joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d48d2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x6d48d2ef
pop dword [ebp - 0x38]
mov eax, 0xfb6e895a
sub eax, 0x8e25b66b
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x25555454
sub dword [ebp - 0x48], 0xd7030f09
mov dword [ebp - 0x44], 0xc2b92613
add dword [ebp - 0x44], 0x6f7a2632
mov dword [ebp - 0x40], 0xd2587c4f
sub dword [ebp - 0x40], 0x860c3821
mov dword [ebp - 0x3c], 0xd4db2eae
sub dword [ebp - 0x3c], 0xd4db2eae
lea eax, [ebp - 0x48]
push eax
mov eax, 0x51117b01
add eax, 0x1c37b61f
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x39a38200
add dword [ebp - 0x48], 0x3acee756
mov dword [ebp - 0x44], 0xa64e585d
sub dword [ebp - 0x44], 0x64e1f6e8
mov dword [ebp - 0x40], 0x2f74633b
sub dword [ebp - 0x40], 0xcc04f6cf
mov dword [ebp - 0x3c], 0x83572de6
sub dword [ebp - 0x3c], 0x83572de6
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xc0c346be
sub eax, 0x537a15a2
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x37b95
push 0
call eax
mov ecx, 0x4e9abaf9
sub ecx, 0x4e9a72a5
xor esi, esi
add esi, eax
mov edx, 0x6d49f400
add edx, dword [ebp - 0x38]
mov edi, 0xf74a9d7f
add edi, 0xde0ec54a
xor dword [ebp - 0x10], 0x483e88e5
mov ebx, dword [edx]
add dword [ebp - 0xc], edi
add ebx, edi
xor dword [ebp - 0x30], 0x86e52a55
mov dword [esi], ebx
add esi, 0x1b492909
sub esi, 0x1b492905
add edx, 0xf61d0185
add edx, 0x9e2fe7f
loop 0x6d48d40d
add eax, 0x11423
mov ebx, eax
add eax, 0x5d53c2d0
sub eax, 0x5d53c2cb
mov ecx, 0xb21a8c96
sub ecx, 0x44d28c96
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x6d491820
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d49bb70]
jne 0x6d49182a
repz ret
jmp fcn.6d491dab
Function at 0x30019b3c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.300163e5
xor ebx, ebx
cmp dword [0x30022154], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x30019c11
push 0x30002dd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x30019b7c
xor eax, eax
jmp 0x30019cd5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x30002dc4
push edi
call esi
cmp eax, ebx
je 0x30019b75
push eax
call fcn.30016382
mov dword [esp], 0x30002db4
push edi
mov dword [0x30022154], eax
call esi
push eax
call fcn.30016382
mov dword [esp], 0x30002da0
push edi
mov dword [0x30022158], eax
call esi
push eax
call fcn.30016382
mov dword [0x3002215c], eax
lea eax, [ebp - 8]
push eax
call fcn.30015694
test eax, eax
pop ecx
pop ecx
je 0x30019bdf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.30018a15
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x30019c11
push 0x30002d84
push edi
call esi
push eax
call fcn.30016382
cmp eax, ebx
pop ecx
mov dword [0x30022164], eax
je 0x30019c11
push 0x30002d6c
push edi
call esi
push eax
call fcn.30016382
pop ecx
mov dword [0x30022160], eax
mov eax, dword [0x30022160]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x30019c8a
cmp dword [0x30022164], esi
je 0x30019c8a
push eax
call fcn.300163ee
pop ecx
call eax
cmp eax, ebx
je 0x30019c57
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x30022164]
call fcn.300163ee
pop ecx
call eax
test eax, eax
je 0x30019c57
test byte [ebp - 0x18], 1
jne 0x30019c8a
lea eax, [ebp - 0xc]
push eax
call fcn.300156cb
test eax, eax
pop ecx
je 0x30019c72
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.30018a15
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x30019c81
or dword [ebp + 0x10], 0x200000
jmp 0x30019cbb
or dword [ebp + 0x10], 0x40000
jmp 0x30019cbb
mov eax, dword [0x30022158]
cmp eax, esi
je 0x30019cbb
push eax
call fcn.300163ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x30019cbb
mov eax, dword [0x3002215c]
cmp eax, esi
je 0x30019cbb
push dword [ebp - 4]
push eax
call fcn.300163ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x30022154]
call fcn.300163ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x52e988
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x52e999
lcall 0x5de5, 0x8b10c483
jmp loc.01037a50

