joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10083a30
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10083bc2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10083a5a
call fcn.10083820
test al, al
jne 0x10083a5a
push dword [esi + 0xc]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10083a75
call fcn.10083820
test al, al
jne 0x10083a75
push dword [esi + 0x10]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10083a90
call fcn.10083820
test al, al
jne 0x10083a90
push dword [esi + 0x14]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10083aab
call fcn.10083820
test al, al
jne 0x10083aab
push dword [esi + 0x18]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x10083ac6
call fcn.10083820
test al, al
jne 0x10083ac6
push dword [esi + 0x1c]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10083ae1
call fcn.10083820
test al, al
jne 0x10083ae1
push dword [esi + 0x20]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x10083afc
call fcn.10083820
test al, al
jne 0x10083afc
push dword [esi + 0x24]
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x10083bc2
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x10083b3b
call fcn.10083820
test al, al
jne 0x10083b3b
push dword [esi + 0x38]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x10083b56
call fcn.10083820
test al, al
jne 0x10083b56
push dword [esi + 0x3c]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10083b71
call fcn.10083820
test al, al
jne 0x10083b71
push dword [esi + 0x40]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10083b8c
call fcn.10083820
test al, al
jne 0x10083b8c
push dword [esi + 0x44]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10083ba7
call fcn.10083820
test al, al
jne 0x10083ba7
push dword [esi + 0x48]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10083bc2
call fcn.10083820
test al, al
jne 0x10083bc2
push dword [esi + 0x4c]
call sub.msvcrt.dll_free
add esp, 4
pop esi
pop ebp
ret
Function at 0x10083bd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0xbc]
test ecx, ecx
je 0x10083d4d
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x10083d4d
cmp dword [eax], 0
jne 0x10083d4d
call fcn.10083820
test al, al
jne 0x10083d4d
mov ecx, dword [edi + 0xb0]
call fcn.10083820
test al, al
jne 0x10083d4d
mov ecx, dword [edi + 0xb8]
test ecx, ecx
je 0x10083c4f
cmp dword [ecx], 0
jne 0x10083c4f
call fcn.10083820
test al, al
jne 0x10083c4f
push dword [edi + 0xb8]
call sub.msvcrt.dll_free
push dword [edi + 0xbc]
call fcn.10083a30
add esp, 8
mov ecx, dword [edi + 0xb4]
test ecx, ecx
je 0x10083d34
cmp dword [ecx], 0
jne 0x10083d34
call fcn.10083820
test al, al
jne 0x10083d34
push dword [edi + 0xb4]
call sub.msvcrt.dll_free
mov esi, dword [edi + 0xbc]
add esp, 4
test esi, esi
je 0x10083d34
mov ecx, dword [esi]
test ecx, ecx
je 0x10083ca8
call fcn.10083820
test al, al
jne 0x10083ca8
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10083cc3
call fcn.10083820
test al, al
jne 0x10083cc3
push dword [esi + 4]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10083cde
call fcn.10083820
test al, al
jne 0x10083cde
push dword [esi + 8]
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x10083d34
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x10083d19
call fcn.10083820
test al, al
jne 0x10083d19
push dword [esi + 0x30]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x10083d34
call fcn.10083820
test al, al
jne 0x10083d34
push dword [esi + 0x34]
call sub.msvcrt.dll_free
add esp, 4
push dword [edi + 0xb0]
call sub.msvcrt.dll_free
push dword [edi + 0xbc]
call sub.msvcrt.dll_free
add esp, 8
mov ecx, dword [edi + 0xc0]
test ecx, ecx
je 0x10083db3
cmp dword [ecx], 0
jne 0x10083db3
call fcn.10083820
test al, al
jne 0x10083db3
mov eax, dword [edi + 0xc4]
sub eax, 0xfe
push eax
call sub.msvcrt.dll_free
mov eax, dword [edi + 0xcc]
add esp, 4
sub eax, 0x80
je 0x10083d8f
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [edi + 0xd0]
sub eax, 0x80
je 0x10083da5
push eax
call sub.msvcrt.dll_free
add esp, 4
push dword [edi + 0xc0]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [edi + 0xd4]
test ecx, ecx
je 0x10083de8
cmp dword [ecx + 0xb4], 0
jne 0x10083de8
call fcn.10083820
test al, al
jne 0x10083de8
push dword [edi + 0xd4]
call fcn.10083880
push dword [edi + 0xd4]
call sub.msvcrt.dll_free
add esp, 8
lea esi, [edi + 0x48]
lea ebx, [edi + 0xa8]
cmp esi, ebx
je 0x10083e2c
mov ecx, dword [esi]
test ecx, ecx
je 0x10083e00
call fcn.10083820
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10083e25
call fcn.10083820
test al, al
jne 0x10083e25
