joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40677c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 1
mov esi, ecx
push dword [esi + 0x6c]
push 4
pop ebx
push ebx
push 0
push dword [esi + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x4067a2
xor al, al
jmp 0x406815
mov edx, dword [esi + 0x6c]
sub esp, 0x28
mov ecx, dword [esi]
mov eax, esp
push edx
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_94705684943314e091474c52c41fcebe___void___.0
mov dword [eax + 4], esi
mov dword [eax + 0x24], eax
call fcn.00414516
and dword [ebp - 4], 0
lea eax, [esi + 0x48]
cmp dword [eax + 0x14], 8
jb 0x4067cd
mov eax, dword [eax]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push eax
push dword [esi + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406813
cmp dword [ebp - 0xc], ebx
jne 0x406813
test eax, eax
jne 0x406813
mov ecx, dword [ebp - 4]
cmp ecx, 0x64
ja 0x406813
cmp ecx, dword [esi + 0x74]
je 0x406813
mov dword [esi + 0x74], ecx
cmp byte [esi + 0x70], al
je 0x406813
push ecx
lea ecx, [esi + 8]
call fcn.004068c0
mov al, 1
pop esi
pop ebx
leave
ret

Function at 0x409f4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x48c00c]
xor eax, esp
mov dword [esp + 0x20], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x409fa5
lea ecx, [esp + 0xc]
call fcn.0040faa1
and dword [esp + 8], 0
lea ecx, [esp + 8]
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
push 0
cmovae eax, dword [esp + 0x10]
push ecx
push dword [esp + 0x24]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0xc]
call fcn.00403224
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.00429be3
mov esp, ebp
pop ebp
ret 4

Function at 0x40a104
Capabilities:
Bypass mark of the web
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462c4a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x48c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0xc]
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004019ab
push str.:Zone.Identifier
lea ecx, [ebp - 0x28]
call fcn.00401f04
cmp dword [eax + 0x14], 8
jb 0x40a161
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x28]
setne bl
call fcn.00401952
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429be3
leave
ret
Function at 0x40a319
Capabilities:
Accept command line arguments
Copy file

Disassembly:
push 0xd4
mov eax, 0x462cb8
call fcn.0046020f
mov esi, ecx
lea ecx, [ebp - 0xd0]
call fcn.004158ab
xor edi, edi
mov dword [ebp - 4], edi
cmp byte [ebp - 0xb8], 0
je 0x40a4fb
mov dl, 1
lea ecx, [ebp - 0x5c]
call fcn.0040e946
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call fcn.004019f9
push str.loader.exe
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00401f04
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.004019f9
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00401952
push 8
pop ebx
cmp dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x2c]
push edi
cmovae ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], ebx
push ecx
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40a4d7
cmp dword [ebp - 0x18], ebx
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0040a104
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0xb4]
call fcn.00401910
push str.___cp
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00401f04
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
call fcn.004019f9
lea ecx, [ebp - 0xb4]
call fcn.00401952
lea ecx, [ebp - 0x9c]
call fcn.00413b04
xor eax, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
push edi
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xa
push eax
sub esp, 0x18
lea eax, [ebp - 0x74]
mov ecx, esp
push eax
call fcn.004018ec
lea ecx, [ebp - 0x9c]
call fcn.00413c4b
push ecx
mov ecx, eax
call fcn.00413b70
lea ecx, [ebp - 0x44]
call fcn.00401952
lea ecx, [ebp - 0x9c]
mov dword [ebp - 4], ebx
call fcn.00413b28
lea ecx, [ebp - 0x9c]
mov dword [esi], eax
call fcn.0040537b
lea ecx, [ebp - 0x74]
call fcn.00401952
lea ecx, [ebp - 0x2c]
call fcn.00401952
lea ecx, [ebp - 0x5c]
call fcn.00401952
cmp byte [ebp - 0xb8], 0
je 0x40a4a3
lea ecx, [ebp - 0xd0]
call fcn.00415952
mov al, 1
jmp 0x40a4fd
lea ecx, [ebp - 0x2c]
call fcn.00401952
lea ecx, [ebp - 0x5c]
call fcn.00401952
cmp byte [ebp - 0xb8], 0
je 0x40a4fb
lea ecx, [ebp - 0xd0]
call fcn.00415952
xor al, al
call fcn.0046015c
ret
Function at 0x40bbef
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x48c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x1a
mov ecx, dword [edi + 4]
call fcn.00406958
movzx eax, ax
xor ebx, ebx
mov edx, eax
add edx, dword [edi + 4]
test ax, ax
je 0x40bc29
mov ecx, edx
call fcn.00408e90
lea esi, [edx + eax]
jmp 0x40bc2b
mov esi, ebx
cmp dword [edi], ebx
je 0x40bc4f
mov ecx, dword [edi]
push 0x1a
call fcn.00406958
movzx eax, ax
mov edx, eax
add edx, dword [edi]
test ax, ax
je 0x40bc4f
mov ecx, edx
call fcn.00408e90
add eax, edx
jmp 0x40bc51
mov eax, ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
call fcn.004093e2
mov edi, eax
mov eax, edx
mov dword [ebp - 0x20], eax
cmp eax, ebx
jl 0x40bcc1
jg 0x40bc70
cmp edi, ebx
jbe 0x40bcc1
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
movlpd qword [ebp - 0x30], xmm0
call fcn.0040ec33
cmp dword [eax + 0x14], 8
jb 0x40bc88
mov eax, dword [eax]
push ebx
push ebx
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00401952
test esi, esi
je 0x40bcc1
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
shrd ecx, eax, 0x14
shr eax, 0x14
cmp dword [ebp - 0x20], eax
jb 0x40bcbb
ja 0x40bcbd
cmp edi, ecx
ja 0x40bcbd
mov bl, 1
mov al, bl
jmp 0x40bcc3
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429be3
leave
ret

