joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457f00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x457f19
mov edi, ebx
mov ebx, eax
jmp 0x457f1b
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jle 0x457f31
push eax
push esi
call fcn.0041daf0
add esp, 8
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x457f4f
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x457f38
cmp eax, dword [edi + 4]
jge 0x457f66
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x457f54
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x457f91
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
lea esp, [esp]
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x457f91
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x457f80
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x45bf80
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.0047a8c0
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x45bf9a
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x45c01c
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x45bfe8
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call fcn.00413b50
add esp, 8
test eax, eax
jne 0x45c009
push edi
mov edi, 0x4a2708
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x45bfe8
push ebx
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
jne 0x45c00c
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebx
call fcn.00413b50
add esp, 8
test eax, eax
je 0x45c013
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebx
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x45d871
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x290
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push ebp
push esi
push edi
mov ecx, str.MSYDCOM.dat
call fcn.0045d9c1
xor ebp, ebp
test eax, eax
lea ecx, [eax + 1]
lea eax, [esp + 0x10]
cmovns ebp, ecx
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x45d8e9
lea eax, [esp + 0x94]
push eax
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea edi, [esp + 0x94]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45d8d7
mov esi, str.Microsoft_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x45d8f4
mov dword [esp + 0x94], 0x5c3a43
mov al, byte [esp + ebx + 0x94]
mov byte [esp + ebx + 0x198], al
inc ebx
test al, al
jne 0x45d8f4
lea edi, [esp + 0x198]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45d90f
mov esi, str.MSYDCOM.dat
xor eax, eax
push 0xa
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x8c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x8c]
push eax
push ebp
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
lea esi, [esp + 0x94]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x45d94a
sub esi, ecx
lea ecx, [esp + 0x14]
call fcn.0045d0e0
push esi
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x1c]
call fcn.0045d112
lea eax, [esp + 0x198]
push 0x4a2948
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45d9a8
push edi
push esi
lea ecx, [esp + 0x90]
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
add esp, 0x14
inc eax
mov ecx, dword [esp + 0x29c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046f100
add esp, 0x290
ret
Function at 0x45d9c1
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x284
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x280], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1c
push ebx
mov ebp, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x45da27
lea eax, [esp + 0x88]
push eax
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea edi, [esp + 0x88]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45da15
mov esi, str.Microsoft_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x45da32
mov dword [esp + 0x88], 0x5c3a43
mov ecx, ebx
mov al, byte [esp + ecx + 0x88]
mov byte [esp + ecx + 0x18c], al
inc ecx
test al, al
jne 0x45da34
mov esi, ebp
mov al, byte [ebp]
inc ebp
test al, al
jne 0x45da49
lea edi, [esp + 0x18c]
sub ebp, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x45da5b
mov ecx, ebp
lea eax, [esp + 0x18c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
push 0x4a294c
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebp, eax
pop ecx
pop ecx
test ebp, ebp
jne 0x45daa2
lea eax, [esp + 0x18c]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
inc eax
neg eax
sbb eax, eax
jmp 0x45db20
push 2
push ebx
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push ebp
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
add esp, 0x14
test esi, esi
je 0x45daec
lea eax, [esi + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push ebp
push esi
mov edi, eax
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x14
cmp eax, esi
je 0x45daf7
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
or ebx, 0xffffffff
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
jmp 0x45db21
lea ecx, [esp + 0x14]
call fcn.0045d0e0
push esi
push edi
lea ecx, [esp + 0x1c]
call fcn.0045d112
push edi
mov byte [edi + esi], bl
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, esi
pop ecx
pop ecx
mov ecx, dword [esp + 0x290]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046f100
add esp, 0x284
ret
Function at 0x45f1c7
Capabilities:
Encode data using base64

