joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x44900018
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x60092b9d
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x461f88
Capabilities:
Encode data using xor

Disassembly:
test byte [0xd535637c], dl
sbb ecx, dword [esi - 0x40a4093e]
cmp ch, byte [ebp - 0x6c]
Function at 0x10006971
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100069b0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100069b0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100069b0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100069b0
cmp dword [ecx + 0x74], 0xe
jbe 0x100069b0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000803b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010e08
push 0x10010e00
push str.FlsAlloc
push 0x1f
call fcn.10007f57
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000806f
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f174]
call esi
jmp 0x10008075
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100080b9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010e18
push 0x10010e10
push str.FlsGetValue
push 0x21
call fcn.10007f57
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100080f0
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100080f8
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010e20
push 0x10010e18
push str.FlsSetValue
push 0x22
call fcn.10007f57
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008132
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000a34a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000a3e7
push ebx
push esi
call fcn.1000a313
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000a2a7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000a394
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a3e6
push edi
push eax
call fcn.10008b41
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000a3b4
call fcn.10007e04
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000a3e5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000a2a7
add esp, 0x20
test eax, eax
jne 0x1000a3d3
push edi
call fcn.10007e04
jmp 0x1000a3db
push ebx
call fcn.10007e04
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1000e460
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e48d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e48d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, 1
mov edi, 2
mov ebx, 3
mov eax, 4
xor ecx, ecx
sub esi, 0x404060
sub edi, 0x404060
sub ebx, 0x404060
sub eax, 0x404060
mov dword [ebp - 4], eax
mov eax, 0xaaaaaaab
mul ecx
mov eax, ecx
shr edx, 2
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
lea edx, [esi + 0x404060]
add edx, ecx
movzx eax, byte [eax + 0x404058]
xor byte [ecx + 0x404060], al
mov eax, 0xaaaaaaab
mul edx
mov eax, ecx
shr edx, 2
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
lea edx, [edi + 0x404060]
add edx, ecx
movzx eax, byte [eax + 0x404059]
xor byte [ecx + 0x404061], al
mov eax, 0xaaaaaaab
mul edx
mov eax, ecx
shr edx, 2
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
lea edx, [ebx + 0x404060]
add edx, ecx
movzx eax, byte [eax + 0x40405a]
xor byte [ecx + 0x404062], al
mov eax, 0xaaaaaaab
mul edx
mov eax, ecx
shr edx, 2
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
movzx eax, byte [eax + 0x40405b]
xor byte [ecx + 0x404063], al
mov eax, dword [ebp - 4]
lea edx, [eax + 0x404060]
mov eax, 0xaaaaaaab
add edx, ecx
mul edx
mov eax, ecx
shr edx, 2
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
movzx eax, byte [eax + 0x40405c]
xor byte [ecx + 0x404064], al
add ecx, 5
cmp ecx, 0x320
jl 0x401037
pop edi
pop esi
pop ebx
mov eax, 0x404060
call eax
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40191e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40195d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40195d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40195d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40195d
cmp dword [ecx + 0x74], 0xe
jbe 0x40195d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x415500
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00415517

Function at 0x417bc0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00417bd7

