joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
test ebx, ebx
push edi
mov edi, 0x811c9dc5
jle 0x40123c
mov al, byte [esi + ebp]
movzx ecx, al
xor ecx, edi
imul ecx, ecx, 0x1000193
mov edi, ecx
movsx edx, al
push edi
push edx
push esi
push str.__d___d__d_n
call fcn.004014a0
add esi, 1
add esp, 0x10
cmp esi, ebx
jl 0x401212
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x401670
Capabilities:
Move file

Disassembly:
sub esp, 0xc
push ebp
push esi
push 0x400
call fcn.00409e92
mov esi, eax
push 0x400
push esi
call fcn.0040c47f
push esi
push str._Extractor__Working_dir_is__s_n
call fcn.004014a0
push esi
call fcn.00409db5
push edi
push ebx
call fcn.0040a4d1
add esp, 0x20
test eax, eax
mov dword [esp + 0xc], 0
je 0x4017a0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
cmp dword [esp + 0xc], 0xa
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
jge 0x4017c4
call fcn.0040a069
mov eax, dword [eax]
push eax
push edi
push ebx
push str._Rename__Could_not_rename__s_to__s___d__n
call fcn.004014a0
add esp, 0x10
push 0x32
call esi
push str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.004014a0
add esp, 4
push 3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4017b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x400
mov esi, eax
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 8]
push edx
call ebp
push str.MoveFileEx
mov dword [esp + 0x14], eax
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [ecx + eax + 0x28]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 8]
push ecx
push esi
push str.MoveFileEx
push str._HttpDownloader___s_failed_with_error__d:__s_n
mov ebp, eax
call fcn.004014a0
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x10
push edx
call esi
push ebp
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x12c
call esi
add dword [esp + 0xc], 1
push edi
push ebx
call fcn.0040a4d1
add esp, 8
test eax, eax
jne 0x4016c0
push edi
push ebx
push str._Rename__File__s_renamed_to__s_n
call fcn.004014a0
add esp, 0xc
pop esi
pop ebp
add esp, 0xc
ret
push str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.004014a0
add esp, 4
jmp 0x4017a0
test eax, eax
je 0x4017a0
call fcn.0040a069
mov eax, dword [eax]
push eax
push edi
push ebx
push str._Rename___FAIL__Could_not_rename__s_to__s___d__n
call fcn.004014a0
push str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.004014a0
mov eax, edi
call fcn.00401830
push edi
push str._Rename__Created_folder__s_n
call fcn.004014a0
push edi
push ebx
call fcn.00401cb0
add esp, 0x24
test eax, eax
je 0x401819
push str._Rename__Copy_failed_too__Severe_filesystem_issues._n
call fcn.004014a0
add esp, 4
pop esi
pop ebp
add esp, 0xc
ret
push edi
push ebx
push str._Rename__Copied__s_to__s_n
call fcn.004014a0
add esp, 0xc
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x401940
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov edi, eax
push edi
push str.Fixing__s_n
call fcn.004014a0
push 0x41ef6c
push edi
call fcn.0040afd6
mov esi, eax
add esp, 0x10
test esi, esi
mov byte [esp + 8], 0x50
mov byte [esp + 9], 0x45
mov byte [esp + 0xa], 0
mov byte [esp + 0xb], 0
jne 0x40198d
push edi
push str.Could_not_open_file__s_n
call fcn.004014a0
add esp, 8
push 1
call fcn.0040a935
push ebp
push edi
push str.Opened__s_n
call fcn.004014a0
add esp, 8
xor ebp, ebp
push ebx
xor edi, edi
push esi
call fcn.0040adb1
push esi
mov ebx, eax
add ebp, 1
call fcn.0040a57a
add esp, 8
test eax, eax
jne 0x401a66
cmp bl, byte [esp + edi + 0x10]
jne 0x40199f
add edi, 1
cmp edi, 4
jne 0x4019a1
push str.Found_marker_OK_n
mov dword [0x432b88], ebp
call fcn.004014a0
mov eax, dword [0x432b88]
push 0
add eax, 0x59
push eax
push esi
call fcn.0040c831
push str.Skipped_to_relevant_spot_n
call fcn.004014a0
push esi
call fcn.0040adb1
push eax
push str.Was__02X_n
call fcn.004014a0
mov ecx, dword [0x432b88]
push 0
add ecx, 0x59
push ecx
push esi
call fcn.0040c831
push esi
push 2
call fcn.0040a392
mov edx, dword [0x432b88]
push 0
add edx, 0x59
push edx
push esi
call fcn.0040c831
add esp, 0x40
push esi
call fcn.0040adb1
push eax
push str.Now__02X_n
call fcn.004014a0
push esi
call fcn.0040ad55
push esi
call fcn.0040cb7f
push str.Fixed_OK_n
call fcn.004014a0
add esp, 0x18
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
push str.SS_edit___PE_sig
push str.Could_not_find_marker:__s_n
call fcn.004014a0
add esp, 8
push 1
call fcn.0040a935
int3

Function at 0x401c30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push edi
mov esi, eax
push 0x41f038
push esi
call fcn.0040afd6
mov edi, eax
add esp, 8
test edi, edi
jne 0x401c60
push esi
push str.Unable_to_open_destination_file_for_copy__s_n
call fcn.004014a0
add esp, 8
pop edi
pop esi
ret
push ebx
push 0xc350
push 1
push 0x426820
call fcn.0040b3ed
mov esi, eax
add esp, 0x10
test esi, esi
jbe 0x401c8c
push edi
push esi
push 1
push 0x426820
call fcn.0040c11c
add esp, 0x10
cmp esi, 0xc350
je 0x401c60
push ebx
call fcn.0040cb7f
push edi
call fcn.0040cb7f
add esp, 8
pop edi
pop esi
ret
Function at 0x403bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
push edi
push ebx
push str._ExtractArchive__Extracting_archive__s_into__s_n
call fcn.004014a0
add esp, 0xc
push 0x41ef2c
push ebx
call fcn.0040afd6
mov esi, eax
add esp, 8
test esi, esi
jne 0x403bf8
push ebx
push str._ExtractArchive__Failed_to_extract_archive___couldnt_open_file__s_n
call fcn.004014a0
add esp, 8
push 1
call fcn.0040a935
mov ebx, dword [ebp + 8]
push esi
push 0
mov edx, edi
mov ecx, ebx
call fcn.004033f0
add esp, 8
test eax, eax
je 0x403bfb
push str._ExtractArchive__Done_extracting_archive._n
call fcn.004014a0
add esp, 4
push esi
call fcn.0040cb7f
mov eax, dword [ebp + 0xc]
add esp, 4
push eax
call fcn.0040aee8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403f50
Capabilities:
Get session user name