Disassembly:
push 0x18
mov eax, 0x47b092
call fcn.0046fa56
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x20], ebx
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
mov byte [ecx], bl
mov eax, dword [ebp + 8]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 1
test eax, eax
je 0x45f35a
push 3
pop esi
jmp 0x45f20e
mov edx, dword [ebp - 0x24]
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
mov byte [ebp + edi - 0x14], al
inc edi
mov ch, byte [ebp - 0x12]
inc edx
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov dl, byte [ebp - 0x13]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x45f2a0
mov esi, dword [ebp - 0x1c]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], ch
cmp dword [0x4c1134], 0xf
mov ecx, 0x4c1120
movzx eax, byte [ebp + edi - 0x18]
cmova ecx, dword [0x4c1120]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0045f557
inc edi
cmp edi, 4
jl 0x45f268
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x45f20b
mov dword [ebp + 8], edi
test edi, edi
je 0x45f357
mov eax, edi
cmp edi, esi
jge 0x45f2d6
cmp eax, esi
jae 0x45f362
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x45f2be
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x45f342
mov esi, dword [ebp - 0x1c]
mov edi, eax
cmp dword [0x4c1134], 0xf
mov ecx, 0x4c1120
movzx eax, byte [ebp + ebx - 0x18]
cmova ecx, dword [0x4c1120]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0045f557
inc ebx
cmp ebx, edi
jl 0x45f313
mov edi, dword [ebp + 8]
push 3
pop esi
cmp edi, esi
jge 0x45f357
sub esi, edi
mov ecx, dword [ebp - 0x1c]
push 0x3d
call fcn.0045f557
sub esi, 1
jne 0x45f348
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
call fcn.0046fa24
ret
call fcn.0046f253
int3
Function at 0x463352
Capabilities:
Get socket status

Disassembly:
sub esp, 0x61c
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x618], eax
mov eax, dword [esp + 0x624]
push ebx
push ebp
mov ebp, dword [esp + 0x628]
xor ebx, ebx
and dword [esp + 0x14], ebx
mov eax, dword [eax + 8]
push esi
mov esi, ecx
mov dword [esp + 0x10], ebp
push edi
xor edi, edi
mov dword [esp + 0x18], eax
cmp dword [esi + 0x11c], ebx
je 0x46358c
and dword [esp + 0x20], 0
mov eax, dword [esi + 0x120]
mov dword [esp + 0x128], eax
mov dword [esp + 0x124], 1
test ebx, ebx
je 0x4633c6
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x18]
inc eax
push ecx
push 0
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x130]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x463550
test eax, eax
je 0x46352c
lea eax, [esp + 0x124]
push eax
push dword [esi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x463428
test ebx, ebx
je 0x463399
lea eax, [esp + 0x20]
push eax
push dword [esi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x463399
xor ebx, ebx
push 0x400
lea eax, [esp + 0x22c]
push eax
push ebp
call fcn.004011f0
mov ebp, eax
push ebp
push dword [esp + 0x24]
call fcn.004026e0
add esp, 0x14
test eax, eax
jne 0x4634c6
lea eax, [edi + ebp]
mov dword [esp + 0x10], eax
cmp eax, 0x27ff
jg 0x4634e5
push ebp
lea eax, [esp + 0x22c]
push eax
mov eax, dword [esi + 0x11c]
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push ebp
call fcn.004011d0
add esp, 0x10
test eax, eax
jne 0x46342a
mov eax, dword [esi + 0x11c]
xor ecx, ecx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x20], ecx
mov byte [edi + eax], cl
test edi, edi
jne 0x463571
push 0x190
lea ecx, [esp + 0x14]
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x4635a1
cmp eax, 6
je 0x46348e
mov ebp, dword [esp + 0x14]
cmp eax, 2
je 0x463399
cmp eax, 3
jne 0x46350a
xor ebx, ebx
inc ebx
jmp 0x463399
and dword [esp + 0x124], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0x20], ebx
push 0x198
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x4635a1
and dword [esp + 0x124], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0x20], ebx
push 0x19e
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x4635a1
and dword [esp + 0x124], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x20], 0
push 0x192
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x4635a1
and dword [esp + 0x124], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x20], 0
push 0x6d
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x4635a1
mov ecx, dword [esp + 0x628]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046f100
add esp, 0x61c
ret 8
push 0x19a
lea ecx, [esp + 0x18]
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4637b6
Capabilities:
Get socket status
Print debug messages