Function at 0x40c627
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x40c62f
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c641
shr eax, 4
and al, 1
ret
xor al, al
ret

Function at 0x40c644
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x1c
mov eax, 0x461b5d
call fcn.004601a1
mov esi, ecx
cmp dword [esi + 0x14], 8
mov edi, esi
jb 0x40c65c
mov edi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c66f
shr al, 4
and al, 1
jmp 0x40c6e5
push ecx
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.0040eb45
pop ecx
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 8
jb 0x40c68a
mov ecx, dword [esi]
push dword [esi + 0x10]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push dword [ebp - 0x18]
push eax
call fcn.0040e39b
add esp, 0x10
test al, al
jne 0x40c6db
lea ecx, [ebp - 0x28]
call fcn.0040c644
test al, al
je 0x40c6db
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c6d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c6db
mov ecx, esi
call fcn.0040c627
test al, al
je 0x40c6db
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.00401952
mov al, bl
call fcn.0046014b
ret
Function at 0x40c6eb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ecx + 0x14], 8
push edi
mov edi, edx
jb 0x40c6fe
mov ecx, dword [ecx]
push 0x478dd0
push ecx
lea eax, [ebp - 4]
push eax
call fcn.00434927
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x40c71f
call fcn.00435442
mov eax, dword [eax]
jmp 0x40c772
push esi
push 2
push 0
push dword [ebp - 4]
call fcn.00434d44
push dword [ebp - 4]
call fcn.00434547
add esp, 0x10
mov esi, eax
push dword [ebp - 4]
test esi, esi
jne 0x40c748
call fcn.004349ef
pop ecx
jmp 0x40c76f
call fcn.0043506b
pop ecx
push edi
push esi
mov ecx, edi
call fcn.0040df85
push dword [ebp - 4]
push esi
push 1
push dword [edi]
call fcn.004359d2
push dword [ebp - 4]
call fcn.004349ef
add esp, 0x14
xor eax, eax
pop esi
pop edi
leave
ret

Function at 0x40cc06
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40cc2d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d2d2
jmp 0x40cce2
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x40cc4f
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40cc51
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x40ccd6
jg 0x40cc66
test esi, esi
je 0x40ccd6
test ecx, ecx
jl 0x40ccaf
jg 0x40cc70
test eax, eax
je 0x40ccaf
cmp edi, ecx
jg 0x40cc84
jl 0x40cc7a
cmp esi, eax
jae 0x40cc84
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.00430780
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x40ccb2
mov edx, dword [ebp + 8]
test edi, edi
jl 0x40ccd6
jg 0x40ccbc
test esi, esi
je 0x40ccd6
cmp dword [ebx + 0x4c], 0
je 0x40ccd6
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.00435371
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40cceb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40cd12
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d3b0
jmp 0x40cde1
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x40cd34
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40cd36
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x40cdd5
jg 0x40cd53
test esi, esi
je 0x40cdd5
test ecx, ecx
jl 0x40cda0
jg 0x40cd5d
test eax, eax
je 0x40cda0
cmp ebx, ecx
jg 0x40cd71
jl 0x40cd67
cmp esi, eax
jae 0x40cd71
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00430780
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40cda7
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x40cdd5
jg 0x40cdb1
test esi, esi
je 0x40cdd5
cmp dword [edi + 0x4c], 0
je 0x40cdd5
mov ecx, edi
call fcn.0040d93b
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004359d2
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d047
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x48c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x40d06d
xor eax, eax
jmp 0x40d134
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40d096
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x40d096
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x40d134
cmp dword [esi + 0x4c], 0
je 0x40d132
mov ecx, esi
call fcn.0040d93b
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40d0c3
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0043457b
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x40d132
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x40d132
cmp eax, 1
jle 0x40d101
cmp eax, 3
jne 0x40d132
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 0x25]
push ecx
jmp 0x40d0b5
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x40d124
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00435371
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x40d132
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x40d134
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429be3
leave
ret 4

