joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461e6d
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x461e7b
sub edi, ecx
sar edi, 1
lea eax, [edi + 1]
test eax, eax
js 0x461ea1
lea eax, [edi*2 + 2]
call fcn.006408f0
mov esi, esp
jmp 0x461eb2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [0x7b0cc8], eax
mov dword [0], esi
lea eax, [edi*2 + 2]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
push esi
call fcn.00658b30
add esp, 0xc
push 0x5c
pop edx
cmp word [esi], dx
jne 0x461ee7
cmp word [esi + 2], dx
jne 0x461ee7
cmp word [esi + 4], 0x3f
jne 0x461f4c
cmp word [esi + 6], dx
jne 0x461f4c
add esi, 8
cmp edi, 3
jl 0x461ef6
cmp word [esi + 2], 0x3a
jne 0x461ef6
add esi, 6
push edx
push esi
call fcn.0047c649
mov esi, eax
test esi, esi
je 0x461f3f
mov edi, dword [ebp - 4]
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x461f21
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x461f67
push 0x5c
xor ecx, ecx
pop eax
mov word [esi - 2], ax
cmp word [esi], cx
je 0x461f3f
push eax
lea eax, [esi + 2]
push eax
call fcn.0047c649
mov esi, eax
test esi, esi
jne 0x461f06
mov al, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 2
pop ecx
add esi, 4
movzx eax, word [esi]
add esi, 2
cmp ax, dx
jne 0x461f62
sub ecx, 1
je 0x461ef6
test ax, ax
jne 0x461f52
xor al, al
jmp 0x461f41

Function at 0x4625e5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x6a1c79
call fcn.00640244
push ecx
xor edx, edx
mov dword [ebp - 0x10], edx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], edx
jb 0x46260e
mov eax, dword [esi]
jmp 0x462610
mov eax, esi
xor ecx, ecx
push ebx
mov word [eax], cx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push edx
push edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 1
call ebx
mov edi, eax
test edi, edi
je 0x46268d
push 0
push edi
mov ecx, esi
call fcn.0043fb65
cmp dword [esi + 0x14], 8
jb 0x462644
mov eax, dword [esi]
jmp 0x462646
mov eax, esi
push eax
push edi
call ebx
test eax, eax
jne 0x462664
and dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x46265b
mov eax, dword [esi]
jmp 0x46265d
mov eax, esi
xor ecx, ecx
mov word [eax], cx
jmp 0x46268d
cmp dword [esi + 0x14], 8
jb 0x46266e
mov ecx, dword [esi]
jmp 0x462670
mov ecx, esi
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x462675
sub ecx, edx
sar ecx, 1
push ebx
push ecx
mov ecx, esi
call fcn.0043fb65
xor eax, eax
pop ebx
cmp dword [esi + 0x10], eax
jne 0x4626aa
mov edi, 0x6cc408
push edi
call fcn.00428460
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00438cfb
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x462b13
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push ebx
push esi
push edi
mov ebx, 0x104
or esi, 0xffffffff
push ebx
push eax
push dword [ebp + 8]
mov edi, SysReAllocString
call fcn.00471786
test al, al
je 0x462bbb
push ebx
xor ebx, ebx
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x462bbb
push str.FATE
lea eax, [ebp - 0x208]
push eax
call fcn.0047e15a
test al, al
jne 0x462bbb
push str.FAT32
lea eax, [ebp - 0x208]
push eax
call fcn.0047e15a
test al, al
jne 0x462bb9
push 0x6cccf0
lea eax, [ebp - 0x208]
push eax
call fcn.0047e15a
test al, al
jne 0x462bb4
push str.FAT16
lea eax, [ebp - 0x208]
push eax
call fcn.0047e15a
test al, al
je 0x462bbb
mov esi, 0x7ffa8000
mov edi, ebx
push dword [ebp + 8]
push edi
push esi
push str.GetMaxFileSize___returning__Ld_for___s_
call fcn.0040e2b4
add esp, 0x10
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x462faf
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x438]
push ebx
push esi
push 0x21c
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov esi, eax
call fcn.004765c9
xor ebx, ebx
test al, al
je 0x46301b
mov ecx, str.Sysnative..explorer.exe
lea eax, [esi + esi]
sub eax, ecx
lea edx, [ebp - 0x438]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x462feb
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
test ecx, ecx
je 0x463059
mov ecx, 0x6cce44
lea eax, [esi + esi]
sub eax, ecx
lea edx, [ebp - 0x438]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x46302d
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
xor ecx, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x463278
Capabilities:
Get disk information