Disassembly:
sub esp, 0x22c
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x230]
mov edx, dword [esp + 0x234]
and dword [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [edi + 0x118]
mov esi, ecx
lea ebx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4637f2
mov eax, dword [edx + 4]
xor ebp, ebp
and dword [esp + 0x1c], ebp
sub esi, ebx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x463979
jmp 0x463905
and dword [esp + 0x20], 0
mov eax, dword [edi + 0x120]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], 1
test ebp, ebp
je 0x463842
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x18]
inc eax
push ecx
push 0
lea ecx, [esp + 0x130]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x463958
test eax, eax
je 0x463934
lea eax, [esp + 0x128]
push eax
push dword [edi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x4638a0
test ebp, ebp
je 0x463905
lea eax, [esp + 0x20]
push eax
push dword [edi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x463905
mov eax, dword [edi + 0x118]
xor ebp, ebp
add eax, dword [esp + 0x14]
push esi
push eax
push dword [esp + 0x18]
call fcn.00401290
mov ebx, eax
push ebx
push dword [esp + 0x20]
call fcn.004026e0
add esp, 0x14
sub eax, ebp
je 0x4638ff
dec eax
sub eax, 1
je 0x4638fa
sub eax, 1
je 0x463905
and dword [esp + 0x20], ebp
lea ecx, [esp + 0x10]
and dword [esp + 0x128], ebp
push 0x19e
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x46398e
xor ebp, ebp
inc ebp
jmp 0x463905
sub esi, ebx
add dword [esp + 0x14], ebx
test esi, esi
jg 0x463815
push dword [edi + 0x118]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046f100
add esp, 0x22c
ret 8
and dword [esp + 0x128], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x20], 0
push 0x192
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x46398e
and dword [esp + 0x128], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x20], 0
push 0x6d
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x46398e
push 0x19b
lea ecx, [esp + 0x14]
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4639dc
Capabilities:
Get socket status

Disassembly:
sub esp, 0x22c
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x16c]
test eax, eax
je 0x463b8c
push eax
call fcn.00401e00
mov dword [esi + 0x170], eax
pop ecx
test eax, eax
jne 0x463a2f
push 0x19e
lea ecx, [esp + 0x18]
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x463ba1
push dword [esi + 0x120]
push eax
call fcn.00401170
xor ebp, ebp
push ebp
push 4
push 0x21
push dword [esi + 0x170]
call fcn.004022a0
add esp, 0x18
mov dword [esp + 0x18], 0xb4
mov ebx, ebp
mov dword [esp + 0x1c], ebp
mov edi, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x128], ebp
test ebx, ebx
je 0x463a81
mov eax, dword [esi + 0x120]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
test edi, edi
je 0x463a9d
mov eax, dword [esi + 0x120]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], 1
test ebx, ebx
jne 0x463aa5
test edi, edi
je 0x463ad7
lea eax, [esp + 0x18]
mov ebx, ebp
push eax
push ebp
lea eax, [esp + 0x28]
mov edi, ebp
push eax
lea eax, [esp + 0x134]
push eax
mov eax, dword [esi + 0x120]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x463b54
test eax, eax
je 0x463b32
push dword [esi + 0x170]
call fcn.00402800
push eax
push dword [esi + 0x170]
call fcn.004026e0
add esp, 0xc
sub eax, ebp
je 0x463b73
dec eax
sub eax, 1
je 0x463b08
sub eax, 1
jne 0x463b10
xor ebx, ebx
inc ebx
jmp 0x463a60
xor edi, edi
inc edi
jmp 0x463a60
push 0x19e
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x12c], ebp
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x463ba1
push 0x192
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x12c], ebp
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x463ba1
push 0x6d
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x12c], ebp
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
jmp 0x463ba1
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046f100
add esp, 0x22c
ret
push 0x19e
lea ecx, [esp + 0x18]
call fcn.0045f7e8
push 0x4ac194
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x464d1d
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x465589
Capabilities:
Get file version info

