joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59b510
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x59b519
xchg dword [ebp - 4], ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406334
mov eax, dword [ebp - 8]
call fcn.00406334
xor eax, eax
push ebp
push 0x59b622
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x59b560
lea edx, [ebp - 0xc]
mov eax, 0x59b63c
call fcn.0059a904
jmp 0x59b56b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0059a904
push 0
push 0
push 0x59b6a4
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.00406590
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406590
mov eax, dword [ebp - 0x1c]
mov cl, 2
pop edx
call fcn.0059ada0
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00406568
mov esi, dword [ebx]
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x59b6c4
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
call fcn.0040adf0
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.0040634c
mov ecx, dword [ebx]
lea eax, [ebp - 0x24]
mov edx, 0x59b6d8
call fcn.00406820
mov eax, dword [ebp - 0x24]
call fcn.004063d8
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59b629
lea eax, [ebp - 0x24]
call fcn.0040633c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405564
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406344
ret
Function at 0x59f428
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x59f44e
shr edx, 1
xor edx, eax
jmp 0x59f450
shr edx, 1
inc ecx
jne 0x59f440
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x59f439
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x59f468
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x59f471
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00429494
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x59f51e
cmp dword [ebp - 0xc], 0x2800
jl 0x59f4cc
mov dword [ebp - 8], 0x2800
jmp 0x59f4d2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x59f516
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x61a91c]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x59f4ed
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x59f4b4
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5a13f4
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x5a148e
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x5a1413
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x5a14a4
dec edx
je 0x5a14d9
jmp 0x5a152a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x5a152a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5a159c
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x5a15bb
add edx, 3
sar edx, 2
test edx, edx
jle 0x5a16c9
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x5a15f0
je 0x5a1633
sub ecx, 0x2b
je 0x5a1629
sub ecx, 4
je 0x5a162e
dec ecx
sub ecx, 0xa
jb 0x5a161b
jmp 0x5a1636
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x5a1602
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x5a160d
jmp 0x5a1636
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x5a1636
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x5a1636
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x5a1636
mov byte [eax], 0x3e
jmp 0x5a1636
mov byte [eax], 0x3f
jmp 0x5a1636
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x5a15d3
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x5a1687
cmp byte [esp + 7], 0xff
jne 0x5a1687
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x5a16be
cmp dl, 0xff
je 0x5a16be
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x5a15ca
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x5a2450
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x5a2471
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x5a245e
pop edi
pop esi
pop ebx
ret

Function at 0x5a6e54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x5a6ea8
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x5d31dc]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x5d35dc]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x5d39dc]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x5d3ddc]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x5a6e62
pop edi
pop esi
pop ebx
ret
Function at 0x5ab6d4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ab754
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
mov ecx, 0x5ab76c
mov edx, 0x59
call fcn.00413c98
push dword [ebp - 4]
push 0x5ab780
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
mov ecx, 0x5ab790
mov edx, 0x5a
call fcn.00413c98
push dword [ebp - 8]
mov eax, ebx
mov edx, 3
call fcn.00406904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab75b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406344
ret
Function at 0x5b78ac
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x5b79d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00487aa4
xor edx, edx
mov eax, ebx
call fcn.00487ad8
lea edx, [ebp - 0xc]
mov eax, 1
call fcn.00403430
mov eax, dword [ebp - 0xc]
mov edx, 0x5b79f0
call fcn.0040cabc
test al, al
je 0x5b79bb
lea edx, [ebp - 4]
mov eax, 3
call fcn.00403430
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040e08c
mov eax, dword [ebp - 0x10]
call fcn.004dfdbc
mov eax, 0x3e8
call fcn.005ac88c
lea edx, [ebp - 8]
mov eax, 4
call fcn.00403430
mov edx, 0x5b7a14
mov eax, dword [ebp - 8]
call fcn.0040cabc
test al, al
je 0x5b795a
push 0
mov eax, ebx
call fcn.00490e44
xor ecx, ecx
mov edx, 0x5f4
call fcn.005ac808
jmp 0x5b79bb
mov eax, 0x3e8
call fcn.005ac88c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040e08c
mov eax, dword [ebp - 0x14]
call fcn.004dfdbc
mov eax, dword [ebp - 4]
call fcn.0040d89c
test al, al
je 0x5b79ae
push 1
push 0
mov eax, dword [ebx + 0x3e0]
call fcn.004063d8
push eax
mov eax, dword [ebp - 4]
call fcn.004063d8
push eax
push 0x5b7a1c
mov eax, ebx
call fcn.00490e44
push eax
call sub.shell32.dll_ShellExecuteW
push 0
call fcn.005ac79c
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b79dd
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00406344
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push str.calc.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
pop ebp
ret

