0xfffffff8
test al, 1
je 0x47a638
shr eax, 1
xor eax, 0xedb88320
jmp 0x47a63a
shr eax, 1
inc edx
jne 0x47a62b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x47a624
pop ebx
ret

Function at 0x47a650
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
cmp byte [0x47dab8], 0
jne 0x47a669
mov byte [0x47dab8], 1
call fcn.0047a61c
or ebx, 0xffffffff
mov eax, esi
call fcn.004047f4
test eax, eax
jle 0x47a6a2
mov edx, 1
xor ecx, ecx
mov cl, byte [esi + edx - 1]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x480bd4]
shr ebx, 8
and ebx, 0xffffff
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x47a67c
and ebx, 0x7fffffff
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x414500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
jmp 0x414536
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x414594
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
call fcn.00414470
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jne 0x414592
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp - 0x10]
mov cx, word [edx + eax*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
movzx ecx, word [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
mov eax, edx
jmp 0x414596
jmp 0x41452d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4145a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call dword [fcn.00402008]
mov esp, ebp
pop ebp
ret
Function at 0x4149b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push 0x214c6981
call fcn.004145f0
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x104
lea eax, [ebp - 0x2b8]
push eax
call dword [ebp - 0x1c]
push 0x1c368da0
call fcn.004145f0
add esp, 4
mov dword [ebp - 0x14], eax
call dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x158]
push ecx
call fcn.00414400
add esp, 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x144], 0x2e
mov byte [ebp - 0x143], 0x64
mov byte [ebp - 0x142], 0x6c
mov byte [ebp - 0x141], 0x6c
mov byte [ebp - 0x140], 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2b8]
push eax
call fcn.00414df0
add esp, 8
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00414df0
add esp, 8
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00414df0
add esp, 8
push 0x4e1e0843
call fcn.004145f0
add esp, 4
mov dword [ebp - 0x1a4], eax
push 0
push 0x80
push 2
push 0
push 0
push 0x10000000
lea edx, [ebp - 0x2b8]
push edx
call dword [ebp - 0x1a4]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
je 0x414b05
mov dword [ebp - 0x2bc], 0
push 0x7463a627
call fcn.004145f0
add esp, 4
mov dword [ebp - 0x2c4], eax
push 0
lea eax, [ebp - 0x2bc]
push eax
push 0xf400
push 0x403000
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [ebp - 0x2c4]
push 0x70ebfb28
call fcn.004145f0
add esp, 4
mov dword [ebp - 0x2c0], eax
mov edx, dword [ebp - 0x13c]
push edx
call dword [ebp - 0x2c0]
mov byte [ebp - 0x1b0], 0x60
mov byte [ebp - 0x1af], 0x47
mov byte [ebp - 0x1ae], 0x5c
mov byte [ebp - 0x1ad], 0x56
mov byte [ebp - 0x1ac], 0x5e
mov byte [ebp - 0x1ab], 0x5e
mov byte [ebp - 0x1aa], 1
mov byte [ebp - 0x1a9], 0
mov byte [ebp - 0x1a8], 0x12
mov byte [ebp - 0x1a7], 0x32
push 0x32
push 0xa
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.00414640
add esp, 0x10
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x75
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x65
mov byte [ebp - 8], 0
push 0x44
push 0
lea edx, [ebp - 0x1a0]
push edx
call fcn.00414620
add esp, 0xc
mov dword [ebp - 0x1a0], 0x44
push 0x10
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00414620
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x2b8]
push edx
call fcn.00414df0
add esp, 8
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00414de0
add esp, 8
lea edx, [ebp - 0x2b8]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00414df0
add esp, 8
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00414d50
add esp, 4
push 0xe621d6
call fcn.004145f0
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x1a0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call dword [ebp - 4]
push 0xea60
mov edx, dword [ebp - 0x134]
push edx
call dword [fcn.00402014]
mov esp, ebp
pop ebp
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x344f0f59
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x26907c1d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x409c50
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
sub esp, 0x830
