joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039cf
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push ebx
push esi
push edi
push 8
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0040c36f
lea eax, [ebp - 0x70]
push eax
mov edx, str.SOFTWAREFlashFXP3
call fcn.004057af
pop ecx
lea eax, [ebp - 0x30]
push eax
mov edx, str.datafolder
call fcn.004057af
pop ecx
mov esi, 0x104
push esi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x70]
push eax
lea edi, [ebp - 0x278]
mov eax, 0x80000002
call fcn.00408936
add esp, 0xc
cmp eax, 0xffffffff
je 0x403a54
cmp eax, ebx
jbe 0x403a54
push esi
lea eax, [ebp - 0x480]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.00403737
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
jne 0x403ac9
lea eax, [ebp - 0x48]
push eax
mov edx, str.flashfxp
call fcn.004057af
lea eax, [ebp - 0x48]
pop ecx
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x26
mov dword [ebp - 0xc], eax
xor esi, esi
lea eax, [ebp - 0x278]
push eax
push ebx
push ebx
push dword [ebp + esi*4 - 0x18]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x403ac0
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push 0x40379e
push 2
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.004086ef
add esp, 0x24
inc esi
cmp esi, 3
jb 0x403a85
cmp dword [ebp - 4], ebx
jbe 0x403ad5
mov esi, dword [ebp - 8]
call fcn.0040362f
jmp 0x403ade
push dword [ebp - 8]
call fcn.0040c30c
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403ae3
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
imul eax, eax, 0x8088405
push 0x20
push 0
push dword [esp + 0xc]
inc eax
push 0
push eax
mov dword [ecx], eax
call fcn.00408a77
push edx
push eax
call fcn.00408a48
ret
Function at 0x403b06
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x108
push ebx
push esi
push edi
call fcn.0040c836
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x403c2b
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
call fcn.0040c705
test al, al
je 0x403c2b
sub esi, 4
xor ebx, ebx
test esi, esi
mov dword [ebp - 4], 0xcf671
jle 0x403b73
push 8
lea ecx, [ebp - 4]
lea edi, [ebp + ebx - 0x108]
call fcn.00403ae3
pop ecx
movsx ecx, al
mov al, byte [edi]
rol al, cl
inc ebx
cmp ebx, esi
mov byte [edi], al
jl 0x403b53
mov dword [ebp - 4], 0x3039
mov dword [ebp - 8], 0x100
push esi
lea ecx, [ebp - 4]
call fcn.00403ae3
pop ecx
push esi
lea ecx, [ebp - 4]
movsx edi, al
call fcn.00403ae3
dec dword [ebp - 8]
pop ecx
movsx ecx, al
lea ecx, [ebp + ecx - 0x108]
mov bl, byte [ecx]
lea eax, [ebp + edi - 0x108]
mov dl, byte [eax]
mov byte [eax], bl
mov byte [ecx], dl
jne 0x403b81
xor edi, edi
test esi, esi
mov dword [ebp - 4], 0xa564
jle 0x403bdd
push 0x100
lea ecx, [ebp - 4]
call fcn.00403ae3
xor byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
pop ecx
jl 0x403bc3
xor edi, edi
test esi, esi
mov dword [ebp - 4], 0xd431
jle 0x403c04
push 0x100
lea ecx, [ebp - 4]
call fcn.00403ae3
sub byte [ebp + edi - 0x108], al
inc edi
cmp edi, esi
pop ecx
jl 0x403bea
xor eax, eax
test esi, esi
jle 0x403c1f
movzx cx, byte [ebp + eax - 0x108]
mov edx, dword [ebp + 8]
mov word [edx + eax*2], cx
inc eax
cmp eax, esi
jl 0x403c0a
mov eax, dword [ebp + 8]
and word [eax + esi*2], 0
mov eax, esi
jmp 0x403c2d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403c79
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x20002
push 8
push dword [0x4263c8]
call edi
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [ebp - 0x14], ebx
je 0x403e49
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffff
push ebx
push eax
push eax
push eax
call esi
test eax, eax
jbe 0x403e42
lea ecx, [eax + 1]
mov eax, ebx
call fcn.0040c947
test al, al
je 0x403e42
push 0xc0c
push 8
push dword [0x4263c8]
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x403e42
lea eax, [edi + 0x3fc]
mov dword [ebp - 8], eax
add eax, 0x1fe
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x74]
push eax
mov edx, str.connections
mov dword [ebp - 4], ebx
call fcn.004057af
pop ecx
lea eax, [ebp - 0x34]
push eax
mov edx, str.default
call fcn.004057af
pop ecx
lea eax, [ebp - 0x24]
push eax
mov edx, 0x40fa44
call fcn.004057af
pop ecx
lea eax, [ebp - 0x48]
push eax
mov edx, str.username
call fcn.004057af
pop ecx
lea eax, [ebp - 0x5c]
push eax
mov edx, str.password
call fcn.004057af
pop ecx
mov ebx, 0xff
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403e22
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403e22
push dword [ebp + 8]
push ebx
push edi
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403e22
push dword [ebp + 8]
lea eax, [edi + 0x1fe]
push ebx
push eax
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403e22
push dword [ebp + 8]
lea eax, [ebp - 0x5c]
push ebx
push dword [ebp - 8]
push 0
push eax
push dword [ebp - 4]
call esi
test eax, eax
jbe 0x403e22
push dword [ebp - 8]
call fcn.00403b06
test eax, eax
pop ecx
jle 0x403e22
lea eax, [ebp - 0x94]
push eax
mov edx, str.ftp:___s:_s__s_n
call fcn.004057af
pop ecx
push edi
push dword [ebp - 8]
mov edi, dword [ebp - 0xc]
push dword [ebp - 0x18]
lea eax, [ebp - 0x94]
push eax
mov edx, 0x307
call fcn.0040c8cb
add esp, 0x10
test eax, eax
jle 0x403e1f
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.0040c4dd
test al, al
pop ecx
je 0x403e1f
inc dword [edi + 4]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push 1
call fcn.0040c967
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x403d57
push edi
call fcn.0040c30c
mov ebx, dword [ebp - 0x14]
pop ecx
push ebx
call fcn.0040c30c
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e9f
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push esi
push edi
push 8
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.0040c36f
lea eax, [ebp - 0x100]
mov ebx, str.SOFTWAREGhislerTotal_Commander
push eax
mov edx, ebx
call fcn.004057af
pop ecx
lea eax, [ebp - 0x6c]
push eax
mov edx, str.ftpininame
call fcn.004057af
pop ecx
mov esi, 0x104
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x100]
push eax
lea edi, [ebp - 0x308]
mov eax, 0x80000001
call fcn.00408936
add esp, 0xc
cmp eax, 0xffffffff
je 0x403f38
test eax, eax
jbe 0x403f38
push esi
lea eax, [ebp - 0x510]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x510]
push eax
call fcn.00403c79
pop ecx
pop ecx
lea eax, [ebp - 0x510]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [ebp - 8], 0
jne 0x40408d
lea eax, [ebp - 0x40]
push eax
mov edx, str.totalcmd
call fcn.004057af
pop ecx
lea eax, [ebp - 0x9c]
push eax
mov edx, str.totalcommander
call fcn.004057af
pop ecx
lea eax, [ebp - 0x54]
push eax
mov edx, str.ghisler
call fcn.004057af
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x54]
pop ecx
mov dword [ebp - 0x28], 0x24
mov dword [ebp - 0x24], 0x1a
mov dword [ebp - 0x20], 0x26
mov dword [ebp - 0x1c], 0x23
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp + eax*4 - 0x28]
lea eax, [ebp - 0x308]
push eax
xor eax, eax
push eax
push eax
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40400e
cmp edi, 0x24
jne 0x403fe9
xor edi, edi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.00403c32
add esp, 0xc
mov word [ebp - 0x302], di
jmp 0x403feb
xor edi, edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x403e4e
push 2
push 3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.004086ef
add esp, 0x24
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x403fa7
cmp dword [ebp - 8], 0
jne 0x40408d
lea eax, [ebp - 0xb8]
push eax
mov edx, ebx
call fcn.004057af
pop ecx
lea eax, [ebp - 0x40]
push eax
mov edx, str.installdir
call fcn.004057af
pop ecx
push esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xb8]
push eax
lea edi, [ebp - 0x308]
mov eax, 0x80000001
call fcn.00408936
add esp, 0xc
cmp eax, 0xffffffff
je 0x404089
test eax, eax
jbe 0x404089
push esi
lea eax, [ebp - 0x510]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x510]
push eax
call fcn.00403c32
add esp, 0xc
cmp dword [ebp - 8], 0
jbe 0x404099
mov esi, dword [ebp - 0xc]
call fcn.0040362f
jmp 0x4040a2
push dword [ebp - 0xc]
call fcn.0040c30c
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404376
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea eax, [ebp - 0x30]
push edi
push eax
mov edx, str.filezilla
call fcn.004057af
pop ecx
lea eax, [ebp - 0x30]
push 8
mov dword [ebp - 0xc], eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
call fcn.0040c36f
xor edi, edi
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push dword [ebp + edi*4 - 0x18]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4043f6
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push 0x4040a7
push 2
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.004086ef
add esp, 0x24
inc edi
cmp edi, 3
jb 0x4043bb
cmp dword [ebp - 4], esi
jbe 0x40440b
mov esi, dword [ebp - 8]
call fcn.0040362f
jmp 0x404414
push dword [ebp - 8]
call fcn.0040c30c
pop ecx
pop edi
pop esi
leave
ret

Function at 0x404418
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
push edi
lea eax, [ebp - 0x100]
push eax
call fcn.0040c348
mov cl, byte [ebp - 0xff]
xor cl, byte [ebp - 0x100]
mov dl, byte [ebp - 0xfe]
or cl, 0x50
xor eax, eax
test dl, dl
mov byte [ebp - 2], 0
je 0x40446c
push esi
lea esi, [ebp - 0xfe]
xor dl, cl
movzx dx, dl
mov word [edi + eax*2], dx
inc eax
inc esi
mov dl, byte [esi]
test dl, dl
jne 0x404459
pop esi
and word [edi + eax*2], 0
leave
ret
Function at 0x404701
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
mov ecx, edi
call fcn.0040c836
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0xff
jge 0x4047b3
lea ecx, [ebp - 0x100]
mov eax, edi
call fcn.0040c705
test al, al
je 0x4047b3
xor eax, eax
test esi, esi
jle 0x40474a
xor byte [ebp + eax - 0x100], 0x5c
inc eax
cmp eax, esi
jl 0x40473d
mov bl, byte [ebp - 0x100]
cmp bl, 0xff
jne 0x404763
mov bl, byte [ebp - 0xfe]
lea eax, [ebp - 0xfd]
jmp 0x404769
lea eax, [ebp - 0xff]
movzx ecx, byte [eax]
lea ecx, [eax + ecx + 1]
movzx eax, bl
lea edx, [eax + ecx]
lea esi, [ebp + esi - 0x100]
cmp edx, esi
ja 0x4047b3
cmp eax, dword [ebp + 8]
jl 0x4047b3
cmp byte [ebp - 0x100], 0xff
jne 0x404795
add ecx, dword [ebp + 8]
sub bl, byte [ebp + 8]
movzx eax, bl
xor edx, edx
test eax, eax
jle 0x4047ac
movzx si, byte [edx + ecx]
mov word [edi + edx*2], si
inc edx
cmp edx, eax
jl 0x40479e
and word [edi + eax*2], 0
jmp 0x4047b5
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x404d30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push esi
lea eax, [ebp - 0x38]
push edi
push eax
mov edx, str.ftpcommander
call fcn.004057af
pop ecx
lea eax, [ebp - 0x38]
push 8
mov dword [ebp - 0xc], eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x18], 0x26
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x10], 0x23
call fcn.0040c36f
xor edi, edi
lea eax, [ebp - 0x240]
push eax
push esi
push esi
push dword [ebp + edi*4 - 0x18]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x404db0
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
push 0x404a6a
push 2
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.004086ef
add esp, 0x24
inc edi
cmp edi, 3
jb 0x404d75
cmp dword [ebp - 4], esi
jbe 0x404dc5
mov esi, dword [ebp - 8]
call fcn.0040362f
jmp 0x404dce
push dword [ebp - 8]
call fcn.0040c30c
pop ecx
pop edi
pop esi
leave
ret
Function at 0x4053d4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
push esi
push edi
push 8
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.0040c36f
lea eax, [ebp - 0x128]
push eax
mov edx, str.SOFTWARE_smartftpclient_2.0_settingsgeneral_favorites
call fcn.004057af
lea eax, [ebp - 0xb8]
push eax
mov edx, str.SOFTWARE_smartftpclient_2.0_settings_backup
call fcn.004057af
lea eax, [ebp - 0x54]
push eax
mov edx, str.personal_favorites
call fcn.004057af
lea eax, [ebp - 0x2c]
push eax
mov edx, str.folder
call fcn.004057af
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
mov ebx, 0x104
push ebx
push dword [ebp + esi - 0x14]
lea edi, [ebp - 0x330]
push dword [ebp + esi - 0x1c]
mov eax, 0x80000001
call fcn.00408936
add esp, 0xc
cmp eax, 0xffffffff
je 0x4054a1
test eax, eax
jbe 0x4054a1
push ebx
lea eax, [ebp - 0x538]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x538]
push eax
call fcn.00405119
pop ecx
pop ecx
add esi, 4
dec dword [ebp - 4]
jne 0x405459
cmp dword [ebp - 8], 0
jbe 0x4054b9
mov esi, dword [ebp - 0xc]
call fcn.0040362f
jmp 0x4054c2
push dword [ebp - 0xc]
call fcn.0040c30c
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406ebc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x406eef
xor eax, eax
jmp 0x406f24
push edi
push dword [ebp + 0x14]
call fcn.004056ef
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
pop esi
leave
ret

Function at 0x4071d3
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x4071e5
xor eax, eax
pop esi
ret
push esi
push esi
push esi
push 1
push esi
call dword [sym.imp.WININET.dll_InternetOpenW]
xor ecx, ecx
cmp eax, esi
setne cl
mov dword [0x4124e4], eax
pop esi
mov eax, ecx
ret
Function at 0x4074ea
Capabilities:
Clear file content
Delete file
Download and write a file
Query remote server for available data
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40752c
mov eax, dword [ebp + 0x10]
or dword [eax], 1
xor eax, eax
jmp 0x4075f9
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov edi, dword [ebp + 0x10]
jne 0x407549
push dword [ebp - 4]
or dword [edi], 2
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
push ebx
push 0x80000000
push ebx
push ebx
push dword [ebp + 8]
push dword [0x4124e4]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x10], esi
jne 0x407578
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 4
jmp 0x4075f5
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
lea eax, [ebp - 8]
push eax
mov edi, 0x800
push edi
lea eax, [ebp - 0x818]
push eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x4075cb
cmp dword [ebp - 8], ebx
je 0x4075d5
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 0x10]
call esi
cmp eax, 1
mov dword [ebp - 0xc], eax
je 0x40759f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
inc eax
cmp dword [ebp - 0xc], eax
je 0x4075f7
mov eax, dword [ebp + 0x10]
or dword [eax], 4
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x407a7b
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push edi
xor esi, esi
push esi
mov edi, 0x80
push edi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x407bc6
push esi
push edi
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 0xc]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x407ad1
push 2
pop eax
jmp 0x407bc9
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x407bc6
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push dword [ebp - 0xc]
call ebx
test eax, eax
je 0x407bc6
cmp dword [ebp - 8], edi
jne 0x407bc6
push esi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push esi
push esi
push dword [ebp - 4]
call edi
push esi
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 0x14]
push esi
push esi
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call edi
push esi
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call ebx
call fcn.00405aeb
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, dword [ebp - 0x140]
push esi
push esi
push dword [ebp - 0x10]
push dword [ebp - 4]
lea eax, [eax + edx - 0x1f4]
mov dword [ebp - 0x140], eax
call edi
push esi
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x407bc9
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407bce