Disassembly:
mov eax, 0x69c666
call fcn.00640244
sub esp, 0x2c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push 0x104
push 0
push eax
call fcn.004407ff
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x4632a8
lea eax, [ebp - 0x38]
push ebx
push 0xa
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.00471786
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 2
lea ecx, [ebp - 0x38]
push 0
push 1
sete bl
call fcn.004281f2
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x463359
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
push str.ReplaceFileW
xor ebx, ebx
push 0x6c0ff0
mov esi, ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x463418
push dword [0x7b0438]
call fcn.00669db1
call fcn.00669d90
push eax
push dword [ebp + 0xc]
mov esi, 0x104
lea eax, [ebp - 0x208]
push str._s._u.tmp
push esi
push eax
call fcn.00464914
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push str._s.new
push esi
push eax
call fcn.00464914
add esp, 0x28
lea eax, [ebp - 0x410]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push ebx
push ebx
push 2
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 0xc]
call edi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x463418
push 4
push ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
pop edi
test esi, esi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4636dd
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push dword [esp + 0x220]
xor ebx, ebx
mov esi, ebx
call fcn.00461054
movzx ebp, al
test al, al
mov eax, 0x6c111c
je 0x463707
mov eax, str..new
push eax
push dword [esp + 0x224]
lea eax, [esp + 0x1c]
push 0x6c1e64
push 0x104
push eax
call fcn.00464914
add esp, 0x14
lea eax, [esp + 0x14]
push 0x80
push 7
push eax
call fcn.00461598
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x463744
xor al, al
jmp 0x4637b5
push dword [esp + 0x228]
push dword [esp + 0x228]
push eax
call fcn.00461a64
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
call fcn.00461528
test ebp, ebp
je 0x4637a2
push dword [esp + 0x220]
lea eax, [esp + 0x18]
push eax
call fcn.00463359
movzx esi, al
test al, al
jne 0x4637a2
push ebx
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x228]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [esp + 0x10], ebx
jne 0x4637b3
test esi, esi
jne 0x4637b0
test ebp, ebp
jne 0x4637b3
xor ebx, ebx
inc ebx
mov al, bl
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc

Function at 0x46385a
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x46386a
xor al, al
jmp 0x4638c6
mov eax, dword [esp + 8]
push ebx
push esi
push edi
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call fcn.00658b30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, bl
pop ebx
ret 8
Function at 0x463d38
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0x10
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
test eax, eax
jne 0x463d79
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_get_computer_name____d__d
call fcn.0047cc09
add esp, 0xc
push 0x6cce80
jmp 0x463d7d
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00429973
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4642dd
Capabilities:
Check http status code

Disassembly:
mov eax, 0x69cddf
call fcn.00640244
sub esp, 0x44
push ebx
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x10]
mov esi, ecx
push eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 0x20000013
push dword [esi]
mov dword [ebp - 0x18], ebx
call dword [0x7ab508]
test eax, eax
je 0x464357
cmp dword [ebp - 0x14], 0xc8
je 0x464357
push dword [ebp - 0x14]
lea eax, [ebp - 0x50]
push str.HTTP_Reply__d
push eax
call fcn.004654e1
add esp, 0xc
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x46433f
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.004642a8
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.004281f2
jmp 0x464418
push edi
xor eax, eax
mov byte [ebp - 0x38], bl
lea edi, [ebp - 0x37]
mov dword [ebp - 0x10], 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x1d
push dword [esi]
call dword [0x7ab508]
test eax, eax
je 0x4643a0
lea eax, [ebp - 0x38]
push str.gzip
push eax
call fcn.00669dfe
pop ecx
pop ecx
test eax, eax
jne 0x4643a0
or byte [esi + 0x25], 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x20
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
push eax
lea eax, [esi + 5]
push eax
push 1
push dword [esi]
call dword [0x7ab508]
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 0x24]
push eax
push 0x20000005
push dword [esi]
call dword [0x7ab508]
test eax, eax
je 0x4643ea
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ebx
push 0xa
pop ecx
xor eax, eax
lea edi, [esi + 0x2c]
rep stosd dword es:[edi], eax
mov edi, 0x2000
mov dword [esi + 0x2c], 0x28
push edi
call fcn.004600d6
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edi
mov byte [esi + 4], 1
call fcn.0046446b
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46b229
Capabilities:
Create thread