Function at 0x52e999
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x52e999
lcall 0x5de5, 0x8b10c483
jmp loc.01037a50
Function at 0x5a98b6
Capabilities:
Encode data using xor

Disassembly:
iretd
sar byte [eax], cl
cwde
aas
jne 0x5a97c7
hlt
mul byte [edi + edx*2 + 0x37]
jle 0x5a989a
pushal
invalid
cld
movsb byte es:[edi], byte [esi]
fldcw word es:[0x55949981]
in eax, 0x99
pop edx
jbe 0x5a9812
sbb eax, 0x2f38790f
les ebp, [0x3a7a975d]
ret 0x3fc0
cmp al, dl
sar byte [edi], 0x27
xchg esp, eax
pop eax
jb 0x5a982e
cmp eax, 0x25e0aea7
add esp, dword [ecx + 0x43d3c513]
push cs
push ds
insb byte es:[edi], dx
sub eax, 0x53946d95
xor eax, 0x637b7620
jle 0x5a9842
outsd dx, dword [esi]
push ss
adc ecx, dword [ebx]
push edi
ja 0x5a9836
invalid
out 0x4a, eax
out 0x8f, eax
iretd
mov edi, 0x4e62e2ea
fcompi st(5)
adc eax, 0x9c27f411
xchg dword [eax - 0x19], eax
mov edi, 0xb675a18
invalid
inc esp
adc eax, ebx
rcl byte [edi - 0x51]
das
jl 0x5a984e
mov ah, byte [esi - 0x4766ed45]
fistp word [ebp + 0x455a46eb]
adc eax, 0xc82d6950
mov edx, 0x4f3ce275
jno 0x5a988e
invalid

Function at 0x5bd12c
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x16
inc esi
outsb dx, byte [esi]
sahf
outsd dx, dword [esi]
fxam
pop eax
aam 0xce
into
jb 0x5bd0f5
inc edi
inc esi
xchg dword [ebx + 0x4a], ebx
xor al, 0x77
outsb dx, byte [esi]
pop ecx
sub ah, dh
xchg esp, eax
aad 0x23
mov byte [0xf399e1d7], al
sub bh, dh
cmp ah, cl
jno 0x5bd0c7
lodsd eax, dword [esi]
pop ss
push ebp
sti
xor al, 0xd1
cmpsb byte [esi], byte es:[edi]
pop ecx
not byte [esi - 0x13044ead]
in al, dx
ljmp 0x72d6:0x9bc10629
push es
sbb bh, byte [ecx + edx*8 + 0x2794c92a]
xchg dl, ah
movsd dword es:[edi], dword [esi]
jb 0x5bd0cc
imul ebx, dword [ebx + 0x5a], 0xffffff87
inc edi
push ds
jecxz 0x5bd0c2
inc edi
adc edx, dword [edi]
jecxz 0x5bd144
lcall 0x7ef9, 0x5f52a812
xor al, 0x13
lds ebx, [ebx]
salc
xlatb
xchg ebx, eax
add eax, 0xb689764f
inc edx
popfd
xor dword [ebx + 0x271ff5b1], edx
push ecx
das
xchg edi, eax
adc dl, 0xa8
mov ebp, 0x2dd70546
mov ah, 0x3e
invalid

Function at 0x5e7af0
Capabilities:
Encode data using xor

Disassembly:
aam 0x52
push esi
mov al, 0x47
mov ebp, 0x5e882ec1
popfd
inc esp
test esi, esp
std
Function at 0x5e9e36
Capabilities:
Encode data using xor

Disassembly:
and byte [ebx + edi - 0x290b39ec], dh
push esp
xor dword [edx + 0x2b16f91c], ecx
stc
sbb al, 0xf9
push ss
sub edi, ecx
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
aad 0x21
aad 0x52
mov ebp, 0x27d5355b
in eax, dx
xor al, 0xd1
push edi
pop ss
xchg ecx, eax
xor eax, 0xaa77f5f7
in eax, 6
ja 0x5e9d1b
sub al, 0xc
adc ebx, dword [esi + 0x37]
or al, bl
scasb al, byte es:[edi]
shr byte [edx - 0x6219a9c4], 1
ret 0xf7a4
insd dword es:[edi], dx
insd dword es:[edi], dx
cmp dword [ecx - 0x3844bb79], esi
js 0x5e9d16
daa
cmp dword [esi - 0x6973a953], esp
imul bp, word [ebx], 0x35
pop ebx
aaa
pushfd
or dh, byte [bx - 0x7a]
inc ebp
mov al, 0x47
fisubr dword [ebx + 0x48]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x2994da63]
xchg dword [eax], edi
int1
mov byte [0xd01bbc5e], al
and eax, 0x64966d56
jne 0x5e9d0c
rcl dword [ebp - 0x7cff82d9]
ja 0x5e9d96
dec ecx
aam 0xa1
aam 0xa1
out 0x4e, eax
test bh, ch
mov cl, 0xb2
push esi
out dx, al
push ss
xchg esi, eax
lodsd eax, dword [esi]
add ebx, esp
jbe 0x5e9ddf
neg byte [edi + 0xc]
inc edi
pop edi
or al, 0x47
sub dword [ecx + 0x21], esi
xchg esi, ebp
out 0xc8, eax
jnp 0x5e9da9
stosb byte es:[edi], al
invalid
cwd
mov ecx, 0xc598b5a9
xchg ebx, eax
mov bh, 0x23
daa
daa
fadd dword [ecx]
xlatb
jbe 0x5e9d92
xlatb
and eax, 0xa683777a
ja 0x5e9d54
cmpsb byte [esi], byte es:[edi]
and al, 0x97
fistp word [ebx - 0x15c7249c]
xor cl, bl
pushfd
loop 0x5e9dba
popfd
movsd dword es:[edi], dword [esi]
push es
jnp 0x5e9d85
mov cl, 0xb6
cwde
salc
lodsb al, byte [esi]
cdq
push esi
salc
imul esi, dword [esi], 0x76
xchg esp, eax
xchg esp, eax
not dword [esi + 0x23efb8fc]
invalid
push ss
bound edx, qword es:[ecx - 0x1cb8b9c8]
fbstp tbyte [esi + 0x42]
adc dh, byte [esi - 0x72d45069]
jg 0x5e9dcf
inc ebp
xchg esi, eax
push esi
cmp ah, byte [ebx - 0x276c11eb]
aam 0x2e
mov al, 0x36
sub word [ebp + 0x758986e6], cx
push edi
lahf
cmp eax, ebx
ret
invalid
Function at 0x5ec380
Capabilities:
Encode data using xor

Disassembly:
inc edi
add ch, cl
or byte [edi], 0x68
or byte [edi], dh
push ecx
aas
lcall 0xe1cb, 0x95ca9226
pop ebx
into
xchg al, bl
dec esp
adc eax, 0xdbfdaf03
jae 0x5ec378
add byte [ecx + esi*8 + 0x51b716bc], ah
outsb dx, byte [esi]
cmp al, 0xbe
mov es, word [ebp - 0x42f5816d]
dec esi
in al, 0x9c
adc edx, edx
xchg byte [edi - 0x47caa7], bh
jmp 0xc619dca0
sbb dword [ebx - 0x7af90b3b], edi
and eax, 0xb706b311
and al, 0x17
push ss
cmpsb byte [esi], byte es:[edi]
aam 0x29
idiv dword [edx + 0x4ee33628]
mov dh, 0x57
mov cl, 0xc2
mov ss, word [ebp + 0x3b]
loop 0x5ec398
pop ss
pop ss
sbb byte [eax + 0x2b320f71], ah
dec edi
daa
jecxz 0x5ec3cb
loopne 0x5ec324
mov ah, 0xd6
mov al, byte [0x4cfacadb]
xor ebx, esi
lodsd eax, dword [esi]
dec esi
call edi
jbe 0x5ec361
xchg ecx, eax
sti
out 0x37, al
xchg esi, eax
xchg ebp, eax
pop edi
push ds
mov ah, 0xf1
jno 0x5ec41f
cmpsb byte [esi], byte es:[edi]
push esi
sub dword [ebp - 0x5ec998f5], esi
les esp, [eax - 0x2a]
jae 0x5ec398
ret
and esp, dword [edi]
xor byte [edx], bh
and al, 0xc9
inc esi
sub dl, dl
jmp 0x8c6ff35f
leave
cld
cmp dword ds:[ebp - 0x2a], ebp
xchg dword [edx - 0x1f5b2ffc], eax
cmp eax, 0x9cdcb174
sbb al, 0x60
pop ss
les esi, [edx + 0x2a]
adc dword [edx], esp
pop eax
and ecx, dword [ebp + 0x18]
xor ecx, dword [edx - 0x1330e2f1]
or ebx, dword [ebx]
je 0x5ec3d2
fcomp qword [esp + ebx + 0x72c41760]
sub dl, byte [ecx]
and bl, byte [eax + 0x23]
dec ebp
sbb byte [ebx], dh
mov cl, byte [edi]
sbb eax, 0x1b0beccf
cmpsd dword [esi], dword es:[edi]
js 0x5ec412
shl byte [eax - 0x41], cl
mov esi, dword [edx + 0x3846af1f]
cli
mov ecx, 0xaee74cd9
push 0x37
push ebx
cmp bl, byte [ebp + 0x63]
cmpsd dword [esi], dword es:[edi]
add bh, byte [ebx - 0x20190701]
test al, 0x85
lea esi, [0x648d6083]
cwde
push cs
popal
and al, 0xba
mov eax, 0xaba17382
ljmp 0xd68f

Function at 0x5fef4c
Capabilities:
Packed with generic packer

Disassembly:
push ss
pop eax
push eax
inc edi
pushal
or byte [ecx], bh
sbb dword [esi + 0x57], esp
fcmovb st(0), st(1)
invalid
Function at 0x616d3c
Capabilities:
Encode data using xor

Disassembly:
adc esi, edi
xor byte [ebx], 0xf8
test byte [edi + 0x6c], 0xf7
adc dword [ecx + 0x6a2ac2bb], edx
hlt
jbe 0x616ccb
cmp dword [esi - 0x49], ebx
sub al, 0x8d
aam 0x17
dec ebp
bound eax, qword [ebx + 0x18ee8cdd]
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
cwde
pop ecx
mov eax, dword [0x9c6bb18d]
inc edi
mov ah, 0x9d
mov edi, 0x6b8e93a5
pop esi
mov byte [0xf8a7cd11], al
or ebp, edi
faddp st(6)
out dx, eax
inc ebp
sub al, 0x8a
sal byte [edi + ecx*8], 1
cmp ecx, dword [edi]
sal ecx, cl
lds edi, [edi + 0x4d48e971]
test al, 0x7d
jb 0x616d34
imul edx, dword [ebx + 0x70], 0xffffff82
mov al, ch
or ch, ah
cmpsb byte [esi], byte es:[edi]
jae 0x616d32
jge 0x616df5
imul ebx, dword [edx - 0x4a09e04b], 0x3ce651d7
mov al, 0x90
mov ebp, 0xd58524a8
sbb edi, dword [eax - 0x14]
cmp al, 0x9b
mov edi, 0x98bb4b8c
cmp ebx, dword [ebp - 0x72]
mov eax, dword [0x11deb3f7]
loope 0x616de3
clc
fcomp dword [edx]
pop ss
imul esi, dword [ebp + esi*4 - 0x72], 0x83794655
mov al, byte [0xff1f85d8]
invalid
invalid
dec esp
js 0x616dd6
xor bh, bh
dec ecx
mov edi, 0x3a3d1f6a
mov edi, 0x9d1fb62a
sahf
fidiv dword [edx + 0x73]
jb 0x616e6a
movsb byte es:[edi], byte [esi]
ficom word [ecx - 0x52]
xor ch, cl
mov word [ebx + 0x19], gs
outsd dx, dword fs:[esi]
adc eax, 0xe9976709
mov al, byte [0x72ff770e]
jno 0x616de8
sti
mov byte [eax], bl
pop ebx
inc ax
hlt
popfd
jne 0x616eb7
push edx
outsd dx, dword [esi]
mov byte [ecx], ch
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
in eax, 0xc8
sbb dword [edi - 0x1c], esi
outsd dx, dword [esi]
int3
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x491d1184]
mov ah, 0x2d
pop ebx
iretd
Function at 0x402280
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0x14
mov eax, 0x458d98
call fcn.00434ba0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x476984
push 1
push 0
push 0x4769a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x40239b
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
and dword [ebp - 0x18], 0
push edx
push 0x476994
mov ecx, dword [eax]
push eax
call dword [ecx]
mov ebx, eax
test ebx, ebx
js 0x402392
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.004178dd
mov eax, dword [ebp - 0x10]
xor ebx, ebx
push dword [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [ebp + 0x14], ebx
je 0x402318
push dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
call fcn.004178dd
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0040665e
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040665e
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
call fcn.004178dd
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040665e
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.004178dd
mov eax, dword [ebp - 0x18]
push 1
push dword [ebp - 0x20]
mov dword [ebp - 4], 3
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
mov ebx, eax
call fcn.0040665e
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
not ebx
shr ebx, 0x1f
mov al, bl
call fcn.00434b69
ret
Function at 0x402772
Capabilities:
Get file version info

Disassembly:
push ebp
sub esp, 0x80
lea ebp, [esp - 4]
mov eax, dword [0x48d0e4]
xor eax, ebp
mov dword [ebp + 0x80], eax
push 0x18
mov eax, 0x458e3b
call fcn.00434ba0
mov eax, dword [ebp + 0x8c]
lea ecx, [ebp - 0x14]
xor ebx, ebx
push eax
mov esi, ebx
call fcn.004178dd
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x14]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40286c
push eax
call fcn.00434b4a
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x14]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x402863
lea eax, [ebp]
push str.VarFileInfoTranslation
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402863
cmp dword [ebp - 0x18], 4
jb 0x402863
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
lea eax, [ebp]
push str.StringFileInfo_04x_04xProductVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402863
mov eax, dword [ebp - 0x10]
inc eax
push eax
call fcn.0043a2b9
mov ecx, dword [ebp - 0x10]
mov esi, eax
mov byte [ecx + esi], bl
push dword [ebp - 0x10]
push dword [ebp - 0x20]
push esi
call fcn.00439010
add esp, 0x10
push edi
call fcn.00434b53
pop ecx
mov ebx, esi
lea ecx, [ebp - 0x14]
call fcn.0040665e
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.00434b58
lea esp, [ebp + 0x84]
pop ebp
ret
Function at 0x402c43
Capabilities:
Check http status code
Create http request
Download and write a file
Get http content length
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov eax, 0x4020
call fcn.00434c80
mov eax, dword [0x48d0e4]
xor eax, esp
mov dword [esp + 0x401c], eax
mov eax, dword [esp + 0x4028]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4030]
push edi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0x32
pop edi
xor ebx, ebx
xor eax, eax
push ebx
push ebx
push ebx
inc eax
push ebx
push str.SpotifyInstaller_1.0
mov dword [esp + 0x34], eax
mov byte [0x4948b8], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
test ebp, ebp
jne 0x402ca8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x402de7
push ebx
push 0x80000200
push ebx
push ebx
push esi
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
jne 0x402ccc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x34
pop edi
jmp 0x402de0
and dword [esp + 0x18], 0
lea eax, [esp + 0x10]
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
push 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 4
push eax
push 0x20000005
push ebx
call esi
and dword [esp + 0x1c], 0
lea eax, [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 4
push eax
push 0x20000013
push ebx
call esi
cmp dword [esp + 0x1c], 0xc8
je 0x402d25
push 0x33
jmp 0x402dd8
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [0x4948b4], eax
mov dword [0x4948b0], 0
jmp 0x402dc9
push 0x494898
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0x494898
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea eax, [esp + 0x14]
push eax
push 0x4000
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x402e24
cmp byte [esp + 0x20], 0
mov eax, dword [esp + 0x14]
je 0x402d96
mov byte [esp + 0x20], 0
cmp eax, 2
jb 0x402d96
cmp byte [esp + 0x2c], 0x4d
jne 0x402e08
cmp byte [esp + 0x2d], 0x5a
jne 0x402e08
test eax, eax
je 0x402e16
push 0
lea ecx, [esp + 0x2c]
push ecx
push eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x402e0c
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], eax
jne 0x402e12
add dword [0x4948b0], eax
add esi, dword [esp + 0x14]
cmp byte [0x49488d], 0
je 0x402d3f
push 0x13
pop edi
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esp + 0x402c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00434b58
add esp, 0x4020
ret
push 0x36
jmp 0x402dd8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0xb
jmp 0x402dd8
xor eax, eax
cmp esi, dword [esp + 0x18]
push 0x36
pop edi
cmove edi, eax
jmp 0x402dd9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x402dd9
Function at 0x403018
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0
push str.SpotifyMainWindow
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x4030e3
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 8]
xor bl, bl
push eax
push 0x1388
push 1
push 0
push 0
push 0x8068
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
je 0x4030ad
cmp dword [ebp - 4], 0
je 0x403080
push dword [ebp - 4]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
jmp 0x403082
xor esi, esi
push 0x1388
test esi, esi
je 0x4030a3
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ebx, eax
neg ebx
push esi
sbb bl, bl
inc bl
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4030a9
call dword [sym.imp.KERNEL32.DLL_Sleep]
test bl, bl
jne 0x4030e2
cmp dword [ebp - 4], 0
je 0x4030e2
push dword [ebp - 4]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x4030e2
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push 0x1388
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4030e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
push edi
push str.SpotifyHttpsListener
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x403148
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 8]
push eax
push 0x3e8
push 1
push edi
push edi
push 0x8001
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push dword [ebp - 4]
push edi
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x403148
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40314e
Capabilities:
Check mutex on windows

Disassembly:
push esi
push dword [esp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov esi, eax
test esi, esi
je 0x40317b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40317b
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
pop esi
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403185
mov dword [eax], esi
mov al, 1
pop esi
ret
Function at 0x4037f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.00439590
mov dword [ebp - 0x3c], esi
add esp, 0xc
mov esi, dword [ebp + 0x1c]
mov eax, esi
neg eax
mov dword [ebp - 0x20], 1
sbb eax, eax
and eax, 0x40
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40385f
test esi, esi
je 0x40385c
mov ecx, dword [ebp - 4]
mov dword [esi], ecx
xor eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403f3a
Capabilities:
Create process on windows

Disassembly:
push 0x5c
mov eax, 0x4590c8
call fcn.00434ba0
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
xor ebx, ebx
push 0x44
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x68]
push eax
call fcn.00439590
mov edi, dword [ebp + 0x14]
add esp, 0xc
test edi, edi
je 0x403f69
mov dword [edi], ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.004178dd
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004178dd
mov esi, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
test esi, esi
mov byte [ebp - 4], 1
mov eax, 0x45d534
cmovne eax, esi
push eax
call fcn.004178dd
xor eax, eax
mov dword [ebp - 0x68], 0x44
lea ecx, [ebp - 0x24]
test esi, esi
push ecx
cmovne eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x68]
push ecx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x403fe6
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test edi, edi
je 0x403fda
mov eax, dword [ebp - 0x24]
mov dword [edi], eax
jmp 0x403fdf
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov bl, 1
lea ecx, [ebp + 0x14]
call fcn.0040665e
lea ecx, [ebp - 0x10]
call fcn.0040665e
lea ecx, [ebp - 0x14]
call fcn.0040665e
mov al, bl
call fcn.00434b69
ret