joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b521
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b5be
push ebx
push esi
call fcn.0040b4ea
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b47e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b56b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b5bd
push edi
push eax
call fcn.00408736
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b58b
call fcn.00407b18
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b5bc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b47e
add esp, 0x20
test eax, eax
jne 0x40b5aa
push edi
call fcn.00407b18
jmp 0x40b5b2
push ebx
call fcn.00407b18
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40dba6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x41cf70]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40dbe6
cmp byte [ebx], 0xa
jne 0x40dbe6
or byte [edi + eax + 0x28], 4
jmp 0x40dbeb
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x40dcea
mov dl, byte [eax]
cmp dl, 0x1a
je 0x40dccd
inc eax
cmp dl, 0xd
je 0x40dc17
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x40dc3d
cmp eax, ecx
jae 0x40dc4b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x40dbff
jmp 0x40dcea
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40dcc8
cmp dword [ebp - 0x10], 0
je 0x40dcc8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x41cf70]
test byte [eax + edi + 0x28], 0x48
je 0x40dca2
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x40dc8d
mov byte [esi], dl
jmp 0x40dc9e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x41cf70]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x40dcea
cmp byte [ebp - 1], 0xa
jne 0x40dcb1
cmp esi, ebx
jne 0x40dcb1
mov byte [esi], 0xa
jmp 0x40dce9
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00411717
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x40dcea
mov byte [esi], 0xd
jmp 0x40dce9
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x41cf70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40dce7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40dcea
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40dcf3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x41cf70]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40dd39
cmp word [ebx], dx
jne 0x40dd39
or byte [eax + edi + 0x28], 4
jmp 0x40dd3e
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x40dea1
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x40de81
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x40dd7f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x40ddb5
cmp eax, edx
jae 0x40ddc3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x40dd5a
jmp 0x40dea1
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40de7c
cmp dword [ebp - 0x18], 0
je 0x40de7c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x41cf70]
test byte [eax + edi + 0x28], 0x48
je 0x40de52
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x40de16
mov word [esi], cx
jmp 0x40de4d
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x41cf70]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x41cf70]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x41cf70]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x40dea1
pop eax
cmp word [ebp - 4], ax
jne 0x40de62
cmp esi, ebx
jne 0x40de62
mov word [esi], ax
jmp 0x40de9e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00411717
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x40dea1
push 0xd
pop eax
jmp 0x40de5d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x41cf70]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x40de9b
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x40dea1
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x414040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41406d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41406d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00405630
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00405630
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00405630
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00405630
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00405630
mov dword [0x41203c], eax
call fcn.00405630
test eax, eax
jge 0x402550
push 8
call fcn.00405630
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00405630
pop ecx
push 1
call fcn.00405630
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00405630
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00405630