Disassembly:
mov eax, 0x6a0cd0
call fcn.00640244
sub esp, 0x14
and dword [ebp - 0x10], 0
push esi
push edi
mov edi, dword [ebp + 0x20]
test edi, edi
jne 0x46b246
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [edi]
mov esi, eax
mov edi, 0x7ab684
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x1c], 1
call fcn.0046b312
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0x7ab6c0
call fcn.0046a662
push edi
call fcn.0046b405
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x46cb23
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0x784c34]
cmp esi, 0x270
jl 0x46cbe8
xor esi, esi
push ebx
mov edx, esi
mov ebx, SysReAllocString
mov ecx, dword [edx*4 + 0x7ab844]
xor ecx, dword [edx*4 + 0x7ab840]
and ecx, ebx
xor ecx, dword [edx*4 + 0x7ab840]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x784e38]
xor ecx, dword [edx*4 + 0x7abe74]
mov dword [edx*4 + 0x7ab840], ecx
inc edx
cmp edx, 0xe3
jl 0x46cb40
cmp edx, 0x26f
jge 0x46cbb9
push edi
lea edi, [edx*4 + 0x7ab840]
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, ebx
xor ecx, dword [edi]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x784e38]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0x7ac1fc
jl 0x46cb8c
pop edi
mov ecx, dword [0x7ab840]
xor ecx, dword [0x7ac1fc]
and ecx, ebx
xor ecx, dword [0x7ac1fc]
mov eax, ecx
shr ecx, 1
and eax, 1
pop ebx
xor ecx, dword [eax*4 + 0x784e38]
xor ecx, dword [0x7abe70]
mov dword [0x7ac1fc], ecx
mov ecx, dword [esi*4 + 0x7ab840]
mov eax, ecx
shr eax, 0xb
inc esi
xor ecx, eax
mov dword [0x784c34], esi
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret

Function at 0x46cd7f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
mov dword [0x7ab840], eax
inc edx
mov ecx, 0x7ab840
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x7ac1fc
jl 0x46cd90
mov dword [0x784c34], edx
ret 4
Function at 0x46ddd9
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x46de0f
xor eax, eax
cmp dword [ebp + 0x14], eax
setne al
cmp dword [ebp + 0x18], 0
je 0x46ddfd
or eax, 2
test ecx, eax
je 0x46de0f
not eax
and eax, ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
pop ebp
ret 0x14

Function at 0x46e0fe
Capabilities:
Copy file

Disassembly:
push ebp
sub esp, 0x54
mov eax, 0x6a0e80
call fcn.00640244
sub esp, 0x74
push ebx
push esi
mov esi, dword [ebp + 0x64]
push edi
push dword [ebp + 0x6c]
mov edi, dword [ebp + 0x68]
push esi
push dword [ebp + 0x60]
and dword [edi], 0
call fcn.00463066
mov ebx, eax
test ebx, ebx
jne 0x46e148
push dword [ebp + 0x60]
call fcn.00461054
xor ecx, ecx
test al, al
setne cl
add ecx, 2
xor eax, eax
mov dword [edi], ecx
jmp 0x46e27a
cmp byte [ebx], 0x64
jne 0x46e278
cmp dword [esi], 0x39
jb 0x46e278
push 0x11
push str.d10:.fileguard40:
push ebx
call fcn.006593f7
add esp, 0xc
test eax, eax
je 0x46e186
push 0x11
push str.d10:file_guard40:
push ebx
call fcn.006593f7
add esp, 0xc
test eax, eax
jne 0x46e278
push 0xa
pop ecx
push 1
push 0x28
lea eax, [ebp]
push eax
lea eax, [ebp + 0x2c]
lea esi, [ebx + 0x11]
lea edi, [ebp]
rep movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp + 0x28], 0
call fcn.00470e65
test al, al
jne 0x46e1b1
mov eax, str.malformed_guard
jmp 0x46e228
mov esi, dword [ebp + 0x64]
add dword [esi], 0xffffffc8
mov eax, dword [esi]
dec eax
push eax
lea eax, [ebx + 0x39]
push eax
lea eax, [ebx + 1]
push eax
call fcn.00658170
mov eax, dword [esi]
lea ecx, [ebp - 0x80]
add esp, 0xc
mov byte [ebx + eax], 0
call fcn.0046a427
push dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x80]
push ebx
call fcn.0046a3c3
mov edx, eax
lea esi, [ebp + 0x2c]
xor ecx, ecx
mov eax, dword [esi + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x46e217
inc ecx
cmp ecx, 5
jne 0x46e1ef
push dword [ebp + 0x60]
push str.File_passed_integrity_check:__s
call fcn.0040e2b4
add esp, 8
lea ecx, [ebp - 0x80]
call fcn.0040e2b4
jmp 0x46e278
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0040e2b4
mov eax, str.hash_doesnt_match
push dword [ebp + 0x60]
push eax
push str.Warning:_file_integrity_check_failed___s_:__s
call fcn.0047cc80
push str.Ignore_this_warning_if_you_switched_to_1.6.1_or_older_and_back
call fcn.0047cc80
add esp, 0x10
lea eax, [ebp + 0x40]
push 0x6cec40
push dword [ebp + 0x60]
push eax
call fcn.0046e46e
cmp dword [ebp + 0x54], 8
mov eax, dword [ebp + 0x40]
jae 0x46e260
lea eax, [ebp + 0x40]
push 0
push eax
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push 0
push 1
lea ecx, [ebp + 0x40]
call fcn.004281f2
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x58]
pop ebp
ret 0x10
Function at 0x46fd2f
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x46fd6f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x46fd6f
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x472c2a
Capabilities:
Delete file

Disassembly:
mov eax, 0x6a113c
call fcn.00640244
sub esp, 0x28
push ebx
push esi
push dword [0x789830]
xor ebx, ebx
mov byte [ebp - 0xd], bl
call fcn.0048342b
mov esi, eax
test esi, esi
jne 0x472c5b
push ebx
mov byte [ebp - 0xd], 1
call fcn.0048342b
mov esi, eax
mov eax, fcn.00482b54
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
test esi, esi
je 0x472d03
push str.campaigncode.txt
lea eax, [ebp - 0x34]
mov dword [ebp - 0x14], ebx
push eax
call fcn.0047dfcb
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 1
jb 0x472c8e
mov eax, dword [eax]
push edi
lea ecx, [ebp - 0x14]
push ecx
push eax
push esi
call fcn.00482e98
push ebx
push 1
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004281f2
test edi, edi
je 0x472cd4
cmp dword [ebp - 0x14], 0
je 0x472cd4
push edi
call fcn.00666c12
pop ecx
mov ecx, 0x7ac4a8
mov ebx, eax
call fcn.004730a5
test eax, eax
jne 0x472cce
mov dword [0x7ad374], ebx
mov dword [0x7ad370], ebx
cmp byte [ebp - 0xd], 0
je 0x472ced
cmp dword [esi + 0x14], 8
jb 0x472ce4
mov eax, dword [esi]
jmp 0x472ce6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov byte [ebp - 4], 2
test edi, edi
je 0x472cfd
push 1
push edi
call fcn.004600c9
mov eax, fcn.00482b54
pop edi
mov dword [ebp - 4], 3
test eax, eax
je 0x472d18
test esi, esi
je 0x472d18
push esi
call fcn.00482b54
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x473012
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x6a11a6
call fcn.00640244
sub esp, 0xc
push esi
push edi
xor edx, edx
lea edi, [ecx + 0xef0]
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x14], edx
jb 0x473036
mov eax, dword [edi]
jmp 0x473038
mov eax, edi
push edx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
xor ecx, ecx
mov dword [ebp - 0x10], eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00640585
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
jb 0x47306a
mov edi, dword [edi]
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov ecx, dword [ebp + 8]
push esi
call fcn.00429973
test esi, esi
je 0x473089
push esi
call fcn.00640272
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4749f1
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x6a13d4
call fcn.00640244
sub esp, 0x44
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push edi
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], 1
call fcn.00478821
mov edi, dword [ebp + 8]
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], ebx
jb 0x474a2e
mov eax, dword [edi]
jmp 0x474a30
mov eax, edi
mov byte [eax], bl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
call fcn.004761f9
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
sar ecx, 2
test ecx, ecx
je 0x474b67
push esi
call fcn.004761f9
mov eax, dword [eax]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 8]
jmp 0x474b3d
mov edi, dword [edx + 4]
movzx edx, word [edx + 8]
add edi, dword [eax]
test dl, 0xe0
je 0x474b34
and edx, 0xf
jmp dword [edx*4 + 0x474e39]
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
add edx, 0x1c
mov ebx, dword [edx]
mov dword [ebp - 0x18], edx
test ebx, ebx
jne 0x474a63
mov ebx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x1c], ebx
call fcn.004761f9
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
sar ecx, 2
cmp ebx, ecx
jb 0x474a4e
pop esi
mov dword [ebp - 4], 5
call fcn.00478862
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x478daa
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x478ead
push ebx
xor ebx, ebx
inc ebx
cmp byte [esp + 0x10], 0
je 0x478de9
xor eax, eax
mov word [esp + 0x10], bx
push 4
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push eax
push 0x80
push 0xffff
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_setsockopt]
test byte [edi + 0xe], 0x20
je 0x478e79
mov ecx, dword [edi + 0x54]
test ecx, ecx
jns 0x478dfe
neg ecx
jmp 0x478e00
xor ecx, ecx
mov esi, dword [edi + 0x90]
test esi, esi
jns 0x478e0e
neg esi
jmp 0x478e10
xor esi, esi
xor eax, eax
push ebp
mov dword [esp + 0x14], eax
cmp dword [edi + 0xf4], eax
jle 0x478e49
lea ebp, [edi + 0xe0]
mov ebx, dword [ebp]
test ebx, ebx
je 0x478e39
mov eax, ecx
cdq
add dword [ebx + 0x2c], eax
mov eax, dword [esp + 0x14]
adc dword [ebx + 0x30], edx
inc eax
add ebp, 4
mov dword [esp + 0x14], eax
cmp eax, dword [edi + 0xf4]
jl 0x478e25
xor ebx, ebx
cmp dword [edi + 0xf4], ebx
jle 0x478e75
lea ebp, [edi + 0xe0]
mov ecx, dword [ebp]
test ecx, ecx
je 0x478e69
mov eax, esi
cdq
add dword [ecx + 0x34], eax
adc dword [ecx + 0x38], edx
inc ebx
add ebp, 4
cmp ebx, dword [edi + 0xf4]
jl 0x478e59
xor ebx, ebx
inc ebx
pop ebp
push dword [edi + 4]
call fcn.0047a723
or dword [edi + 4], 0xffffffff
test byte [edi + 0xe], 0x20
je 0x478eac
cmp byte [edi + 0x18], 6
jb 0x478eac
push ebx
push 2
push 0x40
lea ecx, [edi + 0x4c]
call fcn.00476e58
push 0
push 2
push 0x40
lea ecx, [edi + 0x4c]
call fcn.00476e58
pop ebx
and byte [edi + 0xe], 0xdf
cmp byte [edi + 0xe], 0
jge 0x478ed6
mov esi, dword [edi + 0xf8]
and dword [edi + 0xf8], 0
test esi, esi
je 0x478ed6
push esi
call fcn.004e3a4a
push 0
push esi
call fcn.004e43c7
pop edi
pop esi
ret 4