joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe24
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ffa3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x40ffb8
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004101e8
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov esi, eax
test esi, esi
jne 0x40fe7a
mov edx, 0x40ffc8
mov eax, ebx
call fcn.0040efc0
jmp 0x40ff86
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebx + 0x28]
push edx
push 1
push 3
push 1
push 0xf01ff
mov eax, dword [ebx + 0x20]
push eax
push eax
push esi
call sub.advapi32.dll_CreateServiceW
mov edi, eax
call sub.kernel32.dll_GetLastError
sub eax, 0x430
je 0x40fec2
dec eax
jne 0x40fed3
push 0xf01ff
mov eax, dword [ebx + 0x20]
push eax
push esi
call sub.advapi32.dll_OpenServiceW
mov edi, eax
jmp 0x40fed3
mov edx, 0x410054
mov eax, ebx
call fcn.0040efc0
jmp 0x40ff86
test edi, edi
jne 0x40fee8
mov edx, 0x4100d4
mov eax, ebx
call fcn.0040efc0
jmp 0x40ff86
lea eax, [ebp - 8]
push eax
push 0
push edi
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x40ff1e
call sub.kernel32.dll_GetLastError
cmp eax, 0x420
je 0x40ff1e
push edi
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
mov edx, 0x410118
mov eax, ebx
call fcn.0040efc0
jmp 0x40ff86
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 0x28]
call fcn.00406888
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x41015c
call fcn.004069e4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0040efc0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push 0x41017c
call sub.kernel32.dll_CreateFileW
mov dword [ebx + 0x18], eax
push edi
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebx + 0x18], 0xffffffff
jne 0x40ff82
mov edx, 0x41019c
mov eax, ebx
call fcn.0040efc0
jmp 0x40ff86
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ffaa
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406278
pop eax
jmp eax

Function at 0x4101e8
Capabilities:
Delete service
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
xor ebx, ebx
mov eax, dword [edi + 0x1c]
cmp eax, 0xffffffff
je 0x410207
push eax
call sub.kernel32.dll_CloseHandle
mov dword [edi + 0x1c], 0xffffffff
mov eax, dword [edi + 0x18]
cmp eax, 0xffffffff
je 0x41021c
push eax
call sub.kernel32.dll_CloseHandle
mov dword [edi + 0x18], 0xffffffff
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov esi, eax
test esi, esi
je 0x41025f
push 0xf01ff
mov eax, dword [edi + 0x20]
push eax
push esi
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
je 0x41024b
push esp
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_DeleteService
push ebx
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
mov bl, 1
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x410b4c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040630c
xor eax, eax
push ebp
push 0x410bbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00406868
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x410ba3
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410bc2
lea eax, [ebp - 4]
call fcn.00406218
pop eax
jmp eax
Function at 0x411368
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x411421
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x58], 2
mov eax, ebx
call fcn.0041167c
mov esi, eax
mov dword [ebx + 0x5c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], fcn.0041145c
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], 0x4115bc
mov byte [esi + 5], 0
mov eax, dword [ebx + 0x44]
call fcn.0040d840
mov edx, dword [ebx + 0x5c]
mov byte [edx + 4], al
xor eax, eax
mov dword [ebx + 0x60], eax
lea eax, [ebp - 8]
call fcn.0040abd0
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040ae2c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x28]
call fcn.0040cfe0
lea eax, [ebp - 0xc]
call fcn.00410a44
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x30]
call fcn.0040cfe0
mov eax, dword [ebx + 0x5c]
call fcn.0040fe24
mov eax, dword [ebx + 0x5c]
mov dl, 1
call fcn.0040fa10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411428
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406278
pop eax
jmp eax
Function at 0x41167c
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4118c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x24
call fcn.00404404
lea eax, [ebp - 0x34]
push eax
call sub.kernel32.dll_GetNativeSystemInfo
movzx eax, word [ebp - 0x34]
sub ax, 1
jb 0x411713
sub ax, 8
jne 0x41172f
mov eax, ebx
mov edx, 0x4118e4
call fcn.0041145c
mov dl, 1
mov eax, dword [0x40ee44]
call fcn.0041082c
mov esi, eax
jmp 0x41173d
mov eax, ebx
mov edx, 0x411920
call fcn.0041145c
mov dl, 1
mov eax, dword [0x40ed80]
call fcn.004107bc
mov esi, eax
jmp 0x41173d
mov eax, ebx
mov edx, 0x41195c
call fcn.0041145c
xor esi, esi
lea eax, [ebp - 0x78]
xor ecx, ecx
mov edx, 0x40
call fcn.00404404
