joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413fca
Capabilities:
Get common file path

Disassembly:
push 0x28
mov eax, 0x4513b5
call fcn.0043bf61
mov edi, ecx
lea ecx, [ebp - 0x34]
call fcn.0042c78d
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.004016f6
and dword [edi], 0
lea ecx, [ebp - 0x14]
call fcn.00401b4d
mov byte [ebp - 4], 2
mov esi, 0x105
push esi
lea ecx, [ebp - 0x14]
call fcn.00409cd1
mov dword [ebp - 0x20], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x414040
call fcn.00403497
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b87
or dword [ebp - 4], 0xffffffff
call fcn.0042c7a3
mov eax, esi
call fcn.0043c006
ret
or ebx, 0xffffffff
push ebx
lea ecx, [ebp - 0x14]
call fcn.004055c6
lea ecx, [ebp - 0x18]
call fcn.00401b4d
mov byte [ebp - 4], 3
push esi
lea ecx, [ebp - 0x18]
call fcn.00409cd1
mov esi, eax
push esi
push 0
push dword [ebp + 8]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x41409a
call fcn.00403497
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b87
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b87
mov dword [ebp - 4], ebx
jmp 0x414033
push ebx
lea ecx, [ebp - 0x18]
call fcn.004055c6
lea eax, [ebp - 0x1c]
push eax
call fcn.0041608e
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
push 0
push 1
push 0x80
push 0x1041
push esi
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
mov dword [ebp - 0x24], eax
test eax, eax
jge 0x414105
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0041526a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b87
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b87
mov dword [ebp - 4], ebx
call fcn.0042c7a3
mov eax, dword [ebp - 0x24]
jmp 0x41403a
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
mov ecx, dword [ebp + 0xc]
call fcn.00401640
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
call fcn.0041526a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00401b87
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401b87
mov dword [ebp - 4], ebx
call fcn.0042c7a3
xor eax, eax
jmp 0x41403a

Function at 0x414181
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x50]
push esi
push eax
mov dword [ebp - 0x54], 0x44
call fcn.00436b60
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x1000000
push esi
push esi
push esi
call fcn.004099c3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.004055c6
cmp edi, esi
jne 0x4141e0
xor eax, eax
jmp 0x4141f3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414634
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push 0x240
mov eax, 0x452139
call fcn.0043bf97
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x248], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea edi, [ebp + 0xc]
call fcn.0040df0d
mov ecx, dword [ebp - 0x22c]
push 0x45b10c
call fcn.0040154d
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x248], esi
call fcn.0040154d
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x230]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
jne 0x414850
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x224], ebx
je 0x414850
mov dword [ebp - 0x228], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x23c], eax
jne 0x414834
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.0040154d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.00401b4d
mov byte [ebp - 4], 4
lea eax, [ebp - 0x234]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call esi
cmp eax, ebx
jne 0x414816
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.DisplayName
call fcn.0040154d
mov byte [ebp - 4], 5
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x24c]
call fcn.00414599
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x220]
call fcn.00401afd
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00401b87
lea edi, [ebp - 0x220]
call fcn.0040df0d
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00401e8b
test eax, eax
jne 0x414816
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str.UninstallString
call fcn.0040154d
mov byte [ebp - 4], 7
push dword [ebp - 0x234]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x240]
call fcn.00414599
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
push eax
call fcn.00401ae8
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00401b87
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
call fcn.00401b87
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.00401b87
inc dword [ebp - 0x228]
cmp dword [ebp - 0x23c], ebx
mov dword [ebp - 0x224], 0x104
je 0x4146e6
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.00401b87
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401b87
mov eax, dword [ebp - 0x22c]
call fcn.0043c01a
ret
Function at 0x414882
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x452c7f
call fcn.0043bf97
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x224]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x414997
lea ecx, [ebp - 0x21c]
call fcn.0040689a
cmp eax, esi
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x21c], ecx
jne 0x414997
lea eax, [ebp - 0x230]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push ecx
mov dword [ebp - 0x220], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x228], 1
jmp 0x414993
cmp word [ebp - 0x218], 0x76
jne 0x414959
lea eax, [ebp - 0x216]
push eax
lea ebx, [ebp - 0x230]
call fcn.004163c9
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [edi + 4]
jb 0x414959
mov eax, dword [ebp - 0x230]
ja 0x414954
cmp eax, dword [edi]
jbe 0x414959
mov dword [edi], eax
