joyce8/EMBER2024-capa huggingface dataset:
Function at 0x112b6ffd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x112b701f
test al, 0x10
je 0x112b701f
mov eax, esi
pop esi
pop ebp
ret 4
xor esi, esi
jmp 0x112b7018

Function at 0x112ba108
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov bh, 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.112b9e74
aad 0xe6
mov ah, 0x2e
lea eax, [ebp - 0x58]
push eax
call fcn.112b9e84
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
invalid

Function at 0x112ba232
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.112b9e84
push eax
push esi
push dword [ebp + 8]
call fcn.112b9e39
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.112b9e84
push eax
push esi
push dword [ebp + 8]
call fcn.112b9e39
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.112b9e74
cmpsb byte [esi], byte es:[edi]
mov dword [edi + 0x7c9d884a], ecx
invalid

Function at 0x112ba515
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x112ba528
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x112ba523
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x112ba50d
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp fcn.112ba515
cmp edx, ebx
jne 0x112ba663
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x112ba4e4
add eax, dword [eax + 4]
jmp 0x112ba4d1
mov dword [ebp + 0xc], ebx
jmp 0x112ba533
Function at 0x112ba54c
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x112ba54b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x112ba569
movzx eax, ax
mov bh, 0xc0
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
invalid
invalid

Function at 0x112ba5be
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x112ba5ae
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x112ba5b7
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x112ba5c1
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x112ba5a3
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x112ba52d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x112ba614
dec eax
je 0x112ba60b
sub eax, 3
je 0x112ba602
mov dword [ebp - 4], 0x40
jmp 0x112ba631
mov dword [ebp - 4], 4
jmp 0x112ba617
mov dword [ebp - 4], 0x20
jmp 0x112ba617
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x112ba663
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x112ba5e3
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.112b9e74
nop
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x112ba6ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edx + 0x6dfffffc], edi
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.112b9e84
pop ecx
Function at 0x112ba719
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.112b9e39
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
add byte [eax], al
add byte [eax - 0x3c35b], al
inc dword [eax]
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.112b9e84
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.112b9e39
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.112b9e84
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.112b9e39
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.112b9e74
aam 0x77
pop ebx
dec edi
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.112b9e84
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.112b9e39
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.112b9e74
dec esp
loope 0x112ba9ee
dec eax
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
invalid
invalid
Function at 0x112ba762
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax - 0x3c35b], al
inc dword [eax]

Function at 0x112bd963
Capabilities:
Create thread

Disassembly:
push dword [0x112cb4f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x112bd99e
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x112b9580
push esi
push esi
push esi
push esi
mov dword [0x112cb4ec], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x112cb4f0], eax
cmp eax, esi
je 0x112b9580
lea eax, [edi + 4]
push eax
push esi
push edi
push 0x112b6bd0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x112bd983
push 0xffffffffffffffff
push dword [0x112cb4f0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x112bd98f
xor ebx, ebx
jmp 0x112bd99e
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc ebx
push edi
mov edi, ecx
cmp dword [0x112cb388], esi
je 0x112b9536
jmp 0x112b9580
mov dword [edi], eax
cmp eax, esi
jne 0x112b956d
jmp 0x112bd997
test eax, eax
je 0x112b9525
xor ebx, ebx
jmp 0x112b9525
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x112bea31
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cli
invalid
push 4
mov eax, 0x112c7dcf
call fcn.112b1d79
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x112b9628
mov edi, dword [esi + 0x18]
xor ebx, ebx
mov dword [ebp - 4], 5
test edi, edi
jle 0x112bea73
push ebx
lea ecx, [esi + 0x10]
call fcn.112b8883
mov ecx, dword [eax]
test ecx, ecx
je 0x112bea6e
push 1
call fcn.112c5ee6
inc ebx
cmp ebx, edi
jl 0x112bea58
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x112bea81
push 1
call fcn.112c5ee6
mov ebx, dword [esi + 0x2c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x112beaa0
push ebx
call fcn.112b858a
push dword [eax + 8]
call edi
push ebx
lea ecx, [esi + 0x28]
call fcn.112c5dfb
dec ebx
lea ecx, [esi + 0x28]
js 0x112ba952
jmp 0x112bea8c

Function at 0x112bfe2c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
test esi, esi
jne 0x112bfe47
push 0x80004005
call fcn.112bf095
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x112bfe49
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x112c04dc
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x112cb010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.112bfd8a
mov edi, eax
cmp edi, esi
je 0x112c054e
lea ecx, [ebp - 0x214]
call fcn.112bfd17
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.112b13e5
leave
ret 4
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
jmp 0x112c056c
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.112c04dc
cmp eax, esi
jne 0x112c05b7
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x112c0556
lea ecx, [ebp - 0x214]
call fcn.112bfd17
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.112bfbfe
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.112bfd17
mov eax, esi
jmp 0x112c053e
Function at 0x112c1c1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x112c6bc7
call fcn.112c23d2
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x112c1c76
call fcn.112bfafa
mov esi, eax
jmp 0x112c1d7f
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x112c1c8f
call fcn.112bfafa
jmp 0x112c1d71
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x112c1c85
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x112c1cf5
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x112c1cdb
lea ecx, [ebp - 0x418]
call fcn.112c047b
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.112c03ed
mov eax, esi
call fcn.112c2412
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.112c0b06
mov dword [ebp - 4], 1
jmp 0x112c1d23
cmp dword [ebp - 0x418], esi
jne 0x112c1d32
mov esi, 0x8007000e
jmp 0x112c1d73
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x112c1c85
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.112c1ae1
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x112c1ce0
lea ecx, [ebp - 0x418]
call fcn.112c047b
jmp 0x112c1ce0
Function at 0x112c5bdf
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x112cb010]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
push 8
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_OpenProcessToken]
test eax, eax
jne 0x112c5c14
xor al, al
jmp 0x112c5c91
push esi
mov esi, dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_GetTokenInformation]
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0
push 1
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call fcn.112b5720
mov edi, eax
pop ecx
test edi, edi
je 0x112c5c55
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push 1
push dword [ebp - 8]
call esi
test eax, eax
jne 0x112c5c62
push edi
call fcn.112b2e9d
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x112c5c8f
lea eax, [ebp - 0x6c]
push eax
call fcn.112c5bad
add eax, 4
push eax
push dword [edi]
call dword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_EqualSid]
lea ecx, [ebp - 0x6c]
mov esi, eax
call fcn.112c5b70
push edi
call fcn.112b2e9d
xor eax, eax
test esi, esi
pop ecx
setne al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.112b13e5
leave
ret
Function at 0x4118b1
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x3bc]
sub esp, 0x43c
mov eax, dword [0x494284]
xor eax, ebp
mov dword [ebp + 0x3b8], eax
push ebx
push esi
push edi
mov ebx, SysStringLen
lea ecx, [ebp - 0x64]
push ebx
call fcn.00419301
lea eax, [ebp - 0x48]
push 0x400
push eax
call fcn.00412523
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ecx
pop ecx
test eax, eax
js 0x4118fd
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call fcn.00411cc2
pop ecx
test eax, eax
je 0x41191d
lea eax, [ebp - 0x48]
push eax
push eax
call fcn.00411f52
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
call esi
call fcn.004119d1
xor edi, edi
push edi
push str.PreDownldStatus
push edi
call fcn.0041263c
add esp, 0xc
lea ecx, [ebp - 0x64]
push ebx
call fcn.00419334
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041937b
test eax, eax
jne 0x4119b9
mov ebx, 0x20019
push ebx
lea eax, [ebp - 0x48]
inc edi
push eax
lea ecx, [ebp - 0x64]
call fcn.00419394
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.00404c4e
test esi, esi
jne 0x4119a8
push eax
lea ecx, [ebp - 0x80]
call fcn.00419301
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x80]
call fcn.00419394
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.00404c4e
push eax
lea ecx, [ebp - 0x80]
call fcn.00419334
test esi, esi
jne 0x4119a8
push str.VersionXmlURL
lea ecx, [ebp - 0x80]
call fcn.0041936b
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041937b
test eax, eax
je 0x411952
mov ecx, dword [ebp + 0x3b8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043f9b7
add ebp, 0x3bc
leave
ret

