joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ff0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x783760]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov edx, ecx
lea ecx, [esp + 4]
push 1
call fcn.0040f400
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x40901d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x18]
mov ebx, eax
cmp ecx, 8
jb 0x40903e
inc ecx
push ecx
push dword [esp + 8]
lea ecx, [esp + 0xc]
call fcn.00401f70
cmp ebx, 0xffffffff
jne 0x409055
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
test bl, 0x10
mov eax, 0
sete al
pop ebx
xor ecx, esp
lea eax, [eax*2 - 1]
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret

Function at 0x409080
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x681bbb
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0xa4]
call fcn.004059f0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xa4]
call fcn.00408bb0
cmp dword [eax + 0x14], 8
jb 0x4090d6
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
mov eax, dword [ebp - 0x14]
sete bl
cmp eax, 8
jb 0x4090f8
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00401f70
xor eax, eax
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.0040f210
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret

Function at 0x409210
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x681c30
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0040f400
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x409253
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x14]
mov esi, eax
cmp ecx, 8
jb 0x409271
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00401f70
test esi, esi
je 0x409292
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, 0xda
call fcn.00401840
int3
Function at 0x4092a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x681c68
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [ebp - 0x40]
call fcn.0040f400
mov esi, eax
push 0
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040f400
add esp, 8
cmp dword [esi + 0x14], 8
jb 0x4092f7
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x4092ff
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
mov eax, dword [ebp - 0x14]
sete bl
cmp eax, 8
jb 0x409321
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00401f70
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x409351
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401f70
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
test bl, bl
je 0x409375
mov edx, edi
mov ecx, 0xdb
call fcn.00401840
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret
Function at 0x40a030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x40a050
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [edi + 4]
mov dword [esp + 0x10], esi
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
cmp eax, vtable.CZipFile.0
jne 0x40a191
call fcn.0064c8d9
push ebx
push dword [ebp + 8]
mov dword [eax], 0
push dword [esi + 4]
call fcn.00659eaf
mov esi, eax
add esp, 0xc
cmp esi, ebx
jge 0x40a096
call fcn.0064c8d9
cmp dword [eax], 0
je 0x40a096
jmp 0x40a188
test esi, esi
jne 0x40a0bb
mov eax, dword [edi + 0x3c]
mov ecx, edi
shr eax, 4
test al, 1
je 0x40a1a0
mov ax, word [edi + 0x24]
inc ax
movzx eax, ax
push eax
call fcn.0040a2e0
jmp 0x40a050
cmp esi, ebx
je 0x40a17d
cmp byte [ebp + 0x10], 0
je 0x40a0d7
mov eax, dword [edi + 0x3c]
and eax, 0x70
cmp al, 0x70
jne 0x40a1aa
mov eax, dword [edi + 0x3c]
shr eax, 4
test al, 1
je 0x40a1aa
cmp esi, ebx
jae 0x40a17d
nop dword [eax]
mov ax, word [edi + 0x24]
mov ecx, edi
inc ax
movzx eax, ax
push eax
call fcn.0040a2e0
mov edx, dword [edi + 4]
mov ecx, ebx
sub ecx, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov eax, dword [edx]
mov ebx, dword [eax + 0x2c]
mov dword [esp + 0x14], ebx
mov ebx, dword [ebp + 0xc]
cmp eax, vtable.CZipFile.0
jne 0x40a1b6
test ecx, ecx
jne 0x40a12f
xor eax, eax
jmp 0x40a16b
call fcn.0064c8d9
push dword [esp + 0xc]
mov dword [eax], 0
mov eax, dword [ebp + 8]
add eax, esi
push eax
mov eax, dword [esp + 0x18]
push dword [eax + 4]
call fcn.00659eaf
add esp, 0xc
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0xc]
jge 0x40a16b
call fcn.0064c8d9
cmp dword [eax], 0
jne 0x40a1c5
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40a173
cmp esi, ebx
jb 0x40a1aa
add esi, eax
cmp esi, ebx
jb 0x40a0f0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x10]
call fcn.0040fc60
push ebx
push dword [ebp + 8]
mov ecx, esi
call edx
mov esi, eax
jmp 0x40a096
push 0xc9
call fcn.0040a3d0
push 0xc9
mov ecx, edi
call fcn.0040a3d0
mov eax, dword [ebp + 8]
push ecx
add eax, esi
mov ecx, edx
push eax
call dword [esp + 0x1c]
jmp 0x40a16b
mov ecx, dword [esp + 0x10]
call fcn.0040fc60
int3
Function at 0x40c6d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x40c745
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
sar eax, 8
xor byte [esi + ebx], al
movsx eax, byte [esi + ebx]
inc esi
mov edx, dword [ecx + 4]
xor eax, edx
movzx eax, al
shr edx, 8
mov eax, dword [eax*4 + 0x732320]
xor eax, edx
mov edx, dword [ecx + 0xc]
mov dword [ecx + 4], eax
movzx eax, al
add eax, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x732320]
mov dword [ecx + 0xc], edx
cmp esi, edi
jb 0x40c6e2
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x40c750
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [ebp + 0xc], ebx
jbe 0x40c7c9
push esi
nop
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0xc]
mov esi, edx
and esi, 0xfffd
movsx eax, byte [ebx + eax]
or esi, 2
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x732320]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 4], eax
movzx eax, al
add eax, dword [edi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x732320]
mov eax, esi
xor eax, 1
mov dword [edi + 0xc], edx
imul eax, esi
sar eax, 8
xor byte [ebx + ecx], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x40c760
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x40cd40
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
jne 0x40cd56
pop edi
xor al, al
pop esi
pop ebp
ret 4
push dword [esi + 4]
call fcn.00658b9c
add esp, 4
cmp eax, 0xffffffff
je 0x40cd9d
push 0x7358c0
push 0
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi], eax
test eax, eax
je 0x40cd4e
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 4], eax
test eax, eax
pop edi
setne al
pop esi
pop ebp
ret 4
mov ecx, esi
call fcn.0040fc60
int3
Function at 0x40dc20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x682138
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x783760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [esi + 0x24]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 0x20]
mov eax, dword [esi + 0x1c]
add edx, 0x16
mov dword [ebp - 0x10], edx
mov ebx, dword [eax + 4]
sub ebx, dword [eax]
xor eax, eax
sar ebx, 2
mov dword [ebp - 0x20], ebx
cmp ax, bx
jae 0x40dd64
mov eax, dword [esi + 0x1c]
movzx ecx, cx
mov eax, dword [eax]
mov ebx, dword [eax + ecx*4]
cmp dword [ebx + 0x78], 0
je 0x40dc93
cmp dword [ebx + 0x7c], 0
jbe 0x40dc93
mov esi, dword [ebx + 0x7c]
jmp 0x40dce9
mov dword [ebp - 0x30], vtable.CZipAutoBuffer.0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
mov ecx, ebx
call fcn.00403720
mov esi, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.CZipAutoBuffer.0
test eax, eax
je 0x40dce9
push eax
call fcn.0056e30f
add esp, 4
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov ecx, ebx
call fcn.00402870
mov ecx, dword [ebx + 0x3c]
add eax, esi
mov edi, dword [ebx + 0x40]
xor esi, esi
mov ebx, edi
mov dword [ebp - 0x1c], eax
sub ebx, ecx
mov dword [ebp - 0x18], ecx
sar ebx, 2
xor eax, eax
test ebx, ebx
jle 0x40dd35
sub edi, ecx
sar edi, 2
cmp edi, eax
jbe 0x40dd5a
mov ecx, dword [ecx + eax*4]
xor edx, edx
cmp byte [ecx + 0xc], dl
setne dl
inc eax
lea edx, [edx*2 + 2]
add edx, dword [ecx + 8]
mov ecx, dword [ebp - 0x18]
add esi, edx
cmp eax, ebx
jl 0x40dd12
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add edx, 0x2e
mov ecx, dword [ebp - 0x14]
add eax, esi
inc ecx
add edx, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
cmp cx, word [ebp - 0x20]
jae 0x40dd64
mov esi, dword [ebp - 0x24]
jmp 0x40dc77
push str.invalid_vector_T__subscript
call fcn.0056af4e
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ffe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x40fff6
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
call fcn.0064c8d9
push esi
push dword [ebp + 8]
mov dword [eax], 0
push dword [edi + 4]
call fcn.00659eaf
mov ebx, eax
add esp, 0xc
cmp ebx, esi
jge 0x410021
call fcn.0064c8d9
cmp dword [eax], 0
jne 0x41002a
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov ecx, edi
call fcn.0040fc60
int3
Function at 0x4103b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6815b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x783760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
call fcn.00410720
push 0xc
mov dword [ebp - 0x18], vtable.CZipAutoBuffer.0
call fcn.0056e306
mov edi, eax
mov dword [ebp - 0x10], 0xc
add esp, 4
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp + 0x10]
push 0
push 0xc
push edi
mov dword [ebp - 4], 0
call fcn.0040a030
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov ebx, dword [esi + 4]
mov dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
mov eax, edx
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp + 8]
sar ecx, 8
xor cl, byte [edi + eax]
movsx eax, cl
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x732320]
movzx eax, bl
add eax, dword [ebp + 0x10]
imul eax, eax, 0x8088405
mov dword [esi + 4], ebx
inc eax
mov dword [esi + 8], eax
mov dword [ebp + 0x10], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x732320]
mov eax, dword [ebp + 8]
inc eax
mov dword [esi + 0xc], edx
mov dword [ebp + 8], eax
cmp eax, 0xc
jl 0x410426
cmp byte [ebp + 0x14], 0
jne 0x4104b4
mov edx, dword [ebp + 0xc]
mov al, byte [edx + 0xc]
shr al, 3
test al, 1
je 0x4104a4
xor eax, eax
cmp byte [edx + 0x11], cl
jmp 0x4104a9
xor eax, eax
cmp byte [edx + 0x17], cl
sete al
test eax, eax
jne 0x4104b4
xor bl, bl
jmp 0x4104b6
mov bl, 1
test edi, edi
je 0x4104c3
push edi
call fcn.0056e30f
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x410720
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [edx + 4], 0x12345678
mov dword [edx + 8], 0x23456789
mov dword [edx + 0xc], 0x34567890
cmp dword [ecx + 8], ebx
jbe 0x41079c
mov eax, dword [edx + 4]
push esi
push edi
mov edi, dword [edx + 8]
mov esi, 0x34567890
mov ecx, dword [ecx + 4]
movsx ecx, byte [ecx + ebx]
inc ebx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x732320]
movzx ecx, al
add ecx, edi
mov dword [edx + 4], eax
imul edi, ecx, 0x8088405
inc edi
mov ecx, edi
mov dword [edx + 8], edi
shr ecx, 0x18
xor ecx, esi
shr esi, 8
movzx ecx, cl
xor esi, dword [ecx*4 + 0x732320]
mov ecx, dword [ebp + 8]
mov dword [edx + 0xc], esi
cmp ebx, dword [ecx + 8]
jb 0x410752
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x419de5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x7e7c38], 0
push esi
mov esi, ecx
je 0x419e08
xor eax, eax
jmp 0x419ead
push ebx
push edi
call fcn.00419d7c
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esi + 0x80]
call fcn.004c2c38
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x419e62
cmp dword [esi + 0x4c], ebx
je 0x419e62
lea edi, [esi + 0x50]
mov eax, 0x7d0
cmp word [edi], ax
jb 0x419e62
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00565e04
pop ecx
pop ecx
test eax, eax
js 0x419e62
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.00565e04
pop ecx
pop ecx
cmp eax, 7
jge 0x419e62
xor eax, eax
jmp 0x419eab
cmp dword [esi + 0x7c], ebx
jne 0x419ea8
push 0x141
mov ecx, 0x796c94
call fcn.00417bfd
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x419e81
mov eax, dword [eax]
push eax
push 1
mov ecx, esi
call fcn.0041b7cc
push ebx
push 1
mov ecx, esi
call fcn.0041b766
push ebx
push ebx
push esi
push 0x41b819
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
xor eax, eax
inc eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 4

Function at 0x419f26
Capabilities:
Create thread

Disassembly:
push 0x20
mov eax, 0x68e2b1
call fcn.0056e23b
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x7c], edi
jne 0x419fb5
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov dword [ebp - 4], edi
mov ecx, 0x796c94
push 0x147
call fcn.00417bfd
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x419f60
mov eax, dword [eax]
push ecx
push ecx
xorps xmm0, xmm0
movsd qword [esp], xmm0
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov ecx, esi
cmovae eax, dword [ebp - 0x28]
push eax
push 3
call fcn.0041b7cc
push edi
push 3
mov ecx, esi
call fcn.0041b766
push edi
push edi
push esi
push 0x41bea6
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x7c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
call fcn.0056e1e5
ret

Function at 0x41a06f
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 8], 4
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push 0x20000005
push dword [eax + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41a0a9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x41a0b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41e026
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push 0x64
mov eax, 0x6833be
call fcn.0056e23b
mov dword [ebp - 0x70], ecx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push 0x1000
call fcn.0041f109
push 0x8000
lea ecx, [ebp - 0x64]
call fcn.0054570b
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x68]
mov edi, dword [ebp - 0x64]
sub eax, edi
push ecx
and eax, 0xfffffffc
push eax
push edi
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x41e186
mov esi, dword [ebp - 0x68]
xor ebx, ebx
shr esi, 2
test esi, esi
je 0x41e186
push dword [edi + ebx*4]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x41e17a
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x6c]
and dword [ebp - 0x6c], 0
push eax
push 4
lea eax, [ebp - 0x4c]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41e173
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x58]
sar eax, 1
push eax
push dword [ebp - 0x58]
push dword [ebp - 0x4c]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x41e173
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push dword [ebp - 0x58]
call fcn.00565361
add esp, 0x14
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x2c]
push eax
call fcn.0041dfd7
mov edx, dword [ebp - 0x70]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
mov eax, dword [edx]
push ecx
push 0
mov ecx, edx
call dword [eax + 0x10]
test eax, eax
je 0x41e15b
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0041786a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x64]
inc ebx
cmp ebx, esi
jb 0x41e0a8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0041f0e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.0058226f
call fcn.0056e1e5
ret
Function at 0x41e61d
Capabilities:
Enumerate process modules

Disassembly:
push 0x68
mov eax, 0x68347f
call fcn.0056e23b
mov esi, ecx
mov dword [ebp - 0x54], esi
xor eax, eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x60]
push 0x1000
call fcn.0041f109
push 0x8000
lea ecx, [ebp - 0x6c]
call fcn.0054570b
mov ecx, dword [ebp - 0x6c]
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x68]
sub eax, ecx
push edx
and eax, 0xfffffffc
push eax
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x41e773
mov edi, dword [ebp - 0x70]
xor eax, eax
shr edi, 2
mov dword [ebp - 0x50], eax
test edi, edi
je 0x41e773
mov ecx, dword [ebp - 0x6c]
push dword [ecx + eax*4]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41e761
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x74]
and dword [ebp - 0x74], 0
push eax
push 4
lea eax, [ebp - 0x4c]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x41e75a
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x60]
sar eax, 1
push eax
push dword [ebp - 0x60]
push dword [ebp - 0x4c]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x41e75a
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push dword [ebp - 0x60]
call fcn.00565361
add esp, 0x14
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x2c]
push eax
call fcn.0041dfd7
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
mov eax, dword [edx]
push ecx
push 0
mov ecx, edx
call dword [eax + 0x10]
test eax, eax
jne 0x41e79c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c]
call fcn.0041786a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp eax, edi
jb 0x41e696
mov esi, dword [ebp - 0x54]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.0041f0e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.0058226f
mov eax, ebx
call fcn.0056e1e5
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c]
call fcn.0041786a
jmp 0x41e77c