mov dword [edi + 4], ecx
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x220], 0x104
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x228]
cmp eax, esi
je 0x414921
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040689a
mov eax, edi
call fcn.0043c01a
ret
Function at 0x4149ae
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x452c4c
call fcn.0043bf97
xor ebx, ebx
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP
lea ecx, [ebp - 0x230]
mov byte [ebp - 0x219], bl
call fcn.0040154d
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x230]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x414aea
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x224], ebx
je 0x414aea
mov dword [ebp - 0x228], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, ebx
jne 0x414ad2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040154d
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax - 0xc]
cmp ecx, ebx
jle 0x414ac4
movzx eax, word [eax]
cmp ax, 0x76
jne 0x414ac4
push 0x76
lea eax, [ebp - 0x220]
push eax
call fcn.00411beb
push dword [ebp - 0x220]
lea ebx, [ebp - 0x238]
call fcn.004163c9
mov eax, dword [ebp - 0x234]
shr eax, 0x10
xor ebx, ebx
cmp ax, 2
jne 0x414ac4
mov byte [ebp - 0x219], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x220]
call fcn.00401b87
inc dword [ebp - 0x228]
cmp edi, ebx
mov dword [ebp - 0x224], 0x104
je 0x414a2d
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00401b87
mov al, byte [ebp - 0x219]
call fcn.0043c01a
ret
Function at 0x414b84
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push 0x220
mov eax, 0x45131c
call fcn.0043bf97
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov ecx, ebx
call fcn.00401b4d
mov dword [ebp - 0x228], esi
call fcn.00414479
test al, al
je 0x414ca9
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00401afd
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x224]
call fcn.0040154d
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push edi
push dword [ebp - 0x224]
mov dword [ebp - 0x21c], edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x414c89
lea ecx, [ebp - 0x220]
call fcn.0040689a
cmp eax, edi
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
jne 0x414c89
push str.ProgramFilesDir
lea eax, [ebp - 0x220]
push eax
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x21c], 0x104
call fcn.00406833
test eax, eax
jne 0x414c89
mov eax, edi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040154d
mov byte [ebp - 4], 4
push dword [eax]
push str._ProgramFiles_
push ebx
call fcn.004097d1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
call fcn.00401b87
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.0040689a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.00401b87
xor edi, edi
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x414cbb
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414cdd
mov esi, dword [ebp + 8]
mov eax, 0x3fff
push eax
push eax
mov ecx, ebx
call fcn.00409cd1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004055c6
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401b87
mov eax, ebx
call fcn.0043c01a
ret
Function at 0x4151e7
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x4501eb
call fcn.0043bf2e
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push str.en_us
call fcn.004162f3
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
push 0x45f518
push 0x17
push edi
push 0x45aa64
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jl 0x415251
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push dword [ebp + 8]
mov ebx, eax
add esi, 0x34
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push ebx
call dword [esi]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x415261
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
call fcn.0043c006
ret
Function at 0x4173d0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp byte [eax + 0x29], 0
je 0x4173ea
mov eax, 1
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
xor edi, edi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
cmp eax, edi
jne 0x417422
mov ecx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 4], ecx
cmp eax, edi
push esi
mov esi, eax
jne 0x417542
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.InstallerData
push ecx
mov dword [ebp - 0xc], edi
call ebx
test eax, eax
jne 0x417457
mov edi, dword [ebp - 0xc]
test eax, eax
mov esi, eax
jne 0x417537
push 0xfffe
mov dword [ebp + 0xc], eax
call fcn.00437364
add esp, 4
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x4174a6
lea edx, [ebp + 0xc]
push edx
call fcn.00402c77
test edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41748e
push edi
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x417498
push eax
call esi
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x28], 0
jne 0x41751c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x10], 0x7fff
jmp 0x4174c3
mov eax, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push eax
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x41751c
mov eax, dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4174c0
call fcn.00410b9b
lea ecx, [ebp + 0xc]
push ecx
mov esi, eax
call fcn.00402c77
test edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x417507
push edi
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x417559
push eax
call ebx
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
add ecx, 0x10
mov dword [ebp - 0x10], ecx
call fcn.00417e70
test eax, eax
jne 0x417567
lea edx, [ebp + 0xc]
push edx
call fcn.00402c77
test edi, edi
je 0x417542
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00410b9b
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x417559
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
push edx
mov ebx, eax
call fcn.00418020
cmp dword [ebx + 0xc], 0
mov dword [ebp + 8], eax
je 0x4175a3
mov esi, dword [ebx + 4]
test esi, esi
mov ebx, dword [ebx]
je 0x4175ab
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x4175b5
cmp dword [ebp + 8], 0
jne 0x417564
jmp 0x41752e
push 0x80004005
call fcn.004017ce
mov eax, esi
jmp 0x4174ea
Function at 0x418850
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x41888a
call fcn.00403497
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x4188de
call fcn.00403497
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x419270
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
sub esp, 8
push esi
xor esi, esi
cmp ax, si
je 0x419294
cmp ax, 1
je 0x419294
mov eax, 0x80004001
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [0x4738e0]
mov edx, dword [eax + 0xc]
push ebx
push edi
mov ecx, 0x4738e0
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call edx
mov ebx, dword [ebp + 8]
mov edi, eax
add edi, 0x10
cmp dword [ebx + 0x44], esi
mov dword [ebp + 0x18], edi
je 0x419379
mov edx, dword [ebx + 0x48]
xor eax, eax
cmp edx, esi
jbe 0x4192df
mov esi, dword [ebx + 0x40]
mov ecx, esi
lea ecx, [ecx]
cmp dword [ecx], 0
jne 0x4192f2
add eax, 1
add ecx, 4
cmp eax, edx
jb 0x4192d0
xor eax, eax
test eax, eax
mov esi, eax
je 0x419358
test esi, esi
mov edx, esi
mov dword [ebp + 8], edx
jne 0x4192f7
jmp 0x41932e
mov eax, dword [esi + eax*4]
jmp 0x4192e1
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x41932c
mov edi, dword [ebx + 0x48]
mov eax, dword [esi + 0xc]
xor edx, edx
div edi
add edx, 1
jmp 0x419310
cmp edx, edi
jae 0x419329
mov eax, dword [ebx + 0x40]
cmp dword [eax + edx*4], 0
lea eax, [eax + edx*4]
je 0x419322
mov ecx, dword [eax]
add edx, 1
test ecx, ecx
je 0x419310
mov edx, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edx]
cmp dword [eax - 0xc], 0
je 0x419351
mov ecx, dword [edx + 4]
cmp dword [ecx - 0xc], 0
je 0x419351
push ecx
push eax
push str._s:__s_r_n
lea edi, [ebp + 0x18]
call fcn.0041a4f0
add esp, 0xc
test esi, esi
jne 0x4192e7
mov edi, dword [ebp + 0x18]
mov eax, dword [edi - 0xc]
test eax, eax
je 0x419379
cmp dword [edi - 4], 1
mov dword [ebp - 4], eax
jle 0x419376
mov ecx, eax
push ecx
lea ecx, [ebp + 0x18]
call fcn.00401860
mov edi, dword [ebp + 0x18]
mov dword [ebp - 8], edi
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebx + 0x80]
push 0
push 0
push 0
push 0
push edx
push eax
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x4193ad
mov ecx, dword [ebx + 0x80]
push 0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x4193db
call fcn.00403497
mov esi, eax
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4193d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x14
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4193f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41d0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov dl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x41d0fb
movzx esi, dl
push edi
nop
mov ecx, dword [eax + 0x260]
mov edi, ecx
shr edi, 0x18
shl ecx, 8
xor edi, esi
xor ecx, dword [edi*4 + 0x46d040]
mov dword [eax + 0x260], ecx
mov ecx, dword [ebp - 4]
add ecx, ebx
cmp ecx, dword [eax + 0x38]
mov dword [ebp - 4], ecx
jl 0x41d0d0
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x41d189
sub ecx, ebx
je 0x41d16b
sub ecx, ebx
je 0x41d15f
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41e573
mov dword [edi], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41e6da
cmp dword [ebp + 0x10], 0
mov dword [esi + 0x13c4], 0
je 0x41e6da
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jl 0x41e6da
cmp byte [esi + 0x1390], 0
jne 0x41e5c1
test edi, edi
je 0x41e5b0
mov dword [edi], 0xffffffff
pop edi
mov dword [esi + 0x13c4], 0xffffffff
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [esi]
push eax
call fcn.0043aa7d
add esp, 4
test eax, eax
je 0x41e5eb
test edi, edi
je 0x41e5da
mov dword [edi], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test ebx, ebx
jne 0x41e60a
test edi, edi
je 0x41e5f9
mov dword [edi], 0
pop edi
mov dword [esi + 0x13c4], 0
pop esi
pop ebx
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x1394]
mov dword [esi + 0x1398], ebx
push 0
lea ebx, [esi + 4]
push eax
mov dword [eax], ecx
mov dword [esi + 0x13a8], 0x1388
mov dword [esi + 0x13a4], ebx
call fcn.0041d4e0
cmp eax, 1
jne 0x41e6a9
jmp 0x41e640
mov eax, dword [esi + 0x13a8]
cmp eax, 0x1388
jae 0x41e679
mov edx, dword [esi]
push edx
mov edi, 0x1388
sub edi, eax
push edi
push 1
push ebx
call fcn.0043ac0b
add esp, 0x10
cmp edi, eax
jne 0x41e6bc
mov eax, dword [esi]
push eax
call fcn.0043aa7d
add esp, 4
test eax, eax
jne 0x41e6bc
mov edi, dword [ebp + 8]
cmp dword [esi + 0x1398], 0
je 0x41e5ef
push 0
lea eax, [esi + 0x1394]
mov dword [esi + 0x13a8], 0x1388
push eax
mov dword [esi + 0x13a4], ebx
call fcn.0041d4e0
cmp eax, 1
je 0x41e640
test edi, edi
je 0x41e6af
mov dword [edi], eax
pop edi
mov dword [esi + 0x13c4], eax
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x41e6c9
mov dword [eax], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test edi, edi
je 0x41e6e4
mov dword [edi], 0xfffffffe
test esi, esi
je 0x41e6f2
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
pop esi
pop ebx
pop ebp
ret 0x10