cmp dword [0x5628d4], 0x13f7
mov eax, dword [esp + 0x834]
push ebx
mov ebx, dword [eax + 4]
push ebp
push esi
mov esi, dword [esp + 0x844]
push edi
mov edi, dword [eax]
mov eax, dword [esi]
mov ebp, 0xc6ef3720
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], eax
jne 0x409ca2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
cmp dword [0x5628d4], 0x60b
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
jne 0x409cf2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push 0
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov dword [esp + 0x1c], 0x20
lea ebx, [ebx]
mov eax, edi
shl eax, 4
cmp dword [0x5628d4], 5
mov dword [esp + 0x18], eax
jne 0x409d3d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
lea ecx, [esp + 0x38]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00409c00
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0x5628d4], 0x1b
lea ecx, [edi + ebp]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov dword [0x545d34], 0xffcf03fc
jne 0x409d96
push 0
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x14]
mov dword [0x545d34], 0
xor eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add dword [0x545d34], eax
sub ebx, dword [esp + 0x10]
mov esi, ebx
shl esi, 4
cmp dword [0x5628d4], 0x78c
mov dword [esp + 0x18], ebx
jne 0x409de1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov edx, ebx
shr edx, 5
mov dword [0x545d38], 0xc5e121b4
mov dword [0x545d3c], 0xffffffff
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x34]
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
add eax, esi
xor eax, dword [esp + 0x10]
add ebp, 0x61c88647
xor eax, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
sub edi, eax
sub dword [esp + 0x1c], 1
jne 0x409d00
mov eax, dword [esp + 0x844]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov dword [eax + 4], ebx
pop ebx
add esp, 0x830
ret 8
Function at 0x409e50
Capabilities:
Copy file
Manipulate console buffer
Terminate thread

Disassembly:
sub esp, 0xf18
cmp dword [0x5628d4], 0x516
jne 0x409eb4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__hread]
push 0
lea eax, [esp + 0x71c]
push eax
push 0
call sub.KERNEL32.dll_VerLanguageNameW
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
xor edx, edx
xor ecx, ecx
mov word [esp + 2], dx
lea eax, [esp + 4]
push eax
mov word [esp + 4], cx
mov ecx, dword [esp + 4]
push ecx
push edx
lea edx, [esp + 0x324]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [esp + 0xf20]
shr eax, 3
test eax, eax
jbe 0x409fdb
mov ecx, dword [esp + 0xf1c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x5628d4], 0x29
jne 0x409f3b
xor eax, eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x34]
push ecx
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call esi
push 0
push 0
push 0
push 0
push 0
push 0
call edi
lea edx, [esp + 0x2c]
push edx
push 0x401380
call ebx
push 0
call ebp
cmp dword [0x5628d4], 0xe1b
jne 0x409f5f
lea eax, [esp + 0x328]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x5628d4], 0x1c
jne 0x409fb5
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
push 0
push 0
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea edx, [esp + 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [esp + 0xf34]
mov edx, dword [esp + 0x10]
push ecx
push edx
call fcn.00409c50
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x409ef1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf18
ret 0xc
Function at 0x409ff0
Capabilities:
Connect pipe
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
sub esp, 0x6c
cmp dword [0x5628d4], 0x37
jne 0x40a0e4
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x401398
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
push 0x30
lea eax, [esp + 0x40]
push 0
push eax
mov dword [esp + 0x44], 0
call fcn.0040afa0
add esp, 0xc
push 0
lea ecx, [esp + 0x3c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
mov dword [esp], 0
mov eax, dword [0x5628d8]
add dword [esp], eax
mov eax, 0x38d6
add dword [esp], eax
mov edx, dword [esp]
mov eax, dword [esp + 0x70]
mov cl, byte [edx + eax]
mov edx, dword [0x545d30]
mov byte [edx + eax], cl
add esp, 0x6c
ret 4

Function at 0x40a150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov al, 0x65
mov cl, 0x6c
push 0x4c2368
mov byte [0x4c2369], al
mov byte [0x4c236a], 0x72
mov byte [0x4c2370], 0x2e
mov byte [0x4c2371], 0x64
mov byte [0x4c2372], cl
mov byte [0x4c2374], 0
mov byte [0x4c236c], al
mov byte [0x4c236d], cl
mov byte [0x4c236e], 0x33
mov byte [0x4c236f], 0x32
mov byte [0x4c2373], al
mov byte [0x4c236b], 0x6e
mov byte [0x4c2368], 0x6b
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x5628d4]
mov edx, dword [0x545d30]
mov dword [0x561f6c], eax
lea eax, [esp]
push eax
push 0x40
push ecx
push edx
mov byte [0x4c2376], 0
mov byte [0x4c236f], 0x50
mov byte [0x4c236d], 0x61
mov byte [0x4c2368], 0x60
mov byte [0x4c2370], 0x7c
mov byte [0x4c2371], 0x6f
mov byte [0x4c2375], 0x74
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x40b490
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b4af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40b4b6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40b4cd
mov ecx, dword [ebp - 4]
push ecx
call fcn.00411790
add esp, 4
or eax, 0xffffffff
jmp 0x40b4cf
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412600
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c1114]
jne 0x41260a
repz ret
jmp fcn.0041e990
Function at 0x40a518
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push 0x20
mov eax, 0x5d963b
call fcn.00593b07
mov edi, ecx
cmp dword [0x6d2c5c], 0
mov ebx, dword [ebp + 8]
je 0x40a5f0
call fcn.0040a5f8
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push 0x200
call fcn.0040b022
lea esi, [edi + 4]
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
mov esi, 0x62a234
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
push ebx
call fcn.005baec0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040b220
mov esi, 0x62a14c
push esi
call fcn.005baec0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [edi], 0xffffffff
je 0x40a5e8
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
add eax, eax
push eax
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
call fcn.00593ab1
ret 4
Function at 0x40ac7d
Capabilities:
Delete file

Disassembly:
push 0x40
mov eax, 0x5d96a8
call fcn.00593b07
mov esi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x40acb1
push 0xf1
push str.Libcurl::DownloadFile
push str.__s__d___pRequest_is_empty
call fcn.0040a649
add esp, 0xc
or eax, 0xffffffff
jmp 0x40ae5f
and dword [ebp - 0x48], 0
lea edi, [esi + 4]
push ebx
mov ecx, edi
call fcn.00404698
cmp dword [edi + 0x14], 0x10
jb 0x40acc8
mov edi, dword [edi]
push edi
push 0x2712
push dword [esi]
call fcn.004e6960
add esp, 0xc
push 1
push 0x29
push dword [esi]
call fcn.004e6960
add esp, 0xc
push 0
push 0x2b
push dword [esi]
call fcn.004e6960
add esp, 0xc
push 0x40aef5
push 0x4e2b
push dword [esi]
call fcn.004e6960
add esp, 0xc
push 0x40ae67
push 0x4e58
push dword [esi]
call fcn.004e6960
add esp, 0xc
lea edi, [ebx + 0xa8]
push edi
push 0x2749
push dword [esi]
call fcn.004e6960
add esp, 0xc
push dword [esi + 0x20]
push 0xd
push dword [esi]
call fcn.004e6960
add esp, 0xc
push 1
push 0x63
push dword [esi]
call fcn.004e6960
add esp, 0xc
push 0x62a1d0
sub esp, 0x18
mov ecx, esp
push edi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x2c]
call fcn.00430ab2
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x40ad7a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.005baad1
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
cmp dword [ebp - 0x48], 0
jne 0x40adec
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x18
xor ebx, ebx
mov ecx, esp
mov esi, eax
push edi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00404267
lea ecx, [ebp - 0x2c]
call fcn.00430ab2
add esp, 0x18
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
jb 0x40adc6
mov eax, dword [eax]
push eax
push esi
push 0x106
push str.Libcurl::DownloadFile
push str.__s__d___fp_is_empty__code_d__strFileName_s
call fcn.0040a649
add esp, 0x14
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
jmp 0x40aca9
push dword [ebp - 0x48]
push 0x2711
push dword [esi]
call fcn.004e6960
add esp, 0xc
push dword [esi]
call fcn.004e3060
cmp dword [ebp - 0x48], 0
mov esi, eax
pop ecx
je 0x40ae1b
push dword [ebp - 0x48]
call fcn.005babb0
and dword [ebp - 0x48], 0
pop ecx
test esi, esi
jne 0x40ae28
mov byte [ebx + 0x118], 1
jmp 0x40ae5d
sub esp, 0x18
mov ecx, esp
push edi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00404267
lea ecx, [ebp - 0x44]
call fcn.00430ab2
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x40ae4e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x44]
call fcn.0040b67e
mov eax, esi
call fcn.00593ab1
ret 4