Disassembly:
sub esp, 0xd4
mov eax, dword [0x4244e0]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
push str.ALLUSERSPROFILE
call fcn.0040ca89
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403f95
sub eax, edx
lea edx, [esp + 0x14]
push edx
mov ebx, eax
call fcn.00401200
mov esi, eax
add esp, 4
test esi, esi
jge 0x403fb7
neg esi
push 0x64
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.00411ad0
push esi
lea ecx, [esp + 0x88]
push 0x41fb74
push ecx
call fcn.0040a4ff
lea eax, [esp + 0x2c]
add esp, 0x18
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403fe4
sub eax, esi
je 0x404016
cmp byte [esp + edx + 0x14], 0x80
jb 0x403ffd
mov byte [esp + edx + 0x14], 0x5f
lea eax, [esp + 0x14]
add edx, 1
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404007
sub eax, esi
cmp edx, eax
jb 0x403ff1
push 0x1388
call fcn.00409e92
mov ebx, eax
mov eax, edi
add esp, 4
mov byte [ebx], 0
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404030
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x404040
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, str.JWUser_
mov eax, ebx
call fcn.00401890
lea eax, [esp + 0x78]
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404070
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x404080
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
add edi, 0xffffffff
lea ecx, [ecx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4040a0
mov dx, word [0x41f164]
lea eax, [esp + 0x14]
mov word [edi], dx
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4040c0
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4040d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
call section..text
mov esi, eax
test esi, esi
je 0x404131
mov eax, dword [esi]
or edi, 0xffffffff
cmp eax, 0xffffffff
je 0x40410a
push eax
call fcn.0040a372
add esp, 4
mov edi, eax
mov eax, dword [esi + 0x134]
push eax
call fcn.00409db5
push esi
call fcn.00409db5
add esp, 8
cmp edi, 0xffffffff
jne 0x40413a
call fcn.0040a069
mov dword [eax], 9
jmp 0x40413a
push ebx
call fcn.0040b164
add esp, 4
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00409da6
add esp, 0xd4
ret
Function at 0x4041f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4244e0]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push esi
push edi
push str.APPDATA
mov dword [esp + 0x10], 0x94
call fcn.0040ca89
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x404283
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404225
sub eax, edx
cmp eax, 2
jbe 0x404283
cmp byte [ebx], 0x5c
jne 0x404283
cmp byte [ebx + 1], 0x5c
jne 0x404283
push str._Extractor__Roaming_AppData_directory_detected_n
call fcn.004014a0
add esp, 4
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4042f0
cmp dword [esp + 0x10], 5
jbe 0x404292
push str.LOCALAPPDATA
call fcn.0040ca89
mov ebx, eax
push ebx
push str._Extractor__Local_AppData_directory_resolved_to__s_n
call fcn.004014a0
add esp, 0xc
jmp 0x4042f0
push str._Extractor__Local_AppData_directory_detected_n
call fcn.004014a0
add esp, 4
jmp 0x4042f0
push str.USERPROFILE
call fcn.0040ca89
push 0x1388
mov esi, eax
call fcn.00409e92
mov ebx, eax
add esp, 8
mov byte [ebx], 0
mov eax, esi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4042b2
mov edi, ebx
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4042c2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, str.Local_Settings
mov eax, ebx
call fcn.00401890
mov ecx, str.Application_Data
call fcn.00401890
push str.Validating_directory...
call fcn.004014a0
push ebx
push str.Shared_dir_detected_is__s_n
call fcn.004014a0
push ebx
push str.Checking_if__s_exists_n
call fcn.004014a0
push 6
push ebx
call fcn.0040abc3
add esp, 0x1c
test eax, eax
jne 0x404345
mov edi, ebx
call fcn.00403eb0
test eax, eax
je 0x404345
call fcn.00403f00
test eax, eax
jne 0x404345
push str.Shared_directory_appears_valid.
call fcn.004014a0
add esp, 4
jmp 0x4043ca
push ebx
push str.The_directory__s_appears_invalid._n
call fcn.004014a0
push ebx
push str.Trying_the_short_path_instead._n
call fcn.004014a0
push 0x1388
call fcn.00409e92
add esp, 0x14
push 0x400
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4043ba
push esi
push str.Got_short_path_of__s_n
call fcn.004014a0
push ebx
push str.Checking_if__s_exists_n
call fcn.004014a0
push 6
push ebx
call fcn.0040abc3
add esp, 0x18
test eax, eax
jne 0x4043ba
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00409da6
add esp, 0x98
ret
push esi
call fcn.00409db5
add esp, 4
call fcn.00403f50
mov ebx, eax
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00409da6
add esp, 0x98
ret
Function at 0x4076e0
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
movzx ecx, al
cmp ecx, 5
ja 0x4076f8
jne 0x4076ff
cmp ah, 1
jb 0x4076ff
call fcn.00408640
jmp 0x407704
call fcn.00409650
push str._HttpDownloader__Cleaning_up..._n
call fcn.004014a0
add esp, 4
call esi
movzx ecx, al
cmp ecx, 5
pop esi
ja 0x407723
jne 0x40772e
cmp ah, 1
jb 0x40772e
mov eax, dword [0x432b70]
push eax
call sub.gdiplus.dll_GdiplusShutdown
ret

Function at 0x407730
Capabilities:
Check os version
Create thread

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
cmp ecx, 5
ja 0x407745
jne 0x40774a
cmp ah, 1
jb 0x40774a
jmp 0x4085a0
jmp 0x4095d0
cmp dword [0x425c10], 0
push 0
jne 0x408604
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x425c14
push 0
push 0x425c10
push 0x4086b0
push 0
push 0
mov dword [0x425c18], eax
call fcn.0040d6ba
add esp, 0x18
mov dword [0x425c10], eax
mov eax, dword [0x425c18]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408615
push str.Error_starting_SplashThread_n
call fcn.004014a0
add esp, 4
ret
mov ecx, dword [0x425c14]
push 2
push 6
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
ret
cmp dword [0x425c58], 0
push 0
jne 0x409634
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x425c5c
push 0
push 0x425c58
push 0x4096c0
push 0
push 0
mov dword [0x425c60], eax
call fcn.0040d6ba
add esp, 0x18
mov dword [0x425c58], eax
mov eax, dword [0x425c60]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x409645
push str.Error_starting_SplashThread_n
call fcn.004014a0
add esp, 4
ret
mov ecx, dword [0x425c5c]
push 2
push 6
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
ret