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10083e25
cmp dword [eax], 0
jne 0x10083e25
push eax
call sub.msvcrt.dll_free
add esp, 4
add esi, 0x10
cmp esi, ebx
jne 0x10083df5
push edi
call sub.msvcrt.dll_free
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10083ef0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100d4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1018b23c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x508], ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test eax, eax
jne 0x10083f3e
push str._create_locale
call fcn.10085d30
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x508]
test eax, eax
jne 0x10083f39
or eax, 0xffffffff
mov dword [0x1018b23c], eax
lea edi, [eax + 1]
neg edi
sbb edi, edi
and edi, eax
je 0x1008405e
test esi, esi
je 0x10083f7f
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x10083f7f
xor ecx, ecx
mov al, byte [esi + ecx]
lea edx, [ecx + ecx]
test al, al
je 0x10083f9c
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x10083f62
push esi
push dword [ebp - 0x508]
call edi
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079e8b
mov esp, ebp
pop ebp
ret
cmp edx, 0x200
jae 0x10084127
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x10083f7f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call ebx
test eax, eax
je 0x10083f7f
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call ebx
test eax, eax
je 0x10083f7f
lea ebx, [ebp - 0x504]
xor eax, eax
jmp 0x10084030
movzx ecx, word [ebx + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x1008404f
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x10084030
jmp 0x10083f7f
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x10083f7f
cmp ecx, 5
ja 0x10084107
test esi, esi
je 0x10084107
call fcn.10084290
mov edi, eax
test edi, edi
je 0x10084112
call fcn.1007a840
mov ebx, eax
push esi
push dword [ebp - 0x508]
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x50c], eax
or eax, 2
mov dword [ebx + 0x70], eax
call fcn.100843a0
add esp, 8
test eax, eax
je 0x100840c2
mov eax, dword [ebx + 0x6c]
push dword [eax + 4]
call sub.msvcrt.dll__setmbcp
add esp, 4
test eax, eax
jne 0x100840c2
call fcn.10084290
mov esi, eax
jmp 0x100840c4
xor esi, esi
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x70], eax
mov eax, dword [edi]
cmp eax, ecx
je 0x100840db
mov dword [edi], ecx
mov dword [ebx + 0x6c], eax
mov eax, dword [edi + 4]
mov ecx, dword [ebx + 0x68]
cmp eax, ecx
je 0x100840eb
mov dword [edi + 4], ecx
mov dword [ebx + 0x68], eax
push edi
call fcn.10084130
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079e8b
mov esp, ebp
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov ecx, dword [ebp - 4]
xor esi, esi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10079e8b
mov esp, ebp
pop ebp
ret
call fcn.1007a61b
int3
Function at 0x100843a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x100d4040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1008449b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x1008449b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x100843fa
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x100843d8
jmp 0x1008449b
cmp edx, 0x200
jae 0x10084501
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x1008449b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x1008449a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x1008449a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x100844e3
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x10084480
pop edi
mov eax, dword [0x1018b244]
test eax, eax
jne 0x100844c1
push str.setlocale
call fcn.10085d30
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100844bc
or eax, 0xffffffff
mov dword [0x1018b244], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x100844ef
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10079e8b
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x1008449a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10079e8b
mov esp, ebp
pop ebp
ret
call fcn.1007a61b
int3
Function at 0x10084b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call sym.steam_api.dll_SteamAPI_ISteamController_GetControllerState
mov esi, dword [ebp + 8]
test al, al