Function at 0x40d9c3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x48c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x40da47
cmp byte [esi + 0x3d], 0
je 0x40da47
push 0xffffffffffffffff
call fcn.0040d047
cmp eax, 0xffffffff
je 0x40da19
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x40da1d
sub eax, 1
je 0x40da21
dec eax
sub eax, 1
je 0x40da47
xor al, al
jmp 0x40da49
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40da3e
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00435371
add esp, 0x10
cmp edi, eax
jne 0x40da19
cmp byte [esi + 0x3d], 0
sete al
jmp 0x40da49
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00429be3
leave
ret
Function at 0x40e84b
Capabilities:
Get common file path

Disassembly:
push 0x50
mov eax, 0x46347f
call fcn.004601a1
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x5c], esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
push ebx
mov edi, 0x105
mov dword [ebp - 4], ebx
push edi
lea ecx, [ebp - 0x40]
call fcn.0040ecd0
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, eax
test ecx, ecx
jne 0x40e8ad
push 0x476c3c
mov ecx, esi
call fcn.00401910
jmp 0x40e936
cmp ecx, dword [ebp - 0x30]
ja 0x40e8c8
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], ecx
cmovae eax, dword [ebp - 0x40]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x40e8d5
sub ecx, dword [ebp - 0x30]
push ebx
push ecx
lea ecx, [ebp - 0x40]
call fcn.0040ecd0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x48], ebx
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], ebx
call fcn.004019f9
push 0x18
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00430780
push 0x18
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00430780
push 0x18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00430780
add esp, 0x24
lea ecx, [ebp - 0x58]
call fcn.00401952
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x5c]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.00401a74
lea ecx, [ebp - 0x40]
call fcn.00401952
mov eax, esi
call fcn.0046014b
ret
Function at 0x41246f
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x15c
mov eax, 0x463a52
call fcn.004601a1
mov ebx, ecx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x138], ebx
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov byte [ebx + 8], al
mov dword [ebx + 0x24], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.00412680
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], 0xf
mov byte [ebx + 0x34], al
mov dword [ebp - 4], eax
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
lea esi, [ebp - 0x144]
lea ecx, [ebx + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004122ff
push 0x118
mov dword [ebx], eax
lea eax, [ebp - 0x12c]
push 0
push eax
mov dword [ebp - 0x130], 0x11c
call fcn.00430d00
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebx + 0xc], 0
jne 0x41252c
mov eax, dword [ebp - 0x12c]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x128]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x124]
mov dword [ebx + 0x14], eax
movzx eax, word [ebp - 0x1c]
lea edi, [ebp - 0x168]
mov dword [ebx + 0x1c], eax
movzx eax, word [ebp - 0x1a]
mov dword [ebx + 0x20], eax
push 9
pop eax
mov ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov cx, word [ebp - 0x168]
xor esi, esi
push 2
pop edi
movzx eax, cx
inc esi
push 9
pop edx
test eax, eax
je 0x412580
cmp eax, 6
je 0x41257b
cmp eax, edx
jne 0x412584
mov dword [ebx + 0x24], esi
jmp 0x412584
mov dword [ebx + 0x24], edi
jmp 0x412584
and dword [ebx + 0x24], 0
cmp dword [ebp - 0x12c], 6
mov eax, dword [ebp - 0x154]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebx + 0x2c], eax
je 0x4125f9
cmp dword [ebp - 0x12c], 0xa
je 0x4125f9
cmp dword [ebp - 0x12c], 5
jne 0x41264e
cmp dword [ebp - 0x128], edi
jne 0x4125e0
cmp byte [ebp - 0x16], 1
jne 0x4125cc
cmp cx, dx
je 0x41266e
mov ax, word [ebp - 0x18]
not ax
movzx eax, ax
shr eax, 0xe
and eax, edi
mov dword [ebx + 0x18], eax
jmp 0x412652
cmp dword [ebp - 0x128], esi
jne 0x41264e
mov ax, word [ebp - 0x18]
not ax
movzx eax, ax
shr eax, 9
and eax, esi
jmp 0x4125db
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x134]
push ecx
push 0
push 0
push dword [ebp - 0x128]
push dword [ebp - 0x12c]
call eax
mov eax, dword [ebp - 0x134]
cmp eax, 0xf
ja 0x41265a
cmp eax, 0xc
jae 0x412673
cmp eax, esi
je 0x41266e
cmp eax, 4
je 0x41266e
cmp eax, 6
je 0x41266e
jbe 0x41264e
cmp eax, 0xa
jbe 0x412673
and dword [ebx + 0x18], 0
mov eax, ebx
call fcn.0046014b
ret
cmp eax, 0x11
jb 0x41264e
cmp eax, 0x12
jbe 0x412673
cmp eax, 0x19
je 0x412673
cmp eax, 0x30
jne 0x41264e
mov dword [ebx + 0x18], esi
jmp 0x412652
mov dword [ebx + 0x18], edi
jmp 0x412652
Function at 0x413c4b
Capabilities:
Create process on windows

