joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482679
Capabilities:
Encode data using xor

Disassembly:
jns 0x4826e0
push 0xf89953ee
add dword [0x7acc8dab], esp
sar dword [edi], 1
mov ds, ebp
xchg ecx, eax
cmp eax, ecx
invalid
push eax
jl 0x482732
adc eax, 0x9051d605
in eax, 0x58
sbb ah, bh
lodsd eax, dword [esi]
push dx
mov dh, 0x20
test byte [eax + ecx - 0x27], bh
cmpsd dword [esi], dword es:[edi]
in eax, dx
fld dword [eax + 0x5c6c2559]
mov dh, 0x8b
jg 0x482741
push 0xaf3916cb
bnd jns 0x48276b
jmp 0x482736
jle 0x4827b0
pop esp
ret
sub edi, ebx
mov esp, 0xc13e5bbf
sub dword [esp + eax*8 + 0x6a312ee8], esp
xchg cl, dh
xor dword cs:[edx - 0x7a], ebp
int1
or dword [edi + edx], esp
pop ss
wait
invalid
sar byte [edx], cl
adc al, ah
or al, 0xf9
sbb dl, byte [0xe3c9e4fd]
jnp 0x4827f5
push 0x984058b9
out 0x42, eax
mov ebp, 0xeb4962a0
bound esi, qword [ebx + 0x1b687303]
in al, 0x21
add dword [eax + eax - 0x56], eax
push edx
fcmove st(0), st(4)
not bl
cmp byte [ecx - 0x56], ah
add eax, 0x7e658d36
push edx
mov al, 0x37
xchg edx, eax
inc edx
ja 0x482748
sub eax, 0x49696a64
popal
hlt
aad 0x5e
pop esi
xor esp, esi
xor eax, 0xb97a206d
fcmovnbe st(0), st(4)
mov dh, 0xd4
ja 0x4827b1
popfd
or eax, 0x9927fc93
inc esp
bound edi, qword [edi + 0x5f389ba1]
lahf
sbb al, 0x20
mov dh, 0xf5
mov cl, 0xfa
fistp word [edx + 0x13]
pushal
cmc
enter 0x177c, 0x60
popal
pop esp
fucomi st(4)
js 0x4827af
test ebx, edi
lds esp, [ebx - 0x5b]
mov byte [0x7e3f2324], al
xlatb
mov ebp, 0xc4c81521
mov eax, 0x1bdf8208
mov dl, 0x6a
pop esp
push edx
sbb dword [ebp - 0x28], ebp
push esp
and al, 0xa5
sbb esi, dword [edx + 0x19525c6a]
insd dword es:[edi], dx
fcom dword [esp - 0x5b]
dec ebx
invalid
Function at 0x4babda
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0388
cmp edx, dword [eax]
je 0x4babfc
add eax, 8
inc ecx
cmp eax, 0x4c0418
jl 0x4babed
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0388]
jne 0x4bad2a
mov eax, dword [0x4c4a00]
cmp eax, 1
je 0x4bad04
test eax, eax
jne 0x4bac2d
cmp dword [0x4c02c8], 1
je 0x4bad04
cmp edx, 0xfc
je 0x4bad2a
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bac64
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb2f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb520
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4baca7
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb520
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be6d0
push edi
call fcn.004bccf0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb2f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb300
lea eax, [ebp - 0xa0]
push 0x4be6b0
push eax
call fcn.004bb300
push dword [esi + 0x4c038c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcc64
add esp, 0x2c
pop edi
jmp 0x4bad2a
lea eax, [ebp + 8]
lea esi, [esi + 0x4c038c]
push 0
push eax
push dword [esi]
call fcn.004bb520
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43b650
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
sub edx, 0xea13dc3b
add ecx, 0xbe179d21
call fcn.0043b686
inc ecx
xor dword [eax], esi
sub edx, edx
inc eax
inc edx
cmp eax, edi
jne fcn.0043b650
and ecx, edx
and ecx, edx
add ecx, 0x63746f8c
ret
Function at 0x401371
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x8c]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x401390
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x401384
add esi, 0x10000
push esi
mov eax, 0x40300c
pop dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004012d9
mov dword [0x4030fe], eax
push 0x403010
push 0x3e8
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4013d4
leave
ret 8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x4013e5
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4013f9
leave
ret 8
push eax
call sub.kernel32.dll_LockResource
or eax, eax
jne 0x401407
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
jne 0x401423
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.00401165
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
pop eax
push ebx
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
mov dword [ebp - 4], ebx
mov ebx, dword [esp]
add ebx, dword [ebp + 0xc]
and ebx, 0xffff0000
add ebx, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push ebx
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x401476
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x4014ec
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401b88
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x4012a4
push dword [ebp + 0xc]
call fcn.00401272
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x401757
add eax, dword [ebp + 8]
call eax
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401350
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov eax, 0x400
mov ebp, esp
push esi
push ebx
sub esp, 0x10
xor ebx, ebx
mov dword [esp + 8], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], ebx
mov eax, 8
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.004012f0
shl eax, 0x18
mov ecx, 7
jmp 0x4013a5
dec ecx
mov eax, edx
js 0x4013c0
test eax, eax
lea edx, [eax + eax]
jns 0x4013a0
xor edx, 0x4c11db7
dec ecx
mov eax, edx
jns 0x4013a5
mov esi, esi
lea edi, [edi]
mov dword [esi + ebx*4], edx
mov ecx, 0x20
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.004012f0
mov dword [esi + ebx*4], eax
inc ebx
cmp ebx, 0xff
jle 0x401380
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x401430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ecx, section..rdata
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x42c
mov ebx, 0xffffffff
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], ecx
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test esi, esi
mov eax, 0xffffffff
je 0x4014d8
lea edi, [ebp - 0x418]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 0xc], esi
mov edx, 0x400
mov eax, 1
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_fread
mov dword [esp + 0xc], eax
mov ebx, eax
lea eax, [ebp - 0x41c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x420]
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.004013f0
cmp ebx, 0x400
je 0x401480
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x41c]
not eax
add esp, 0x42c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4015b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x40e010
push esi
push ebx
sub esp, 0x6c
mov ebx, dword [ebp + 8]
mov dword [esp], 0x413f60
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcpy
mov dword [esp], ebx
mov dword [esp + 4], edi
call sub.msvcrt.dll_fopen
mov ebx, eax
test ebx, ebx
mov eax, 1
je 0x401631
mov dword [esp], ebx
mov ecx, 0xffffffea
mov esi, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], ebx
mov eax, 0x16
mov edx, 1
mov dword [esp + 4], eax
lea eax, [ebp - 0x38]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp dword [ebp - 0x38], 0x6054b50
mov eax, 1
je 0x401639
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, word [ebp - 0x30]
xor edi, edi
mov eax, edx
shl eax, 7
add eax, edx
shl eax, 3
mov dword [esp], eax
call fcn.00401530
mov dword [0x40f018], eax
movzx eax, word [ebp - 0x30]
mov dword [esp], ebx
mov dword [0x414110], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
cmp word [ebp - 0x30], 0
je 0x40174b
xor esi, esi
jmp 0x401690
mov dword [esp + 0xc], ebx
mov eax, 1
mov dword [esp + 8], eax
mov eax, 0x2e
mov dword [esp + 4], eax
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp dword [ebp - 0x68], 0x2014b50
jne 0x40175a
mov edx, dword [0x40f018]
inc edi
mov eax, dword [ebp - 0x50]
mov dword [esi + edx + 0x404], eax
mov eax, dword [ebp - 0x3e]
mov dword [esi + edx + 0x400], eax
mov eax, 0x400
lea edx, [esi + edx]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memset
movzx eax, word [ebp - 0x4c]
mov ecx, 1
mov dword [esp + 0xc], ebx
mov edx, dword [0x40f018]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, esi
add eax, edx
mov dword [esp], eax
call sub.msvcrt.dll_fread
movzx edx, word [ebp - 0x48]
mov eax, 1
mov dword [esp], ebx
add esi, 0x408
mov dword [esp + 8], eax
movzx eax, word [ebp - 0x4a]
add eax, edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
movzx eax, word [ebp - 0x30]
cmp eax, edi
jg 0x401690
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x401631
mov eax, 2
jmp 0x401631
Function at 0x4018f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], ebx
cmp byte [0x40f014], 0
je 0x401970
mov eax, dword [0x414030]
mov dword [esp], eax
call fcn.00403610
mov edx, dword [0x40f010]
mov ebx, eax
mov eax, edx
shl eax, 7
add eax, edx
mov edx, dword [0x40f018]
mov eax, dword [edx + eax*8 + 0x404]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov edx, dword [0x40f010]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov eax, edx