Function at 0x411f52
Capabilities:
Get common file path
Parse url

Disassembly:
sub esp, 0x644
mov eax, dword [0x494284]
xor eax, esp
mov dword [esp + 0x640], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x654]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x65c]
push 0x3c
pop ebx
push ebx
push 0
push eax
mov byte [esp + 0x15c], 0
call fcn.00441390
add esp, 0xc
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x250]
mov dword [esp + 0x40], 0x400
mov dword [esp + 0x3c], eax
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov ebp, 0x104
test eax, eax
je 0x412004
push 0x100
lea eax, [esp + 0x154]
push eax
push ebp
lea eax, [esp + 0x58]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x26c]
push ebx
push eax
call fcn.0044b6b6
lea eax, [esp + 0x70]
push 0x471868
push eax
call fcn.004414f0
add esp, 0x2c
test eax, eax
je 0x412020
push 1
push esi
call fcn.00412824
push eax
lea eax, [esp + 0x58]
push str.jupdate__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x4c]
push eax
push edi
call esi
lea eax, [esp + 0x150]
push eax
push edi
call esi
mov ecx, dword [esp + 0x650]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043f9b7
add esp, 0x644
ret
Function at 0x416215
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x68
mov eax, 0x468142
call fcn.0043fa2a
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x5c], eax
cmp dword [ebp + 0x10], edx
jne 0x41624d
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 0xf
mov byte [esi], dl
jmp 0x416367
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], edx
push ecx
push edx
push 0x40000001
push dword [ebp + 0x10]
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x41636f
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], cl
mov eax, dword [ebp - 0x60]
mov dword [ebp - 4], 2
test eax, eax
jne 0x41629b
mov dword [ebp - 0x18], eax
mov byte [ebp + eax - 0x28], cl
jmp 0x4162a5
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040e2a4
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x60]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x40000001
push dword [ebp + 0x10]
push dword [ebp - 0x5c]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x4162fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004167e7
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push str.binary2string__phase2__failed__sysError
push eax
call fcn.0040227b
add esp, 0x18
mov byte [ebp - 4], 4
jmp 0x41639b
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [ebp - 0x18]
ja 0x416317
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x416325
sub ecx, dword [ebp - 0x18]
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040e2a4
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004028bb
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x416367
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], ecx
cmp eax, 0x1000
jb 0x41635e
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004078a4
mov eax, dword [ebp - 0x64]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x5c]
push eax
push ecx
call fcn.0043f54d
pop ecx
pop ecx
mov eax, esi
call fcn.0043f9d9
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004167e7
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push str.binary2string__phase1__failed__sysError
push eax
call fcn.0040227b
add esp, 0x18
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x70]
call fcn.00402d4f
push 0x48a83c
lea eax, [ebp - 0x70]
push eax
call fcn.004417dd
int3
Function at 0x4163b3
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x54
mov eax, 0x46817e
call fcn.0043fa2a
mov esi, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x48]
push eax
push 1
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], ecx
push eax
movlpd qword [ebp - 0x48], xmm0
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x416426
push dword [ebp - 0x48]
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0041173c
push dword [ebp - 0x48]
push dword [ebp - 0x44]
push dword [esi]
call fcn.00440e10
add esp, 0xc
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
call fcn.0043f9d9
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004167e7
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edi
push str.decryption_failed__sysError
push eax
call fcn.0040227b
add esp, 0x18
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00402d4f
push 0x48a83c
lea eax, [ebp - 0x60]
push eax
call fcn.004417dd
int3

Function at 0x416550
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x54
mov eax, 0x46817e
call fcn.0043fa2a
mov esi, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x50], eax
xor eax, eax
push 5
inc eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 0x14], eax
pop ecx
cmove eax, ecx
movlpd qword [ebp - 0x48], xmm0
lea ecx, [ebp - 0x48]
push ecx
push eax
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
je 0x4165ce
push dword [ebp - 0x48]
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0041173c
push dword [ebp - 0x48]
push dword [ebp - 0x44]
push dword [esi]
call fcn.00440e10
add esp, 0xc
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
call fcn.0043f9d9
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004167e7
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], edi
push str.encryption_failed__sysError
push eax
call fcn.0040227b
add esp, 0x18
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00402d4f
push 0x48a83c
lea eax, [ebp - 0x60]
push eax
call fcn.004417dd
int3