joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427008]
jne 0x40100a
repz ret
jmp fcn.00401dd8

Function at 0x405eea
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403abe
and dword [ebp - 4], 0
cmp dword [0x42925c], 0
mov ebx, eax
jne 0x405f9b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40604c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40604c
push eax
call fcn.00403a4c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42925c], eax
call esi
push eax
call fcn.00403a4c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429260], eax
call esi
push eax
call fcn.00403a4c
mov dword [esp], 0x424974
push edi
mov dword [0x429264], eax
call esi
push eax
call fcn.00403a4c
pop ecx
mov dword [0x42926c], eax
test eax, eax
je 0x405f9b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403a4c
pop ecx
mov dword [0x429268], eax
mov eax, dword [0x429268]
cmp eax, ebx
je 0x405ff3
cmp dword [0x42926c], ebx
je 0x405ff3
push eax
call fcn.00403ac7
push dword [0x42926c]
mov esi, eax
call fcn.00403ac7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405ff3
test edi, edi
je 0x405ff3
call esi
test eax, eax
je 0x405fea
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405fea
test byte [ebp - 0xc], 1
jne 0x405ff3
or dword [ebp + 0x10], 0x200000
jmp 0x40602c
mov eax, dword [0x429260]
cmp eax, ebx
je 0x40602c
push eax
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40602c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40602c
mov eax, dword [0x429264]
cmp eax, ebx
je 0x40602c
push eax
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40602c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42925c]
call fcn.00403ac7
pop ecx
test eax, eax
je 0x40604c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40604e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4232a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.00408f60
mov eax, dword [0x427008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x100c], eax
cmp ebx, 0x182
jne 0x4232d9
lea ecx, [ebp - 0x102c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x4232e9
cmp ebx, 0x19f
jne 0x4232e9
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
xor edi, edi
test ebx, ebx
jle 0x42336f
push esi
jmp 0x423300
lea esi, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
call fcn.00423290
mov dl, byte [ebp - 0x1008]
mov eax, dword [ebp - 0x100c]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x423369
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.yodawelizukipa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
inc edi
cmp edi, ebx
jl 0x423300
pop esi
pop edi
cmp ebx, 0x2d
jne 0x423389
mov dword [0x51ef40], 0xa62e7790
mov dword [0x51ef44], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x4233a0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x51ee0c]
push ebx
push esi
mov esi, dword [0x51ec54]
mov ebx, eax
cmp eax, 0x5dd
jne 0x4233c2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x428000]
call fcn.00423260
cmp dword [0x51ee0c], 0x2f
jne 0x4233dd
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.004232a0
add esp, 4
cmp dword [0x51ee0c], 0x568
pop esi
pop ebx
jne 0x42340a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x40b9c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x800
lea eax, [ebp - 0x804]
mov ebx, ecx
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.HaloWallPaperInstaller
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x808], esi
test esi, esi
je 0x40baa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ba74
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x537934
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x40ba62
push 0
push 0
push 0x1400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
cmp dword [ecx + 8], eax
je 0x40ba92
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x40ba9f
lea edx, [ebp - 0x808]
push edx
push eax
call fcn.0040b4b0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7695
mov esp, ebp
pop ebp
ret
Function at 0x40bb40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a3c
call fcn.004a76b0
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0
push 2
mov dword [ebp - 0x1a34], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40bd59
push edi
push 0x228
lea eax, [ebp - 0x1a2c]
push 0
push eax
call fcn.004ca680
add esp, 0xc
mov dword [ebp - 0x1a30], 0x22c
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40bd55
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1a3c], eax
cmp eax, dword [ebp - 0x1a28]
je 0x40bd3a
push dword [ebp - 0x1a34]
lea eax, [ebp - 0x1a0c]
push eax
call fcn.004f5041
add esp, 8
test eax, eax
jne 0x40bd3a
push 0x800
push eax
lea eax, [ebp - 0x1804]
push eax
call fcn.004ca680
add esp, 0xc
push dword [ebp - 0x1a28]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40bcf6
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x40bceb
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004ca680
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.004caeaa
add esp, 0x14
test eax, eax
je 0x40bcb3
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x40bcb3
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bca0
lea eax, [ebp - 0x1004]
jmp 0x40bcd1
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bcc0
lea eax, [ebp - 0x804]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x1804]
push 0x400
push eax
call fcn.004f5036
add esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x40bcfc
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1804]
push eax
call fcn.004672b0
add esp, 4
test eax, eax
je 0x40bd3a
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x1a28]
mov dword [ebp - 0x1a38], ecx
cmp dword [esi + 8], eax
je 0x40bd2b
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x40bd3a
lea ecx, [ebp - 0x1a38]
push ecx
push eax
mov ecx, esi
call fcn.0040b350
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
mov eax, dword [ebp - 0x1a3c]
jne 0x40bbc1
push ebx
call edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7695
mov esp, ebp
pop ebp
ret 8
Function at 0x4116f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
push edi
test ebx, ebx
jne 0x41170d
xor edi, edi
jmp 0x411864
cmp dword [ebp + 0x14], 0
je 0x41183d
push 0x1440
call fcn.00449260
mov edi, eax
add esp, 4
test edi, edi
je 0x4117d3
mov ecx, dword [ebp + 0x40]
xor edx, edx
mov dword [ebp - 0x28], edx
test ecx, ecx
je 0x411747
mov eax, dword [ecx]
lea edx, [ebp - 0x4c]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
lea esi, [edi + 0x1418]
mov dword [edi], ecx
mov dword [edi + 0x1414], 1
mov dword [esi + 0x24], 0
test edx, edx
je 0x411771
mov eax, dword [edx]
mov ecx, edx
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0x1000
lea esi, [edi + 4]
push 0
push esi
call fcn.004ca680
push 0x800
push ebx
push esi
call fcn.004f6ddc
push 0x410
lea esi, [edi + 0x1004]
push 0
push esi
call fcn.004ca680
mov eax, dword [ebp - 4]
add esp, 0x24
test eax, eax
je 0x4117b9
push 0x208
push eax
push esi
call fcn.004f6ddc
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4117d5
mov edx, dword [ecx]
lea eax, [ebp - 0x4c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x4117d5
xor edi, edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], vtable.CSimpleThread.0
push eax
push 0
push edi
push 0x411890
push 0
push 0
mov dword [ebp - 0xc], 0x411890
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.004f720a
add esp, 0x18
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], vtable.CSimpleThread.0
test eax, eax
je 0x411836
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x411864
sub esp, 0x28
mov edi, esp
mov dword [edi + 0x24], 0
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x411858
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov ecx, dword [ebp + 8]
push esi
push ebx
call fcn.00411b10
mov edi, eax
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x41187c
mov esi, dword [ecx]
lea eax, [ebp + 0x1c]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x411970
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004a76b0
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0x10]
push 0x4000
push 0
push eax
call fcn.004ca680
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x411a68
test edi, edi
je 0x411a68
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x411a68
cmp eax, 0x3fff
ja 0x411a68
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x411a68
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x5378a0
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x411a68
mov esi, dword [ebp + 0x14]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.004ca680
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.00412b80
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004a7695
mov esp, ebp
pop ebp
ret 0x10

Function at 0x411ad0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x411af5
test byte [ebp - 4], 7
je 0x411af5
mov eax, 1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x411b10
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5222c8
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x411bb2
cmp word [esi], di
je 0x411bb2
test eax, eax
je 0x411b6e
cmp word [eax], di
je 0x411b6e
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x411bb2
jmp 0x411bad
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x411bb2
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x411be3
mov dword [ebp - 0x424], edi
lea edx, [ebp - 0x424]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x411be3
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret 0x30
Function at 0x412ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x412b29
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x412b29
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x412b1a
cmp esi, edx
jae 0x412b29
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x412b08
cmp esi, edx
jae 0x412b29
cmp word [esi], 0
je 0x412b29
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x413f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x48]
push esi
movups xmmword [ebp - 0x48], xmm0
mov esi, dword [ebp + 0x8c]
movups xmm0, xmmword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x90]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x4c], esi
mov dword [edi + 0x40], esi
movups xmm0, xmmword [ebp + 0x28]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp + 0x4c]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [ebp + 0x5c]
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp + 0x6c]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp + 0x7c]
movups xmmword [ebp - 0x5c], xmm0
test esi, esi
jle 0x4140c4
cmp esi, 0x40
jb 0x4140ad
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x49]
add edx, edi
cmp edi, ecx
ja 0x413fe7
lea ecx, [ebp - 0x48]
cmp edx, ecx
jae 0x4140ad
lea ecx, [ebp + esi - 0x8d]
cmp edi, ecx
ja 0x414000
lea ecx, [ebp - 0x8c]
cmp edx, ecx
jae 0x4140ad
mov ecx, esi
push ebx
and ecx, 0x8000003f
jns 0x414010
dec ecx
or ecx, 0xffffffc0
inc ecx
mov ebx, esi
lea edx, [edi + 0x20]
sub ebx, ecx
mov dword [ebp - 0x98], edx
mov esi, edi
lea ecx, [ebp - 0x38]
sub esi, ecx
sub ecx, edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x7c]
sub ecx, edi
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x48]
lea ecx, [ebp - 0x38]
add edx, eax
movups xmm1, xmmword [ebp + eax - 0x8c]
add ecx, eax
pxor xmm1, xmm0
movups xmm0, xmmword [ecx]
movups xmmword [esi + ecx], xmm1
mov ecx, dword [ebp - 0x94]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x6c]
movups xmmword [edx - 0x10], xmm1
movups xmm1, xmmword [ebp + eax - 0x28]
add eax, 0x40
pxor xmm1, xmm0
movups xmm0, xmmword [edi + edx]
movups xmmword [edx], xmm1
movups xmm1, xmmword [ecx + edx]
pxor xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
mov edx, dword [ebp - 0x98]
cmp eax, ebx
jl 0x414040
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
pop ebx
cmp eax, esi
jge 0x4140c4
mov cl, byte [ebp + eax - 0x8c]
xor cl, byte [ebp + eax - 0x48]
mov byte [edi + eax], cl
inc eax
cmp eax, esi
jl 0x4140b1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a7695
mov esp, ebp
pop ebp
ret
Function at 0x416850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x579ec8
mov dword [ebp - 0x64], 0x740068
lea esi, [ebp - 0x64]
mov dword [ebp - 0x60], 0x700074
push edi
mov dword [ebp - 0x5c], 0x2f003a
mov edx, 0x30
mov dword [ebp - 0x58], 0x73002f
sub esi, eax
mov dword [ebp - 0x54], 0x2e0032
mov dword [ebp - 0x50], 0x75006c
mov dword [ebp - 0x4c], 0x610064
mov dword [ebp - 0x48], 0x680073
mov dword [ebp - 0x44], 0x2e0069
mov dword [ebp - 0x40], 0x6f0063
mov dword [ebp - 0x3c], 0x2f006d
mov dword [ebp - 0x38], 0x6e0069
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x75002f
mov dword [ebp - 0x2c], 0x69006e
mov dword [ebp - 0x28], 0x73006e
mov dword [ebp - 0x24], 0x2e0074
mov dword [ebp - 0x20], 0x680070
mov dword [ebp - 0x1c], 0x3f0070
mov dword [ebp - 0x18], 0x720066
mov dword [ebp - 0x14], 0x6d006f
mov dword [ebp - 0x10], 0x64003d
mov dword [ebp - 0xc], 0x640069
mov dword [ebp - 8], 0x61
nop word [eax + eax]
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x41693e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41693e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x416920
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
Function at 0x416ef0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push eax
lea ecx, [edi + 8]
call fcn.00416700
push esi
lea ecx, [edi + 4]
call fcn.00416700
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x537cdc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416f96
lea eax, [ebp - 0x20c]
push eax
call esi
push str.UtilsNetULEx.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00417cc0
mov ecx, eax
call fcn.00417d60
mov eax, dword [edi + 0xc]
cmp dword [eax - 0xc], 0
jne 0x41703f
push 0x208
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x828]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x20a
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.004ca680
add esp, 0xc
call fcn.00416d40
push 0x104
lea edx, [ebp - 0x620]
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x828]
push edx
push eax
call dword [ecx + 4]
lea edx, [ebp - 0x620]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x417020
sub edx, ecx
lea eax, [ebp - 0x620]
sar edx, 1
lea ecx, [edi + 0xc]
push edx
push eax
call fcn.00412590
mov eax, dword [edi + 0x14]
cmp dword [eax - 0xc], 0
jne 0x41709f
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004ca680
add esp, 0xc
call fcn.00416d40
push 0x104
lea edx, [ebp - 0x414]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
lea edx, [ebp - 0x414]
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x417080
sub edx, ecx
lea eax, [ebp - 0x414]
sar edx, 1
lea ecx, [edi + 0x14]
push edx
push eax
call fcn.00412590
mov ecx, edi
call fcn.004170c0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a7695
mov esp, ebp
pop ebp
ret 8
Function at 0x417d60
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x417d76
mov eax, 1
pop edi
pop ebp
ret 4
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x417e34
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417e34
push esi
call fcn.004672b0
add esp, 4
test eax, eax
je 0x417e34
cmp dword [edi + 0xc], 0
jne 0x417e07
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0xc], eax
test eax, eax
je 0x417e2b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi + 0xc]
mov dword [edi + 0x10], eax
call esi
push str.zlib_uncompress
push dword [edi + 0xc]
mov dword [edi + 0x14], eax
call esi
push str.zlib_compress
push dword [edi + 0xc]
mov dword [edi + 0x1c], eax
call esi
push str.zlib_compressBound
push dword [edi + 0xc]
mov dword [edi + 0x20], eax
call esi
mov dword [edi + 0x24], eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x417e07
call eax
mov dword [edi + 0x18], eax
cmp dword [edi + 0x14], 0
je 0x417e2b
cmp dword [edi + 0x10], 0
je 0x417e2b
cmp dword [edi + 0x18], 0
je 0x417e2b
pop esi
mov dword [edi + 4], 1
mov eax, 1
pop edi
pop ebp
ret 4
mov eax, dword [edi + 4]
pop esi
pop edi
pop ebp
ret 4
pop esi
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x4185b0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x418618
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
test eax, eax
jne 0x418628
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret