joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa76210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a76360
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa76236
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa76222
add dl, dl
jne 0xa76241
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa76294
xor eax, eax
add dl, dl
jne 0xa7624e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa76335
add dl, dl
jne 0xa7625d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa76268
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa76273
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa7627e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa7628a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa7622d
mov eax, 1
add dl, dl
jne 0xa762a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa762ad
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa76299
sub eax, ebx
mov ebx, 1
jne 0xa762e0
mov ecx, 1
add dl, dl
jne 0xa762c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa762d1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa762bd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7622d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa762f7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa76302
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa762ee
cmp eax, 0x7d00
jae 0xa76325
cmp eax, 0x500
jb 0xa76320
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7622d
cmp eax, 0x7f
ja 0xa76328
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa7622d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa76356
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa7622d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x401797
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x4d04c0]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4017df
cmp byte [esp], 2
jne 0x4017d9
mov eax, dword [esp]
shr eax, 8
cmp al, 2
jne 0x4017d9
xor eax, eax
inc eax
jmp 0x4017e1
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0047a0fb
mov esp, ebp
pop ebp
ret
Function at 0x401b27
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4d04c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x114], eax
cmp eax, edi
je 0x401b71
cmp dword [ebp + 0xc], edi
jl 0x401b71
cmp dword [esi + 0xc], edi
jne 0x401b85
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._ERROR___d___socket__receive_failed__no_connected.
call fcn.00414401
pop ecx
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047a0fb
leave
ret 8
mov eax, dword [esi + 4]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x11c]
push eax
push edi
push edi
lea eax, [ebp - 0x110]
push eax
push edi
mov dword [ebp - 0x11c], 0x3c
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x110], 1
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp ebx, 0xffffffff
jne 0x401be9
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._ERROR___d___socket__receive_failed__select_err__d_.
mov ecx, dword [0x4d4770]
call fcn.00414401
add esp, 0xc
jmp 0x401b71
cmp ebx, edi
jne 0x401bfc
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._WARN___d___socket__receive_failed__select_ret_0___err__d_.
jmp 0x401bd9
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x114]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp ebx, edi
jne 0x401c3a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._WARN___d___socket__receive_failed__size_0_.
call fcn.00414401
pop ecx
pop ecx
call fcn.00401b0b
mov eax, ebx
jmp 0x401b74
cmp ebx, 0xffffffff
jne 0x401c33
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._ERROR___d___socket__receive_failed__err__d_
jmp 0x401bd9

Function at 0x401cbb
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4d04c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp ebx, edi
je 0x401d50
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
jl 0x401d50
cmp dword [esi + 0xc], edi
je 0x401d50
mov dword [ebp - 0x108], eax
mov eax, dword [esi + 4]
push 0xfc
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x100]
push edi
push eax
mov dword [ebp - 0x110], 0x1e
mov dword [ebp - 0x10c], edi
call fcn.004805d0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push edi
lea eax, [ebp - 0x108]
push eax
push edi
push edi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x401d50
cmp eax, edi
je 0x401d50
push edi
push dword [ebp + 8]
push ebx
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x401d52
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0047a0fb
leave
ret 4
Function at 0x401d61
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4d04c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 8], ebx
je 0x401d8a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x401d8e
xor eax, eax
jmp 0x401da5
lea edi, [eax + eax]
mov eax, edi
call fcn.00480b60
mov esi, esp
push 3
push edi
push dword [ebp + 8]
call fcn.0040212f
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x401dbb
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
