joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4129b0
Capabilities:
Resume thread
Suspend thread

Disassembly:
test bl, bl
je 0x4129d4
cmp byte [0x4ac2c6], 0
jne 0x4129ff
mov eax, dword [0x4b1c74]
test eax, eax
je 0x4129ff
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov byte [0x4ac2c6], bl
ret
cmp byte [0x4ac2c6], 1
jne 0x4129ff
mov eax, dword [0x4b1c74]
test eax, eax
je 0x4129ff
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4129ff
mov eax, dword [0x4b1c74]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov byte [0x4ac2c6], bl
ret

Function at 0x413460
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1b8
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAStartup]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_socket]
push esi
mov dword [esp + 0x10], 0
push 6
push 1
push 2
xor esi, esi
call ebp
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x4134ca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x276d
jne 0x413554
lea eax, [esp + 0x28]
push eax
push 0x202
call ebx
mov esi, eax
test esi, esi
je 0x41348b
cmp esi, 0x276d
je 0x41348b
mov edx, dword [edi]
push 4
lea ecx, [esp + 0x18]
push ecx
push 0xffffff7f
push 0xffff
push edx
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, 2
push str.127.0.0.1
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x1c8]
push ecx
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0x1c]
mov word [esp + 0x1e], ax
mov eax, dword [edi]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x413537
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x413554
cmp byte [esp + 0x1cc], 0
jne 0x413554
mov edx, dword [edi]
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test esi, esi
je 0x41356c
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x41356c
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
mov ecx, dword [esp + 0x1bc]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047a722
add esp, 0x1b8
ret

Function at 0x413590
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push esi
push edi
xor esi, esi
jmp 0x4135a0
mov ecx, dword [esp + 0x14]
push 0
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [esp + 0x18]
lea edx, [esi + ecx]
push edx
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x4135d1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4135d1
cmp eax, 0x274c
jne 0x4135dd
add esi, edi
cmp esi, ebx
jl 0x4135a0
pop edi
mov eax, esi
pop esi
pop ebp
ret
push eax
or esi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x413670
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
xor esi, esi
mov byte [esp + 0x13], 0
mov ecx, dword [esp + 0x18]
xor edi, edi
push edi
mov eax, 0x1f
sub eax, esi
push eax
push ebp
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x4136cc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
je 0x4136dd
cmp edi, 0x274c
je 0x4136dd
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
test eax, eax
je 0x4136dd
mov edx, dword [esp + 0x1c]
add esi, eax
lea ebp, [esi + edx]
mov byte [ebp], 0
test esi, esi
je 0x4136ed
mov eax, dword [esp + 0x1c]
mov cl, byte [esi + eax - 1]
mov byte [esp + 0x13], cl
cmp esi, 0x20
jge 0x4136bd
cmp byte [esp + 0x13], 0xa
je 0x4136bd
test edi, edi
je 0x413686
cmp edi, 0x2733
je 0x413686
cmp edi, 0x274c
je 0x413686
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x413980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
push 0
push 0
push 4
push 0
push 5
push 0x40000000
push ebx
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0xffffffff
jne 0x4139c4
cmp eax, 0x20
jne 0x413a3b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413992
push 2
xor ecx, ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4139f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413a00
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
push eax
push edi
push esi
call ebx
test al, al
jne 0x413a30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x20
jne 0x413a32
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4139f6
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413ab0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
push eax
xor ebx, ebx
push ecx
mov dword [esp + 0x14], ebx
call fcn.0047c5ba
add eax, 0x11
cdq
and edx, 0xf
add eax, edx
mov esi, eax
sar esi, 4
shl esi, 4
push esi
call fcn.0047a780
mov edi, eax
add esp, 0xc
cmp edi, ebx
jne 0x413af1
pop edi
pop esi
lea eax, [ebx + 8]
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push eax
push esi
push edi
call fcn.0047be02
mov eax, edi
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413b10
sub eax, edx
mov esi, eax
je 0x413b52
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push edi
push edx
call ebp
test al, al
jne 0x413b4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x20
jne 0x413b51
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413b24
xor ebx, ebx
pop ebp
push edi
call fcn.0047a868
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x413f30
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x12], 1
mov byte [esp + 0x13], 0
xor ebp, ebp
xor bl, bl
mov dword [esp + 0x14], ebp
call fcn.0040b740
mov edi, eax
test edi, edi
jne 0x413fee
mov esi, 0x490
push str._Unable_to_get_server_processing_status.
push esi
call fcn.0040a310
add esp, 8
push 0
push 1
push str.http:__uav.secureaplus.com_
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x413fbb
cmp byte [esp + 0x1c], al
jne 0x413f96
push str.Unable_to_connect_to_Universal_AV_server.
mov esi, 0x4b1d24
call fcn.00413780
add esp, 4
mov ebx, 0x1388
call fcn.00409b80
cmp byte [esp + 0x1c], 0
jne 0x413fb9
push str.Wait_for_the_server_to_process_the_information...
mov esi, 0x4b1d24
call fcn.00413780
add esp, 4
mov bl, 1
test ebp, ebp
je 0x413fc8
push ebp
call fcn.0047a868
add esp, 4
mov byte [esp + 0x12], 0
test bl, bl
jne 0x413f41
cmp byte [esp + 0x13], bl
je 0x413fe6
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, 0x49ca47
mov eax, 0x4b33f8
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x414018
test dl, dl
je 0x414014
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x414018
add eax, 2
add ecx, 2
test dl, dl
jne 0x413ff8
xor eax, eax
jmp 0x41401d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x414039
call fcn.00414df0
push eax
push 0x49e414
mov edx, 0x4b33f8
call fcn.00406090
add esp, 8
push edi
push str.Version1.0MachineID_s
push str.POST
push 0x4b33f8
lea edx, [esp + 0x24]
mov ecx, str._CheckWhitelistDone.php
call fcn.00408560
push edi
mov esi, eax
call fcn.0047a868
mov ebp, dword [esp + 0x28]
add esp, 0x14
test esi, esi
jne 0x413f5d
test ebp, ebp
je 0x413fc8
mov ecx, 0x49f5b8
mov eax, ebp
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4140a0
test dl, dl
je 0x41409c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4140a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x414080
xor eax, eax
jmp 0x4140a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x413fbb
cmp byte [esp + 0x12], 0
mov byte [esp + 0x13], 1
je 0x4140df
push str.Wait_for_the_server_to_process_the_information..._r_n
call fcn.0040a210
add esp, 4
cmp byte [esp + 0x1c], 0
jne 0x4140df
push str.Wait_for_the_server_to_process_the_information...
mov esi, 0x4b1d24
call fcn.00413780
add esp, 4
push 0x2a
push str._Still_in_progress:_Add_whitelist_in_db
push ebp
call fcn.0047b67e
add esp, 0xc
test eax, eax
je 0x414115
push 0x2d
push str._Still_in_progress:_Add_missing_file_in_db
push ebp
call fcn.0047b67e
add esp, 0xc
test eax, eax
je 0x414115
push ebp
push str.Server_response:__S_r_n
call fcn.0040a210
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413fb9
Function at 0x4150d0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4a8698
push 0x47eeb0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4aab30]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x58], ebx
mov ecx, 0xc
mov esi, str.Content_Type:_application_x_www_form_urlencoded
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x7c], 0x49e240
mov dword [ebp - 0x78], ebx
xor edi, edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 4], ebx
mov dword [eax], ebx
call fcn.0040b740
mov dword [ebp - 0x54], eax
test eax, eax
je 0x41523e
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415156
sub eax, edx
lea esi, [eax + 0x40]
push esi
call fcn.0047a780
add esp, 4
mov ebx, eax
mov dword [ebp - 0x6c], ebx
test ebx, ebx
je 0x41523e
mov eax, dword [ebp - 0x54]
push eax
push str.Version1.0MachineID_s
push esi
push ebx
call fcn.0047b592
add esp, 0x10
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415190
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x50]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4151a1
sub eax, esi
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push edx
push ebx
push eax
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x7c]
push eax
call fcn.00414e90
push eax
mov edx, str._GetNextFileToUpload.php
mov ecx, str.POST
call fcn.00407f80
add esp, 0x24
mov dword [ebp - 0x5c], eax
test eax, eax
jne 0x41523e
push 0x400
call fcn.0047a780
add esp, 4
mov edi, eax
mov dword [ebp - 0x60], edi
test edi, edi
je 0x41523e
push 0x400
push 0
push edi
call fcn.0047d730
add esp, 0xc
lea ecx, [ebp - 0x68]
push ecx
push 0x3ff
push edi
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x415229
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x5c], eax
jmp 0x41523e
mov eax, dword [ebp - 0x68]
mov byte [eax + edi], 0
push edi
call fcn.0047bfb6
add esp, 4
mov ecx, dword [ebp - 0x74]
mov dword [ecx], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.0041526f
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0047a722
mov esp, ebp
pop ebp
ret
Function at 0x415520
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4a8678
push 0x47eeb0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4aab30]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], ebx
mov ecx, 0xc
mov esi, str.Content_Type:_application_x_www_form_urlencoded
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x78], 0x49e240
mov dword [ebp - 0x74], ebx
xor edi, edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], ebx
call fcn.0040b740
mov dword [ebp - 0x50], eax
test eax, eax
je 0x415680
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4155a1
sub eax, edx
lea esi, [eax + 0x40]
push esi
call fcn.0047a780
add esp, 4
mov ebx, eax
mov dword [ebp - 0x60], ebx
test ebx, ebx
je 0x415680
mov eax, dword [ebp - 0x50]
push eax
push str.Version1.0MachineID_s
push esi
push ebx
call fcn.0047b592
add esp, 0x10
mov eax, ebx
lea edx, [eax + 1]
jmp 0x4155e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4155e0
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x4c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4155f1
sub eax, esi
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push edx
push ebx
push eax
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x78]
push eax
call fcn.00414e90
push eax
mov edx, str._ResetFailedFile.php
mov ecx, str.POST
call fcn.00407f80
add esp, 0x24
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x415680
push 0x400
call fcn.0047a780
add esp, 4
mov edi, eax
mov dword [ebp - 0x54], edi
test edi, edi
je 0x415680
push 0x400
push 0
push edi
call fcn.0047d730
add esp, 0xc
lea ecx, [ebp - 0x68]
push ecx
push 0x3ff
push edi
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x415679
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x58], eax
jmp 0x415680
mov eax, dword [ebp - 0x68]
mov byte [eax + edi], 0
mov dword [ebp - 4], 0xfffffffe
call fcn.004156b1
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0047a722
mov esp, ebp
pop ebp
ret
Function at 0x4158e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x49dbc0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x41594d
push 8
lea edx, [esp + 0xc]
push edx
push 3
push eax
mov eax, dword [esp + 0x14]
push str.LastScan
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x41595c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x415994
mov esi, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00415820
push 8
lea ecx, [esp + 0xc]
push ecx
push 3
push str.LastScan
push esi
xor ecx, ecx
mov edx, 0x49dbc0
call fcn.0040b7f0
add esp, 0x14
pop esi
add esp, 0xc
ret
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x4159d0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4a8658
push 0x47eeb0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4aab30]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], ebx
mov ecx, 0xc
mov esi, str.Content_Type:_application_x_www_form_urlencoded
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x78], 0x49e240
mov dword [ebp - 0x74], ebx
xor edi, edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], ebx
call fcn.0040b740
mov dword [ebp - 0x50], eax
test eax, eax
je 0x415b30
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415a51
sub eax, edx
lea esi, [eax + 0x40]
push esi
call fcn.0047a780
add esp, 4
mov ebx, eax
mov dword [ebp - 0x60], ebx
test ebx, ebx
je 0x415b30
mov eax, dword [ebp - 0x50]
push eax
push str.Version1.0MachineID_s
push esi
push ebx
call fcn.0047b592
add esp, 0x10
mov eax, ebx
lea edx, [eax + 1]
jmp 0x415a90
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415a90
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x4c]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415aa1
sub eax, esi
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push edx
push ebx
push eax
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x78]
push eax
call fcn.00414e90
push eax
mov edx, str._NotifyUninstall.php
mov ecx, str.POST
call fcn.00407f80
add esp, 0x24
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x415b30
push 0x400
call fcn.0047a780
add esp, 4
mov edi, eax
mov dword [ebp - 0x54], edi
test edi, edi
je 0x415b30
push 0x400
push 0
push edi
call fcn.0047d730
add esp, 0xc
lea ecx, [ebp - 0x68]
push ecx
push 0x3ff
push edi
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x415b29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x58], eax
jmp 0x415b30
mov eax, dword [ebp - 0x68]
mov byte [eax + edi], 0
mov dword [ebp - 4], 0xfffffffe
call fcn.00415b61
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0047a722
mov esp, ebp
pop ebp
ret
Function at 0x4162b0
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
xor eax, eax
push edi
xor ebp, ebp
push str.NewWhitelist
mov ecx, 0x49dbc0
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.0040bbe0
mov esi, eax
add esp, 4
cmp esi, ebp
jne 0x416319
mov edi, 0x49f4a8
call fcn.00415bd0
mov dword [esp + 0x18], eax
cmp eax, ebp
jne 0x416304
mov ebp, 8
jmp 0x416489
mov ebx, eax
call fcn.0040c3a0
mov esi, eax
test esi, esi
jne 0x416319
lea ebp, [eax + 8]
jmp 0x416489
push 0
push 0
push 4
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x416349
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebp, eax
push str._Create_file_failed__filename__S._Error_code
jmp 0x41642e
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416350
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push str.NewWhitelist
push reloc.OLEAUT32.dll_SysReAllocString
xor ecx, ecx
mov edx, 0x49dbc0
call fcn.0040b7f0
add esp, 0x14
push 2
xor ecx, ecx
push ecx
push ecx
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.0040c1c0
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
push 0
push 0x416040
push 0
push 0
lea ecx, [esp + 0x3c]
push ecx
push 1
push eax
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x4c], str._whitelistmissing.txt
mov byte [esp + 0x45], 0
mov byte [esp + 0x44], 1
call fcn.00405530
add esp, 0x30
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00407520
add esp, 4
or eax, edx
jne 0x416404
push str.No_new_sample_file_from_this_machine._r_n
call fcn.0040a210
add esp, 4
jmp 0x416437
mov ebx, 0x1388
call fcn.00409b80
call fcn.00417420
mov ebp, eax
push esi
test ebp, ebp
jne 0x416429
push str.Server_has_been_notified_about_the_sample_files_that_is_available_at_this_client._File:___s_._r_n
call fcn.0040a210
add esp, 8
jmp 0x416437
push str._Unable_to_notify_the_server_the_information_about_the_sample_files_available_at_this_machine._File:___s_.
push ebp
call fcn.0040a310
add esp, 0xc
test esi, esi
je 0x416489
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x416464
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 2
je 0x416489
push esi
push str.Unable_to_delete:__s
push ebp
call fcn.0040a310
add esp, 0xc
jmp 0x416489
push str.NewWhitelist
mov ecx, 0x49dbc0
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040b9a0
add esp, 4
push esi
push str.Deleted:__s_r_n
call fcn.0040a210
add esp, 8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41649a
push eax
call fcn.0047a868
add esp, 4
test esi, esi
je 0x4164a7
push esi
call fcn.0047a868
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4165f0
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x228
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
push esi
xor ebp, ebp
push 0x208
mov esi, ecx
lea ecx, [esp + 0x22]
xor eax, eax
push ebp
push ecx
mov ebx, edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov word [esp + 0x28], ax
call fcn.0047d730
add esp, 0xc
push esi
mov dword [esp + 0x1c], ebp
call fcn.0040bfc0
push eax
push 0x4a0840
lea edx, [esp + 0x28]
call fcn.004012e0
add esp, 0xc
push ebp
lea edx, [esp + 0x20]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x41670f
push esi
call fcn.0040bfc0
push eax
push str._s_S.7z
push 0x105
push ebx
call fcn.0047a84a
add esp, 0x14
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004011a0
mov esi, dword [esp + 0x20]
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4166e3
push ebx
call fcn.00407520
add esp, 4
mov ebx, eax
or eax, edx
mov dword [esp + 0x10], edx
jne 0x4166f5
push edi
push str._Compress_failed__file:__S_r_n
call fcn.0040a210
add esp, 8
test esi, esi
je 0x4166f5
push str.__________________________________r_n
call fcn.0040a210
add esp, 4
push esi
push str._S_r_n
call fcn.0040a210
push str.__________________________________r_n
call fcn.0040a210
add esp, 0xc
jmp 0x4166f5
push str._Unable_to_compress_file.
push ebp
call fcn.0040a310
mov ebx, dword [esp + 0x14]
add esp, 8
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x416713
push esi
call fcn.0047a868
add esp, 4
jmp 0x416713
mov ebx, dword [esp + 0xc]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x10]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0047a722
add esp, 0x228
ret