joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42565a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041bf60
xor ebx, ebx
cmp dword [0x43ee00], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x425730
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x425810
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x425810
push eax
call fcn.0041bef2
mov dword [esp], 0x432d4c
push edi
mov dword [0x43ee00], eax
call esi
push eax
call fcn.0041bef2
mov dword [esp], 0x432d38
push edi
mov dword [0x43ee04], eax
call esi
push eax
call fcn.0041bef2
mov dword [0x43ee08], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00418ef7
test eax, eax
pop ecx
pop ecx
je 0x4256fe
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041d1f1
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x425730
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041bef2
cmp eax, ebx
pop ecx
mov dword [0x43ee10], eax
je 0x425730
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041bef2
pop ecx
mov dword [0x43ee0c], eax
mov eax, dword [0x43ee0c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4257b5
cmp dword [0x43ee10], ecx
je 0x4257b5
push eax
call fcn.0041bf69
push dword [0x43ee10]
mov esi, eax
call fcn.0041bf69
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4257b5
cmp edi, ebx
je 0x4257b5
call esi
cmp eax, ebx
je 0x425782
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425782
test byte [ebp - 0x18], 1
jne 0x4257b5
lea eax, [ebp - 0x10]
push eax
call fcn.00418f2e
test eax, eax
pop ecx
je 0x42579d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041d1f1
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4257ac
or dword [ebp + 0x10], 0x200000
jmp 0x4257f0
or dword [ebp + 0x10], 0x40000
jmp 0x4257f0
mov eax, dword [0x43ee04]
cmp eax, dword [ebp - 8]
je 0x4257f0
push eax
call fcn.0041bf69
cmp eax, ebx
pop ecx
je 0x4257f0
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4257f0
mov eax, dword [0x43ee08]
cmp eax, dword [ebp - 8]
je 0x4257f0
push eax
call fcn.0041bf69
cmp eax, ebx
pop ecx
je 0x4257f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ee00]
call fcn.0041bf69
cmp eax, ebx
pop ecx
je 0x425810
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425812
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ba94
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43aee0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042ba29
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00416950
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42bae3
cmp dword [ebp - 0x1c], 5
jb 0x42bafb
jmp 0x42baf7
cmp dword [ebp - 0x10], 1
jne 0x42bafb
cmp dword [ebp - 0x1c], 4
ja 0x42baf7
jne 0x42bafb
cmp dword [ebp - 0x18], 0
jbe 0x42bafb
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x433f34
call fcn.0042b91a
test eax, eax
jge 0x42bb1c
mov byte [0x43c3b4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004166ff
add ebp, 0x78
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x4f267de9
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x52fd05a3
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x414de6
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [ecx], edx
sub esi, 0x614f029
add ecx, 4
cmp ecx, eax
jne fcn.00414de6
add ebx, edi
mov esi, 0x8bde78dd
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1538721b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x68790d59
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748
Function at 0x404750
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x5321d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x800
lea eax, [ebp - 0x804]
mov ebx, ecx
push 0
push eax
call fcn.00470520
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.AnythingInstaller
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x808], esi
test esi, esi
je 0x404837
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404804
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4fd8b4
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4047f2
push 0
push 0
push 0x1400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044474a
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
cmp dword [ecx + 8], eax
je 0x404822
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x40482f
lea edx, [ebp - 0x808]
push edx
push eax
call fcn.00404240
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.0044474a
mov esp, ebp
pop ebp
ret
Function at 0x4048d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a3c
call fcn.00444760
mov eax, dword [0x5321d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0
push 2
mov dword [ebp - 0x1a34], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404ad6
push edi
push 0x228
lea eax, [ebp - 0x1a2c]
push 0
push eax
call fcn.00470520
add esp, 0xc
mov dword [ebp - 0x1a30], 0x22c
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404ad2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1a3c], eax
cmp eax, dword [ebp - 0x1a28]
je 0x404ab7
push dword [ebp - 0x1a34]
lea eax, [ebp - 0x1a0c]
push eax
call fcn.0049942c
add esp, 8
test eax, eax
jne 0x404ab7
push 0x800
push eax
lea eax, [ebp - 0x1804]
push eax
call fcn.00470520
add esp, 0xc