Function at 0x407750
Capabilities:
Check os version

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
cmp ecx, 5
ja 0x407765
jne 0x40776a
cmp ah, 1
jb 0x40776a
jmp fcn.00408640
jmp fcn.00409650
Function at 0x407b10
Capabilities:
Check mutex on windows
Create thread

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
push 0x24
mov edi, eax
call fcn.00409e92
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 4
push 0
push 0
push 0
mov esi, eax
call ebx
push 0
push 0
push 0
mov dword [esi], eax
call ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 8], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], 0
call fcn.00407e30
push 0
push 0
push 1
push 0
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push ecx
mov dword [esi + 0x20], eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea edx, [esp + 0x24]
push edx
push 0
push esi
push 0x407aa0
push 0
push 0
call edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x28]
push eax
push 0
push esi
push 0x407850
push 0
push 0
call edi
lea ecx, [esp + 0x2c]
push ecx
push 0
push esi
push 0x4078f0
push 0
push 0
mov dword [esp + 0x2c], eax
call edi
lea edx, [esp + 0x30]
push edx
push 0
push esi
push 0x4079c0
push 0
push 0
mov dword [esp + 0x30], eax
call edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x34]
push eax
push 0
push esi
push 0x407a30
push 0
push 0
call edi
mov ecx, dword [esi]
push ecx
mov dword [esp + 0x24], eax
mov dword [esi + 0x1c], 5
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0x20]
push 0xffffffffffffffff
push edx
call ebx
mov eax, dword [esi + 8]
push eax
push str._HttpDownloader__Download_Tasks_Complete___success_d__n
call fcn.004014a0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
xor edi, edi
mov edi, edi
mov ecx, dword [esp + edi*4 + 0x10]
push ecx
call ebx
add edi, 1
cmp edi, 5
jl 0x407c30
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x407c50
Capabilities:
Delete file

Disassembly:
push edi
mov edi, dword [0x432b74]
cmp dword [edi], 0
jne 0x407c65
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
ret
push esi
push 0x41f038
push eax
call fcn.0040afd6
mov esi, eax
add esp, 8
test esi, esi
je 0x407cb1
mov eax, dword [edi]
test eax, eax
je 0x407ca8
push esi
push eax
call fcn.0040d0a4
add esp, 8
cmp dword [edi + 4], 0
je 0x407ca8
push esi
push 0x4217c8
call fcn.0040d0a4
mov eax, dword [edi + 4]
push esi
push eax
call fcn.0040d0a4
add esp, 0x10
push esi
call fcn.0040cb7f
add esp, 4
pop esi
pop edi
ret
Function at 0x407cc0
Capabilities:
Initialize winhttp library

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, edx
mov esi, eax
mov ebx, ecx
call fcn.004093c0
mov ebp, eax
xor eax, eax
push str._Proxy__Opening_HTTP_Session_n
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.004014a0
add esp, 4
push 0
push 0
push 0
push 1
push str.JWrapper_Proxy_Detector_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
test edi, edi
je 0x407e10
test ebx, ebx
mov dword [esp + 0x20], 1
je 0x407d57
push ebx
push str._Proxy__Using_auto_config_URL:__S_n
mov dword [esp + 0x28], 3
call fcn.004014a0
add esp, 8
mov dword [esp + 0x28], ebx
push ebp
push str._Proxy__Attempting_to_detect_proxy_for_URL__S_n
mov dword [esp + 0x2c], 3
mov dword [esp + 0x3c], 1
call fcn.004014a0
add esp, 8
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebp
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x407de0
push str._Proxy__Configuration_found_n
call fcn.004014a0
add esp, 4
cmp dword [esp + 0x14], 1
jne 0x407da6
push str._Proxy__Direct_connection_used_n
jmp 0x407de5
mov edx, dword [esp + 0x18]
push edx
push str._Proxy___S_n
call fcn.004014a0
mov eax, dword [esp + 0x24]
push eax
push str._Proxy___S_n
call fcn.004014a0
mov ebx, dword [esp + 0x28]
add esp, 0x10
call fcn.00409420
mov ebx, dword [esp + 0x1c]
mov dword [esi], eax
call fcn.00409420
mov dword [esi + 4], eax
jmp 0x407ded
push str._Proxy__Configuration_NOT_found_n
call fcn.004014a0
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x407dfe
push eax
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x407e09
push eax
call esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push ebp
call fcn.00409db5
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x408030
Capabilities:
Create process on windows

Disassembly:
mov eax, 0xc3b8
call fcn.00417d80
mov eax, dword [0x4244e0]
xor eax, esp
mov dword [esp + 0xc3b0], eax
push ebp
push esi
push edi
push str._Spawner__Constructing_command_line..._n
call fcn.004014a0
call fcn.0040a9c1
add eax, 0x20
push eax
call fcn.0040ad55
mov eax, dword [ebx]
add esp, 8
xor ebp, ebp
test eax, eax
mov byte [esp + 0x68], 0
je 0x4080fa
jmp 0x408080
lea edi, [esp + 0x68]
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x408087
mov cx, word [0x41f1a8]
mov word [edi], cx
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4080a0
lea edi, [esp + 0x68]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4080b4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x68]
rep movsb byte es:[edi], byte [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4080d3
mov dx, word [0x421a34]
mov cl, byte [0x421a36]
mov word [eax], dx
add ebp, 1
mov byte [eax + 2], cl
mov eax, dword [ebx + ebp*4]
test eax, eax
jne 0x408080
lea edx, [esp + 0x68]
push edx
push str._Spawner__Creating_command_line__s_n
call fcn.004014a0
call fcn.0040a9c1
add eax, 0x20
push eax
call fcn.0040ad55
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00411ad0
add esp, 0x18
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
push eax
push eax
push 1
push eax
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40819c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.004014a0
call fcn.0040a9c1
add eax, 0x20
push eax
call fcn.0040ad55
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xc3b0]
xor ecx, esp
call fcn.00409da6
add esp, 0xc3b8
ret
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
push str._Spawner__runSpawnerAndWait_returned__d_n
call fcn.004014a0
mov ecx, dword [esp + 0xc3c4]
mov eax, dword [esp + 0x14]
add esp, 8
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00409da6
add esp, 0xc3b8
ret
Function at 0x408200
Capabilities:
Create process on windows

Disassembly:
mov eax, 0xc3b8
call fcn.00417d80
mov eax, dword [0x4244e0]
xor eax, esp
mov dword [esp + 0xc3b0], eax
push ebp
push esi
push edi
push str._Spawner__Constructing_command..._n
mov byte [esp + 0x6c], 0
call fcn.004014a0
call fcn.0040a9c1
add eax, 0x20
push eax
call fcn.0040ad55
mov eax, dword [ebx]
add esp, 8
xor ebp, ebp
test eax, eax
je 0x4082ca
jmp 0x408250
lea edi, [esp + 0x68]
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x408257
mov cx, word [0x41f1a8]
mov word [edi], cx
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x408270
lea edi, [esp + 0x68]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x408284
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x68]
rep movsb byte es:[edi], byte [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4082a3
mov dx, word [0x421a34]
mov cl, byte [0x421a36]
mov word [eax], dx
add ebp, 1
mov byte [eax + 2], cl
mov eax, dword [ebx + ebp*4]
test eax, eax
jne 0x408250
lea edx, [esp + 0x68]
push edx
push str._Spawner__Executing_command__s_n
call fcn.004014a0
call fcn.0040a9c1
add eax, 0x20
push eax
call fcn.0040ad55
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00411ad0
add esp, 0x18
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
push eax
push eax
push 1
push eax
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40836c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.004014a0
call fcn.0040a9c1
add eax, 0x20
push eax
call fcn.0040ad55
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xc3b0]
xor ecx, esp
call fcn.00409da6
add esp, 0xc3b8
ret
push str._Spawner__Create_process_seems_to_have_worked_n
call fcn.004014a0
call fcn.0040a9c1
add eax, 0x20
push eax
call fcn.0040ad55
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov ecx, dword [esp + 0xc3bc]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00409da6
add esp, 0xc3b8
ret

Function at 0x408640
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x425c10], 0
je 0x40869f
mov eax, dword [0x425c14]
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ecx, dword [0x425c10]
push 0x2328
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408686
mov edx, dword [0x425c10]
push 0x8ae
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x425c10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [0x425c18]
push ecx
call esi
pop esi
mov dword [0x425c10], 0
ret