mov dword [ebp - 0x78], 0x40
lea eax, [ebp - 0x78]
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
push 0
push 0x400
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
call fcn.00407604
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x41199c
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 8]
call fcn.0040a794
push dword [ebp - 0x88]
push 0x4119bc
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.004066e0
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
call fcn.004068e0
push dword [ebp - 0x80]
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x8c]
call fcn.004108f4
push dword [ebp - 0x8c]
push 0x4119d0
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00406a6c
mov edx, dword [ebp - 0x7c]
mov eax, ebx
call fcn.0041145c
lea eax, [ebp - 0x10]
push eax
call sub.kernel32.dll_GetPhysicallyInstalledSystemMemory
test eax, eax
je 0x411871
push 0x4119e0
lea edx, [ebp - 0x9c]
mov eax, dword [ebp - 0x10]
call fcn.0040a794
push dword [ebp - 0x9c]
push 0x4119bc
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.004066e0
mov edx, dword [ebp - 0x98]
lea eax, [ebp - 0x94]
call fcn.004068e0
push dword [ebp - 0x94]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0xa0]
call fcn.004108f4
push dword [ebp - 0xa0]
push 0x4119d0
lea eax, [ebp - 0x90]
mov edx, 3
call fcn.00406a6c
mov edx, dword [ebp - 0x90]
mov eax, ebx
call fcn.0041145c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4118d0
lea eax, [ebp - 0xa0]
call fcn.00406218
lea eax, [ebp - 0x9c]
mov edx, 2
call fcn.004062b0
lea eax, [ebp - 0x94]
mov edx, 3
call fcn.00406278
lea eax, [ebp - 0x88]
mov edx, 2
call fcn.004062b0
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.00406278
pop eax
jmp eax
Function at 0x403d77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407018]
jne 0x403d81
repz ret
jmp fcn.00404178
Function at 0x46be54
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x46be5c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x46c04e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x46c064
mov eax, esi
call fcn.00469be4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404870
lea ecx, [ebp - 0x10]
mov edx, 0x46c078
mov eax, esi
call fcn.00469be4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404870
lea ecx, [ebp - 0x14]
mov edx, 0x46c090
mov eax, esi
call fcn.00469be4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404870
lea ecx, [ebp - 0x18]
mov edx, 0x46c0ac
mov eax, esi
call fcn.00469be4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404870
lea ecx, [ebp - 0x1c]
mov edx, 0x46c0c8
mov eax, esi
call fcn.00469be4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404870
lea ecx, [ebp - 0x24]
mov edx, 0x46c0e0
mov eax, esi
call fcn.00469be4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408df0
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004091d0
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x46c0f8
mov eax, esi
call fcn.00469be4
mov eax, dword [ebp - 0x28]
call fcn.00468cfc
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x46c108
mov eax, esi
call fcn.00469be4
mov eax, dword [ebp - 0x2c]
call fcn.00468cfc
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x46c120
mov eax, esi
call fcn.00469be4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004091d0
inc eax
je 0x46bff1
lea ecx, [ebp - 0x34]
mov edx, 0x46c120
mov eax, esi
call fcn.00469be4
mov eax, dword [ebp - 0x34]
call fcn.00409194
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a7b4
fstp qword [ebp - 0x3c]
wait
call fcn.0040ab18
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x46c00c
lea ecx, [ebp - 0x40]
mov edx, 0x46c120
mov eax, esi
call fcn.00469be4
mov eax, dword [ebp - 0x40]
call fcn.00468cfc
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x46c130
mov eax, esi
call fcn.00469be4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404870
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c055
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404840
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404840
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push 0x44
lea eax, [esp + 0x14]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
lea edx, [esp]
push edx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x20
push 0
push 0
mov ecx, 5
mov word [esp + 0x5c], cx
mov ecx, dword [esp + 0x74]
push 0
push ecx
push 0
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x64], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x401078
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
add esp, 0x54
ret
xor al, al
add esp, 0x54
ret
Function at 0x4012f0
Capabilities:
Create http request
Reference http user-agent string

Disassembly:
push ebx
push ebp
push esi
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_93.0.4577.82_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, eax
test esi, esi
je 0x40133a
push edi
push 0
push 0
push 0
push 0
push str.http:__anduu.net_peinstall.php
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0x3e8
mov edi, eax
call ebx
push edi
call ebp
pop edi
push 0x3e8
call ebx
push esi
call ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x401350
Capabilities:
Check if file exists
Query environment variable

Disassembly:
sub esp, 0x410
push 0x104
lea eax, [esp + 0x20c]
push eax
push str._temp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x208]
push ecx
lea edx, [esp + 4]
push str._s33573537.jpg
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4013a0
xor al, al
add esp, 0x410
ret
push 0
push 2
push 1
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4013c6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add esp, 0x410
ret
Function at 0x4014a0
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aec02
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x98], eax
mov esi, edx
mov dword [ebx], eax
lea ecx, [eax + 0xf]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], eax
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], 0x3e000000
mov dword [ebp - 0x60], 0x3f000000
mov dword [ebp - 0x5c], 0x37363534
mov dword [ebp - 0x58], 0x3b3a3938
mov dword [ebp - 0x54], 0x3d3c
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0x2010000
mov dword [ebp - 0x48], 0x6050403
mov dword [ebp - 0x44], 0xa090807
mov dword [ebp - 0x40], 0xe0d0c0b
mov dword [ebp - 0x3c], 0x1211100f
mov dword [ebp - 0x38], 0x16151413
mov dword [ebp - 0x34], 0x191817
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x1c1b1a00
mov dword [ebp - 0x28], 0x201f1e1d
mov dword [ebp - 0x24], 0x24232221
mov dword [ebp - 0x20], 0x28272625
mov dword [ebp - 0x1c], 0x2c2b2a29
mov dword [ebp - 0x18], 0x302f2e2d
mov word [ebp - 0x14], 0x3231
mov byte [ebp - 0x12], 0x33
mov byte [esi], al
xor ecx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x90], ecx
cmp dword [ebp + 8], eax
jle 0x401693
nop
cmp ecx, 0x8c4c
jne 0x4015d5
push str.debug
call fcn.004792f4
add esp, 4
mov al, byte [edi]
cmp al, 0xd
je 0x40167d
cmp al, 0xa
je 0x40167d
movsx ecx, byte [edi + 1]
movsx edx, byte [ebp + ecx - 0x8c]
mov ecx, dword [ebp - 0x94]
movsx eax, al
movsx esi, byte [ebp + eax - 0x8c]
shl edx, 0xc
shl esi, 0x12
add esi, edx
mov eax, esi
sar eax, 0x10
push eax
push 1
add edi, 2
call fcn.00402ab0
inc dword [ebx]
mov al, byte [edi]
cmp al, 0x3d
je 0x40166e
movsx ecx, al
movsx edx, byte [ebp + ecx - 0x8c]
mov ecx, dword [ebp - 0x94]
shl edx, 6
add esi, edx
mov eax, esi
sar eax, 8
push eax
push 1
inc edi
call fcn.00402ab0
inc dword [ebx]
mov al, byte [edi]
cmp al, 0x3d
je 0x40166e
movsx ecx, al
movsx edx, byte [ebp + ecx - 0x8c]
mov ecx, dword [ebp - 0x94]
add esi, edx
push esi
push 1
inc edi
call fcn.00402ab0
inc dword [ebx]
add dword [ebp - 0x90], 4
mov esi, dword [ebp - 0x94]
jmp 0x401684
inc edi
inc dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
cmp ecx, dword [ebp + 8]
jl 0x4015c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478c25
mov esp, ebp
pop ebp
ret 4
Function at 0x401f00
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aebb9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x629214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], esi
mov byte [ebx], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], 1
cmp ecx, dword [ebp + 0x10]
jae 0x402023
mov al, byte [ecx]
cmp al, 0x20
jbe 0x401fbe
movzx eax, al
mov al, byte [eax + 0x62b500]
test al, 0xc0
jne 0x401fc7
mov byte [ebp + esi - 0x10], al
inc esi
cmp esi, 4
jne 0x401fbe
mov ecx, dword [ebp - 0x10]
movzx edi, ch
movzx ecx, cl
add ecx, ecx
mov eax, edi
add ecx, ecx
shr eax, 4
or eax, ecx
push eax
push 1
mov ecx, ebx
call fcn.00402ab0
movzx esi, byte [ebp - 0xe]
mov eax, esi
shr eax, 2
shl edi, 4
or eax, edi
push eax
push 1
mov ecx, ebx
call fcn.00402ab0
movzx edx, byte [ebp - 0xd]
shl esi, 6
or esi, edx
push esi
push 1
mov ecx, ebx
call fcn.00402ab0
mov ecx, dword [ebp + 0xc]
xor esi, esi
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp + 0x10]
jb 0x401f53
cmp esi, 2
jl 0x402023
mov ecx, dword [ebp - 0x10]
movzx eax, ch
movzx ecx, cl
add ecx, ecx
mov dword [ebp + 0xc], eax
add ecx, ecx
shr eax, 4
or eax, ecx
push eax
push 1
mov ecx, ebx
call fcn.00402ab0
cmp esi, 3
jl 0x402023
movzx edi, byte [ebp - 0xe]
mov ecx, dword [ebp + 0xc]
mov eax, edi
shl ecx, 4
shr eax, 2
or eax, ecx
push eax
push 1
mov ecx, ebx
call fcn.00402ab0
cmp esi, 4
jl 0x402023
movzx edx, byte [ebp - 0xd]
shl edi, 6
or edi, edx
push edi
push 1
mov ecx, ebx
call fcn.00402ab0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403470
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x802]
push ecx
mov word [ebp - 0x804], ax
call fcn.0047b9a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.cache_
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0047965b
add esp, 0xc
lea edx, [ebp - 0x804]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4034fa
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.updater.log
lea ecx, [ebp - 0x804]
push 0x400
push ecx
call fcn.0047965b
lea edx, [ebp - 0x804]
push 0x61858c
push edx
call fcn.0047978e
add esp, 0x14
push 0x630464
mov dword [0x630460], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x630460
call fcn.00478c25
mov esp, ebp
pop ebp
ret
Function at 0x403590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x3f
lea eax, [ebp - 0x47]
push 0
push eax
mov byte [ebp - 0x48], 0
call fcn.0047b9a0
xor eax, eax
add esp, 0xc
lea edx, [ebp - 0x458]
xor ecx, ecx
push edx
mov word [ebp - 0x458], cx
mov dword [ebp - 0x456], eax
mov dword [ebp - 0x452], eax
mov dword [ebp - 0x44e], eax
mov word [ebp - 0x44a], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x44a]
movzx ecx, word [ebp - 0x44c]
movzx edx, word [ebp - 0x44e]
push eax
movzx eax, word [ebp - 0x450]
push ecx
movzx ecx, word [ebp - 0x452]
push edx
movzx edx, word [ebp - 0x456]
push eax
movzx eax, word [ebp - 0x458]
push ecx
push edx
push eax
push str._02hd_02hd_02hd__02hd_02hd_02hd__02hd:
lea ecx, [ebp - 0x48]
push 0x3f
push ecx
call fcn.00479926
push 0x3ff
lea edx, [ebp - 0x447]
push 0
push edx
mov byte [ebp - 0x448], 0
call fcn.0047b9a0
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x448]
push 0x400
push edx
call fcn.004888ff
mov edi, eax
add esp, 0x48
test edi, edi
jle 0x403707
lea eax, [esi + 4]
push eax
mov dword [ebp - 0x45c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esi]
test edx, edx
je 0x4036fa
lea eax, [ebp - 0x48]
lea ecx, [eax + 1]
mov dword [ebp - 0x460], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403695
sub eax, dword [ebp - 0x460]
push edx
push eax
lea edx, [ebp - 0x48]
push 1
push edx
call fcn.00479b48
add esp, 0x10
cmp dword [ebp + 8], 1
jne 0x4036cc
mov eax, dword [esi]
push eax
push 7
push 1
push str._ERROR_
call fcn.00479b48
add esp, 0x10
mov ecx, dword [esi]
push ecx
push edi
lea edx, [ebp - 0x448]
push 1
push edx
call fcn.00479b48
mov eax, dword [esi]
push eax
push 1
push 1
push 0x6185c4
call fcn.00479b48
mov ecx, dword [esi]
push ecx
call fcn.00479d4c
add esp, 0x24
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00478c25
mov esp, ebp
pop ebp
ret
Function at 0x404a50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp dword [eax + 0x14], 8
push esi
jb 0x404a5b
mov ecx, dword [eax]
jmp 0x404a5d
mov ecx, eax
mov edx, dword [eax + 0x10]
lea edx, [ecx + edx*2]
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x404a82
lea esp, [esp]
movzx esi, word [ecx]
imul eax, eax, 0x1000193
add ecx, 2
xor eax, esi
cmp ecx, edx
jne 0x404a70
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.00479e96
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x404aac
add eax, 0x7fffffff
pop esi
ret

Function at 0x406420
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad111
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
push str.cacheupdate_temp_silent.denied
lea ecx, [ebp - 0x19c]
mov byte [esi], 0
call fcn.0043db1b
mov edi, eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 4], 0
call fcn.004383f8
add esp, 4
push edi
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0043db64
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 3
call fcn.0043d597
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 4
call fcn.0043d597
lea ecx, [ebp - 0x94]
call fcn.00477dc0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4064c3
mov byte [esi], 1
push 0x61858c
lea ecx, [ebp - 0x94]
call fcn.00477dc0
push eax
call fcn.0047978e
add esp, 8
test eax, eax
je 0x4064e9
push eax
call fcn.00479f11
add esp, 4
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0043d597
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478c25
mov esp, ebp
pop ebp
ret

Function at 0x406520
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad111
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x629214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
push str.cacheupdate_temp_silent.denied
lea ecx, [ebp - 0x19c]
call fcn.0043db1b
mov esi, eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 4], 0
call fcn.004383f8
add esp, 4
push esi
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0043db64
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 3
call fcn.0043d597
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 4
call fcn.0043d597
lea ecx, [ebp - 0x94]
call fcn.00477dc0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4065cf
lea ecx, [ebp - 0x94]
call fcn.00477dc0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.0043d597
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478c25
mov esp, ebp
pop ebp
ret