joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483844
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
mov dword [ebp - 0x184], ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 4]
xor ecx, ecx
mov cl, byte [ebp - 0x80]
lea edx, [ebp - 0x7f]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 4]
push esi
push edi
xor eax, eax
lea esi, [ebp - 0x80]
lodsb al, byte [esi]
push esi
push eax
mov ecx, eax
mov edx, eax
mov edi, esi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x48388b
pop eax
pop esi
lea edi, [ebp - 0x100]
mov cl, byte [esi]
inc ecx
sub eax, ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x180]
stosb byte es:[edi], al
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, esi
lea edx, [ebp - 0x100]
call fcn.00403ef8
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00403ef8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484054
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
test byte [esp], 1
je 0x484067
add ebx, 0x20
test byte [esp], 2
je 0x484070
add ebx, 2
test byte [esp], 4
je 0x484077
inc ebx
test byte [esp], 8
je 0x484080
add ebx, 4
test byte [esp], 0x10
je 0x48408c
add ebx, 0x100
test byte [esp], 0x20
je 0x484098
add ebx, 0x1000
push ebx
mov eax, esi
call fcn.00404118
push eax
call sub.kernel32.dll_SetFileAttributesA
neg eax
sbb eax, eax
neg eax
pop edx
pop esi
pop ebx
ret

Function at 0x484cf8
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x484e15
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
xor eax, eax
call fcn.00484bc0
pop ecx
test al, al
je 0x484df0
mov eax, dword [ebp + 8]
push eax
call fcn.00484a04
pop ecx
test al, al
jne 0x484df0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x140]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
je 0x484df0
mov eax, dword [ebp + 8]
push eax
mov eax, 0x13
call fcn.00484a44
pop ecx
test al, al
je 0x484df0
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.00403f04
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004093f0
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x188], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x188]
cmp esi, 0xc8
je 0x484dbb
mov eax, dword [ebp + 8]
cmp esi, 0xce
jne 0x484df0
mov eax, dword [ebp + 8]
push eax
mov eax, 5
call fcn.00484a44
pop ecx
test al, al
je 0x484df0
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
add edx, 0xffffeffc
mov ecx, 0x1000
call fcn.00403f04
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004093f0
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
call fcn.00484a04
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484e1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403cf8
ret
Function at 0x489628
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
cmp dword [esi + 0x18], 0
je 0x48963c
mov eax, esi
call fcn.004896d8
mov eax, dword [esi + 4]
mov dword [esi + 0x18], eax
test bl, bl
je 0x48965e
mov eax, dword [esi + 4]
cmp word [eax], 0x25ff
jne 0x48965e
add dword [esi + 0x18], 2
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0x18]
sub eax, 5
mov byte [esi + 0xc], 0xe9
mov edx, eax
and dl, 0xff
mov byte [esi + 0xd], dl
mov edx, eax
shr edx, 8
and dl, 0xff
mov byte [esi + 0xe], dl
mov edx, eax
shr edx, 0x10
and dl, 0xff
mov byte [esi + 0xf], dl
shr eax, 0x18
and al, 0xff
mov byte [esi + 0x10], al
mov eax, dword [esi + 0x18]
mov al, byte [eax]
mov byte [esi + 0x11], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 1]
mov byte [esi + 0x12], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 2]
mov byte [esi + 0x13], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 3]
mov byte [esi + 0x14], al
mov eax, dword [esi + 0x18]
mov al, byte [eax + 4]
mov byte [esi + 0x15], al
push esp
push 0x40
push 5
mov eax, dword [esi + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4896d4
call fcn.00489ed8
pop edx
pop esi
pop ebx
ret
Function at 0x489790
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4897ae
add esp, 0xfffffff0
call fcn.004032ac
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404108
xor eax, eax
push ebp
push 0x489981
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404118
push eax
call sub.kernel32.dll_CreateFileA_1
mov edi, eax
mov dword [esi + 0x20], edi
cmp edi, 0xffffffff
jne 0x489816
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4899b0
call fcn.00403fa0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x486714]
call fcn.0040c584
call fcn.00403704
push 0
push 0
push 0
push 2
push 0
mov eax, dword [esi + 0x20]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
mov dword [esi + 0x24], edi
test edi, edi
jne 0x489856
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x4899cc
call fcn.00403fa0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x486714]
call fcn.0040c584
call fcn.00403704
push 0
push 0
push 0
push 4
mov eax, dword [esi + 0x24]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
mov dword [esi + 0x28], edi
test edi, edi
jne 0x4898a9
push 0x4899f8
push dword [ebp - 4]
push 0x489a14
lea eax, [ebp - 0x14]
call fcn.004874f0
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404014
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x486714]
call fcn.0040c584
call fcn.00403704
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x28]
mov dword [esi + 0x2c], eax
mov byte [esi + 4], 0
xor ecx, ecx
mov edx, dword [esi + 0x2c]
mov eax, esi
call fcn.00489778
cmp eax, 0x950412de
je 0x4898f4
cmp eax, 0xde120495
je 0x4898f4
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 0x489a34
call fcn.00403fa0
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x486714]
call fcn.0040c584
call fcn.00403704
cmp eax, 0xde120495
sete al
mov byte [esi + 4], al
mov ecx, 4
mov edx, dword [esi + 0x2c]
mov eax, esi
call fcn.00489778
mov ecx, 8
mov edx, dword [esi + 0x2c]
mov eax, esi
