joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8963cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x4f896314
add ebx, 0
push ecx
call 0x4f896329
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x73467302
sub ebx, dword [0x73486b41]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x73486b31
call fcn.4f891df3
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.4f891301
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x4f896487
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x4f896487
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x4f89643e
mov eax, 1
lock xchg dword [0x73486b3d], eax
push 0x3dd1fc71
call 0x4f8963cb
push esi
add esp, 8
cmp eax, 0
jne 0x4f8963b4
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x4f8963da
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x4f8963ef
cmp ecx, edx
cmp eax, 0
je 0x4f896414
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x4f8963fe
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.4f89642d
dec eax
loope 0x4f896430
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x73486b3d], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x4f896464
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x4f896479
jmp 0x4f896484
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x4f896372
Function at 0x4f89d4ec
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x4f89d7c2
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x734737b5
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x7346a77b
push 0xffffffffffffffff
call fcn.4f8946ec
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x4f89d556
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.4f89d56e
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x4f89d7b6
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x4f89d78a
Function at 0x4f8acfbc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f8acfde
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f8acfde
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f8acfde
ret
cmp word [ebx + 4], 0x14c
jne 0x4f8acfde
test word [ebx + 0x16], 2
je 0x4f8acfde
test word [ebx + 0x16], 0x100
je 0x4f8acfde
cmp word [ebx + 0x18], 0x10b
jne 0x4f8acfde
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f8acfde
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f8ad06a
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f8acffe
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f893f49
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f8acfde
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x4f8ad06a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f8acfde
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f8acfde
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f8acfde
ret
cmp word [ebx + 4], 0x14c
jne 0x4f8acfde
test word [ebx + 0x16], 2
je 0x4f8acfde
test word [ebx + 0x16], 0x100
je 0x4f8acfde
cmp word [ebx + 0x18], 0x10b
jne 0x4f8acfde
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f8acfde
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f8ad06a
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f8acffe
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f893f49
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f8acfde
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x4f8ad121
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f8ad17a
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f8ad121
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f8ad130
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fcb2dd3
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f8ad181
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f893ff7
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f8ad220
add edi, 4
add eax, 2
dec ecx
jne 0x4f8ad166
call 0x4f8ad1cd
loope 0x4f8ad1c3
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f8ad21d
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f8ad22e
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f8ad1e1
cmp eax, ecx
ja 0x4f8ad1e1
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f8ad26b
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f8ad261
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f8944d6
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4f8ad130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f8ad17a
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f8ad121
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f8ad130
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fcb2dd3
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f8ad181
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f893ff7
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f8ad220
add edi, 4
add eax, 2
dec ecx
jne 0x4f8ad166
call 0x4f8ad1cd
loope 0x4f8ad1c3
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f8ad21d
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f8ad22e
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f8ad1e1
cmp eax, ecx
ja 0x4f8ad1e1
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f8ad26b
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f8ad261
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f8944d6
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10010020
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004e70d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x80
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push 0x44
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.1002fd00
mov ecx, dword [0x10065598]
lea eax, [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x30], 0x5b
xorps xmm0, xmm0
movups xmmword [ebp - 0x88], xmm0
push eax
call fcn.10010700
push eax
lea ecx, [ebp - 0x2c]
call fcn.10011440
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.10011260
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
cmp eax, 1
jb 0x100100d5
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
mov word [ecx + eax], 0x22
jmp 0x100100f3
push 1
push 0x10059700
mov byte [ebp - 0x8d], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x8d]
push 1
call fcn.10012570
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10010151
push edi
push dword [ebp - 0x88]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x84]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x88]
call esi
mov byte [ebp - 0x89], 1
jmp 0x10010158
mov byte [ebp - 0x89], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x10010188
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001017e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100101ac
push ecx
push edx
call fcn.1002e314
add esp, 8
mov al, byte [ebp - 0x89]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002dfbc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1003396b
int3
Function at 0x100101c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
call fcn.10011f90
mov ecx, dword [0x10065598]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x9a
lea ecx, [ecx + 8]
call fcn.100105a0