cmp eax, ebx
je 0x401dbb
mov ebx, dword [eax]
mov eax, ebx
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047a0fb
leave
ret 4

Function at 0x4021ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402243
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x402235
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x402231
cmp edi, eax
jae 0x402235
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x402223
cmp edi, eax
jb 0x402239
xor eax, eax
jmp 0x402242
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x404a10
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x4a0e30
call fcn.0048109c
mov edi, ecx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push Ordinal_1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x404b1a
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___RunExe_1
call fcn.00414401
push 0x38
lea eax, [ebp - 0x4c]
push ebx
push eax
call fcn.004805d0
add esp, 0x14
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x48], ebx
call fcn.0041a3c7
mov dword [ebp - 0x44], str.runas
test eax, eax
jne 0x404a93
mov dword [ebp - 0x44], str.open
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ebx
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___RunExe_3
call fcn.00414401
pop ecx
pop ecx
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, dword [ebp - 0x18]
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___RunExe_4
call fcn.00414401
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push ebx
call edi
call esi
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___RunExe_5
call fcn.00414401
mov eax, dword [ebp - 0x14]
jmp 0x404b34
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___RunExe_6
call fcn.00414401
or eax, 0xffffffff
pop ecx
pop ecx
call fcn.00481174
ret
Function at 0x404c65
Capabilities:
Resolve dns

Disassembly:
push 0x58
mov eax, 0x49feaa
call fcn.00481105
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ebx
test ebx, ebx
jne 0x404c87
xor al, al
jmp 0x404dde
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x404c9c
and dword [ebp - 0x54], 0
jmp 0x404cb4
lea edi, [eax + eax]
mov eax, edi
call fcn.00480b60
mov esi, esp
push 3
push edi
push ebx
call fcn.0040212f
mov dword [ebp - 0x54], eax
push dword [ebp - 0x54]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x404d54
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004029c1
mov ecx, dword [ebp - 0x4c]
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00406eda
mov edi, eax
call fcn.004072aa
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402a5a
mov ebx, dword [esi + 0xc]
cmp dword [ebx], 0
je 0x404d54
and dword [ebp - 0x58], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x2c]
call fcn.004029c1
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 4], 1
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00406eda
mov esi, eax
lea edi, [ebp - 0x5c]
call fcn.0041963f
push eax
push esi
lea esi, [ebp - 0x64]
call fcn.004078dd
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402a5a
add ebx, 4
cmp dword [ebx], 0
jne 0x404d03
push dword [ebp - 0x50]
lea ecx, [ebp - 0x2c]
call fcn.004029c1
mov esi, dword [ebp - 0x54]
mov dword [ebp - 4], 2
test esi, esi
jne 0x404d72
mov esi, 0x4badf6
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x2c]
push eax
call fcn.00406eda
push dword [eax + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___query_host__s___ip_count__d_
call fcn.00414401
or dword [ebp - 4], 0xffffffff
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402a5a
push dword [ebp - 0x50]
lea ecx, [ebp - 0x48]
call fcn.004029c1
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], 3
call fcn.00406eda
mov esi, dword [eax + 8]
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00402a5a
test esi, esi
setne al
lea esp, [ebp - 0x74]
call fcn.00481188
ret 4
Function at 0x405ed4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 0x1c]
mov edi, ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___download:_start_pos__I64d___will_download__I64d___downloaed__I64d_
call fcn.00414401
mov eax, dword [ebp + 0x10]
add esp, 0x20
or eax, dword [ebp + 0x14]
jne 0x405f22
inc eax
mov dword [edi + 0x11c], eax
jmp 0x405fdf
push dword [ebp + 0x14]
mov dword [edi + 0x90], ebx
push dword [ebp + 0x10]
mov dword [edi + 0x94], esi
call fcn.00406b6b
cmp dword [edi + 0x8c], 0
jl 0x405f71
jg 0x405f4d
cmp dword [edi + 0x88], 0
jbe 0x405f71
mov ebx, dword [edi + 0x88]
mov esi, dword [edi + 0x8c]
mov eax, edi
call fcn.00406bb6
cmp edx, esi
jl 0x405f71
jg 0x405f6a
cmp eax, ebx
jbe 0x405f71
push esi
push ebx
call fcn.00406b6b
push dword [ebp + 0x1c]
mov esi, edi
push dword [ebp + 0x18]
call fcn.00406aec
lea eax, [esp + 0xc]
push eax
xor esi, esi
push esi
push edi
push 0x405dc6
push 0x800000
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x78], eax
cmp eax, esi
je 0x405fc4
cmp eax, 0xffffffff
je 0x405fc4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._INFO___d___create_download_thread_success.
call fcn.00414401
xor eax, eax
inc eax
jmp 0x405fdd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x4d4770]
push eax
push str._ERROR___d___create_download_thread_failed_
call fcn.00414401
xor eax, eax
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x40659a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
xor eax, eax
push edi
cmp dword [ebp + 8], eax
je 0x40660e
cmp dword [ebp + 0xc], eax
jl 0x40660e
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40660e
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x10], eax
mov eax, esi
mov dword [ebp - 0xc], edx
call fcn.00406b1b
mov edi, eax
add edi, dword [ebp - 0x10]
mov ebx, edx
adc ebx, dword [ebp - 0xc]
push ebx
push edi
call fcn.00406aec
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x406608
push dword [esi + 0x70]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push edi
push dword [esi + 8]
call eax
add esp, 0x18
mov eax, edi
mov edx, ebx
jmp 0x406613
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40a9d7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
push edi
test eax, eax
js 0x40ab9f
cmp eax, dword [esi + 0x50]
jge 0x40ab9f
mov edx, dword [ebp + 0x10]
test edx, edx
jl 0x40ab9f
mov ebx, dword [ebp + 0xc]
jg 0x40aa18
test ebx, ebx
jb 0x40ab9f
test edx, edx
jl 0x40aa26
jg 0x40aa18
test ebx, ebx
je 0x40aa26
mov ecx, dword [esi + 0x60]
imul eax, eax, 0x18
mov dword [ecx + eax + 0x10], ebx
mov dword [ecx + eax + 0x14], edx
lea edi, [esi + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x14]
add dword [esi + 0x10], eax
mov eax, dword [ebp + 0x18]
push edi
adc dword [esi + 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.0040cbd2
test eax, eax
je 0x40ab9f
push ebx
push 5
push dword [esi + 0xa0]
push dword [ebp + 8]
call fcn.0040d07a
mov eax, dword [esi + 0x54]
or dword [ebp + 0x14], 0xffffffff
or dword [ebp + 0x18], 0xffffffff
xor edi, edi
cmp eax, edi
je 0x40aa92
mov ecx, dword [eax + 0x88]
mov eax, dword [eax + 0x8c]
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], eax
cmp dword [esi + 0x58], edi
je 0x40ab9f
cmp dword [ebp + 0x18], edi
jl 0x40ab9f
jg 0x40aaaf
cmp dword [ebp + 0x14], edi
jbe 0x40ab9f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xac]
add ecx, 0x64
cmp eax, ecx
jbe 0x40ab9f
mov dword [ebp - 4], edi
mov dword [ebp + 0x10], edi
cmp dword [esi + 0x50], edi
jle 0x40ab0e
mov dword [ebp + 8], edi
mov eax, dword [esi + 0x58]
add eax, dword [ebp + 8]
call fcn.00406b1b
mov ebx, edi
mov edi, dword [ebp - 4]
sub ebx, eax
mov eax, dword [esi + 0x58]
sbb edi, edx
add eax, dword [ebp + 8]
call fcn.00406bb6
add eax, ebx
adc edx, edi
inc dword [ebp + 0x10]
add dword [ebp + 8], 0x120
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], edx
cmp eax, dword [esi + 0x50]
jl 0x40aad4
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
sub ebx, edi
sbb eax, dword [ebp - 4]
push 0x20
mov dword [ebp + 0x10], eax
call fcn.0047a357
xor edi, edi
pop ecx
cmp eax, edi
je 0x40ab3d
mov dword [eax + 0x18], edi
mov dword [eax], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov edi, eax
test edi, edi
je 0x40ab9f
mov eax, dword [esi + 0xa0]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x10], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0xc], eax
call ebx
sub eax, dword [esi + 0x38]
jne 0x40ab70
and dword [edi + 0x18], eax
jmp 0x40ab87
push 0
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00483440
imul eax, eax, 0x3e8
mov dword [edi + 0x18], eax
push edi
push 3
push dword [esi + 0xa0]
push 0xffffffffffffffff
call fcn.0040d07a
call ebx
mov dword [esi + 0xac], eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40ad85
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004829e0
mov eax, dword [0x4d04c0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3ffe
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
push eax
call fcn.004805d0
add esp, 0xc
lea eax, [ebp - 0x400c]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x40ae33
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x40ae33
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x4008]
push eax
push 0x4bae2c
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40ae33
mov eax, dword [ebp - 0x4008]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
mov eax, edi
call fcn.00404705
xor eax, eax
add esp, 0x14
inc eax
jmp 0x40ae35
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047a0fb
leave
ret

Function at 0x40b06b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4d04c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x40b095
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40b099
xor eax, eax
jmp 0x40b0b0
lea edi, [eax + eax]
mov eax, edi
call fcn.00480b60
mov esi, esp
push 3
push edi
push dword [ebp + 8]
call fcn.0040212f
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x40b0f5
mov edi, dword [ebp + 0xc]
call fcn.004072aa
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x40b0f5
and dword [ebp - 8], 0
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0xc]
mov dword [ebp - 0xc], eax
call fcn.0041963f
push eax
push esi
lea esi, [ebp - 0x14]
call fcn.004078dd
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40b0d2
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ecx + 8], eax
setne al
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047a0fb
leave
ret 8
Function at 0x40bf2d
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [esi + 0x54]
push ebx
push edi
xor edi, edi
mov dword [ebp - 8], edi
cmp eax, edi
je 0x40c036
cmp dword [esi + 0x60], edi
je 0x40c036
cmp dword [eax + 0x74], edi
je 0x40c036
cmp dword [esi + 0x5c], edi
je 0x40c036
lea eax, [ebp - 4]
push eax
push esi
call fcn.0040bb1d
push edi
push 0x80
push 3
push edi
push 3
push 0xc0000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40bf9a
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00402a23
jmp 0x40c036
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40c020
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0xfffffffffffffffc
pop eax
push 2
lea edx, [ebp - 0x20]
push edx
or ecx, 0xffffffff
push ecx
push eax
push ebx
call edi
test eax, eax
je 0x40c020
and dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [esi + 0x5c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c020
mov ecx, dword [esi + 0x50]
imul ecx, ecx, 0x18
push 0xfffffffffffffffc
pop eax
push 2
sub eax, ecx
cdq
lea ecx, [ebp - 0x28]
push ecx
push edx
push eax
push ebx
call edi
test eax, eax
je 0x40c020
and dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x50]
imul eax, eax, 0x18
push eax
push dword [esi + 0x60]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c020
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00402a23
test ebx, ebx
je 0x40c036
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret
Function at 0x40e2ac
Capabilities:
Read file on windows

Disassembly:
push 0x128
mov eax, 0x49f457
call fcn.00481105
mov eax, dword [ebp + 0xc]
push 0x4bcd80
push dword [ebp + 8]
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x134], esi
call fcn.0047c2e8
xor ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 0x120], eax
cmp eax, ebx
jne 0x40e31d
cmp edi, ebx
je 0x40e316
lea ecx, [ebp - 0x11c]
call fcn.0040ecd9
mov esi, eax
mov dword [ebp - 4], ebx
call fcn.00401fff
push ebx
push 1
lea ecx, [ebp - 0x11c]
call fcn.00402a5a
xor al, al
jmp 0x40e445
cmp esi, ebx
je 0x40e32b
mov eax, dword [esi]
mov dword [ebp - 0x128], eax
jmp 0x40e331
mov dword [ebp - 0x128], ebx
push 9
xor eax, eax
pop ecx
mov word [ebp - 0x38], ax
lea edi, [ebp - 0x36]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x12c]
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.00402660
push 2
push ebx
push dword [ebp - 0x120]
call fcn.0047c389
push dword [ebp - 0x120]
call fcn.0047c599
push ebx
push ebx
push dword [ebp - 0x120]
mov esi, eax
call fcn.0047c389
add esp, 0x1c
xor edi, edi
cmp esi, ebx
je 0x40e3f5
push esi
call fcn.00479152
push dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
push 1
push esi
push eax
call fcn.0047c848
push esi
push dword [ebp - 0x124]
xor ebx, ebx
call fcn.0040ea92
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00479152
push esi
push dword [ebp - 0x124]
mov ebx, eax
call fcn.0040ea92
mov ecx, dword [ebp - 0x12c]
add esp, 0x28
push edi
push ebx
call fcn.0040291c
push ebx
call fcn.0047af65
push dword [ebp - 0x124]
call fcn.0047af65
pop ecx
pop ecx
xor ebx, ebx
push edi
push esi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x100]
push str._s_d_bytes_to__d_wide_chars
push eax
call fcn.0047c865
mov ecx, dword [ebp - 0x130]
add esp, 0x14
cmp ecx, ebx
je 0x40e425
lea eax, [ebp - 0x100]
push eax
call fcn.0040299a
push dword [ebp - 0x120]
call fcn.0047c971
mov eax, dword [ebp - 0x134]
pop ecx
cmp eax, ebx
je 0x40e443
mov ecx, dword [ebp - 0x128]
mov dword [eax], ecx
mov al, 1
call fcn.00481188
ret