call fcn.00489778
mov dword [esi + 0xc], eax
mov ecx, 0xc
mov edx, dword [esi + 0x2c]
mov eax, esi
call fcn.00489778
mov dword [esi + 0x10], eax
mov ecx, 0x10
mov edx, dword [esi + 0x2c]
mov eax, esi
call fcn.00489778
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x18], 1
test eax, eax
je 0x48995b
shr eax, 1
shl dword [esi + 0x18], 1
test eax, eax
jne 0x489952
shr dword [esi + 0x18], 1
mov eax, dword [esi + 0x18]
shr eax, 1
mov dword [esi + 0x1c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489988
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403cf8
ret
Function at 0x4a35cc
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404108
xor eax, eax
push ebp
push 0x4a372c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3744
call fcn.00403fa0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040441c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.0048a198
push dword [0x4a8ff0]
push 0x4a377c
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404014
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4a378c
call fcn.00403fa0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
call fcn.0042eac4
mov eax, dword [0x4a7498]
mov eax, dword [eax]
call fcn.0044d2c8
xor eax, eax
push ebp
push 0x4a36d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404118
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404118
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
je 0x4a36cc
push 0
push 0x4a3798
push dword [ebp - 8]
push 0x4a37c0
push 0x4a37cc
push 0x4a37d8
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404014
mov eax, dword [ebp - 0x20]
mov cx, word [0x4a3808]
mov dl, 4
call fcn.00451410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a36e0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x314]
mov eax, ebx
call fcn.004540f4
mov edx, eax
add edx, 0xa
mov eax, ebx
call fcn.004542a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3733
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403cf8
lea eax, [ebp - 0x14]
call fcn.00404304
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403cf8
ret
Function at 0x4a380c
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404108
xor eax, eax
push ebp
push 0x4a396c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3984
call fcn.00403fa0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040441c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.0048a198
push dword [0x4a8ff0]
push 0x4a39c0
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404014
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4a39d4
call fcn.00403fa0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
call fcn.0042eac4
mov eax, dword [0x4a7498]
mov eax, dword [eax]
call fcn.0044d2c8
xor eax, eax
push ebp
push 0x4a3916
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404118
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404118
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
je 0x4a390c
push 0
push 0x4a39e0
push dword [ebp - 8]
push 0x4a3a08
push 0x4a3a14
push 0x4a3a20
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404014
mov eax, dword [ebp - 0x20]
mov cx, word [0x4a3a50]
mov dl, 4
call fcn.00451410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3920
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x314]
mov eax, ebx
call fcn.004540f4
mov edx, eax
add edx, 0xa
mov eax, ebx
call fcn.004542a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3973
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403cf8
lea eax, [ebp - 0x14]
call fcn.00404304
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403cf8
ret
Function at 0x4a3a54
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404108
xor eax, eax
push ebp
push 0x4a3bb4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3bcc
call fcn.00403fa0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040441c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.0048a198
push dword [0x4a8ff0]
push 0x4a3c00
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404014
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3c14
call fcn.00403fa0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
call fcn.0042eac4
mov eax, dword [0x4a7498]
mov eax, dword [eax]
call fcn.0044d2c8
xor eax, eax
push ebp
push 0x4a3b5e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404118
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404118
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
je 0x4a3b54
push 0
push 0x4a3c20
push dword [ebp - 8]
push 0x4a3c48
push 0x4a3c54
push 0x4a3c60
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404014
mov eax, dword [ebp - 0x20]
mov cx, word [0x4a3c90]
mov dl, 4
call fcn.00451410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3b68
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x314]
mov eax, ebx
call fcn.004540f4
mov edx, eax
add edx, 0xa
mov eax, ebx
call fcn.004542a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3bbb
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403cf8
lea eax, [ebp - 0x14]
call fcn.00404304
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403cf8
ret
Function at 0x4a3c94
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404108
xor eax, eax
push ebp
push 0x4a3df4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3e0c
call fcn.00403fa0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0040441c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
call fcn.0048a198
push dword [0x4a8ff0]
push 0x4a3e3c
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404014
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4a3e50
call fcn.00403fa0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
call fcn.0042eac4
mov eax, dword [0x4a7498]
mov eax, dword [eax]
call fcn.0044d2c8
xor eax, eax
push ebp
push 0x4a3d9e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404118
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404118
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
je 0x4a3d94
push 0
push 0x4a3e5c
push dword [ebp - 8]
push 0x4a3e84
push 0x4a3e90
push 0x4a3e9c
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00404014
mov eax, dword [ebp - 0x20]
mov cx, word [0x4a3ecc]
mov dl, 4
call fcn.00451410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a3da8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x314]
mov eax, ebx
call fcn.004540f4
mov edx, eax
add edx, 0xa
mov eax, ebx
call fcn.004542a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3dfb
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403cf8
lea eax, [ebp - 0x14]
call fcn.00404304
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403cf8
ret
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x10001a70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, eax
cmp ebp, 3
jb 0x10001ae9
mov eax, 0xaaaaaaab
mul ebp
shr edx, 1
push ebx
mov edi, edi
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
shl eax, 8
or eax, ebx
movzx ebx, byte [esi + 2]
shl eax, 8
or eax, ebx
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + edi]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + edi]
mov byte [ecx + 1], bl
mov ebx, eax
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + edi]
and eax, 0x3f
mov byte [ecx + 2], bl
mov al, byte [eax + edi]
mov byte [ecx + 3], al
add esi, 3
add ecx, 4
sub ebp, 3
sub edx, 1
jne 0x10001a90
pop ebx
sub ebp, 1
je 0x10001b2d
sub ebp, 1
jne 0x10001b51
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + edi]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shl edx, 4
shr eax, 4
or edx, eax
movzx edx, byte [edx + edi]
mov byte [ecx + 1], dl
movzx eax, byte [esi + 1]
and eax, 0xf
movzx edx, byte [edi + eax*4]
pop edi
pop esi
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
pop ebp
ret
movzx eax, byte [esi]
shr eax, 2
movzx edx, byte [eax + edi]
mov byte [ecx], dl
movzx eax, byte [esi]
and eax, 3
shl eax, 4
movzx edx, byte [eax + edi]
mov al, 0x3d
mov byte [ecx + 1], dl
mov byte [ecx + 2], al
mov byte [ecx + 3], al
pop edi
pop esi
pop ebp
ret
Function at 0x401110
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x401128
cmp eax, 0x80010106
jne 0x4011a6
push edi
push esi
push 0x66377c
push 1
push 0
push 0x66376c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x401157
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.00569b20
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x401180
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.00569b20
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4011a4
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.00569b20
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret

Function at 0x4014a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4014b8
cmp eax, 0x80010106
jne 0x40150c
push edi
push esi
push 0x6637bc
push 1
push 0
push 0x6637ac
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4014e7
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.00569b20
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x40150b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.00569b20
mov eax, esi
add esp, 8
pop edi
pop esi
ret
Function at 0x401590
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 4], 0
jne 0x4015a6
mov eax, 0x80004001
pop esi
pop ecx
ret 0xc
push ebx
push ebp
push edi
push str.Infestation:_Survivor_Stories
call fcn.00401050
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00401050
mov ecx, dword [esp + 0x28]
push ecx
mov ebp, eax
call fcn.00401050
mov dword [esp + 0x28], eax
add esp, 0xc
lea ebx, [esp + 0x20]
mov eax, esi
mov dword [esp + 0x10], 0
call fcn.00401510
mov esi, eax
test esi, esi
jge 0x401603
push esi
push str.IsAppEnabled_failed:_0x_08lx_n
call fcn.00569b20
add esp, 8
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
cmp dword [esp + 0x20], 0
je 0x401614
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push 0x6637dc
push 1
push 0
push 0x6637cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x40163e
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x4016cd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x4016d5
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.00569b20
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x401910
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x690dfc]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.0058ff10
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x40196b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.00569e30
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.0056a7d0
add esp, 0xc
test al, al
jne 0x40199e
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.00569cf0
add esp, 8
push str.1.0.1
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.00401aa0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4019db
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.00569cf0
add esp, 0xc
push 0x2f
push str.http:__188.212.158.32_WWZ_Newkoh_launcher_wzupd.xml
call fcn.0058ff10
mov esi, eax
add esp, 8
test esi, esi
jne 0x401a05
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.00569e30
add esp, 0x10
lea edi, [esi + 1]
push 0x66386c
push edi
call fcn.0056ace0
mov esi, eax
push 0x663870
push esi
call fcn.0058ff3d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push str.1.0.1
push ecx
lea edx, [esp + 0x2c]
push edx
push str.http:__188.212.158.32_WWZ_Newkoh_launcher_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.0058ff3d
push str.__p__n
push esi
call fcn.0058ff3d
push esi
call fcn.005900d0
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00401ac0
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.0058fc47
add esp, 0x614
ret