Disassembly:
push 0x80
mov eax, 0x463d27
call fcn.0046016d
mov ebx, ecx
mov esi, dword [ebp + 0x20]
and dword [ebp - 4], 0
lea eax, [ebp - 0x64]
push 0x44
pop edi
push edi
push 0
push eax
call fcn.00430d00
add esp, 0xc
mov dword [ebp - 0x64], edi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [esi + 0x10], edx
jne 0x413c96
mov esi, edx
jmp 0x413c9e
cmp dword [esi + 0x14], 8
jb 0x413c9e
mov esi, dword [esi]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push esi
push edx
push dword [ebp + 0x24]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push edx
push edx
push edx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x413ccf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413d20
mov eax, dword [ebp - 0x20]
mov ecx, ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.004049cf
cmp dword [ebp - 0x10], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x413cf1
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 0x1c]
lea ecx, [ebx + 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.004049cf
cmp dword [ebp - 0x10], 0
je 0x413d0e
push dword [ebp - 0x10]
call esi
lea ecx, [ebp + 8]
call fcn.00401952
mov eax, ebx
call fcn.00460136
ret 0x20
push ecx
push eax
lea ecx, [ebp - 0x8c]
call fcn.0041b7a3
push 0x4891d8
lea eax, [ebp - 0x8c]
push eax
call fcn.00432217
int3
Function at 0x415997
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463f8c
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x48c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
mov edi, 0x105
lea eax, [ebp - 0x220]
xor ebx, ebx
push eax
push edi
mov dword [ebp - 0x228], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x415aca
cmp eax, edi
jae 0x415aca
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
xor edi, edi
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x238]
call fcn.00401984
push 0x479270
lea ecx, [ebp - 0x238]
call fcn.00401f04
lea edx, [edi + ebx]
lea ecx, [ebp - 0x250]
call fcn.00404963
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x415a4a
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00401f2b
lea ecx, [ebp - 0x250]
call fcn.00401952
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
push 0
cmovae eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x415aba
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
xor ecx, ecx
and dword [ebp - 0x228], 0
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x415aba
inc edi
cmp edi, 0xa
jl 0x415a0f
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov byte [ebp - 0x254], al
jmp 0x415ad6
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [ebp - 0x254], bl
push dword [ebp - 0x254]
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.00401a74
lea ecx, [ebp - 0x238]
call fcn.00401952
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429be3
leave
ret

Function at 0x415fc9
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push ebx
push esi
push edi
lea edi, [ebp - 0x10]
mov ebx, ecx
stosd dword es:[edi], eax
mov esi, dword [ebx + 0x1c]
stosd dword es:[edi], eax
not esi
and esi, 1
test byte [ebx + 0x1c], 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
je 0x416006
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x416006
mov ecx, dword [ebp - 8]
test ecx, ecx
push 3
pop eax
cmovne esi, eax
jmp 0x416009
mov ecx, dword [ebp - 8]
lea eax, [ebx + 4]
cmp dword [eax + 0x14], 8
jb 0x416014
mov eax, dword [eax]
push 0x10000000
push dword [ebp - 4]
push ecx
push esi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebx + 0x20]
mov dword [ebx + 0x20], eax
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x416039
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
leave
ret