mov esi, eax
cmp dword [esi + 0x10], 1
jbe 0x100102a4
mov ecx, dword [0x10065598]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x9c
lea ecx, [ecx + 8]
call fcn.100105a0
mov ecx, dword [0x10065598]
mov edi, eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9b
push eax
lea ecx, [ecx + 8]
call fcn.100105a0
cmp dword [eax + 0x14], 7
jbe 0x1001024e
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 2
push 0
push 0
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100102a4
cmp dword [edi + 0x14], 7
mov eax, dword [edi + 0x10]
lea eax, [eax*2 + 2]
jbe 0x10010281
mov edi, dword [edi]
cmp dword [esi + 0x14], 7
jbe 0x10010289
mov esi, dword [esi]
push eax
push edi
push 1
push 0
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x10065598]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x59
call fcn.10010700
cmp dword [eax + 0x10], 1
jbe 0x100102ce
mov edx, 0x2710
mov ecx, eax
call fcn.10010020
mov ecx, dword [0x10065598]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x5a
call fcn.10010700
cmp dword [eax + 0x10], 1
jbe 0x100102f8
mov edx, 0x2710
mov ecx, eax
call fcn.10010020
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001030b
push 1
push eax
call fcn.1002e314
add esp, 8
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1002dfbc
mov esp, ebp
pop ebp
ret
Function at 0x1002d935
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.1003940f
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x1002d974
sub eax, 1
je 0x1002d96f
sub eax, 1
je 0x1002d96b
xor eax, eax
leave
ret
push 3
jmp 0x1002d976
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x1003c4b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1003c4f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003c4f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003c4f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1003c4f7
cmp dword [ecx + 0x74], 0xe
jbe 0x1003c4f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100418b6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10055d18
push 0x10055d10
push str.FlsAlloc
push 0x1f
call fcn.10041721
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100418ea
push dword [ebp + 8]
mov ecx, esi
call dword [0x10051164]
call esi
jmp 0x100418f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10041934
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10055d28
push 0x10055d20
push str.FlsGetValue
push 0x21
call fcn.10041721
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004196b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10051164]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10041973
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10055d30
push 0x10055d28
push str.FlsSetValue
push 0x22
call fcn.10041721
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100419ad
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10051164]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10046f28
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1003d87c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1003d87c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10046f9f
cmp word [ecx], dx
je 0x10046f9f
mov eax, dword [0x1005619c]
push edi
dec eax
push eax
push 0x10056088
call fcn.10046ec7
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10047012
cmp word [eax], dx
je 0x10047012
mov eax, dword [edi]
test eax, eax
je 0x10046fc3
cmp word [eax], dx
je 0x10046fc3
lea eax, [ebp - 0x10]
push eax
call fcn.100468aa
jmp 0x10046fcc
lea eax, [ebp - 0x10]
push eax
call fcn.10046945
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1004703c
mov eax, dword [0x10056084]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10055d78
call fcn.10046ec7
add esp, 0xc
test al, al
je 0x1004703c
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10047007
cmp word [eax], di
je 0x10047007
lea eax, [ebp - 0x10]
push eax
call fcn.100468aa
pop ecx
jmp 0x1004703e
lea eax, [ebp - 0x10]
push eax
call fcn.10046945
jmp 0x10047004
mov eax, dword [edi]
test eax, eax
je 0x10047029
cmp word [eax], dx
je 0x10047029
lea eax, [ebp - 0x10]
push eax
call fcn.1004685f
pop ecx
jmp 0x1004703c
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10047107
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10046d4c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10047107
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10047107
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10047107
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10047094
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10041b4f
test ebx, ebx
je 0x10047102
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10041b4f
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10047107
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10047107
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1004ae0f
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10047109
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002dfbc
leave
ret
Function at 0x1004ce10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004ce3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004ce3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x403a50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ee7c
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x569434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea edi, [esi + 8]
mov dword [esi], vtable.CCurlDownloader.0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x24], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x403aad
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
lea edi, [esi + 0x30]
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x403acc
mov eax, dword [edi]
jmp 0x403ace
mov eax, edi
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x403aef
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403ae0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00402a00
lea ebx, [esi + 0x48]
mov byte [ebp - 4], 3
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 8
jb 0x403b17
mov eax, dword [ebx]
jmp 0x403b19
mov eax, ebx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov word [eax], cx
cmp word [edx], cx
je 0x403b40
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403b30
sub ecx, dword [ebp + 8]
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.00402a00
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x403b55
mov edi, dword [edi]
cmp dword [ebx + 0x14], 8
jb 0x403b5d
mov ebx, dword [ebx]
push dword [ebp - 0x10]
push ecx
push edi
push ebx
lea ecx, [esi + 0x60]
call fcn.00414710
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2c]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x60]
push 1
push eax
mov dword [ebx + 0xf0], 0
mov byte [ebx + 0xf4], 0
call fcn.004149d0
cmp dword [eax + 0x14], 8
jb 0x403b99
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x403bb5
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00402e20
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc