joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403072
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4170ec]
mov edi, eax
sub esi, dword [0x40b01c]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebp
jle 0x403248
push dword [0x41f0fc]
call fcn.00403285
push ebp
push ebp
push dword [0x40b01c]
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f0f8], esi
mov dword [0x4170e8], ebp
mov eax, dword [0x4170f0]
mov ebx, 0x4000
sub eax, dword [0x41f0fc]
cmp eax, ebx
jg 0x4030e5
mov ebx, eax
mov esi, 0x4130a8
push ebx
push esi
call fcn.00403253
test eax, eax
je 0x403213
add dword [0x41f0fc], ebx
mov dword [0x40b038], esi
mov dword [0x40b03c], ebx
cmp dword [0x424348], ebp
je 0x403176
cmp dword [0x4243e0], ebp
jne 0x403176
cmp dword [esp + 0x10], ebp
je 0x403143
mov eax, dword [0x41f0f8]
push ebp
sub eax, dword [0x4170ec]
sub eax, dword [esp + 0x20]
add eax, dword [0x40b01c]
mov dword [0x4170e8], eax
call fcn.00405e5f
jmp 0x403176
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x403176
mov eax, dword [0x424344]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402bae
push ebp
push 0x6f
push dword [0x424340]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
mov ecx, 0x40b020
mov dword [0x40b040], 0x40b0a8
mov dword [0x40b044], 0x8000
call fcn.00405f20
test eax, eax
jl 0x40321c
mov esi, dword [0x40b040]
mov eax, 0x40b0a8
sub esi, eax
je 0x4031dd
lea ecx, [esp + 0x14]
push ebp
push ecx
push esi
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403218
cmp esi, dword [esp + 0x14]
jne 0x403218
add dword [0x40b01c], esi
cmp dword [0x40b03c], ebp
jne 0x40310b
jmp 0x4031e9
cmp dword [0x40b03c], ebp
jne 0x40321c
cmp ebx, ebp
je 0x40321c
mov eax, dword [0x4170ec]
mov ecx, eax
sub ecx, dword [0x40b01c]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x4030cf
push ebp
push ebp
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x403221
or eax, 0xffffffff
jmp 0x40324a
push 0xfffffffffffffffe
jmp 0x40321e
push 0xfffffffffffffffd
pop eax
jmp 0x40324a
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x403248
mov eax, dword [0x41f0f8]
push ebp
push ebp
push 0x113
push esi
mov dword [0x4170e8], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x4053ad
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x422950], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x4053d1
test al, 0x10
jne 0x4053d4
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x422950
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4053ff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x405467
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00405708
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x40549d
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4243c8], eax
jmp 0x405622
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x4054b8
test eax, eax
je 0x4055cd
test cl, 2
je 0x4055cd
mov esi, 0x421950
push ebx
push esi
call fcn.00405b2f
cmp dword [ebp + 8], 0
je 0x4054d7
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054dd
push ebx
call fcn.0040566f
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4055c3
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405653
cmp byte [eax], 0
je 0x40552e
cmp byte [ebp - 0x18], 0
je 0x40552e
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405544
mov al, byte [esi + 1]
test al, al
je 0x4055a2
cmp al, 0x2e
jne 0x405544
cmp byte [esi + 2], 0
je 0x4055a2
push esi
push edi
call fcn.00405b2f
test byte [ebp - 0x148], 0x10
je 0x405569
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4055a2
push dword [ebp + 0xc]
push ebx
call fcn.00405467
jmp 0x4055a2
push ebx
call fcn.004057ec
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40559a
test byte [ebp + 0xc], 4
je 0x405592
push ebx
push 0xfffffffffffffff1
call fcn.00404ef4
push 0
push ebx
call fcn.00405882
jmp 0x4055a2
inc dword [0x4243c8]
jmp 0x4055a2
push ebx
push 0xfffffffffffffff2
call fcn.00404ef4
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40550c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4055cd
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x405622
cmp dword [ebp - 8], esi
jne 0x4055e2
inc dword [0x4243c8]
jmp 0x405622
push ebx
call fcn.00405df7
test eax, eax
je 0x405622
push ebx
call fcn.00405628
push ebx
call fcn.004057ec
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40561a
test byte [ebp + 0xc], 4
je 0x4055da
push ebx
push 0xfffffffffffffff1
call fcn.00404ef4
push esi
push ebx
call fcn.00405882
jmp 0x405622
push ebx
push 0xffffffffffffffe5
call fcn.00404ef4
pop esi
pop ebx
leave
ret 8
Function at 0x405708
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421d50
push esi
call fcn.00405b2f
push esi
call fcn.004056bb
mov edi, eax
test edi, edi
jne 0x405729
xor eax, eax
jmp 0x40577b
push edi
call fcn.00405d5e
test byte [0x424350], 0x80
je 0x405742
mov al, byte [edi]
test al, al
je 0x405725
cmp al, 0x5c
je 0x405725
sub edi, esi
jmp 0x40575a
call fcn.00405df7
test eax, eax
je 0x405754
test byte [eax], 0x10
je 0x405725
push esi
call fcn.0040566f
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405746
call fcn.00405628
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4057ec
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405808
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40580b
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x40583a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40587e
test edi, edi
jne 0x405845
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405878
Function at 0x405882
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405e35
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4058ae
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4059e7
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422ad8], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422ad8
je 0x4058f2
push 1
push 0
push esi
call fcn.0040580b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4059ed
cmp eax, edi
jg 0x4059ed
mov esi, 0x422550
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4059ed
cmp eax, edi
jg 0x4059ed
push esi
push ebp
push str._s_s_r_n
push 0x422150
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x424348]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405b51
push 4
push 0xc0000000
push esi
call fcn.0040580b
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x4059e7
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4059e0
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4059e0
cmp edi, dword [esp + 0x18]
jne 0x4059e0
push str._Rename__r_n
push esi
call fcn.00405780
test eax, eax
jne 0x4059f4
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405b2f
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x422150
push eax
call fcn.004057cc
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4243d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409314
push eax
call fcn.00405780
test eax, eax
je 0x4059ab
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405a1b
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405a10
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x4059ad

Function at 0x405a23
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a87
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405a76
cmp dword [ebp + 0x14], 1
je 0x405a78
cmp dword [ebp + 0x14], 2
je 0x405a78
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x405b51
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x405b72
mov ecx, dword [0x423b1c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x424378]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x4232e0
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405d38
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405d38
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405d45
inc ebx
cmp cl, 0xfc
jbe 0x405d2b
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0xc], eax
or eax, edx
push 2
mov dword [ebp - 8], eax
pop eax
mov dword [ebp - 0x14], ecx
or ecx, edx
add ebx, eax
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0x10], ecx
jne 0x405cd6
cmp dword [0x4243c4], 0
mov dword [ebp + 0xc], eax
je 0x405c04
mov dword [ebp + 0xc], 4
dec dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push dword [ebp + eax*4 - 0x14]
push dword [0x424344]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405c3b
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x405c44
and byte [edi], 0
cmp dword [ebp + 0xc], 0
jne 0x405c04
cmp byte [edi], 0
jne 0x405cbd
mov eax, dword [ebp - 0x14]
cmp eax, 0x2b
jne 0x405c68
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405a23
jmp 0x405cb8
cmp eax, 0x26
jne 0x405c94
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405a23
cmp byte [edi], 0
jne 0x405cbd
push str.C:Program_Files
push edi
call fcn.00405b2f
jmp 0x405cb8
cmp eax, 0x25
jne 0x405ca7
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405cb8
cmp eax, 0x24
jne 0x405cb8
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
je 0x405cce
cmp dword [ebp - 0xc], 0x1a
jne 0x405cce
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405d5e
jmp 0x405d1c
cmp byte [ebp + 0xf], 0xfd
jne 0x405d0a
cmp esi, 0x1b
jne 0x405cef
push dword [0x424344]
push edi
call fcn.00405a8d
jmp 0x405d00
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.00405b2f
add esi, 0xffffffeb
cmp esi, 6
jae 0x405d1c
jmp 0x405cce
cmp byte [ebp + 0xf], 0xff
jne 0x405d1c
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00405b51
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x4232e0
jmp 0x405d38
jne 0x405d35
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405d38
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405b9d
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405d5a
push eax
push dword [ebp + 8]
call fcn.00405b2f
leave
ret 8
Function at 0x405e92
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422edc], 0
push esi
jne 0x405ec9
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405ea3
mov dword [ecx*4 + 0x422ed8], eax
inc ecx
cmp ecx, 0x100
jl 0x405e9e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405efa
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ed8]
xor eax, esi
inc ecx
dec edx
jne 0x405edc
pop edi
not eax
pop esi
ret 0xc
Function at 0x405fff
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x43d30e
call fcn.0043c04c
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
push edi
xor eax, eax
mov byte [ebp - 0x1c], 0
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], esi
push 0x4423c0
mov ecx, ebx
mov byte [ebx], al
call fcn.00401bb9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], 1
cmp eax, esi
jle 0x4060f8
mov esi, dword [ebp + 0xc]
add esi, 2
mov dword [ebp - 0x10], eax
push 3
dec eax
xor edx, edx
pop ecx
div ecx
lea edi, [eax + 1]
mov eax, dword [ebp - 0x10]
push 3
pop ecx
mov dword [ebp + 0x10], ecx
cmp eax, ecx
jg 0x406075
mov dword [ebp + 0x10], eax
movzx eax, byte [esi - 2]
mov ecx, eax
shr ecx, 2
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 0x1c], cl
movzx ecx, byte [esi - 1]
and eax, 3
mov edx, ecx
shl eax, 4
shr edx, 4
or edx, eax
cmp dword [ebp + 0x10], 1
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 0x1b], al
jle 0x4060c0
movzx eax, byte [esi]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or eax, ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 0x1a], al
jmp 0x4060c4
mov byte [ebp - 0x1a], 0x3d
cmp dword [ebp + 0x10], 2
jle 0x4060db
movzx eax, byte [esi]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 0x19], al
jmp 0x4060df
mov byte [ebp - 0x19], 0x3d
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.004066e8
sub dword [ebp - 0x10], 3
add esi, 3
dec edi
jne 0x406065
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4063dd
Capabilities:
Hash data with md5

Disassembly:
mov eax, 0x43da30
call fcn.0043c04c
sub esp, 0x128
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp + 0xc], ebx
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
push esi
push edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], 0x67452301
mov dword [ebp - 0x70], 0xefcdab89
mov dword [ebp - 0x6c], 0x98badcfe
mov dword [ebp - 0x68], 0x10325476
jb 0x406427
mov ecx, dword [eax]
jmp 0x406429
mov ecx, eax
mov eax, edx
shl eax, 3
cmp edx, ebx
jle 0x406442
push edx
push ecx
lea ecx, [ebp - 0x7c]
push ecx
xor ecx, ecx
call fcn.00406f5a
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea esi, [ebp - 0x7c]
call fcn.00407001
pop ecx
xor edi, edi
inc edi
push edi
push 3
lea ecx, [ebp - 0x134]
call fcn.00403584
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
lea eax, [ebp + eax - 0x124]
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
lea eax, [ebp + eax - 0x124]
mov byte [eax + 0x40], 0x30
xor esi, esi
push ebx
lea eax, [ebp - 0x8c]
push 2
push eax
call fcn.00412316
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx + 4]
add esp, 0xc
push dword [eax + 0xc]
lea ecx, [ebp + ecx - 0x124]
push dword [eax + 8]
push ecx
call dword [eax]
movzx eax, byte [ebp + esi - 0x20]
add esp, 0xc
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0040670b
inc esi
cmp esi, 0x10
jl 0x40649b
push dword [ebp + 8]
lea ecx, [ebp - 0x134]
call fcn.00403636
lea ecx, [ebp - 0x134]
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], bl
call fcn.00403054
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x40735c
Capabilities:
Connect to http server
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov eax, 0x43d2eb
call fcn.0043c04c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub esp, 0x2c
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
cmp eax, ebx
je 0x40749f
cmp dword [ecx + 0x14], 0x10
jb 0x407388
mov ecx, dword [ecx]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x1bb
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x40749f
cmp dword [edi + 0x14], 0x10
jb 0x4073b3
mov eax, dword [edi]
jmp 0x4073b5
mov eax, edi
push ebx
push 0xc03000
push ebx
push ebx
push ebx
push eax
push str.POST
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
mov dword [ebp + 8], edi
mov byte [ebp - 4], 1
cmp edi, ebx
jne 0x4073e8
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x40749f
push 0x3e
push str.Content_Type:_application_x_www_form_urlencoded_r_nAccept:___r_n
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x34], bl
call fcn.00401f77
mov byte [ebp - 4], 2
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
jb 0x407413
mov esi, dword [esi]
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x40741f
lea eax, [ebp - 0x34]
push ecx
push esi
push dword [ebp - 0x24]
push eax
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x40743e
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00401bdc
push edi
jmp 0x407492
mov edi, 0x20000
lea esi, [ebp - 0x18]
mov dword [ebp - 0x10], ebx
call fcn.00406826
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x18]
cmp esi, ebx
jne 0x40745c
push ebx
jmp 0x40747e
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40747d
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push esi
call fcn.004050b3
push esi
call fcn.00423efe
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00401bdc
push dword [ebp + 8]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp + 0xc]
call esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x407c17
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x43d5d9
call fcn.0043c04c
sub esp, 0x74
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004245f0
add esp, 0xc
push dword [ebp + 8]
mov dword [ebp - 0x80], edi
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004084ae
push str.__VERYSILENT
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], esi
call fcn.004084d0
mov eax, dword [ebp - 0x28]
push 2
xor ebx, ebx
pop ecx
inc eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.00412076
mov edi, eax
pop ecx
cmp edi, esi
je 0x407c8d
push ebx
push esi
push edi
call fcn.004245f0
add esp, 0xc
jmp 0x407c8f
xor edi, edi
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x407c9b
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x28]
add ecx, ecx
push ecx
push eax
push edi
call fcn.00424a70
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407cd6
cmp dword [ebp - 0x1c], 0xffffffff
je 0x407cd6
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call fcn.00423efe
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.00401cc1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x407cf9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push ebx
xor eax, eax
push 0x206
mov word [ebp - 0x280], ax
xor ebx, ebx
lea eax, [ebp - 0x27e]
push ebx
push eax
call fcn.004245f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x280]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x407d41
xor al, al
jmp 0x407e15
push esi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407e12
push 0x39
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.004245f0
add esp, 0xc
push 2
push ebx
push 0xffffffffffffffc8
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push 0x38
lea eax, [ebp - 0x78]
push eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x78], 0x44414544
jne 0x407e12
cmp dword [ebp - 0x74], 0x46454542
jne 0x407e12
push edi
xor eax, eax
mov byte [ebp - 0x18], bl
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x18]
push 0x11
push eax
call fcn.004241d0
mov ecx, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
call fcn.004066e8
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x3c], bl
lea edi, [ebp - 0x3b]
rep stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x3c]
push 0x11
push eax
call fcn.004241d0
mov ecx, dword [ebp + 0xc]
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
call fcn.004066e8
mov al, 1
pop edi
jmp 0x407e14
xor al, al
pop esi
pop ebx
leave
ret 8