shl eax, 7
add eax, edx
mov edx, dword [0x40f018]
mov eax, dword [edx + eax*8 + 0x404]
mov esp, ebp
pop ebp
ret
mov eax, dword [0x414030]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fread
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x401bd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
mov eax, dword [ecx]
xor dl, byte [ebp + 8]
shr eax, 8
mov dword [ecx], eax
movzx edx, dl
xor eax, dword [edx*4 + 0x40da20]
mov dword [ecx], eax
pop ebp
ret

Function at 0x401e70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov dword [esp], 0x4000
call fcn.00401c00
mov dword [ebp - 0x10], eax
nop
lea esi, [esi]
test edi, edi
je 0x401ee4
cmp edi, 0x4000
mov esi, edi
jbe 0x401ea3
mov esi, 0x4000
mov dword [esp + 8], esi
mov eax, dword [0x414190]
sub edi, esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fread
sub dword [0x4143c0], esi
mov ebx, dword [ebp - 0x10]
nop
dec esi
cmp esi, 0xffffffff
je 0x401e90
movsx eax, byte [ebx]
inc ebx
mov dword [esp], eax
call fcn.00401c90
jmp 0x401ed0
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll_free

Function at 0x403610
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push ebx
xor edx, edx
sub esp, 0x34
mov dword [0x40f020], ecx
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x28]
mov dword [0x40f024], edx
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [0x414190], eax
mov eax, 1
mov dword [esp + 8], eax
mov eax, 0x1e
mov dword [esp + 4], eax
call sub.msvcrt.dll_fread
mov eax, 1
mov dword [esp + 8], eax
movzx eax, word [ebp - 0xe]
mov dword [esp + 4], eax
mov eax, dword [0x414190]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, 1
mov dword [esp + 8], eax
movzx eax, word [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [0x414190]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004034c0
mov dword [esp + 4], ebx
mov dword [esp], 1
call fcn.004034c0
mov dword [esp + 4], ebx
mov dword [esp], 2
call fcn.004034c0
mov eax, dword [0x40f024]
add esp, 0x34
pop ebx
pop ebp
ret
Function at 0x403a80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x40f470
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, str.Error_code__i__Please_submit_a_ticket.
mov dword [esp + 8], eax
mov eax, pe_nt_image_headers32
mov dword [esp + 4], eax
call fcn.0040a110
mov dword [esp], ebx
mov ecx, 0x3e9
mov dword [esp + 4], ecx
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov edx, 1
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, 0x105
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.USER32.dll_RedrawWindow
sub esp, 0x10
mov dword [esp], 4
call fcn.00403770
mov dword [esp], 0x40e10e
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x403c10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov edx, str.FlowsionMS_Updater
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x40f4f8], eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.USER32.dll_SetWindowTextA
sub esp, 8
mov eax, 0x3e9
mov dword [esp + 4], eax
mov eax, dword [0x40f4f8]
mov dword [esp], eax
call sub.USER32.dll_GetDlgItem
sub esp, 8
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
mov byte [0x40f450], 0
call sub.msvcrt.dll_clock
push eax
mov edx, 0x40e10e
mov ecx, 0x3eb
fild dword [esp]
add esp, 4
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
fadd dword [0x40e1d4]
or ax, 0xc00
mov word [ebp - 4], ax
xor eax, eax
fldcw word [ebp - 4]
fistp dword [0x40f040]
fldcw word [ebp - 2]
mov dword [0x40f458], eax
mov eax, 0x40e153
mov dword [0x40f45c], eax
xor eax, eax
mov dword [0x40f454], edx
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [0x40f4fc]
mov dword [esp], eax
call sub.USER32.dll_LoadImageA
mov dword [0x40f4f4], eax
sub esp, 0x18
xor eax, eax
mov dword [esp + 0x30], eax
xor eax, eax
mov edx, str.Tahoma
mov dword [esp + 0x2c], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x34], edx
xor edx, edx
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp], 0x10
call sub.GDI32.dll_CreateFontA
mov dword [0x40f4f0], eax
sub esp, 0x38
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [0x40f4f8]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp], 1
call fcn.00403770
test eax, eax
jne 0x403da0
mov eax, dword [0x40f4f8]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00403a80
leave
xor eax, eax
ret
mov dword [esp], 5
mov eax, str.Initialized.
mov dword [esp + 4], eax
call fcn.00403b80
leave
mov eax, 1
ret
Function at 0x403f80
Capabilities:
Copy file
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x40e1dc
push esi
lea esi, [ebp - 0x238]
push ebx
sub esp, 0x2cc
mov ebx, 0x104
mov dword [esp + 4], esi
mov dword [esp], 0x104
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
mov dword [esp + 4], edi
xor edi, edi
mov dword [esp], esi
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x128]
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], ebx
lea ebx, [ebp - 0x288]
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
mov eax, 0x4000000
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, 3
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 5
mov dword [esp + 8], eax
mov eax, 0x80000000
mov dword [esp + 0x18], edx
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x29c], eax
sub esp, 0x1c
mov eax, 0x44
mov dword [esp + 4], edi
lea edi, [ebp - 0x298]
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
cld
xor eax, eax
mov ecx, 4
rep stosd dword es:[edi], eax
mov dword [esp], ebx
xor edx, edx
mov ecx, 0x44
mov dword [esp + 8], ecx
xor edi, edi
mov dword [esp + 4], edx
call sub.msvcrt.dll_memset
mov dword [esp], esi
mov eax, 0x44
mov dword [ebp - 0x288], eax
mov eax, 0x40e1ec
mov dword [esp + 4], eax
call sub.KERNEL32.dll_lstrcatA
mov eax, dword [ebp + 8]
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [ebp - 0x298]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov eax, 0x20
mov dword [esp + 0x20], ebx
xor ebx, ebx
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
mov eax, dword [ebp - 0x29c]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x404200
Capabilities:
Copy file
Delete file
Query environment variable

Disassembly:
push ebp
mov eax, str.Initializing_CRC32...
mov ebp, esp
push edi
mov edi, 0x400
push esi
push ebx
sub esp, 0x22c
xor ebx, ebx
mov dword [esp + 4], eax
mov dword [esp], 2
call fcn.00403b80
mov dword [esp], 0x400
call fcn.00404cd0
mov dword [esp], eax
mov esi, eax
mov dword [esp + 8], edi
lea edi, [ebp - 0x218]
mov dword [esp + 4], ebx
call sub.msvcrt.dll_memset
mov dword [esp], esi
call fcn.00401350
mov dword [esp], 2
mov ecx, str.CRC32_Initialized.
mov dword [esp + 4], ecx
call fcn.00403b80
mov dword [esp], str.TEMP
call sub.msvcrt.dll_getenv
mov dword [esp + 0xc], eax
mov eax, str._s_s
mov edx, str.fmsVer.sys
mov dword [esp + 8], eax
mov eax, 0x200
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0040a110
mov dword [esp], edi
mov eax, 0x40e276
mov dword [esp + 4], eax
call sub.msvcrt.dll_fopen
test eax, eax
je 0x404375
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], 2
mov eax, str.Checking...
mov dword [esp + 4], eax
call fcn.00403b80
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401430
mov dword [esp], esi
mov ebx, eax
mov eax, str.fmsVer.sys
mov dword [esp + 4], eax
call fcn.00401430
cmp ebx, eax
je 0x404340
mov dword [esp], 5
mov esi, str.Preparing_to_fetch...
xor ebx, ebx
mov dword [esp + 4], esi
call fcn.00403b80
mov dword [esp + 8], ebx
mov ecx, str.fmsVer.sys
mov dword [esp + 4], ecx
mov dword [esp], edi
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
mov dword [esp], edi
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xa
mov eax, str.No_new_updates_found.
xor edi, edi
mov dword [esp + 4], eax
call fcn.00403b80
mov dword [esp + 4], edi
mov eax, dword [0x40f4f8]
mov dword [esp], eax
call sub.USER32.dll_EndDialog
sub esp, 8
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x40f4f8]
mov dword [esp], 5
mov dword [esp + 4], eax
call fcn.00403a80
xor eax, eax
jmp 0x40436d