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00405630
jmp 0x402495

Function at 0x405630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40563f
pop dword [ebp - 0x28]
mov eax, 0x40563f
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x366ae
push 0
mov eax, 0xe25e8c5d
sub eax, 0xe21dab85
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x657144ce
add ecx, 0x9a8ef80a
xor ebx, ebx
add ebx, eax
mov esi, 0xca4808e5
add esi, 0x35f932df
add esi, dword [ebp - 0x28]
mov edx, 0xcce228cf
sub edx, 0x2afd3f1b
add dword [ebp - 0x20], eax
mov edi, dword [esi]
add dword [ebp - 0x24], ebx
sub edi, edx
add dword [ebp - 0x1c], 0x602e33d1
mov dword [ebx], edi
xor dword [ebp - 0x20], 0x6b6ed5c1
add ebx, 0x40e2fa72
add ebx, 0xbf1d0592
add esi, 0x97d14ee6
add esi, 0x682eb11e
loop 0x40569b
add eax, 0xe633
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd2b30fca
sub ecx, 0xd2730fca
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x402aeb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43631d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x44c054]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x44c054]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
cmp ebx, esi
jne 0x402b35
xor eax, eax
jmp 0x402ca5
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x402b5e
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x402b5e
dec dword [edx]
mov edx, dword [edi + 0x20]
mov eax, ebx
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x402ca5
cmp dword [edi + 0x50], 0
je 0x402ca3
mov ecx, edi
call fcn.00403ad4
xor eax, eax
cmp dword [edi + 0x40], eax
jne 0x402b8f
push dword [edi + 0x50]
movsx eax, bl
push eax
call dword [sym.imp.MSVCR110.dll_fputc]
pop ecx
cmp eax, esi
pop ecx
cmovne esi, ebx
jmp 0x402ca3
push eax
push 8
lea ecx, [esp + 0x28]
mov byte [esp + 0x1b], bl
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], eax
mov byte [esp + 0x28], al
call fcn.00424cd0
and dword [esp + 0x48], 0
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x24]
cmovae edx, dword [esp + 0x24]
lea ecx, [esp + 0x24]
cmovae ecx, dword [esp + 0x24]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x27]
push eax
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP110.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x402c9a
cmp eax, 1
jg 0x402c7f
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
cmp ecx, 0x10
lea eax, [esp + 0x20]
cmovae eax, edx
sub ebx, eax
mov dword [esp + 0x14], ebx
mov ebx, dword [ebp + 8]
je 0x402c49
push dword [edi + 0x50]
cmp ecx, 0x10
push dword [esp + 0x18]
lea eax, [esp + 0x28]
cmovae eax, edx
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fwrite]
mov ecx, dword [esp + 0x24]
add esp, 0x10
cmp ecx, eax
jne 0x402c9a
jmp 0x402c4d
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x13]
mov byte [edi + 0x45], 1
cmp dword [esp + 0x1c], eax
jne 0x402c7b
test ecx, ecx
jne 0x402bb4
cmp dword [esp + 0x30], 0x20
jae 0x402c9a
push ecx
push 8
lea ecx, [esp + 0x28]
call fcn.00424cd0
jmp 0x402bb4
mov esi, ebx
jmp 0x402c9a
cmp eax, 3
jne 0x402c9a
movsx eax, byte [esp + 0x13]
push dword [edi + 0x50]
push eax
call dword [sym.imp.MSVCR110.dll_fputc]
pop ecx
cmp eax, esi
pop ecx
cmovne esi, ebx
lea ecx, [esp + 0x20]
call fcn.004023b1
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0041d508
mov esp, ebp
pop ebp
ret 4
Function at 0x408691
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43631d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x44c054]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x44c054]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, 0xffff
cmp si, bx
jne 0x4086de
xor eax, eax
jmp 0x408868
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40870a
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x40870a
dec dword [edx]
mov edx, dword [edi + 0x20]
mov ax, bx
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x408868
cmp dword [edi + 0x50], 0
je 0x408865
mov ecx, edi
call fcn.004094cb
xor ecx, ecx
cmp dword [edi + 0x40], ecx
jne 0x40873f
push dword [edi + 0x50]
push ebx
call dword [sym.imp.MSVCR110.dll_fputwc]
pop ecx
pop ecx
cmp ax, si
je 0x408865
movzx esi, bx
jmp 0x408865
movzx eax, bx
push ecx
mov dword [esp + 0x34], ecx
mov byte [esp + 0x24], cl
push 8
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], 0xf
call fcn.00424cd0
and dword [esp + 0x48], 0
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x24]
cmovae edx, dword [esp + 0x24]
lea ecx, [esp + 0x24]
cmovae ecx, dword [esp + 0x24]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x22]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP110.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::out_int___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
test eax, eax
js 0x40885c
cmp eax, 1
jg 0x40883d
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
cmp ecx, 0x10
lea eax, [esp + 0x20]
cmovae eax, edx
sub ebx, eax
mov dword [esp + 0x14], ebx
mov ebx, dword [ebp + 8]
je 0x408800
push dword [edi + 0x50]
cmp ecx, 0x10
push dword [esp + 0x18]
lea eax, [esp + 0x28]
cmovae eax, edx
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fwrite]
mov ecx, dword [esp + 0x24]
add esp, 0x10
cmp ecx, eax
jne 0x408835
jmp 0x408804
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
mov byte [edi + 0x46], 1
cmp dword [esp + 0x1c], eax
jne 0x408832
test ecx, ecx
jne 0x408767
cmp dword [esp + 0x30], 0x20
jae 0x408838
push ecx
push 8
lea ecx, [esp + 0x28]
call fcn.00424cd0
jmp 0x408767
movzx esi, bx
movzx esi, si
movzx esi, si
jmp 0x408859
cmp eax, 3
jne 0x40885c
push dword [edi + 0x50]
push dword [esp + 0x14]
call dword [sym.imp.MSVCR110.dll_fputwc]
pop ecx
pop ecx
cmp ax, si
je 0x408859
movzx esi, bx
movzx esi, si
lea ecx, [esp + 0x20]
call fcn.004023b1
mov ax, si
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0041d508
mov esp, ebp
pop ebp
ret 4
Function at 0x40a9a5
Capabilities:
Create http request
Parse url

Disassembly:
push 0x64
mov eax, 0x43648c
call fcn.00433ea9
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push 0x3c
lea eax, [esi + 0xc]
push ecx
push eax
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
call dword [sym.imp.MSVCR110.dll_memset]
or ecx, 0xffffffff
mov dword [esi + 0x14], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x44], ecx
lea eax, [esi + 0xc]
mov ecx, 0xffff
mov dword [eax], 0x3c
mov word [esi + 0x24], cx
mov ecx, dword [edi + 0x10]
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x40a9ff
mov edi, dword [edi]
push eax
push 0
push ecx
push edi
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
jne 0x40aa15
xor al, al
jmp 0x40aac9
push dword [esi + 0x1c]
lea ecx, [ebp - 0x28]
call fcn.00424cd0
xor edi, edi
mov dword [ebp - 4], edi
push dword [esi + 0x20]
lea ecx, [ebp - 0x58]
push edi
push ecx
mov ecx, eax
call fcn.00424cd0
push eax
lea ecx, [esi + 0x48]
call fcn.00424cd0
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.00424cd0
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00424cd0
push dword [esi + 0x38]
lea ecx, [ebp - 0x70]
call fcn.00424cd0
mov dword [ebp - 4], 1
push dword [esi + 0x3c]
lea ecx, [ebp - 0x40]
push edi
push ecx
mov ecx, eax
call fcn.00424cd0
push eax
lea ecx, [esi + 0x60]
call fcn.00424cd0
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00424cd0
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.00424cd0
cmp dword [ebx + 0x14], 8
jb 0x40aa9f
mov ebx, dword [ebx]
push edi
push edi
push edi
push edi
push ebx
call dword [sym.imp.wininet.dll_InternetOpenW]
mov dword [esi], eax
test eax, eax
je 0x40aa0e
xor ecx, ecx
mov edx, 0x4186f1
cmp ecx, edx
je 0x40aac7
push edx
push eax
call dword [sym.imp.wininet.dll_InternetSetStatusCallbackW]
mov al, 1
call fcn.00433e58
ret 0x10
Function at 0x40abd5
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0x20
mov eax, 0x436403
call fcn.00433edf
mov dword [ebp - 0x20], ecx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], esi
push dword [eax + 8]
call dword [sym.imp.wininet.dll_InternetQueryDataAvailable]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x40acc7
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.00424cd0
pop ecx
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
mov ebx, eax
push esi
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.MSVCR110.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
push ebx
push dword [eax + 8]
call dword [sym.imp.wininet.dll_InternetReadFile]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x40ac53
mov dword [ebp - 0x14], esi
jmp 0x40ac65
cmp dword [ebp - 0x14], 0
jbe 0x40ac65
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push ebx
call fcn.00424cd0
or dword [ebp - 4], 0xffffffff
jmp 0x40acb0
push ebx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
cmp dword [ebp - 0x14], 0
pop ecx
mov dword [ebp - 0x18], esi
ja 0x40abec
test edi, edi
setne al
call fcn.00433e44
ret 4
Function at 0x40c14d
Capabilities:
Get common file path

Disassembly:
push 0x874
mov eax, 0x4369b0
call fcn.00433ea9
mov edi, edx
mov esi, ecx
xor ebx, ebx
push 0x802
lea eax, [ebp - 0x81c]
push ebx
push eax
mov dword [ebp - 0x880], ebx
call dword [sym.imp.MSVCR110.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x81c]
push eax
push ebx
push ebx
push 0x801a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40c2b2
mov dword [ebp - 0x820], 7
mov dword [ebp - 0x824], ebx
mov word [ebp - 0x834], ax
cmp word [ebp - 0x81c], ax
je 0x40c1c9
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.MSVCR110.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x834]
call fcn.00424cd0
mov edx, edi
lea ecx, [ebp - 0x84c]
mov dword [ebp - 4], ebx
call fcn.004069bf
push eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 1
call fcn.00424cd0
mov byte [ebp - 4], 2
mov edx, eax
lea ecx, [ebp - 0x864]
mov dword [esp], 0x43fd8c
call fcn.00424cd0
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x834]
mov byte [ebp - 4], 3
call fcn.00424cd0
push ebx
push 1
lea ecx, [ebp - 0x864]
call fcn.00424cd0
push ebx
push 1
lea ecx, [ebp - 0x87c]
call fcn.00424cd0
push ebx
push 1
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], bl
call fcn.00424cd0
lea edx, [ebp - 0x834]
lea ecx, [ebp - 0x84c]
call fcn.00407dbd
mov ecx, eax
call fcn.004074d4
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x84c]
mov bl, al
call fcn.00424cd0
test bl, bl
je 0x40c2a0
lea edx, [ebp - 0x834]
mov ecx, esi
call fcn.004068f7
push edi
push 1
lea ecx, [ebp - 0x834]
call fcn.00424cd0
jmp 0x40c2be
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x834]
call fcn.00424cd0
push 0x43f9ae
mov ecx, esi
call fcn.00424cd0
mov eax, esi
call fcn.00433e58
ret

Function at 0x4128d9
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x4375ca
call fcn.00433ea9
mov edi, ecx
xor esi, esi
push 0x20a
lea eax, [ebp - 0x224]
push esi
push eax
mov dword [ebp - 0x258], esi
call dword [sym.imp.MSVCR110.dll_memset]
add esp, 0xc
call fcn.00424cd0
test al, al
je 0x41299a
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x23c]
call fcn.00424cd0
push str.LogSession
lea ecx, [ebp - 0x254]
mov dword [ebp - 4], esi
call fcn.00424cd0
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call fcn.0040c42d
push 0x43f9ae
lea ecx, [ebp - 0x270]
mov esi, eax
call fcn.00424cd0
push eax
mov byte [ebp - 4], 2
mov edx, dword [esi]
lea eax, [ebp - 0x23c]
push eax
mov ecx, esi
call dword [edx + 0x40]
lea ecx, [ebp - 0x270]
call fcn.004023b1
lea ecx, [ebp - 0x254]
call fcn.004023b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.004023b1
mov ecx, edi
call fcn.0041283a
jmp 0x4129c7
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 0x43fc28
test eax, eax
lea ecx, [ebp - 0x224]
cmovne ecx, edx
push ecx
mov ecx, edi
call fcn.00424cd0
mov eax, edi
call fcn.00433e58
ret
Function at 0x412e6d
Capabilities:
Hash data with md5

Disassembly:
push 0xa8
mov eax, 0x4378ed
call fcn.00433ea9
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 2
push 0x68
mov dword [ebp - 0x98], eax
push ecx
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.MSVCR110.dll_memset]
and dword [ebp - 0x8c], 0
and dword [ebp - 0x90], 0
add esp, 0xc
cmp dword [ebp + 0x1c], 0x10
lea edi, [ebp + 8]
cmovae edi, dword [ebp + 8]
add edi, dword [ebp + 0x18]
cmp dword [ebp + 0x1c], 0x10
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
mov dword [ebp - 0x88], 0x67452301
mov dword [ebp - 0x84], 0xefcdab89
mov dword [ebp - 0x80], 0x98badcfe
mov dword [ebp - 0x7c], 0x10325476
jmp 0x412f2d
mov al, byte [esi]
push 1
lea edx, [ebp - 0x91]
mov byte [ebp - 0x91], al
call fcn.00424cd0
pop ecx
inc esi
lea ecx, [ebp - 0x90]
cmp esi, edi
jne 0x412f16
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00424cd0
xor eax, eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 4], 3
push dword [ebp - 0xac]
lea ecx, [ebp - 0x98]
push dword [ebp - 0xb0]
call fcn.00424cd0
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa4]
and dword [ebx + 0x10], 0
add esp, 0xc
mov dword [ebx + 0x14], 0xf
push dword [ebp - 0x98]
mov byte [ebx], 0
push eax
push ecx
mov ecx, ebx
call fcn.00413303
cmp dword [ebp - 0xa4], 0
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
je 0x412fd5
push dword [ebp - 0xa4]
call esi
xor eax, eax
pop ecx
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
lea ecx, [ebp - 0x28]
call fcn.004023b1
cmp dword [ebp - 0xb0], 0
je 0x413003
push dword [ebp - 0xb0]
call esi
xor eax, eax
pop ecx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
lea ecx, [ebp + 8]
call fcn.004023b1
mov eax, ebx
call fcn.00433e58
ret