joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447e70
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x49e0c4]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
lea eax, [esp + 4]
push ebp
push esi
push edi
mov esi, dword [ebx + 0x508]
mov edi, dword [ebx]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [esi + 0x15c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x447ef5
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.00457730
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x447f30
push str.Received_too_short_packet
push edi
call fcn.0041c620
add esp, 8
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00455c59
add esp, 0x88
ret
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax]
movzx eax, byte [eax + 1]
shl ecx, 8
or ecx, eax
mov dword [esi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x447f51
jmp dword [ecx*4 + 0x448060]
cmp edx, 4
jle case.0x447f51.4
mov ebp, dword [esi + 0x15c]
movzx ecx, byte [ebp + 2]
movzx eax, byte [ebp + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [esi + 0x40]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x447f51.4
lea eax, [edx - 4]
push eax
lea eax, [ebp + 4]
push eax
push 1
push ebx
call fcn.0041c3a0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x447faf
push 5
push esi
call fcn.00448930
add esp, 8
mov eax, ebp
jmp 0x447f17
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x90], eax
adc dword [edi + 0x94], edx
push dword [edi + 0x94]
push dword [edi + 0x90]
push edi
call fcn.004354b0
jmp 0x448036
mov eax, dword [esi + 0x15c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
mov eax, dword [esi + 0x15c]
add eax, 4
mov dword [esi + 8], ecx
push eax
push 0x48042c
push edi
call fcn.0041c750
jmp 0x448036
lea eax, [edx - 2]
push eax
mov eax, dword [esi + 0x15c]
add eax, 2
push eax
push esi
call fcn.00447c00
add esp, 0xc
test eax, eax
je case.0x447f51.4
jmp 0x447f17
push str.Internal_error:_Unexpected_packet
push 0x48486c
push edi
call fcn.0041c620
add esp, 0xc
push ebx
call fcn.004358a0
add esp, 4
test eax, eax
je 0x447f15
push 5
push esi
call fcn.00448930
add esp, 8
mov eax, 0x2a
jmp 0x447f17
Function at 0x4521f0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x452200
sub esi, ecx
je 0x452217
lea eax, [esi + esi]
push eax
call dword [section..data]
jmp 0x452222
push 0x494ccb
call dword [0x49e00c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x452235
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
xor ecx, ecx
test esi, esi
je 0x452250
nop dword [eax + eax]
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x452240
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov ebx, dword [esp + 0x24]
test eax, eax
je 0x4522cd
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4522c1
push 0
lea eax, [esi + esi]
mov dword [esp + 0x18], 0x10
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push 2
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx + 0x14], 0
call dword [0x49e004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4522f0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x49e0c4]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov edi, dword [esp + 0x30]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4523f0
push esi
mov esi, dword [esp + 0x38]
push 8
mov dword [esp + 0x18], 0x208
mov dword [esp + 0x1c], 0x6601
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov al, dl
shr al, 1
mov byte [esp + 0x24], cl
shl cl, 7
or al, cl
shl dl, 6
mov cl, byte [esi + 2]
mov byte [esp + 0x25], al
mov al, cl
shr al, 2
or al, dl
shl cl, 5
mov dl, byte [esi + 3]
mov byte [esp + 0x26], al
mov al, dl
shr al, 3
or al, cl
shl dl, 4
mov cl, byte [esi + 4]
mov byte [esp + 0x27], al
mov al, cl
shr al, 4
or al, dl
shl cl, 3
mov dl, byte [esi + 5]
mov byte [esp + 0x28], al
mov al, dl
shr al, 5
or al, cl
shl dl, 2
mov cl, byte [esi + 6]
mov byte [esp + 0x29], al
mov al, cl
shr al, 6
add cl, cl
or al, dl
mov dword [esp + 0x20], 8
mov byte [esp + 0x2a], al
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x2f], cl
call fcn.004548b0
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x452402
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00455c59
add esp, 0x24
ret
mov ecx, dword [esp + 0x2c]
push dword [esp + 8]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0
push 0
push 0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
xor ecx, esp
call fcn.00455c59
add esp, 0x24
ret
Function at 0x454960
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x454987
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x4549d2
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x4549d6
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x454a36
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4549f5
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x454a67
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x48904e
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x48904f
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x454a40
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x46fb90
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046fa0f

Function at 0x474de8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00474aa8
Function at 0x402f0d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00413fe0
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push ecx
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.00405270
lea eax, [ebp - 0x2004]
push eax
call fcn.00405349
push 0x5c
lea edi, [ebp - 0x2004]
pop ebx
lea edi, [edi + eax*2]
lea eax, [ebp - 0x2004]
push ebx
push eax
call fcn.004042a4
add esp, 0x18
test eax, eax
je 0x402fb0
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x2004]
push ebx
push eax
call fcn.004042a4
pop ecx
pop ecx
test eax, eax
jne 0x402f64
push esi
jmp 0x402f95
push 0
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test esi, esi
je 0x402faf
mov word [esi], bx
lea eax, [ebp - 0x2004]
push eax
call fcn.00405349
lea esi, [ebp - 0x2004]
pop ecx
lea esi, [esi + eax*2]
cmp esi, edi
jne 0x402f7f
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040331d
leave
ret

Function at 0x402fbe
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
jne 0x402fe6
xor eax, eax
jmp 0x40303a
push edi
xor edi, edi
push edi
push 0x8000080
push 2
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40300a
push 0x52
jmp 0x403038
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40302f
cmp dword [ebp - 8], edi
jne 0x40302f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x403039
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1d
pop eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040331d
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
test ebx, ebx
push edi
mov edi, 0x811c9dc5
jle 0x40123c
mov al, byte [esi + ebp]
movzx ecx, al
xor ecx, edi
imul ecx, ecx, 0x1000193
mov edi, ecx
movsx edx, al
push edi
push edx
push esi
push str.__d___d__d_n
call fcn.00401480
add esi, 1
add esp, 0x10
cmp esi, ebx
jl 0x401212
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x401650
Capabilities:
Move file

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push 0x400
call fcn.00409380
mov esi, eax
push 0x400
push esi
call fcn.0040b66f
push esi
push str._Extractor__Working_dir_is__s_n
call fcn.00401480
push esi
call fcn.004092a3
push edi
push ebp
call fcn.004099c1
add esp, 0x20
test eax, eax
mov dword [esp + 0x10], 0
je 0x401782
lea esp, [esp]
cmp dword [esp + 0x10], 0xa
jge 0x4017a7
call fcn.00409559
mov eax, dword [eax]
push eax
push edi
push ebp
push str._Rename__Could_not_rename__s_to__s___d__n
call fcn.00401480
add esp, 0x10
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.00401480
add esp, 4
push 3
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401798
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x400
mov esi, eax
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call ebx
push str.MoveFileEx
mov dword [esp + 0x18], eax
call ebx
mov ecx, dword [esp + 0x14]
lea eax, [ecx + eax + 0x28]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0xc]
push ecx
push esi
push str.MoveFileEx
push str._HttpDownloader___s_failed_with_error__d:__s_n
mov ebx, eax
call fcn.00401480
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x10
push edx
call esi
push ebx
call esi
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [esp + 0x10], 1
push edi
push ebp
call fcn.004099c1
add esp, 8
test eax, eax
jne 0x4016a0
push edi
push ebp
push str._Rename__File__s_renamed_to__s_n
call fcn.00401480
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.00401480
add esp, 4
jmp 0x401782
test eax, eax
je 0x401782
call fcn.00409559
mov eax, dword [eax]
push eax
push edi
push ebp
push str._Rename___FAIL__Could_not_rename__s_to__s___d__n
call fcn.00401480
push str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.00401480
mov eax, edi
call fcn.00401800
push edi
push ebp
call fcn.00401c90
add esp, 0x1c
test eax, eax
je 0x401791
pop esi
pop ebp
pop ebx
add esp, 0xc
mov dword [esp + 4], str._Rename__Copy_failed_too__Severe_filesystem_issues._n
jmp fcn.00401480
Function at 0x401910
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov edi, eax
push edi
push str.Fixing__s_n
call fcn.00401480
push 0x41df5c
push edi
call fcn.0040a1be
mov esi, eax
add esp, 0x10
test esi, esi
mov byte [esp + 8], 0x50
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0
mov byte [esp + 0xb], 0
jne 0x40195d
push edi
push str.Could_not_open_file__s_n
call fcn.00401480
add esp, 8
push 1
call fcn.0040c0a3
push ebp
push edi
push str.Opened__s_n
call fcn.00401480
add esp, 8
xor ebp, ebp
push ebx
xor edi, edi
push esi
call fcn.00409f99
push esi
mov ebx, eax
add ebp, 1
call fcn.00409a6a
add esp, 8
test eax, eax
jne 0x401a41
cmp bl, byte [esp + edi + 0x10]
jne 0x40196f
add edi, 1
cmp edi, 4
jne 0x401971
push ebp
push str.Skipped__ld_n
mov dword [0x4316f8], ebp
call fcn.00401480
push str.Found_marker_OK_n
call fcn.00401480
mov eax, dword [0x4316f8]
push 0
add eax, 0x59
push eax
push esi
call fcn.0040ba21
push str.Skipped_to_relevant_spot_n
call fcn.00401480
push esi
call fcn.00409f99
push eax
push str.Was__02X_n
call fcn.00401480
mov ecx, dword [0x4316f8]
push 0
add ecx, 0x59
push ecx
push esi
call fcn.0040ba21
push esi
push 2
call fcn.00409882
mov edx, dword [0x4316f8]
push 0
add edx, 0x59
push edx
push esi
call fcn.0040ba21
add esp, 0x48
push esi
call fcn.00409f99
push eax
push str.Now__02X_n
call fcn.00401480
push esi
call fcn.00409f3d
push esi
call fcn.0040bd6f
push str.Fixed_OK_n
call fcn.00401480
add esp, 0x18
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
push str.SS_edit___PE_sig
push str.Could_not_find_marker:__s_n
call fcn.00401480
add esp, 8
push 1
call fcn.0040c0a3
int3

Function at 0x401c10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push edi
mov esi, eax
push 0x41e028
push esi
call fcn.0040a1be
mov edi, eax
add esp, 8
test edi, edi
jne 0x401c40
push esi
push str.Unable_to_open_destination_file_for_copy__s_n
call fcn.00401480
add esp, 8
pop edi
pop esi
ret
push ebx
push 0xc350
push 1
push 0x425398
call fcn.0040a5dd
mov esi, eax
add esp, 0x10
test esi, esi
jbe 0x401c6c
push edi
push esi
push 1
push 0x425398
call fcn.0040b30c
add esp, 0x10
cmp esi, 0xc350
je 0x401c40
push ebx
call fcn.0040bd6f
push edi
call fcn.0040bd6f
add esp, 8
pop edi
pop esi
ret
Function at 0x403b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
push edi
push ebx
push str._ExtractArchive__Extracting_archive__s_into__s_n
call fcn.00401480
add esp, 0xc
push 0x41df0c
push ebx
call fcn.0040a1be
mov esi, eax
add esp, 8
test esi, esi
jne 0x403b48
push ebx
push str._ExtractArchive__Failed_to_extract_archive___couldnt_open_file__s_n
call fcn.00401480
add esp, 8
push 1
call fcn.0040c0a3
mov ebx, dword [ebp + 8]
push esi
push 0
mov edx, edi
mov ecx, ebx
call fcn.00403340
add esp, 8
test eax, eax
je 0x403b4b
push str._ExtractArchive__Done_extracting_archive._n
call fcn.00401480
add esp, 4
push esi
call fcn.0040bd6f
mov eax, dword [ebp + 0xc]
add esp, 4
push eax
call fcn.0040a0d0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e50
Capabilities:
Get session user name

Disassembly:
sub esp, 0xd4
mov eax, dword [0x4234e0]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
push str.ALLUSERSPROFILE
call fcn.0040bc79
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403e95
sub eax, edx
lea edx, [esp + 0x14]
push edx
mov ebx, eax
call fcn.00401200
mov esi, eax
add esp, 4
test esi, esi
jge 0x403eb7
neg esi
push 0x64
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.004109c0
push esi
lea ecx, [esp + 0x88]
push 0x41eac0
push ecx
call fcn.004099ef
lea eax, [esp + 0x2c]
add esp, 0x18
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403ee4
sub eax, esi
je 0x403f16
cmp byte [esp + edx + 0x14], 0x80
jb 0x403efd
mov byte [esp + edx + 0x14], 0x5f
lea eax, [esp + 0x14]
add edx, 1
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403f07
sub eax, esi
cmp edx, eax
jb 0x403ef1
push 0x1388
call fcn.00409380
mov ebx, eax
mov eax, edi
add esp, 4
mov byte [ebx], 0
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403f30
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403f40
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, str.JWUser_
mov eax, ebx
call fcn.00401860
lea eax, [esp + 0x78]
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403f70
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403f80
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
add edi, 0xffffffff
lea ecx, [ecx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x403fa0
mov dx, word [0x41e128]
lea eax, [esp + 0x14]
mov word [edi], dx
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403fc0
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x403fd0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
call section..text
mov esi, eax
test esi, esi
je 0x404031
mov eax, dword [esi]
or edi, 0xffffffff
cmp eax, 0xffffffff
je 0x40400a
push eax
call fcn.00409862
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x134]
push eax
call fcn.004092a3
push esi
call fcn.004092a3
add esp, 8
cmp edi, 0xffffffff
jne 0x40403a
call fcn.00409559
mov dword [eax], 9
jmp 0x40403a
push ebx
call fcn.0040a354
add esp, 4
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00409294
add esp, 0xd4
ret
Function at 0x4040f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4234e0]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push edi
push str.APPDATA
mov dword [esp + 0xc], 0x94
call fcn.0040bc79
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x404182
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404124
sub eax, edx
cmp eax, 2
jbe 0x404182
cmp byte [ebx], 0x5c
jne 0x404182
cmp byte [ebx + 1], 0x5c
jne 0x404182
push str._Extractor__Roaming_AppData_directory_detected_n
call fcn.00401480
add esp, 4
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4041f1
cmp dword [esp + 0xc], 5
jbe 0x404191
push str.LOCALAPPDATA
call fcn.0040bc79
mov ebx, eax
push ebx
push str._Extractor__Local_AppData_directory_resolved_to__s_n
call fcn.00401480
add esp, 0xc
jmp 0x4041f1
push str._Extractor__Local_AppData_directory_detected_n
call fcn.00401480
add esp, 4
jmp 0x4041f1
push esi
push str.USERPROFILE
call fcn.0040bc79
push 0x1388
mov esi, eax
call fcn.00409380
mov ebx, eax
add esp, 8
mov byte [ebx], 0
mov eax, esi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4041b2
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4041c2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, str.Local_Settings
mov eax, ebx
call fcn.00401860
mov ecx, str.Application_Data
call fcn.00401860
pop esi
push 0
push ebx
call fcn.00409dab
add esp, 8
test eax, eax
jne 0x40420b
mov edi, ebx
call fcn.00403e00
test eax, eax
jne 0x404235
push ebx
push str.The_directory__s_appears_invalid.
call fcn.00401480
add esp, 8
call fcn.00403e50
pop edi
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00409294
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
pop edi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00409294
add esp, 0x98
ret
Function at 0x4077a0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
push 0x24
mov edi, eax
call fcn.00409380
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 4
push 0
push 0
push 0
mov esi, eax
call ebx
push 0
push 0
push 0
mov dword [esi], eax
call ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 8], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], 0
call fcn.00407ac0
push 0
push 0
push 1
push 0
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push ecx
mov dword [esi + 0x20], eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [esp + 0x24]
push edx
push 0
push esi
push 0x407730
push 0
push 0
call edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
push eax
push 0
push esi
push 0x4074e0
push 0
push 0
call edi
lea ecx, [esp + 0x2c]
push ecx
push 0
push esi
push 0x407580
push 0
push 0
mov dword [esp + 0x2c], eax
call edi
lea edx, [esp + 0x30]
push edx
push 0
push esi
push 0x407650
push 0
push 0
mov dword [esp + 0x30], eax
call edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x34]
push eax
push 0
push esi
push 0x4076c0
push 0
push 0
call edi
mov ecx, dword [esi]
push ecx
mov dword [esp + 0x24], eax
mov dword [esi + 0x1c], 5
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0x20]
push 0xffffffffffffffff
push edx
call ebx
mov eax, dword [esi + 8]
push eax
push str._HttpDownloader__Download_Tasks_Complete___success_d__n
call fcn.00401480
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
xor edi, edi
mov edi, edi
mov ecx, dword [esp + edi*4 + 0x10]
push ecx
call ebx
add edi, 1
cmp edi, 5
jl 0x4078c0
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x4078e0
Capabilities:
Delete file

Disassembly:
push edi
mov edi, dword [0x4316ec]
cmp dword [edi], 0
jne 0x4078f5
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
ret
push esi
push 0x41e028
push eax
call fcn.0040a1be
mov esi, eax
add esp, 8
test esi, esi
je 0x407941
mov eax, dword [edi]
test eax, eax
je 0x407938
push esi
push eax
call fcn.0040c594
add esp, 8
cmp dword [edi + 4], 0
je 0x407938
push esi
push 0x4205f0
call fcn.0040c594
mov eax, dword [edi + 4]
push esi
push eax
call fcn.0040c594
add esp, 0x10
push esi
call fcn.0040bd6f
add esp, 4
pop esi
pop edi
ret