Disassembly:
sub esp, 0x114
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push edi
mov ebp, edx
mov ebx, ecx
call dword [sym.imp.mfc140.dll_Ordinal_2241]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x465635
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
je 0x465635
push esi
push edi
call dword [sym.imp.mfc140.dll_Ordinal_265]
pop ecx
mov esi, eax
lea eax, [esp + 0x1c]
push esi
push edi
push dword [esp + 0x18]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x465626
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push 0x4a37b0
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x465626
mov ecx, dword [esp + 0x14]
xor edi, edi
inc edi
mov eax, dword [ecx + 8]
mov dword [ebx], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp], eax
jmp 0x465628
xor edi, edi
push esi
call dword [sym.imp.mfc140.dll_Ordinal_266]
pop ecx
mov eax, edi
pop esi
jmp 0x465637
xor eax, eax
mov ecx, dword [esp + 0x11c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046f100
add esp, 0x114
ret

Function at 0x46568a
Capabilities:
Read data from internet
Receive data

Disassembly:
sub esp, 0x208
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x220]
lea eax, [esp + 0x14]
xor ebx, ebx
mov esi, edx
push 0x200
push ebx
push eax
mov ebp, ecx
mov dword [esp + 0x1c], ebx
call sub.VCRUNTIME140.dll_memset
push 0x400
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
mov dword [edi], ebx
add esp, 0x18
mov ebx, dword [sym.imp.VCRUNTIME140.dll_strchr]
lea eax, [esp + 0x10]
push eax
push 0x200
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4656fc
xor ecx, ecx
mov dword [esp + 0x10], ecx
jmp 0x465700
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x465737
mov edx, dword [edi]
lea eax, [edx + ecx]
cmp eax, 0x400
ja 0x46575d
push ecx
lea eax, [esp + 0x18]
push eax
lea eax, [edx + esi]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
add dword [edi], eax
test eax, eax
je 0x465737
push 0xffffffffffffffff
push esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x4656da
push 0xffffffffffffffff
push esi
call ebx
neg eax
pop ecx
sbb al, al
pop ecx
inc al
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046f100
add esp, 0x208
ret
xor al, al
jmp 0x465744
Function at 0x465dab
Capabilities:
Create http request

Disassembly:
sub esp, 0x40c
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push ebp
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push dword [0x4e509c]
call dword [sym.imp.WININET.dll_InternetOpenA]
push str._php_alive.php
mov edx, 0x4c111c
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.0045ecaf
pop ecx
push ebx
push 0x84000101
push 0xffffffffffffffff
push ebx
push dword [eax]
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [esp + 0xc]
mov esi, eax
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test esi, esi
je 0x465e4c
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1c]
mov ecx, esi
call fcn.0046568a
pop ecx
pop ecx
test al, al
je 0x465e45
mov eax, dword [esp + 0x10]
test eax, eax
je 0x465e45
cmp eax, 0x400
jae 0x465e6d
mov byte [esp + eax + 0x14], bl
cmp byte [esp + 0x14], 0x6f
jne 0x465e45
cmp byte [esp + 0x15], 0x6b
jne 0x465e45
inc ebx
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x414]
mov eax, ebx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046f100
add esp, 0x40c
ret
call fcn.0046f253
int3

Function at 0x4664c0
Capabilities:
Create process on windows

Disassembly:
push 5
xor eax, eax
push eax
push eax
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x4664d0
Capabilities:
Terminate process

Disassembly:
push 4
mov eax, 0x47b768
call fcn.0046fa56
and dword [ebp - 4], 0
lea ecx, [ebp + 0x1c]
push 0x4a44e4
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x466563
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_316]
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [ebp - 0x10]
push ecx
push str.You_currently_use_version__u._u_of_this_program._The_newest_version__u._u_is_available_online_for_Free._Do_you_want_to_see_more_information_
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x18
push 0x44
push dword [0x4e509c]
push dword [ebp - 0x10]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x466549
mov ecx, dword [ebp + 0x18]
mov ecx, dword [ecx]
call fcn.004664c0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 0x1c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
call fcn.0046fa24
ret 0x18
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 2
push str.This_version_has_expired__please_upgrade_to_the_latest_version._Exiting..
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
pop ecx
pop ecx
push 0x40
mov ecx, 0x4e509c
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp + 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
mov ecx, eax
call fcn.004664c0
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3