push dword [ebp - 0x1a28]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x404a86
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00470520
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x404a7b
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00470520
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.00470d57
add esp, 0x14
test eax, eax
je 0x404a43
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x404a43
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404a30
lea eax, [ebp - 0x1004]
jmp 0x404a61
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404a50
lea eax, [ebp - 0x804]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x1804]
push 0x400
push eax
call fcn.00499421
add esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x404a8c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x1a28]
mov dword [ebp - 0x1a38], ecx
cmp dword [esi + 8], eax
je 0x404aa8
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x404ab7
lea ecx, [ebp - 0x1a38]
push ecx
push eax
mov ecx, esi
call fcn.004040e0
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
mov eax, dword [ebp - 0x1a3c]
jne 0x404951
push ebx
call edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044474a
mov esp, ebp
pop ebp
ret 8
Function at 0x405dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
mov dword [ebp - 0xe8], 0x740068
mov dword [ebp - 0xe4], 0x700074
mov dword [ebp - 0xe0], 0x2f003a
mov dword [ebp - 0xdc], 0x73002f
mov dword [ebp - 0xd8], 0x35002e
mov dword [ebp - 0xd4], 0x740032
mov dword [ebp - 0xd0], 0x6f006f
mov dword [ebp - 0xcc], 0x62006c
mov dword [ebp - 0xc8], 0x78006f
mov dword [ebp - 0xc4], 0x63002e
mov dword [ebp - 0xc0], 0x6d006f
mov dword [ebp - 0xbc], 0x61002f
mov dword [ebp - 0xb8], 0x79006e
mov dword [ebp - 0xb4], 0x650073
mov dword [ebp - 0xb0], 0x720061
mov dword [ebp - 0xac], 0x680063
mov dword [ebp - 0xa8], 0x70003f
mov dword [ebp - 0xa4], 0x640069
mov dword [ebp - 0xa0], 0x7b003d
mov dword [ebp - 0x9c], 0x690070
mov dword [ebp - 0x98], 0x7d0064
mov dword [ebp - 0x94], 0x740026
mov dword [ebp - 0x90], 0x700079
mov dword [ebp - 0x8c], 0x3d0065
mov dword [ebp - 0x88], 0x74007b
mov dword [ebp - 0x84], 0x700079
mov dword [ebp - 0x80], 0x7d0065
mov dword [ebp - 0x7c], 0x610026
mov dword [ebp - 0x78], 0x740063
mov dword [ebp - 0x74], 0x6f0069
mov dword [ebp - 0x70], 0x3d006e
mov dword [ebp - 0x6c], 0x61007b
mov dword [ebp - 0x68], 0x740063
mov dword [ebp - 0x64], 0x6f0069
mov dword [ebp - 0x60], 0x7d006e
mov dword [ebp - 0x5c], 0x610026
mov dword [ebp - 0x58], 0x700070
mov dword [ebp - 0x54], 0x7b003d
mov dword [ebp - 0x50], 0x700061
mov dword [ebp - 0x4c], 0x7d0070
mov dword [ebp - 0x48], 0x610026
mov dword [ebp - 0x44], 0x700070
mov dword [ebp - 0x40], 0x650076
mov dword [ebp - 0x3c], 0x3d0072
mov dword [ebp - 0x38], 0x76007b
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x26007d
mov dword [ebp - 0x2c], 0x69006d
mov dword [ebp - 0x28], 0x3d0064
mov dword [ebp - 0x24], 0x6d007b
mov dword [ebp - 0x20], 0x640069
mov dword [ebp - 0x1c], 0x26007d
mov dword [ebp - 0x18], 0x69006d
mov dword [ebp - 0x14], 0x320064
mov dword [ebp - 0x10], 0x7b003d
mov dword [ebp - 0xc], 0x69006d
mov dword [ebp - 8], 0x320064
mov dword [ebp - 4], 0x7d
call fcn.004066d0
mov ecx, eax
test ecx, ecx
je 0x406027
mov eax, dword [ecx]
push 2
push 0x73
call dword [eax]
test eax, eax
je 0x406031
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x73
jl 0x40601d
mov dword [eax - 0xc], 0x73
xor eax, eax
mov ecx, dword [esi]
push 0xe6
mov word [ecx + 0xe6], ax
lea eax, [ebp - 0xe8]
push eax
push 0xe6
push dword [esi]
call fcn.004083b0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00402ad0
push 0x80004005
call fcn.00402ad0
call fcn.004030c0
int3
Function at 0x4062d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
push edi
test ebx, ebx
jne 0x4062ed
xor edi, edi
jmp 0x406444
cmp dword [ebp + 0x14], 0
je 0x40641d
push 0x1440
call fcn.0041d270
mov edi, eax
add esp, 4
test edi, edi
je 0x4063b3
mov ecx, dword [ebp + 0x40]
xor edx, edx
mov dword [ebp - 0x28], edx
test ecx, ecx
je 0x406327
mov eax, dword [ecx]
lea edx, [ebp - 0x4c]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
lea esi, [edi + 0x1418]
mov dword [edi], ecx
mov dword [edi + 0x1414], 1
mov dword [esi + 0x24], 0
test edx, edx
je 0x406351
mov eax, dword [edx]
mov ecx, edx
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0x1000
lea esi, [edi + 4]
push 0
push esi
call fcn.00470520
push 0x800
push ebx
push esi
call fcn.0049a1ad
push 0x410
lea esi, [edi + 0x1004]
push 0
push esi
call fcn.00470520
mov eax, dword [ebp - 4]
add esp, 0x24
test eax, eax
je 0x406399
push 0x208
push eax
push esi
call fcn.0049a1ad
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4063b5
mov edx, dword [ecx]
lea eax, [ebp - 0x4c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x4063b5
xor edi, edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], vtable.CSimpleThread.0
push eax
push 0
push edi
push 0x406470
push 0
push 0
mov dword [ebp - 0xc], 0x406470
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.0049a663
add esp, 0x18
