joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401eee
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ecx
push ebp
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x401f1c
xor eax, eax
jmp 0x401f7a
push ebx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x401f6e
cmp esi, 0x40
jbe 0x401f6e
push edi
push esi
push edi
push 2
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
cmp ebp, edi
je 0x401f6e
push edi
push edi
push edi
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x401f6b
cmp word [edi], 0x5a4d
je 0x401f7e
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call ebx
xor esi, esi
push dword [esp + 0x10]
call ebx
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret
add esi, 0xffffffc0
push esi
lea edx, [edi + 0x40]
call fcn.00401ead
mov esi, eax
movzx eax, word [edi + 0x26]
pop ecx
movzx ecx, word [edi + 0x24]
shl eax, 0x10
or eax, ecx
sub esi, eax
neg esi
sbb esi, esi
push edi
inc esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call ebx
jmp 0x401f70
Function at 0x403e4b
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x403e53
mov eax, dword [esp + 0xc]
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x403e85
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc

Function at 0x403fc8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x41c0b0]
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 0x1a0]
mov ebx, ecx
push dword [ebx]
mov dword [ebp + 0x194], eax
xor esi, esi
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], esi
call fcn.00403ed3
mov edi, eax
cmp edi, esi
je 0x404018
cmp dword [ebp - 0x70], esi
je 0x404014
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x404082
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x404033
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00403fc8
cmp eax, esi
mov dword [ebp - 0x78], eax
jne 0x40409a
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x404020
cmp dword [ebp - 0x70], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x404066
push dword [ebp - 0x70]
call edi
mov dword [ebp - 0x70], esi
push dword [ebp + 0x1a0]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x70], esi
mov ebx, eax
je 0x404080
push dword [ebp - 0x70]
call edi
mov eax, ebx
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
pop ebx
call fcn.0040f439
add ebp, 0x198
leave
ret 4
cmp dword [ebp - 0x70], esi
je 0x4040a8
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x78]
jmp 0x404082

Function at 0x404433
Capabilities:
Get system information on windows

Disassembly:
push 0x3c
push 0x419ef8
call fcn.0040f448
mov ebx, ecx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
mov edi, eax
mov dword [ebp - 0x20], edi
and dword [ebx], 0
push 4
push 0x2000
shl eax, 0xa
push eax
push 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call esi
test eax, eax
je 0x4044d4
mov dword [ebp - 0x24], edi
push 4
push 0x1000
push edi
push eax
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4044d4
and dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.0040ec80
add esp, 0xc
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
mov dword [ebx], esi
jmp 0x4044d6
xor eax, eax
call fcn.0040f483
ret
Function at 0x40497f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push dword [esi]
xor edi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
or edx, 0xffffffff
cmp ecx, edx
jne 0x4049a2
mov eax, edx
jmp 0x4049d3
mov edx, dword [ebp - 4]
push ebx
xor ebx, ebx
xor eax, eax
or edx, ebx
or eax, ecx
cmp dword [esi + 0x20], edi
pop ebx
je 0x4049d3
cmp dword [esi + 0x14], edi
je 0x4049d3
mov ecx, dword [esi + 0x1c]
add ecx, dword [esi + 8]
push 0
pop edi
adc edi, dword [esi + 0xc]
cmp edx, edi
ja 0x4049d3
jb 0x4049cf
cmp eax, ecx
ja 0x4049d3
mov eax, ecx
mov edx, edi
pop edi
leave
ret

Function at 0x4049d6
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x18]
mov esi, eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 8]
call fcn.00404a60
test eax, eax
je 0x404a52
test byte [ebp + 0xf], 0x40
push ebx
jne 0x404a4e
push edi
lea eax, [ebp + 0xc]
push eax
push dword [esi]
xor edi, edi