je 0x10084b9e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10084bb0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x9401b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00940140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00940140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00940140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00940140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x940bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x940c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x95287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x940c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x940c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401f50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x401f71
add esp, 0x208
ret
lea ecx, [esp]
push 0x449c98
push ecx
call fcn.0042065b
lea edx, [esp + 8]
push 0
push edx
call fcn.00420615
add esp, 0x10
neg eax
sbb eax, eax
inc eax
add esp, 0x208
ret

Function at 0x402700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402719
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40272d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40274e
cmp esi, eax
jae 0x402727
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402740
cmp esi, eax
jae 0x402727
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4027f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
mov edx, dword [esp + 0x5c]
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push edx
push eax
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
add esp, 0x54
ret 8

Function at 0x402bf0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
push 0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0x18]
ja 0x402c24
jb 0x402c1c
mov eax, dword [esp]
cmp eax, dword [esp + 0x14]
ja 0x402c24
xor al, al
add esp, 0x10
ret 8
mov al, 1
add esp, 0x10
ret 8

Function at 0x4043b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
jle 0x4043df
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebx + 0xc]
push 0
push esi
push edi
push eax
call ebp
cmp eax, 0xffffffff
je 0x4043e8
sub esi, eax
add edi, eax
test esi, esi
jg 0x4043c8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
mov eax, dword [ebx + 0xc]
cmp eax, 0xffffffff
je 0x4043fe
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx + 0xc], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x44a3c0
call fcn.004212ef
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
Function at 0x404f30
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4474f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa14
push ebx
push ebp
push esi
push edi
mov esi, ecx
or edi, 0xffffffff
mov dword [esp + 0x14], esi
mov dword [esi + 4], edi
xor ebx, ebx
mov dword [esi], 0x44aff4
mov dword [esp + 0xa2c], ebx
mov dword [esi + 0x20], edi
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
lea ecx, [esi + 0x28]
mov byte [esp + 0xa44], 1
call fcn.0044243b
mov dword [esi + 0x60], edi
push ebx
push ebx
push 1
push ebx
mov byte [esi + 0x40], bl
mov byte [esi + 0x41], bl
mov byte [esi + 0x25], bl
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x866], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x864], bl
mov byte [esi + 0x865], bl
mov byte [esi + 0x24], bl
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.patch.shaiyaodyssey.com_shaiya
mov dword [esi + 0x20], eax
push 0x462bb8
mov byte [esi + 0x874], bl
call fcn.00420685
add esp, 8
push str..CONFIG.ini
xor eax, eax
push 0x104
mov ecx, 0x82
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0x449ff0
push str.TEST_IP
push str.LOGIN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4050da
lea ecx, [esp + 0x18]
push 0x44af50
push ecx
call fcn.00427c5a
add esp, 8
test eax, eax
jne 0x4050da
push 0x44af4c
push str.UpdaterURL.txt
call fcn.004215f3
mov ebp, eax
add esp, 8
cmp ebp, ebx
jne 0x40506f
push ebx
push str.Error
push str.Cant_Find_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call fcn.0042129b
lea edx, [esp + 0x220]
push edx
xor eax, eax
push 0x44a054
mov ecx, 0x200
lea edi, [esp + 0x228]
push ebp
rep stosd dword es:[edi], eax
call fcn.0042154d
lea eax, [esp + 0x22c]
push eax
call fcn.004206a1
add esp, 0x10
cmp eax, 1
jae 0x4050bf
push ebx
push str.Error
push str.Cant_Read_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call fcn.0042129b
lea ecx, [esp + 0x220]
push ecx
push 0x462bb8
call fcn.00420685
push ebp
call fcn.004213ff
add esp, 0xc
mov ecx, dword [esp + 0xa24]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x447598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.004057c0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00405550
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4059d2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x409380
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44789e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1808
call fcn.00421510
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov eax, dword [ebp + 0x5c]
push eax
call fcn.00408550
xor ebx, ebx
mov ecx, ebp
mov dword [ebp + 0x5c], ebx
call fcn.00407b70
push 0x218
call fcn.00436862
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x1824], ebx
je 0x4093e6
mov ecx, eax
call fcn.00408120
jmp 0x4093e8
xor eax, eax
lea esi, [ebp + 4]
mov dword [ebp + 0x5c], eax
mov eax, dword [esi]
cmp eax, 0xffffffff
mov dword [esp + 0x1824], 0xffffffff
je 0x409409
push eax
call fcn.0042174f
add esp, 4
push 0x8000
push 0x44b450
mov dword [esi], 0xffffffff
call fcn.00422115
add esp, 8
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x409440
xor al, al
mov ecx, dword [esp + 0x181c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 3
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.004219c7
mov eax, dword [esi]
push 4
lea edx, [ebp + 0x84]
push edx
push eax
call fcn.004219c7
mov edx, dword [esi]
push 4
lea ecx, [ebp + 0x7c]
push ecx
push edx
call fcn.004219c7
mov ecx, dword [esi]
push 0x28
lea eax, [ebp + 0x14]
push eax
push ecx
call fcn.004219c7
mov edx, dword [ebp + 0x5c]
add esp, 0x30
push edx
push esi
mov ecx, ebp
call fcn.00408940
push esi
mov ecx, ebp
call fcn.00408eb0
lea eax, [ebp + 0x98]
push 4
push eax
mov dword [eax], ebx
mov eax, dword [esi]
push eax
call fcn.004219c7
mov eax, dword [esi]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4094b7
push eax
call fcn.0042174f
add esp, 4
push 0x44b49c
push str.delete.lst
mov dword [esi], 0xffffffff
call fcn.004215f3
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40958e
xor eax, eax
mov ecx, 0x200
lea edi, [esp + 0x18]
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push 0x800
push ecx
call fcn.0042241e
add esp, 0xc
test eax, eax
je 0x409573
lea ecx, [ecx]
mov cl, byte [esp + 0x18]
xor eax, eax
cmp cl, bl
je 0x409527
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x18]
cmp cl, 9
je 0x409527
cmp cl, 0xa
je 0x409527
mov cl, byte [esp + eax + 0x19]
inc eax
cmp cl, bl
jne 0x409510
lea edx, [esp + 0x818]
mov byte [esp + eax + 0x18], bl
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00404c90
add esp, 8
lea ecx, [esp + 0x818]
push ecx
mov ecx, ebp
call fcn.00408b90
push esi
lea edx, [esp + 0x1c]
xor eax, eax
push 0x800
mov ecx, 0x200
lea edi, [esp + 0x20]
push edx
rep stosd dword es:[edi], eax
call fcn.0042241e
add esp, 0xc
test eax, eax
jne 0x409500
push esi
call fcn.004213ff
add esp, 4
push str.delete.lst
mov byte [ebp + 0x9c], 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x181c]
pop edi
mov al, 1
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a4a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esi + 0x110]
call fcn.0040d960
test al, al
je 0x40a568
mov eax, dword [esi + 0x64]
test eax, eax
mov dword [esp + 4], 0
jbe 0x40a568
push ebx
push ebp
push edi
nop
mov eax, dword [esi + 0x1c]
mov ebp, dword [esi + 0x70]
mov ebx, dword [esp + 0x10]
mov edi, dword [esi + 0x14]
and eax, 0xfffd
or eax, 2
add ebp, ebx
mov bl, byte [ebp]
mov dword [esp + 0x14], eax
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov eax, dword [eax + ebx*4]
mov ebx, dword [esi + 0x18]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, ebx
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
mov dword [esi + 0x18], eax
shr ebx, 0x18
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov ecx, dword [eax + ebx*4]
mov eax, dword [esp + 0x14]
shr edi, 8
xor edi, ecx
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x1c], edi
mov bl, byte [ebp]
sar ecx, 8
xor bl, cl
mov byte [ebp], bl
mov ecx, dword [esi + 0x64]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x40a4d0
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x40a570
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x110]
call fcn.0040d960
test al, al
je 0x40a615
mov eax, dword [esp + 8]
push ebp
xor ebp, ebp
test eax, eax
jbe 0x40a614
push ebx
push edi
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x70]
mov bl, byte [eax + ebp]
and ecx, 0xfffd
or ecx, 2
mov edx, ecx
xor edx, 1
imul edx, ecx
add eax, ebp
sar edx, 8
xor bl, dl
mov byte [eax], bl
mov edi, dword [esi + 0x14]
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov eax, dword [eax + ebx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, edi
mov edi, dword [esi + 0x1c]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
mov dword [esi + 0x18], eax
shr ebx, 0x18
call fcn.0040f1f0
xor ebx, edi
and ebx, 0xff
mov edx, dword [eax + ebx*4]
mov eax, dword [esp + 0x14]
shr edi, 8
xor edi, edx
inc ebp
cmp ebp, eax
mov dword [esi + 0x1c], edi
jb 0x40a597
pop edi
pop ebx
pop ebp
pop esi
ret 4