Function at 0x4016ef
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40172e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40172e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40172e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40172e
cmp dword [ecx + 0x74], 0xe
jbe 0x40172e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40e30c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4956a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0x479ab4
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x210], 3
call esi
lea eax, [ebp - 0x210]
push eax
xor ebx, ebx
mov edi, str.Country
push ebx
lea edx, [ebp - 0x214]
mov ecx, edi
call fcn.004102c8
push ebx
push edi
push ebx
call fcn.00410602
add esp, 0x14
test eax, eax
je 0x40e376
push str.Country_Code_deleted
call fcn.004295a9
pop ecx
push str.country_code_is_deleted_after_checker_fail_to_download
call fcn.004295a9
lea eax, [ebp - 0x20c]
mov dword [esp], 0x475e44
push eax
mov dword [ebp - 0x210], pe_nt_image_headers32
call esi
lea eax, [ebp - 0x210]
push eax
push ebx
lea edx, [ebp - 0x20c]
mov ecx, str.PostStatusUrl
call fcn.004102c8
pop ecx
pop ecx
mov edi, 0x479ca4
push edi
lea eax, [ebp - 0x10c]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
push ebx
lea edx, [ebp - 0x10c]
mov ecx, str.InstalledJREVersion
mov dword [ebp - 0x210], 0x80
call fcn.004102c8
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
push ebx
lea edx, [ebp - 0x8c]
mov ecx, str.NewJREVersion
mov dword [ebp - 0x210], 0x80
call fcn.004102c8
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x479d48
lea ecx, [ebp - 0x20c]
call fcn.00410eb6
mov ecx, dword [ebp - 8]
add esp, 0x24
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449589
leave
ret
Function at 0x4117f9
Capabilities:
Get common file path
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x5cc]
sub esp, 0x64c
mov eax, dword [0x4956a0]
xor eax, ebp
mov dword [ebp + 0x5c8], eax
mov eax, dword [ebp + 0x5d4]
push ebx
push esi
push edi
push 0x3c
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x80]
push ebx
push eax
mov esi, ecx
mov byte [ebp + 0x3c4], bl
call fcn.0044b630
lea eax, [ebp - 0x3c]
add esp, 0xc
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x50], 0x400
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov edi, 0x104
cmp eax, ebx
je 0x4118a1
push pe_nt_image_headers32
lea eax, [ebp + 0x3c4]
push eax
push edi
lea eax, [ebp + 0x4c4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.0044d36a
lea eax, [ebp + 0x4c4]
push 0x47a3ec
push eax
call fcn.0044b9c0
add esp, 0x2c
test eax, eax
je 0x4118ea
mov eax, esi
mov dword [ebp - 0x40], ebx
cmp byte [esi], bl
je 0x4118d2
mov cl, byte [eax]
cmp cl, 0x20
je 0x4118b6
cmp cl, 9
jne 0x4118bf
push eax
call dword [sym.imp.USER32.dll_CharNextA]
jmp 0x4118aa
mov ecx, dword [ebp - 0x40]
movsx edx, byte [eax]
imul ecx, ecx, 0x1f
add ecx, edx
inc eax
mov dword [ebp - 0x40], ecx
cmp byte [eax], bl
jne 0x4118aa
push dword [ebp - 0x40]
lea eax, [ebp + 0x4c4]
push str.jupdate__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x4c4]
push eax
push dword [ebp - 0x44]
call esi
lea eax, [ebp + 0x3c4]
push eax
push dword [ebp - 0x44]
call esi
mov ecx, dword [ebp + 0x5c8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449589
add ebp, 0x5cc
leave
ret
Function at 0x4150a2
Capabilities:
Delete file

Disassembly:
push 0x48
mov eax, 0x46916e
call fcn.004516bd
cmp dword [0x49a024], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], eax
mov ebx, str.CheckFileIntegrity
mov edi, str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_wrappers_common_UpdateUtils.cpp
mov esi, 0x49a024
jg 0x41511c
test eax, eax
jne 0x4150d8
mov eax, 0x4791b8
test ecx, ecx
jne 0x4150e1
mov ecx, 0x4791b8
push eax
push ecx
push str.Verify_integrity_of___s__file_from___s_...
lea ecx, [ebp - 0x48]
call fcn.00425a0c
add esp, 0xc
and dword [ebp - 4], 0
push ebx
push 0x94
push edi
push 1
mov edx, eax
mov ecx, esi
call fcn.0042432e
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00403353
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x415129
mov dword [ebp - 0x54], 1
jmp 0x415133
push eax
call fcn.004295d7
pop ecx
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x50]
push 0xffffffffffffffff
call fcn.00414fc2
cmp dword [ebp - 0x54], 0
pop ecx
mov dword [ebp - 0x4c], eax
je 0x41514b
test eax, eax
je 0x4151b0
mov ecx, dword [ebp - 0x50]
push 0
call fcn.00414fc2
pop ecx
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x4151b0
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x49a024], 3
jg 0x4151b0
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41517b
mov eax, 0x4791b8
push eax
push str.Integrity_verification_failed_for___s_
lea ecx, [ebp - 0x2c]
call fcn.00425a0c
pop ecx
pop ecx
push ebx
push 0xab
push edi
push 3
mov edx, eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.0042432e
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403353
mov eax, dword [ebp - 0x4c]
call fcn.00451740
ret

Function at 0x419557
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x467c4a
call fcn.004516bd
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
dec ecx
push 4
neg ecx
sbb ecx, ecx
mov esi, edx
pop edx
and ecx, 0xfffffffc
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
add ecx, edx
lea eax, [ebp - 0x54]
push eax
or ecx, 1
push ecx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], edx
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x4195e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.004194f1
push eax
lea eax, [ebp - 0x4c]
push str.encryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.004089c9
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0040102d
push 0x48627c
mov eax, esi
push eax
call fcn.00451224
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.004128e4
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.004495a0
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
call fcn.00451740
ret
Function at 0x41961b
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x60
mov eax, 0x467c4a
call fcn.004516bd
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x54], ebx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
push 1
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
mov esi, edx
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x419699
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push eax
lea esi, [ebp - 0x30]
call fcn.004194f1
push eax
lea eax, [ebp - 0x4c]
push str.decryption_failed__sysError
push eax
mov dword [ebp - 4], ebx
call fcn.004089c9
add esp, 0x14
lea esi, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0040102d
push 0x48627c
mov eax, esi
push eax
call fcn.00451224
mov edi, dword [ebp - 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov esi, dword [ebp - 0x54]
mov eax, edi
call fcn.004128e4
push dword [ebp - 0x54]
mov eax, dword [edi]
push dword [ebp - 0x50]
push eax
call fcn.004495a0
add esp, 0xc
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
call fcn.00451740
ret

Function at 0x419742
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x6c
mov eax, 0x467c15
call fcn.004516bd
mov eax, dword [ebp + 8]
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], ecx
cmp dword [ebp + 0xc], ecx
jne 0x419771
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ecx
mov byte [edi], cl
jmp 0x41986a
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
lea edx, [ebp - 0x68]
push edx
push ecx
mov ebx, 0x40000001
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x68], ecx
push eax
call esi
test eax, eax
jne 0x4197cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea esi, [ebp - 0x64]
call fcn.004194f1
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x48]
push str.binary2string__phase1__failed__sysError
push eax
call fcn.004089c9
add esp, 0x14
mov byte [ebp - 4], 1
lea esi, [ebp - 0x78]
call fcn.0040102d
push 0x48627c
mov eax, esi
push eax
call fcn.00451224
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
call fcn.00419aed
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4197fc
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x68]
push ecx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x6c]
call esi
test eax, eax
jne 0x41983e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
lea esi, [ebp - 0x48]
call fcn.004194f1
push eax
lea eax, [ebp - 0x64]
push str.binary2string__phase2__failed__sysError
push eax
mov byte [ebp - 4], 3
call fcn.004089c9
add esp, 0x14
mov byte [ebp - 4], 4
jmp 0x4197ba
mov eax, dword [ebp - 0x68]
lea ecx, [ebp - 0x2c]
call fcn.00419aed
and dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
lea esi, [ebp - 0x2c]
mov byte [edi], 0
call fcn.0040319c
push 0
push 1
mov ecx, esi
call fcn.00403353
mov eax, edi
call fcn.00451740
ret