Function at 0x418400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push fcn.00429230
lea eax, [ebp - 4]
lea edi, [ebp + 4]
push eax
add edi, 0xfffffffc
push edi
call fcn.00428190
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
call fcn.00421910
push 0
push dword [ebp - 4]
call fcn.0042bf10
add esp, 0x14
mov esi, dword [eax]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4185e3
push ebx
add esi, 4
call fcn.0042ce30
mov ecx, dword [0x587a88]
mov ebx, 1
cmp eax, ebx
push esi
cmove ecx, ebx
mov dword [0x587a88], ecx
call fcn.0041eb90
add esp, 4
cmp dword [0x587a88], 0
jne 0x41849b
mov eax, dword [0x587a2c]
cmp dword [0x587a38], 0
cmove eax, ebx
mov dword [0x587a2c], eax
push 0
call fcn.0041d9d0
add esp, 4
test eax, eax
je 0x4184b2
cmp byte [eax], 0
je 0x4184b2
xor eax, eax
jmp 0x4184b4
mov eax, ebx
xor ebx, ebx
test eax, eax
sete bl
cmp dword [0x587a34], 0
jne 0x4184f5
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041e950
mov eax, dword fs:[0x2c]
mov ecx, dword [ebp - 8]
test ecx, ecx
cmovne esi, ecx
mov eax, dword [eax]
push esi
mov dword [eax + 0x14c4], ecx
call fcn.0041eb90
add esp, 0x14
xor eax, eax
cmp dword [0x587a84], eax
push ebx
sete al
push eax
push 0x20
call fcn.004185f0
push eax
push str._os_:__5.s___setup_bit_:__d___installing_:__d__is_upgrade_:__d
push edi
call fcn.004284c0
push 0
push dword [eax]
push 0x5108bc
call fcn.00421730
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00428e10
cmp dword [0x587a6c], 0
mov ecx, str.locally
push eax
mov eax, str.remotely
cmove eax, ecx
push eax
push str.setup_started__s:__s
push 0x10005
call fcn.0042ab50
push 0
push 0
push 0x4197e0
call fcn.0042bb00
add esp, 0x44
cmp dword [0x587a80], 0
pop ebx
je 0x418587
push dword [ebp - 0x14]
push str._s_extracted
push edi
call fcn.004284c0
push dword [eax]
call fcn.00421450
add esp, 0x10
jmp 0x4185a5
cmp dword [0x587a84], 0
je 0x418597
call fcn.00420bb0
jmp 0x4185a5
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0041def0
add esp, 8
push str.setup_exited
push 0x10005
mov esi, eax
call fcn.0042ab50
push 0
push 0
push 0x510910
call fcn.00421730
add esp, 0x14
call fcn.00421a00
test esi, esi
je 0x4185d9
mov eax, dword [0x587a8c]
test eax, eax
jne 0x4185db
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 1
call fcn.004f747e
int3

Function at 0x4212c0
Capabilities:
Terminate process

Disassembly:
push str.usage:_setup.exe__OPTIONS__n
call fcn.004f785e
add eax, 0x40
push eax
call fcn.004f793a
add esp, 8
push 1
call fcn.004f747e
int3
Function at 0x421390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push eax
call fcn.00428840
add esp, 8
push 0x512594
push dword [eax]
push dword [0x587a20]
call dword [sym.imp.x_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4213c5
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push dword [0x587a20]
call dword [sym.imp.x_SizeofResource]
cmp eax, 0x14
jb 0x4213bf
push ebx
push esi
push dword [0x587a20]
call dword [sym.imp.x_LoadResource]
push eax
call dword [sym.imp.x_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x4213f9
pop ebx
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push dword [0x587a20]
call dword [sym.imp.x_SizeofResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
pop ebx
pop esi
pop ebp
ret