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], vtable.CSimpleThread.0
test eax, eax
je 0x406416
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x406444
sub esp, 0x28
mov edi, esp
mov dword [edi + 0x24], 0
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x406438
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov ecx, dword [ebp + 8]
push esi
push ebx
call fcn.00406f00
mov edi, eax
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x40645c
mov esi, dword [ecx]
lea eax, [ebp + 0x1c]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
Function at 0x406780
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.00444760
mov eax, dword [0x5321d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0x10]
push 0x4000
push 0
push eax
call fcn.00470520
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x406878
test edi, edi
je 0x406878
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x406878
cmp eax, 0x3fff
ja 0x406878
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x406878
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x4fd820
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x406878
mov esi, dword [ebp + 0x14]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.00470520
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.00408370
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044474a
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0044474a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406ec0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x406ee5
test byte [ebp - 4], 7
je 0x406ee5
mov eax, 1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x407cd0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x521a40
push 0x471700
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x5321d4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
test edi, edi
je 0x407d98
cmp word [edi], si
je 0x407d98
test eax, eax
je 0x407d4e
cmp word [eax], si
je 0x407d4e
push esi
push esi
push eax
push edi
push esi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x407d98
mov esi, 1
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x407db7
push 0x410
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.00470520
add esp, 0xc
push 0
push 0
push 0x104
lea eax, [ebp - 0x42c]
push eax
push edi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x407d98
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 1
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x407db7
test esi, esi
setne al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0044474a
mov esp, ebp
pop ebp
ret
Function at 0x4081c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408219
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408219
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40820a
cmp esi, edx
jae 0x408219
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4081f8
cmp esi, edx
jae 0x408219
cmp word [esi], 0
je 0x408219
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x409730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5321d4]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x48]
push esi
movups xmmword [ebp - 0x48], xmm0
mov esi, dword [ebp + 0x8c]
movups xmm0, xmmword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x90]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x4c], esi
mov dword [edi + 0x40], esi
movups xmm0, xmmword [ebp + 0x28]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp + 0x4c]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [ebp + 0x5c]
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp + 0x6c]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp + 0x7c]
movups xmmword [ebp - 0x5c], xmm0
test esi, esi
jle 0x4098b4
cmp esi, 0x40
jb 0x40989d
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x49]
add edx, edi
cmp edi, ecx
ja 0x4097d7
lea ecx, [ebp - 0x48]
cmp edx, ecx
jae 0x40989d
lea ecx, [ebp + esi - 0x8d]
cmp edi, ecx
ja 0x4097f0
lea ecx, [ebp - 0x8c]
cmp edx, ecx
jae 0x40989d
mov ecx, esi
push ebx
and ecx, 0x8000003f
jns 0x409800
dec ecx
or ecx, 0xffffffc0
inc ecx
mov ebx, esi
lea edx, [edi + 0x20]
sub ebx, ecx
mov dword [ebp - 0x98], edx
mov esi, edi
lea ecx, [ebp - 0x38]
sub esi, ecx
sub ecx, edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x7c]
sub ecx, edi
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x48]
lea ecx, [ebp - 0x38]
add edx, eax
movups xmm1, xmmword [ebp + eax - 0x8c]
add ecx, eax
pxor xmm1, xmm0
movups xmm0, xmmword [ecx]
movups xmmword [esi + ecx], xmm1
mov ecx, dword [ebp - 0x94]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x6c]
movups xmmword [edx - 0x10], xmm1
movups xmm1, xmmword [ebp + eax - 0x28]
add eax, 0x40
pxor xmm1, xmm0
movups xmm0, xmmword [edi + edx]
movups xmmword [edx], xmm1
movups xmm1, xmmword [ecx + edx]
pxor xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
mov edx, dword [ebp - 0x98]
cmp eax, ebx
jl 0x409830
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
pop ebx
cmp eax, esi
jge 0x4098b4
mov cl, byte [ebp + eax - 0x8c]
xor cl, byte [ebp + eax - 0x48]
mov byte [edi + eax], cl
inc eax
cmp eax, esi
jl 0x4098a1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044474a
mov esp, ebp
pop ebp
ret