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov ebx, eax
push ebx
push dword [ebp + 0xc]
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [ebp + 0x18], eax
je 0x404a40
push ebx
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp + 0x18]
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x2c]
cmp eax, edi
pop edi
je 0x404a57
mov dword [esi + 0x30], eax
mov dword [esi + 0x28], ebx
xor eax, eax
inc eax
pop ebx
pop esi
pop ebp
ret 0x14
call fcn.00404c0a
xor eax, eax
jmp 0x404a51

Function at 0x404b46
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x404b9f
cmp dword [esi + 0x14], edi
je 0x404b9c
cmp dword [esi + 0x1c], edi
je 0x404b9c
push dword [esi + 0xc]
push dword [esi + 8]
push esi
call fcn.00404ba5
and eax, edx
cmp eax, 0xffffffff
je 0x404b89
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0x1c]
mov dword [ebp - 4], edi
push dword [esi + 0x14]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404b8d
xor eax, eax
jmp 0x404ba2
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
adc dword [esi + 0xc], edi
mov dword [esi + 0x20], edi
xor eax, eax
inc eax
pop edi
leave
ret
Function at 0x406b1f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x406b3f
cmp word [eax], 0
je 0x406b3f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406b3f
and al, 0x10
sub al, 0x10
neg al
sbb eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x406b57
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x406b79
cmp word [eax], 0
je 0x406b79
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406b79
and al, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
mov eax, ecx
ret
xor eax, eax
ret

Function at 0x4072f0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x41d654], ebx
push esi
mov esi, eax
je 0x407307
call fcn.00407412
cmp esi, ebx
je 0x4073d5
cmp dword [esi], 0x18
jne 0x4073d5
push edi
push dword [esi + 8]
lea edi, [ebp - 4]
call fcn.004052ab
mov eax, dword [esi + 4]
cmp eax, ebx
mov edi, dword [ebp - 4]
jne 0x407339
push 0x10000000
push ebx
push ebx
push 1
jmp 0x4073b3
cmp eax, 1
je 0x4073ab
cmp dword [edi - 8], ebx
je 0x4073ab
push dword [esi + 0x10]
mov eax, 0x41d6f8
call fcn.0040169a
push dword [esi + 0x14]
mov eax, 0x41d6fc
call fcn.0040169a
push dword [esi + 0xc]
mov eax, dword [0x41cc20]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.httphttp:___s:_d
push eax
call fcn.00401945
mov esi, dword [ebp - 4]
add esp, 0x10
push 0x10000000
push str._local_
push esi
push 3
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [0x41d654], eax
lea eax, [esi - 0xc]
cmp eax, dword [0x41cc24]
je 0x4073c1
push eax
call fcn.0040172e
jmp 0x4073c1
push 0x10000000
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [0x41d654], eax
lea eax, [edi - 0xc]
cmp eax, dword [0x41cc24]
pop edi
je 0x4073eb
push eax
call fcn.0040172e
jmp 0x4073eb
push 0x10000000
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [0x41d654], eax
mov eax, dword [0x41d654]
pop esi
cmp eax, ebx
pop ebx
jne 0x4073fa
xor eax, eax
leave
ret
push 0x406ff1
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
leave
ret
Function at 0x407496
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
lea ebp, [esp - 0x794]
sub esp, 0x814
mov eax, dword [0x41c0b0]
push ebx
push esi
mov esi, ecx
mov dword [ebp + 0x790], eax
mov eax, dword [esi + 0x60]
push edi
xor edi, edi
cmp eax, edi
je 0x407647
cmp dword [esi + 0x6c], edi
je 0x407647
cmp dword [esi + 0x70], edi
je 0x407647
mov ebx, dword [sym.imp.WININET.dll_HttpQueryInfoW]
push edi
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push 0x20000013
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], 4
call ebx
test eax, eax
je 0x407647
mov eax, dword [ebp - 0x74]
cmp eax, 0x197
jne 0x407544
cmp dword [esi + 0x40], edi
jne 0x407593
mov eax, dword [0x41d6f8]
mov ecx, dword [eax - 8]
cmp ecx, edi
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionW]
je 0x40752e
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 0x2b
push dword [esi + 0x60]
call ebx
mov eax, dword [0x41d6fc]
mov ecx, dword [eax - 8]
cmp ecx, edi
je 0x407588
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 0x2c
jmp 0x407583
cmp eax, 0x191
jne 0x407593
cmp dword [esi + 0x40], edi
jne 0x407593
mov eax, dword [0x41d6f8]
mov ecx, dword [eax - 8]
cmp ecx, edi
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionW]
je 0x40756f
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 0x1c
push dword [esi + 0x60]
call ebx
mov eax, dword [0x41d6fc]
mov ecx, dword [eax - 8]
cmp ecx, edi
je 0x407588
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 0x1d
push dword [esi + 0x60]
call ebx
xor eax, eax
inc eax
mov dword [esi + 0x40], eax
jmp 0x407649
cmp eax, 0x190
mov dword [esi + 0x28], eax
jae 0x407647
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x20000005
push dword [esi + 0x60]
call ebx
test eax, eax
je 0x407647
mov ecx, dword [ebp - 0x74]
mov eax, dword [esi + 0x70]
mov dword [esi + 0x2c], ecx
mov edx, dword [eax + 0xc]
add edx, dword [eax + 4]
mov eax, dword [esi + 0x6c]
add edx, ecx
mov dword [eax + 0x10], edx
mov word [ebp - 0x70], di
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x6e]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
push 1
push dword [esi + 0x60]
mov dword [ebp - 0x7c], 0x400
call ebx
test eax, eax
je 0x407647
lea eax, [ebp - 0x70]
push eax
lea edi, [ebp - 0x80]
add esi, 0x30
call fcn.004052ab
call fcn.004058dc
mov edi, eax
mov eax, esi
call fcn.00401d75
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff4
cmp eax, dword [0x41cc24]
je 0x407632
push eax
call fcn.0040172e
push str.text
xor ecx, ecx
call fcn.00409649
test eax, eax
jge 0x407647
push 2
pop eax
jmp 0x407649
xor eax, eax
mov ecx, dword [ebp + 0x790]
pop edi
pop esi
pop ebx
call fcn.0040f439
add ebp, 0x794
leave
ret
Function at 0x40765f
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov eax, 0x2494
lea ebp, [esp - 0x2414]
call fcn.00412c80
mov eax, dword [0x41c0b0]
push ebx
xor ebx, ebx
cmp dword [0x41d654], ebx
mov dword [ebp + 0x2410], eax
push esi
je 0x4077e6
cmp dword [edi + 0x6c], ebx
je 0x4077e6
cmp dword [edi + 0x70], ebx
je 0x4077e6
mov esi, edi
call fcn.004077fd
push 0x10000000
push ebx
lea esi, [ebp - 0x78]
call fcn.0040abd3
mov eax, dword [edi + 0x6c]
mov eax, dword [eax + 4]
push 0x10000000
push eax
mov eax, esi
call fcn.0040ab6d
test eax, eax
je 0x4077e6
push ebx
push ebx
push 3
push dword [ebp - 0x54]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x68]
push dword [0x41d654]
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
mov dword [edi + 0x5c], eax
je 0x4077e6
lea eax, [ebp - 0x80]
push eax
mov eax, esi
call fcn.0040ab0d
mov esi, dword [eax]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
call fcn.0040aac8
mov eax, dword [eax]
push edi
push 0x84400200
push ebx
push esi
push ebx
push eax
push 0x419bd4
push dword [edi + 0x5c]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 0x60], eax
mov eax, dword [ebp - 0x7c]
add eax, 0xfffffff4
cmp eax, dword [0x41cc24]
je 0x40773f
push eax
call fcn.0040172e
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff4
cmp eax, dword [0x41cc24]
je 0x407753
push eax
call fcn.0040172e
cmp dword [edi + 0x60], ebx
je 0x4077e6
mov eax, dword [edi + 0x70]
mov ecx, dword [eax + 0xc]
add ecx, dword [eax + 4]
mov esi, dword [0x41cc20]
mov dword [ebp - 0x7c], esi
je 0x40778b
mov ecx, dword [eax + 0xc]
add ecx, dword [eax + 4]
lea eax, [ebp - 0x7c]
push ecx
push str.Range:_bytes_u__r_n
push eax
call fcn.00401945
mov esi, dword [ebp - 0x7c]
add esp, 0xc
mov eax, dword [esi - 8]
push ebx
push ebx
push eax
push esi
push dword [edi + 0x60]
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4077b5
lea eax, [esi - 0xc]
cmp eax, dword [0x41cc24]
je 0x4077b0
push eax
call fcn.0040172e
push 2
pop eax
jmp 0x4077e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
lea eax, [esi - 0xc]
jne 0x4077d8
cmp eax, dword [0x41cc24]
je 0x4077d3
push eax
call fcn.0040172e
xor eax, eax
inc eax
jmp 0x4077e8
cmp eax, dword [0x41cc24]
je 0x4077e6
push eax
call fcn.0040172e
xor eax, eax
mov ecx, dword [ebp + 0x2410]
pop esi
pop ebx
call fcn.0040f439
add ebp, 0x2414
leave
ret
Function at 0x407db4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [ebx + 0x20], 0
mov eax, dword [0x41c0b0]
push esi
push edi
mov dword [ebp - 4], eax
mov edi, ecx
je 0x407dd6
mov eax, ebx
call fcn.00407f31
mov esi, dword [edi + 4]
cmp esi, 1
mov dword [ebp - 0x214], esi
jge 0x407deb
xor eax, eax
jmp 0x407f23
push ebx
call fcn.0040827e
and dword [ebp - 0x210], 0
test esi, esi
jle 0x407e2d
mov esi, dword [ebp - 0x210]
call fcn.004096ac
push eax
lea eax, [ebx + 0xb0]
call fcn.00401484
inc dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x214]
jl 0x407dfc
mov esi, dword [ebp - 0x214]
cmp esi, dword [ebp + 0x18]
mov eax, dword [edi + 0x10]
mov dword [ebx + 0xc0], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0xc4], eax
jge 0x407e49
mov esi, dword [ebp + 0x18]
jmp 0x407e51
cmp esi, dword [ebp + 0x1c]
jle 0x407e51
mov esi, dword [ebp + 0x1c]
test esi, esi
jle 0x407e5f
mov edi, ebx
call fcn.00408016
dec esi
jne 0x407e55
push dword [ebp + 8]
xor eax, eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0xc8], eax
lea esi, [ebx + 0x3c]
mov eax, esi
call fcn.0040169a
lea eax, [ebx + 0x38]
call fcn.004019d0
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x74], eax
mov eax, dword [esi]
xor edi, edi
mov dword [ebx + 0x78], 1
cmp dword [eax - 8], edi
jne 0x407f03
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x78], edi
mov dword [ebp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x18], eax
mov word [ebp - 0x20c], di
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 0x18]
lea eax, [ebp - 0x20c]
push dword [ebp + 0x1c]
push eax
push str._sttcache__u__u
push esi
call fcn.00401945
add esp, 0x14
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
lea eax, [ebx + 0x20]
push eax
call esi
push edi
lea eax, [ebx + 0x24]
push eax
call esi
push edi
mov esi, ebx
call fcn.00407feb
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0040f439
leave
ret 0x18
Function at 0x408643
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x40866e
lea eax, [esi + 0x84]
mov ecx, dword [eax]
mov ecx, dword [ecx + 8]
cmp ecx, edi
je 0x408660
mov dword [ecx], edi
mov eax, dword [eax]
mov dword [eax + 0xc], 2
xor eax, eax
inc eax
jmp 0x4086c8
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov eax, dword [esi + 0x84]
mov dword [ebp - 4], edi
push dword [eax]
push dword [esi + 0x80]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x4086ad
mov ecx, dword [ebp - 4]
add dword [esi + 0x4c], ecx
mov ecx, dword [esi + 0x4c]
cmp ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x84]
sbb ecx, ecx
add ecx, 3
mov dword [edx + 0xc], ecx
jmp 0x4086b6
mov ecx, dword [esi + 0x84]
mov dword [ecx + 0xc], edi
mov ecx, dword [esi + 0x84]
mov ecx, dword [ecx + 8]
cmp ecx, edi
je 0x4086c8
mov edx, dword [ebp - 4]
mov dword [ecx], edx
pop edi
leave
ret 4

Function at 0x408a04
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
call fcn.0040877f
mov edi, ebx
call fcn.00408b77
cmp dword [ebx + 0x78], 0
je 0x408adb
lea esi, [ebx + 0x3c]
mov eax, dword [esi]
cmp dword [eax - 8], 0
je 0x408adb
call fcn.004084fc
test eax, eax
lea edi, [ebx + 0x38]
je 0x408abd
mov eax, dword [esi]
mov ecx, dword [edi]
push eax
push ecx
call fcn.0040ed6b
test eax, eax
pop ecx
pop ecx
je 0x408a86
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x408a71
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x408a86
push 0
push 0
lea eax, [ebx + 0xc0]
push eax
push dword [esi]
call fcn.0040a82e
add esp, 0x10
push str..xml
push esi
lea eax, [ebp - 4]
push eax
call fcn.004058f5
mov esi, dword [ebp - 4]
mov eax, esi
call fcn.00406b57
test eax, eax
je 0x408aaa
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0xc]
cmp eax, dword [0x41cc24]
je 0x408ae6
push eax
call fcn.0040172e
jmp 0x408ae6
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
mov ecx, esi
mov esi, esp
call fcn.00401671
mov eax, 0x41d698
call fcn.004054c4
jmp 0x408ae6
lea edi, [ebx + 0x38]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call fcn.004082cc
mov eax, edi
call fcn.004019d0
xor eax, eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x30]
call fcn.004019d0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409383
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x70]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6c]
inc dword [eax + 0x40]
or dword [eax + 0x38], 0xffffffff
mov ebx, ecx
mov eax, esi
call fcn.00408368
cmp dword [ebx + 0x20], 2
jne 0x40943d
push edi
push ebx
call fcn.004081d6
mov edi, eax
test edi, edi
je 0x4093d5
push dword [ebp - 4]
mov ecx, esi
call fcn.0040719b
mov eax, esi
call fcn.004072b5
mov dword [edi + 0x38], 2
jmp 0x40943c
call fcn.004084bd
test eax, eax
je 0x40943c
call fcn.0040848b
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4093f9
call edi
sub eax, dword [ebx + 0x54]
cmp eax, 0x3a98
jae 0x409410
mov eax, ebx
call fcn.0040877f
call fcn.00408530
mov eax, ebx
call fcn.004086cd
test eax, eax
jne 0x40943c
lea eax, [esi + 0x28]
lea esi, [ebx + 0x28]
call fcn.0040a7a2
call edi
mov ecx, eax
sub ecx, dword [ebx + 0x54]
xor eax, eax
inc eax
cmp ecx, eax
jb 0x40942e
call edi
sub eax, dword [ebx + 0x54]
and dword [ebx + 0x54], 0
mov dword [ebx + 0x5c], eax
mov eax, ebx
call fcn.004087ca
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ab6d
Capabilities:
Parse url

Disassembly:
push esi
mov esi, eax
push edi
push esi
push dword [esp + 0x14]
mov eax, 0x81
push 0
push dword [esp + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov eax, 0x801
mov dword [esi + 8], 0x21
mov dword [esi + 0x14], 0x101
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov edi, eax
test edi, edi
je 0x40abcc
push 0x3f
push dword [esp + 0x10]
call fcn.0040ef1e
test eax, eax
pop ecx
pop ecx
je 0x40abcc
push eax
add esi, 0x1486
push esi
call fcn.0040ef02
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x40aded
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40ba52
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x41c0b0]
push ebx
mov dword [ebp - 4], eax
mov ebx, ecx
mov eax, dword [ebx]
mov eax, dword [eax - 8]
cdq
push esi
sub eax, edx
mov esi, eax
push edi
lea eax, [ebp - 0x14]
push eax
lea edi, [ebp - 0x1c]
sar esi, 1
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x29
mov byte [ebp - 0xb], 0x25
mov byte [ebp - 0xa], 0x21
mov byte [ebp - 9], 0x24
mov byte [ebp - 8], 0
call fcn.0040bd0e
jmp 0x40bac0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040bc86
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 8], esi
jl 0x40bab3
mov eax, esi
lea ecx, [ebp - 0x1c]
call fcn.0040487c
mov eax, dword [0x41cc20]
mov dword [ebp - 0x18], eax
lea eax, [esi + 1]
lea ecx, [ebp - 0x18]
call fcn.004048e3
mov ecx, dword [ebx]
lea edi, [esi - 1]
test edi, edi
mov dword [ebp - 0x24], ecx
jl 0x40bb3e
mov ecx, eax
sub ecx, edi
lea ecx, [ecx + esi - 1]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x24]
mov al, byte [eax + edi*2]
call fcn.0040b8ed
mov bl, al
mov eax, dword [ebp - 0x24]
mov al, byte [eax + edi*2 + 1]
call fcn.0040b8ed
test bl, bl
jl 0x40bb3e
test al, al
jl 0x40bb3e
mov ecx, dword [ebp - 0x20]
shl bl, 4
add bl, al
mov eax, dword [ebp - 0x28]
xor bl, byte [ecx + eax]
dec edi
mov byte [eax], bl
inc eax
test edi, edi
mov dword [ebp - 0x28], eax
jge 0x40bb04
mov eax, esi
lea ecx, [ebp - 0x18]
call fcn.0040487c
lea eax, [ebp - 0x20]
push eax
push 0xd
pop eax
lea ecx, [ebp - 0x18]
call fcn.0040bbfa
mov eax, dword [eax]
push 0x419d58
push eax
call fcn.0040efd9
mov ebx, eax
mov eax, dword [ebp - 0x20]
neg ebx
sbb bl, bl
add eax, 0xfffffff4
pop ecx
inc bl
cmp eax, dword [0x41cc24]
pop ecx
je 0x40bb82
push eax
call fcn.0040172e
test bl, bl
je 0x40bbb8
push ecx
lea ecx, [ebp - 0x18]
mov esi, esp
call fcn.00405147
lea eax, [ebp - 0x20]
call fcn.0040b9e2
mov edi, eax
pop ecx
lea eax, [ebp - 0x18]
call fcn.00405104
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff4
cmp eax, dword [0x41cc24]
je 0x40bbb8
push eax
call fcn.0040172e
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00405147
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
cmp eax, dword [0x41cc24]
je 0x40bbd7
push eax
call fcn.0040172e
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff4
cmp eax, dword [0x41cc24]
je 0x40bbeb
push eax
call fcn.0040172e
mov ecx, dword [ebp - 4]
mov eax, esi
call fcn.0040f439
pop edi
pop esi
pop ebx
leave
ret