Function at 0x4215f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp + 0x10]
push edi
call fcn.0042b300
mov esi, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 4], eax
test esi, esi
jne 0x421633
call dword [sym.imp.x_IsDebuggerPresent]
test eax, eax
je 0x421633
lea eax, [ebp + 4]
sub eax, 4
push edi
push eax
call fcn.00428840
add esp, 8
push dword [eax]
call dword [sym.imp.x_OutputDebugStringW]
push dword [ebp - 4]
call fcn.00423460
add esp, 4
cmp dword [ebp + 0x14], 0
je 0x421654
push 1
push dword [ebp + 0x10]
push edi
call fcn.0042b300
add esp, 0xc
mov edi, eax
test esi, esi
jne 0x421662
mov esi, dword [0x583244]
test esi, esi
je 0x421677
push edi
push 0x5125b4
push esi
call fcn.004f793a
push esi
call fcn.004f7b93
add esp, 0x10
cmp dword [0x58324c], 2
jge 0x421690
push 0
push edi
push 0x583248
call fcn.00428ad0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4216a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 4]
sub eax, 4
push esi
push eax
call fcn.00428840
add esp, 8
push 0x80
push dword [eax]
call dword [sym.imp.x_SetFileAttributesW]
push 0x5125b8
push esi
call fcn.0042d9b0
add esp, 8
mov dword [0x583244], eax
test eax, eax
je 0x421728
push 0x200
push 0x40
push 0
push eax
call fcn.004f7eab
add esp, 0x10
cmp dword [0x583248], 0
je 0x421728
push esi
push 0x583254
call fcn.0042a0a0
push dword [0x583244]
push dword [0x583248]
call fcn.0042df00
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x421728
push 0x583248
call fcn.00429230
add esp, 4
pop esi
pop ebp
ret
Function at 0x421a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0x421c90
lea eax, [ebp - 0x10]
lea esi, [ebp + 4]
push eax
add esi, 0xfffffffc
push esi
call fcn.00428190
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push 0x421c90
push eax
push esi
call fcn.00428190
add esp, 0x18
push dword [ebp + 0xc]
push 0x5125fc
call fcn.0042ee60
push edx
push eax
call fcn.0042edc0
add esp, 0xc
push eax
push dword [ebp + 8]
push 0x51260c
push dword [ebp - 8]
call fcn.0042a180
mov ebx, dword [0x587de0]
add esp, 0x14
cmp dword [ebp + 0x18], 0
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x30000
je 0x421b22
push dword [eax]
push str.Starting_minidump__s.dmp
push 0x10005
call fcn.0042ab50
call fcn.00433c80
mov eax, dword [ebp - 8]
push dword [eax]
push 0x512634
push esi
call fcn.004284c0
push dword [eax]
push ebx
call fcn.00433d90
mov eax, dword [ebp - 8]
push dword [eax]
push str.Finished_minidump__s.dmp
push 0x10005
call fcn.0042ab50
mov eax, dword [ebp - 8]
add esp, 0x2c
push dword [eax]
push 0x512658
push esi
call fcn.004284c0
push 0x511e80
push dword [eax]
call fcn.004f5610
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
je 0x421c38
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x511394
push esi
call fcn.004284c0
push 0
push 0
push dword [eax]
push dword [ebp - 4]
call fcn.004215f0
push dword [ebp - 4]
call fcn.00421830
add esp, 0x24
cmp dword [ebp + 0x14], 0
je 0x421bf5
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0042a2c0
mov ecx, dword [0x583254]
add esp, 8
test ecx, ecx
je 0x421be0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [eax]
push ecx
call fcn.0042de80
add esp, 0x10
test eax, eax
jne 0x421be0
push 0x80
push 0x512688
push dword [ebp - 4]
call fcn.004f793a
push dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0xc]
push 1
push dword [eax]
call fcn.004f7e29
push 0x5125d8
push dword [ebp - 4]
call fcn.004f793a
add esp, 0x24
jmp 0x421bf5
push 0x80
push str.failed_to_get_last__dKB_of_log_file:_n
push dword [ebp - 4]
call fcn.004f793a
add esp, 0xc
lea eax, [ebp - 4]
push eax
call fcn.0042d990
mov eax, dword [0x587ab0]
mov esi, 0x5109c8
test eax, eax
mov ecx, esi
push 0x5126a0
cmovne ecx, eax
push ecx
push 0
call fcn.00431760
inc eax
push eax
mov eax, dword [0x587ab0]
test eax, eax
push 0x5126a0
cmovne esi, eax
push esi
push 0
call fcn.00431800
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0x136
ja 0x4229d9
je 0x4229a4
cmp eax, 0x111
ja 0x422998
je 0x42297b
cmp eax, 0x10
je 0x42295d
cmp eax, 0x20
jne 0x4229d2
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00423360
add esp, 8
pop esi
pop ebp
ret 0x14
mov dword [0x58329c], 0
mov eax, 1
mov dword [0x5832c4], 0
pop esi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
mov ecx, 0x4b0
cmp ax, cx
jne 0x422991
push eax
call fcn.00423310
add esp, 4
xor eax, eax
pop esi
pop ebp
ret 0x14
sub eax, 0x112
je 0x4229b7
sub eax, 0x21
jne 0x4229d2
cmp dword [ebp + 0x18], 0
je 0x4229d2
push 0
call dword [0x5100c4]
pop esi
pop ebp
ret 0x14
cmp dword [ebp + 0x10], 0xf060
jne 0x4229d2
push 0
push 2
push 0x111
push dword [ebp + 8]
call dword [0x510420]
xor eax, eax
pop esi
pop ebp
ret 0x14
cmp eax, 0x202
ja 0x422aad
je 0x422a5d
cmp eax, 0x138
je 0x422a06
cmp eax, 0x201
jne 0x4229d2
mov eax, dword [ebp + 0x14]
mov dword [0x5832c8], eax
mov eax, 1
pop esi
pop ebp
ret 0x14
mov esi, dword [ebp + 8]
push 0x4b0
push esi
call dword [0x51036c]
cmp eax, dword [ebp + 0x14]
jne 0x422a41
push 0xffffffffffffffff
push esi
call fcn.00423360
add esp, 8
push dword [0x567010]
push dword [ebp + 0x10]
call dword [0x5100b0]
push 5
call dword [0x5100c4]
pop esi
pop ebp
ret 0x14
push 0x4b4
push esi
call dword [0x51036c]
cmp eax, dword [ebp + 0x14]
jne 0x4229a4
push 0x262626
jmp 0x422a2b
push dword [ebp + 0x14]
push dword [0x5832c8]
push 0x4b0
push dword [ebp + 8]
call fcn.004221a0
add esp, 0x10
test eax, eax
je 0x422ac3
lea eax, [ebp + 4]
sub eax, 4
push str.http:__hola.org
push eax
call fcn.00428840
add esp, 8
push 5
push 0
push 0
push dword [eax]
push 0x512b10
push 0
call dword [0x510358]
mov eax, 1
pop esi
pop ebp
ret 0x14
cmp eax, 0x403
jne 0x4229d2
push dword [ebp + 8]
call fcn.00434660
add esp, 4
mov eax, 1
pop esi
pop ebp
ret 0x14

Function at 0x422b00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 5
push 0x4b2
push dword [ebp + 8]
call dword [0x51037c]
mov esi, dword [0x510414]
push 0
push dword [0x583288]
call esi
push 0
push dword [0x583298]
call esi
mov esi, dword [sym.imp.x_MulDiv]
push 0x60
push dword [0x583258]
push 0xf
call esi
push 0x60
push dword [0x58325c]
mov dword [ebp - 4], eax
push 0x12
call esi
push 0x60
push dword [0x583258]
mov ebx, eax
push 0x78
call esi
push 0x60
push dword [0x58325c]
mov edi, eax
push 0x35
call esi
push 0
push 0
mov esi, eax
call dword [sym.imp.x_GetModuleHandleW]
push eax
push 0x4b0
push dword [ebp + 8]
push esi
push edi
push ebx
push dword [ebp - 4]
push 0x5400014e
push 0
push 0x512a74
push 0
call dword [0x510418]
mov esi, eax
test esi, esi
je 0x422bc7
push 0xc9
push 0x35
push 0x78
push esi
push dword [ebp + 8]
call fcn.00423b10
add esp, 0x14
mov dword [0x583288], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Could_not_create_static_control
push 0x10000
call fcn.0042ae10
int3
Function at 0x423310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
shr eax, 0x10
test eax, eax
je 0x423321
xor eax, eax
pop ebp
ret
lea eax, [ebp + 4]
sub eax, 4
push str.http:__hola.org
push eax
call fcn.00428840
add esp, 8
push 5
push 0
push 0
push dword [eax]
push 0x512b10
push 0
call dword [0x510358]
mov eax, 1
pop ebp
ret

Function at 0x423de0
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0x512998
push 0
call dword [0x5103d0]
mov esi, eax
test esi, esi
je 0x423e0d
push 9
push esi
call dword [0x510414]
push 0
push 0
push 0x403
push esi
call dword [0x510420]
pop esi
ret
Function at 0x424d10
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
inc eax
mov edi, dword [esi + 0x20]
add eax, ebx
cmp eax, ecx
jle 0x424d45
push ecx
lea eax, [ecx + ecx]
push eax
push dword [edi]
call fcn.00437bd0
mov dword [edi], eax
add esp, 0xc
mov eax, dword [esi + 0x24]
add eax, eax
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x28]
add eax, dword [edi]
push 0
push ebx
push eax
push dword [esi + 8]
call dword [0x510440]
push eax
call fcn.004f5db0
add esp, 4
pop edi
pop esi
pop ebx
test eax, eax
jne 0x424d7b
mov dword [ebp + 0xc], str.WinHttpReadData_failed__m
mov dword [ebp + 8], 0x20003
pop ebp
jmp fcn.0042ab50
xor eax, eax
pop ebp
ret

Function at 0x425270
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea edi, [ebp + 4]
add edi, 0xfffffffc
push ebx
push edi
call fcn.00428840
push dword [ebp + 8]
mov esi, eax
push edi
call fcn.00428840
add esp, 0x10
push 0
push dword [esi]
push dword [eax]
call dword [sym.imp.x_CopyFileW]
test eax, eax
je 0x4252ab
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push ebx
call fcn.0042e550
push ebx
push edi
call fcn.00428840
push dword [ebp + 8]
mov esi, eax
push edi
call fcn.00428840
add esp, 0x14
push 0
push dword [esi]
push dword [eax]
call dword [sym.imp.x_CopyFileW]
neg eax
pop edi
sbb eax, eax
neg eax
pop esi
dec eax
pop ebx
pop ebp
ret

Function at 0x425500
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp + 4]
xor esi, esi
sub eax, 4
push eax
call fcn.00428840
add esp, 8
push dword [eax]
push esi
push esi
call dword [sym.imp.x_CreateMutexW]
push eax
call fcn.004f5de0
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
je 0x4255a4
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x425560
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2b38]
test eax, eax
jne 0x425558
call fcn.004f7685
mov edx, dword [ebp - 4]
cmp dword [eax], 0xb7
je 0x4255a4
push edi
push edx
call dword [sym.imp.x_WaitForSingleObject]
mov edi, eax
cmp edi, 0x102
je 0x4255a4
push 0x80
push 0
push 2
push edi
call fcn.00425230
add esp, 0x10
test eax, eax
jne 0x42559d
push edi
push 0x513460
push 0x10003
call fcn.0042ab50
add esp, 0xc
jmp 0x4255a4
mov esi, dword [ebp - 4]
test esi, esi
jne 0x4255c2
push dword [ebp + 8]
push 0x51348c
push 0x10003
call fcn.0042ab50
lea eax, [ebp - 4]
push eax
call fcn.00431d60
add esp, 0x10
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5834a0], 0
je 0x426c43
cmp dword [0x5834d0], 0
je 0x426c43
cmp dword [0x5834b8], 0
je 0x426c43
call fcn.00427a50
test eax, eax
je 0x426c0b
push dword [0x5834b8]
lea eax, [ebp - 4]
push dword [0x5834b0]
push eax
push 0
call fcn.00427540
add esp, 0x10
test eax, eax
je 0x426c0b
push dword [0x5834a0]
push 1
push dword [ebp - 4]
push eax
call fcn.004f7e29
mov eax, dword [0x5834b8]
add esp, 0x10
cdq
add dword [0x5834a8], eax
mov dword [0x5834b8], 0
adc dword [0x5834ac], edx
call fcn.00426c90
mov esp, ebp
pop ebp
ret
push dword [0x5834a0]
push 1
push dword [0x5834b8]
push dword [0x5834b0]
call fcn.004f7e29
mov eax, dword [0x5834b8]
add esp, 0x10
cdq
add dword [0x5834a8], eax
mov dword [0x5834b8], 0
adc dword [0x5834ac], edx
mov esp, ebp
pop ebp
ret

Function at 0x426d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5834d0], 0
jne 0x426d6d
call fcn.00427a50
test eax, eax
jne 0x426d6d
push dword [0x5834a0]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f7e29
add esp, 0x10
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
jmp 0x426d80
mov esi, dword [0x5834bc]
sub esi, dword [0x5834b8]
mov eax, dword [0x5834b0]
cmp edi, esi
cmovl esi, edi
add eax, dword [0x5834b8]
push esi
push ebx
push eax
call fcn.004f8270
add dword [0x5834b8], esi
add esp, 0xc
add ebx, esi
sub edi, esi
je 0x426dca
cmp dword [0x58353c], 0
je 0x426dc3
call fcn.00427380
jmp 0x426d80
call fcn.00426b80
jmp 0x426d80
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x427760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
cmp ecx, 0xffffffff
jne 0x42777e
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x427774
sub ecx, esi
pop esi
push ecx
push edx
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.00427540
add esp, 0x10
test eax, eax
je 0x4277a4
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push 1
push eax
call fcn.004f7e29
add esp, 0x10
pop ebp
ret

Function at 0x4278a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x5130e4
push dword [ebp + 8]
call fcn.0042d9b0
mov esi, eax
add esp, 8
mov dword [ebp - 8], esi
test esi, esi
je 0x42790a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
cmp ecx, 0xffffffff
jne 0x4278db
mov ecx, edx
push edi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4278d1
sub ecx, edi
pop edi
push ecx
push edx
lea eax, [ebp - 4]
push eax
push 0
call fcn.00427540
add esp, 0x10
test eax, eax
je 0x4278fe
push esi
push dword [ebp - 4]
push 1
push eax
call fcn.004f7e29
add esp, 0x10
lea eax, [ebp - 8]
push eax
call fcn.0042d990
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret