joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cb76
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x5a52fd
call fcn.0043a209
mov ebx, ecx
call fcn.0043b31a
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.004258fa
mov esi, str.WanNengWBInfo.ini
push esi
call fcn.004549d7
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004053e0
push str.guanf
push str.Spreader
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.0043b5b1
and dword [ebp - 4], 0
lea esi, [ebx + 0xec]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x43cbec
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00401fa0
push str.guanf
mov ecx, esi
call fcn.00425671
test eax, eax
jne 0x43cc68
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00446360
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x43cc19
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.guanf
push eax
push edi
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x43cc4a
xor eax, eax
jmp 0x43cc57
lea eax, [ebp - 0x218]
push eax
call fcn.004549d7
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004020c0
jmp 0x43cc6d
mov edi, str.guanf
push edi
mov ecx, esi
call fcn.00425671
test eax, eax
jne 0x43cd30
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00446360
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.004037f0
push str.WanNengWBInfo.ini
mov byte [ebp - 4], 1
call fcn.004549d7
pop ecx
push eax
push str.WanNengWBInfo.ini
lea ecx, [ebp - 0x230]
call fcn.004053e0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x43cd01
xor eax, eax
jmp 0x43cd0e
lea eax, [ebp - 0x218]
push eax
call fcn.004549d7
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004020c0
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.004253f2
push edi
mov ecx, esi
call fcn.00425671
test eax, eax
jne 0x43cd6c
push edi
push str.Spreader
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.0043b718
push eax
mov ecx, esi
call fcn.00403a30
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.004253f2
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.004253f2
call fcn.0043a1c4
ret

Function at 0x43e469
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x43e4e8
push ebx
push edi
Function at 0x43e724
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00446360
push 0x5a6d2c
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.00408fc0
add esp, 0x18
call fcn.0043d15f
test al, al
je 0x43e77e
sub al, 0xa3
push edx
int1
xchg ebp, eax
sub byte [0xb65927e8], 0xb9
adc ecx, dword [ebp + 0x34]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x43ea9a
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00439f30
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
mov dword [ebp - 0x1008], eax
call fcn.00449c97
mov dword [ebp - 0x1018], eax
lea eax, [ebp - 0x1018]
push eax
mov dword [ebp - 0x1014], edx
call fcn.00452db9
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.00424f92
add esp, 0x28
call fcn.0043d525
test al, al
je 0x43eb34
cmp cl, ch
jmp 0x43eb6e
mov edi, dword [ebp - 0x1008]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
inc esi
test eax, eax
cmovne ebx, esi
mov dword [ebp - 0x1008], ebx
call fcn.0043d792
test al, al
je 0x43eb6b
add dword [edx - 0x20d7e10a], esi
invalid
push 0x5a91a0
push edi
call fcn.00453506
pop edx
add byte [edi - 0x18], dl
nop
dec ecx
add dword [eax], eax
mov ebx, eax
mov dword [ebp - 0x1010], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x43ec2c
cmp dword [ebp - 0x1008], 0
jne 0x43ebae
push ebx
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push esi
push eax
call fcn.0045491b
add esp, 0x10
call fcn.0043d6c3
test al, al
je 0x43ebcf
mov bl, 0x81
or dl, byte [edi]
add dword [ebp + 0x5a], esi
aam 0x48
cmp byte [ebp - 0x4f], 0x28
mov dword [esi + esi*4 - 0x30], edi
adc al, 0x8b
popfd
invalid
lea eax, [ebp - 0x1004]
push eax
call fcn.004549d7
push ebx
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.0045491b
push ebx
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.0045491b
push ebx
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.0045491b
push ebx
call fcn.00453304
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x43f293
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
call fcn.0043d2b8
test al, al
je 0x43f2bf
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push eax
push 0xa3b4dc6e
sbb bl, byte [ebp - 0x54]
outsd dx, dword [esi]
sub byte [edi], bl
inc ecx
or dword [edx + edi - 0x49], esp
jl 0x43f2dc
inc edx
invalid
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043f44f
add esp, 0x10
neg eax
add byte [ebx - 0x2708ef3c], al
sbb eax, eax
inc eax
pop ebx
pop ebp
ret
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0043d708
test al, al
je 0x43f2fc
push esp
and ecx, ecx
and bh, ah
mov dword [0xbad8f3d1], eax
pop ds
jge 0x43f2cf
mov dh, 0x98
push edi
call fcn.0043d411
test al, al
je 0x43f324
inc ebp
invalid
salc
mov eax, dword [0x4813b1d1]
dec ebp
leave
out dx, al
test dh, 0x67
fisubr word [edi - 0x33]
dec edx
mov bl, 0x53
dec eax
call fcn.0043d22e
test al, al
je 0x43f343
dec edi
sub byte [esi + 0xd], dl
cmp esp, dword [edx]
in al, 0xa8
cwde
salc
jl 0x43f311
lodsd eax, dword [esi]
push es
cld
mov dh, al
ret 0x14b9
xor ecx, ecx
xor edx, edx
xor ebx, ebx
cmp dword [ebp + 0xc], ecx
jle 0x43f446
mov esi, dword [ebp + 8]
mov al, byte [ebx + esi]
cmp al, 0x3d
jne 0x43f362
inc edx
cmp edx, 2
jg 0x43f3a3
cmp al, 0x7f
ja 0x43f3a3
movzx eax, al
mov al, byte [eax + 0x5ac9d0]
cmp al, 0x7f
je 0x43f3a3
cmp al, 0x40
jae 0x43f37b
test edx, edx
jne 0x43f3a3
inc ecx
inc ebx
mov dword [ebp - 4], ebx
cmp ebx, dword [ebp + 0xc]
jl 0x43f355
test ecx, ecx
je 0x43f446
mov edi, dword [ebp + 0x14]
imul eax, ecx, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x43f3ab
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x43f3a5
push 0xffffffffffffffee
pop eax
jmp 0x43f448
call fcn.0043d6c3
test al, al
je 0x43f3cc
mov cl, 0x75
shl dword [esi], 0x22
not byte [edx]
aad 0x53
pop ebx
invalid
and dword [ebp - 4], 0
xor eax, eax
mov edx, dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
push 3
pop esi
test ebx, ebx
jle 0x43f441
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov cl, byte [eax + 0x5ac9d0]
xor eax, eax
cmp cl, 0x40
sete al
sub esi, eax
movzx eax, cl
mov ecx, dword [ebp - 4]
and eax, 0x3f
shl ecx, 6
or ecx, eax
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], eax
cmp eax, 4
jne 0x43f438
xor eax, eax
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x43f423
mov eax, ecx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp esi, 1
jle 0x43f430
mov eax, ecx
shr eax, 8
mov byte [edx], al
inc edx
cmp esi, 2
jle 0x43f438
mov byte [edx], cl
inc edx
dec ebx
inc edi
test ebx, ebx
jg 0x43f3e2
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f44f
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x43f463
xor eax, eax
jmp 0x43f5a1
mov eax, ebx
shl eax, 3
push 6
pop ecx
cdq
idiv ecx
mov edx, ebx
imul ecx, eax, 6
shl edx, 3
push 3
sub edx, ecx
dec edx
pop ecx
sub edx, 1
je 0x43f48c
dec edx
sub edx, 1
jne 0x43f48e
add eax, 2
jmp 0x43f48e
add eax, ecx
push esi
mov esi, dword [ebp + 0x14]
inc eax
cmp dword [esi], eax
jge 0x43f4a1
push 0xfffffffffffffff0
mov dword [esi], eax
pop eax
jmp 0x43f5a0
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x43f537
dec eax
mov ebx, dword [ebp + 8]
xor edx, edx
push 3
pop ecx
div ecx
inc eax
imul ecx, eax, 3
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x5ac990]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
mov al, byte [eax + 0x5ac990]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
mov al, byte [eax + 0x5ac990]
mov byte [edi + 2], al
mov al, byte [esi + 0x5ac990]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x43f4cc
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x43f53a
mov eax, dword [ebp + 8]
cmp ecx, ebx
jge 0x43f593
movzx edx, byte [eax]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, ebx
jge 0x43f54f
movzx ecx, byte [eax + 1]
jmp 0x43f551
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
mov al, byte [eax + 0x5ac990]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
mov al, byte [eax + 0x5ac990]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], ebx
jge 0x43f588
and ecx, 0xf
mov al, byte [ecx*4 + 0x5ac990]
mov byte [edi + 2], al
jmp 0x43f58c
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [esi], eax
xor eax, eax
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f769
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 8]
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
and dword [ebp - 0x6a4], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.00446360
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5aca60
call fcn.004549d7
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00454e4f
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.00446360
push edi
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.00446360
push 0x64
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x698], edi
push edi
push eax
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x69c], edi
call fcn.00446360
add esp, 0x34
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x43f867
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.00409f80
add esp, 0xc
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.00407220
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret 4

Function at 0x440997
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x89], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x44125a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov byte [ebp - 1], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
lea ecx, [eax + 0x210]
mov dword [ebp - 8], eax
mov esi, dword [ecx]
push edi
mov dword [ebp - 0xc], ecx
cmp esi, dword [eax + 0x214]
je 0x441328
lea edi, [esi + 0x28]
mov dword [ebp + 8], edi
lea ecx, [ebx + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a8a74
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a8a74
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a8a74
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5a8a74
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.00454fb0
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x441308
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.00454fb0
pop ecx
pop ecx
test eax, eax
je 0x441324
mov eax, 0x1b0
add edi, eax
add esi, eax
mov eax, dword [ebp - 8]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
je 0x441328
jmp 0x44128c
mov byte [ebp - 1], 1
call fcn.0043d15f
test al, al
je 0x441341
bnd jo 0x441336
adc edx, esp
push ebp
jecxz 0x441342
lcall 0x5cb8, 0x8ce27cf6
or eax, 0xff7d80
cmp byte [ebp - 1], 0
jge 0x441343
inc dword [eax]
add byte [ebp + 0x1e], dh
jne 0x441365
lea edx, [ebx + 0xa8]
push edx
call fcn.00454b50
pop ecx
test eax, eax
je 0x441365
mov ecx, dword [ebp - 0xc]
push ebx
call fcn.00442098
mov al, 1
jmp 0x441367
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x441f65
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x210]
push ebx
push esi
add byte [ebx + 0x56], dl
push edi
mov dword [ebp - 0x11c], ecx
mov dword [ecx + 0x214], eax
call fcn.0043d4e0
test al, al
je 0x441faa
inc ebp
and ecx, dword [ebx]
insb byte es:[edi], dx
hlt
call fcn.0043d2fd
test al, al
je 0x441fd1
cmpsd dword [esi], dword es:[edi]
jno 0x441fb7
loop 0x441fbd
add eax, 0x117c7c7a
jp 0x442036
jl 0x441fcd
jg 0x441fce
adc byte [ebx - 0x5a4414b1], bl
aaa
invalid
wait
dec edi
jmp 0x441f7d
mov al, byte [0x66ca8956]
push 0xffffffffffffffe8
mov edx, ecx
push 0xffffffffffffffe8
retf 0x6a66
call fcn.0043d3cc
test al, al
div byte [ebx - 0x3f7b0001]
je 0x441ff9
xchg esi, eax
cmp dword [edx - 0x5b], ecx
enter 0x5289, 0x5e
outsb dx, byte [esi]
sub ebx, 0x1f
sub al, 0x5b
xchg esp, eax
pushal
arpl dx, sp
push ebp
je 0x441fcb
push ebx
pop ds
std
jne 0x441fdb
mov dword [0xf6f21509], eax
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00446360
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
mov esi, dword [ebp - 0x11c]
jne 0x44203c
invalid
mov ecx, esi
call fcn.00441825
jmp 0x442051
jmp 0x44202f
mov edi, ebx
test ebx, ebx
jne 0x442051
mov ecx, esi
call fcn.0044167c
inc edi
mov ebx, eax
cmp edi, 0xa
jl 0x44203e
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439cb7
mov esp, ebp
pop ebp
ret

Function at 0x442500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.00443840
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.004437f0
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.00443890
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x44253c
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x442590
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x442580
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x442580
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x4427a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a56f6
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x4427fa
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x442817
mov eax, dword [esi + 0x20]
jmp 0x44281a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x442834
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x44284e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x442868
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.00449c97
push eax
call fcn.00454f36
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00446360
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x442927
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.00446360
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x442918
test eax, eax
je 0x442918
add eax, eax
cmp eax, 0x412
jae 0x442913
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x44291e
call fcn.0043a878
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.00403ab0
mov eax, dword [esi + 0x30]
test eax, eax
je 0x442953
cmp dword [esi + 0x34], 8
jb 0x442939
mov ecx, dword [esi + 0x20]
jmp 0x44293c
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x442953
push 1
push 0x5a6c98
lea ecx, [esi + 0x20]
call fcn.004053e0
cmp dword [esi + 0x30], 0
jne 0x442968
push 3
push 0x5aca60
lea ecx, [esi + 0x20]
call fcn.004020c0
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
Function at 0x442990
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x60], 0
je 0x4429ac
cmp dword [edi + 0x64], 8
lea eax, [edi + 0x50]
jb 0x4429a5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x80]
test eax, eax
je 0x4429c9
push eax
call fcn.00439cd1
add esp, 4
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x68]
cmp eax, 8
jb 0x4429df
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402210
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4429f5
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x50]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x442a10
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402210
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x442a26
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x442a41
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402210
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x442a57
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x442a72
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00402210
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x442a88
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x442aa2
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.00402210
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x442ac1
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x444120
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x44415e
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x44415e
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x45d60c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045d48b

Function at 0x45f5d4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f294
Function at 0x469fa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x469fcc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x469fbd
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x46a000
cmp dword [esi + 8], 0
jne 0x469ff0
push 0x5a8a80
push dword [eax + 8]
call fcn.0045351d
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x469ff0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004539cf
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x46a022
mov eax, dword [esi + 8]
test eax, eax
je 0x46a01c
push eax
call fcn.00453304
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x46a440
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x62c144]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x46a490
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x46a48a
shr eax, 8
cmp al, 2
jne 0x46a48a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439cb7
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.00439cb7
mov esp, ebp
pop ebp
ret