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1000
call fcn.0040da80
push ebx
push esi
push edi
mov ebx, 0x400
push ebx
lea eax, [esp + 0x10]
push eax
xor edi, edi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [esp + 0x1010], edi
je 0x407c14
push dword [esp + 0x1010]
lea eax, [esp + 0x10]
push eax
call fcn.00407a7b
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x407c88
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
lea eax, [esp + 0x814]
push eax
push dword [esi*4 + 0x412044]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x810]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00407a7b
test eax, eax
pop ecx
pop ecx
je 0x407c92
cmp eax, 1
jne 0x407c5e
push 4
call ebp
lea eax, [eax + edi + 0xf4240]
push eax
push 4
jmp 0x407c71
cmp eax, 2
jne 0x407c79
push 4
call ebp
lea eax, [eax + edi + 0xf4240]
push eax
push 5
call fcn.0040ac2d
add esp, 0xc
inc esi
add edi, 0xf4240
cmp esi, 2
jl 0x407c1b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1000
ret
lea eax, [esi + 1]
jmp 0x407c87

Function at 0x407c97
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.0040da00
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
neg eax
sbb eax, eax
neg eax
pop esi
leave
ret
Function at 0x407ff5
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
push esi
push edi
xor eax, eax
call fcn.0040770e
mov edi, eax
mov eax, dword [0x41b634]
test eax, eax
jne 0x408041
lea eax, [esp + 0xd8]
push eax
xor eax, eax
push str.TimeCorr
inc eax
call fcn.004082d2
test eax, eax
pop ecx
pop ecx
je 0x408041
lea eax, [esp + 0xd8]
call fcn.004058c2
mov dword [0x41b634], eax
add eax, edi
xor edx, edx
mov ecx, 0x4b0
div ecx
lea esi, [esp + 0x70]
mov edi, eax
test edi, edi
jne 0x408061
mov byte [esp + 0x70], 0x30
mov byte [esp + 0x71], al
jmp 0x40809f
mov ecx, 0x3b9aca00
cmp edi, ecx
jae 0x40807b
mov eax, ecx
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, eax
cmp edi, ecx
jb 0x40806a
jmp 0x408099
xor edx, edx
mov eax, edi
div ecx
push 0xa
mov dl, al
imul eax, ecx
add dl, 0x30
sub edi, eax
mov byte [esi], dl
mov eax, ecx
xor edx, edx
pop ecx
div ecx
inc esi
mov ecx, eax
test ecx, ecx
jne 0x40807b
mov byte [esi], cl
cmp byte [esp + 0x70], 0
mov edx, str.__scMMdj490_0_Osd
lea eax, [esp + 0x70]
je 0x4080b5
inc eax
cmp byte [eax], 0
jne 0x4080af
mov cl, byte [edx]
mov byte [eax], cl
inc eax
inc edx
test cl, cl
jne 0x4080b5
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
lea eax, [esp + 0x70]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4080ed
lea ecx, [esp + 0x70]
sub eax, ecx
dec eax
mov edx, eax
cmp edx, edi
jle 0x408115
push edx
push ecx
lea ecx, [esp + 0x20]
push ecx
shl eax, 3
xor ecx, ecx
call fcn.0040c186
add esp, 0xc
lea eax, [esp + 8]
push eax
lea esi, [esp + 0x1c]
call fcn.0040c227
pop ecx
xor ecx, ecx
mov dl, byte [esp + ecx + 8]
mov al, dl
shr al, 4
cmp al, 0xa
movzx ax, al
jae 0x40813d
add ax, 0x30
jmp 0x408141
add ax, 0x57
mov word [ebx + ecx*4], ax
movzx eax, dl
and eax, 0x8000000f
jns 0x408154
dec eax
or eax, 0xfffffff0
inc eax
cmp al, 0xa
movzx ax, al
jae 0x408162
add ax, 0x30
jmp 0x408166
add ax, 0x57
mov word [ebx + ecx*4 + 2], ax
inc ecx
cmp ecx, 0x10
jl 0x408126
mov word [ebx + 0x40], di
xor eax, eax
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40817e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040da80
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x2000]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4081b4
lea edx, [ebp - 0x2000]
call fcn.004071b8
jmp 0x4081c2
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, str.System.log
lea eax, [ebp - 0x2000]
call fcn.0040578b
cmp dword [ebp + 8], edi
push 4
pop eax
je 0x4081dd
push 3
pop eax
push edi
push 2
push eax
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov dword [0x4120b4], eax
pop esi
mov eax, ecx
leave
ret