joyce8/EMBER2024-capa huggingface dataset:
Function at 0x561264
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x210], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5612e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
xor ecx, ecx
mov edx, 0x20a
call fcn.00404cac
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea ebx, [ebp - 0x20a]
lea edx, [ebp - 0x210]
mov eax, ebx
call fcn.0041e8a8
mov edx, dword [ebp - 0x210]
mov eax, esi
mov ecx, 0x561304
call fcn.00407c40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5612ef
lea eax, [ebp - 0x210]
call fcn.00407018
ret

Function at 0x561318
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004070fc
mov eax, dword [ebp - 8]
call fcn.004070fc
xor eax, eax
push ebp
push 0x5614a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0041e2f8
mov eax, dword [ebp - 0x50]
mov edx, 0x5614c4
call fcn.0041cfe4
test al, al
je 0x5613b6
cmp dword [ebp - 8], 0
jne 0x5613b6
lea eax, [ebp - 0x10]
call fcn.00561264
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.0041dd84
test al, al
je 0x5613b6
push 0x5614dc
push dword [ebp - 4]
push 0x5614f4
lea eax, [ebp - 8]
mov edx, 3
call fcn.00407cc8
lea eax, [ebp - 4]
mov edx, 0x561504
call fcn.00407420
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0041e160
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404cac
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov eax, dword [0x57b430]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.004079dc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.004079dc
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
call fcn.004079dc
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExW
mov esi, eax
test esi, esi
jne 0x561454
push dword [ebp - 4]
push 0x561520
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x58]
call fcn.0041d79c
push dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.00407cc8
mov eax, dword [ebp - 0x54]
call fcn.0055b058
test bl, bl
je 0x561480
test esi, esi
je 0x561480
jmp 0x56146e
mov eax, dword [0x57b430]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x561480
push 0x64
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x56145e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5614af
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.00407078
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407078
ret
Function at 0x561964
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004070fc
xor eax, eax
push ebp
push 0x561a88
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005615c4
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00561534
cmp dword [ebp - 0xc], 0
jne 0x5619bb
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00407420
cmp dword [ebp - 0x10], 0
jne 0x5619cc
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00407420
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.005611b4
mov esi, eax
mov dword [ebp - 0x23c], 0x22c
lea edx, [ebp - 0x23c]
mov eax, esi
call fcn.005611d4
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x561a63
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x234]
call fcn.00561734
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0041cfe4
test al, al
jne 0x561a36
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0041cfe4
test al, al
jne 0x561a36
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0041cfe4
test al, al
je 0x561a50
push 0
mov eax, dword [ebp - 0x234]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x23c]
mov eax, esi
call fcn.005611f4
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x5619fb
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x561a8f
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407078
ret
Function at 0x562e60
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov edi, eax
xor eax, eax
push ebp
push 0x563082
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x23c]
mov eax, 0x5630a0
call fcn.00424f88
lea eax, [ebp - 0x23c]
mov edx, 0x5630bc
call fcn.00407be8
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 8]
call fcn.0041e1fc
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00407420
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004079dc
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
lea eax, [ebp - 0x238]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jns 0x562f23
add esi, 3
sar esi, 2
test esi, esi
jl 0x56304c
inc esi
lea ebx, [ebp - 0x238]
lea eax, [ebp - 0x240]
movzx edx, word [ebx]
call fcn.004079fc
push dword [ebp - 0x240]
lea eax, [ebp - 0x244]
movzx edx, word [ebx + 2]
call fcn.004079fc
push dword [ebp - 0x244]
lea eax, [ebp - 0x248]
movzx edx, word [ebx + 4]
call fcn.004079fc
push dword [ebp - 0x248]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00407cc8
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.0041e1fc
mov eax, dword [ebp - 0x24c]
mov edx, dword [ebp - 8]
call fcn.0041cfe4
test al, al
jne 0x563042
mov eax, dword [ebp - 4]
call fcn.004079dc
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x563042
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0041e1fc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004079dc
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00407d78
jne 0x563019
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp + 0xc]
jne 0x562fff
cmp eax, dword [ebp + 8]
jbe 0x563042
jmp 0x563001
jle 0x563042
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00407420
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
jmp 0x563042
mov eax, dword [edi]
mov edx, dword [edi + 4]
cmp edx, dword [ebp - 0x2c]
jne 0x56302a
cmp eax, dword [ebp - 0x30]
jae 0x563042
jmp 0x56302c
jge 0x563042
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00407420
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
add ebx, 8
dec esi
jne 0x562f35
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004073d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x563089
lea eax, [ebp - 0x24c]
mov edx, 5
call fcn.00407078
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407078
ret
Function at 0x563488
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004070fc
xor eax, eax
push ebp
push 0x563528
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041dd84
test al, al
je 0x563512
push 0x80
mov eax, dword [ebp - 4]
call fcn.004079dc
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesW
push esi
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x563512
call sub.kernel32.dll_GetLastError_1
mov edi, eax
push esi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x56350c
test ah, 4
je 0x56350c
test al, 0x10
je 0x56350c
mov eax, dword [ebp - 4]
call fcn.004079dc
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x563512
push edi
call sub.kernel32.dll_SetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56352f
lea eax, [ebp - 4]
call fcn.00407018
ret

Function at 0x5652a4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd60
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5653d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x436614]
call fcn.004433e0
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x436614]
call fcn.004433e0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x565395
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x29c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
lea ebx, [ebp - 0x10c]
push pe_nt_image_headers32
push ebx
call sub.wsock32.dll_gethostname
push ebx
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x56532e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5653b2
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x56537f
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x2a0]
call fcn.0041e890
mov edx, dword [ebp - 0x2a0]
lea eax, [ebp - 4]
call fcn.00407aac
mov edx, dword [ebp - 4]
mov eax, 0x5653f0
call fcn.0044ddd4
test al, al
je 0x565373
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x56537e
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x565335
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56539f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0xc]
call fcn.004055f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5653da
lea eax, [ebp - 0x2a0]
call fcn.0040703c
lea eax, [ebp - 4]
call fcn.00407018
ret
Function at 0x566ba4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov eax, dword [0x57b424]
mov eax, dword [eax]
call fcn.004c5c54
test al, al
je 0x566bc1
mov eax, 0x566c44
call fcn.0055b058
pop ebx
ret
mov bl, 1
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0xea60
jae 0x566bd3
mov al, 1
jmp 0x566bf8
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
sub eax, dword [0x57ac40]
sbb edx, dword [0x57ac44]
cmp edx, 0
jne 0x566bf5
cmp eax, 0x2bf20
seta al
jmp 0x566bf8
setg al
test al, al
je 0x566c08
xor ebx, ebx
mov eax, 0x566c70
call fcn.0055b058
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov dword [0x57ac40], eax
mov dword [0x57ac44], edx
mov cl, 1
mov dl, 1
mov eax, dword [0x566860]
call fcn.0044ad18
mov byte [eax + 0x40], bl
mov byte [eax + 0xf], 1
call fcn.0044b9e8
pop ebx
ret
Function at 0x401430
Capabilities:
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041b730
mov eax, dword [0x426030]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x1008], 0
push 0x7ff
push 0
lea eax, [ebp - 0x1007]
push eax
call fcn.004104c0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s___d.gf
lea eax, [ebp - 0x1008]
push eax
call fcn.0040f27a
add esp, 0x10
mov byte [ebp - 0x808], 0
push 0x7ff
push 0
lea ecx, [ebp - 0x807]
push ecx
call fcn.004104c0
add esp, 0xc
lea edx, [ebp - 0x808]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x808]
push ecx
push str._sDataApp_d.gf
lea edx, [ebp - 0x808]
push edx
call fcn.0040f27a
add esp, 0x10
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0
push 0
lea ecx, [ebp - 0x808]
push ecx
lea edx, [ebp - 0x1008]
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
je 0x4014fc
xor eax, eax
jmp 0x401508
lea eax, [ebp - 0x808]
push eax
call fcn.00401420
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee26
mov esp, ebp
pop ebp
ret
Function at 0x403940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0041b730
mov eax, dword [0x426030]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x100c], ecx
mov ecx, dword [ebp - 0x100c]
add ecx, 8
call fcn.00403f00
mov eax, dword [ebp - 0x100c]
mov dword [eax + 0x2024], 0
mov ecx, dword [ebp - 0x100c]
mov dword [ecx], 0
mov edx, dword [ebp - 0x100c]
mov dword [edx + 4], 0
xor eax, eax
mov word [ebp - 0x1008], ax
push 0xffe
push 0
lea ecx, [ebp - 0x1006]
push ecx
call fcn.004104c0
add esp, 0xc
lea edx, [ebp - 0x1008]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1008]
push eax
push 0x4231d8
mov ecx, dword [ebp - 0x100c]
add ecx, 0x24
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, dword [ebp - 0x100c]
push edx
mov ecx, 0x428310
call fcn.00403870
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee26
mov esp, ebp
pop ebp
ret

Function at 0x403a30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041b730
mov eax, dword [0x426030]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x200c], ecx
cmp dword [ebp + 8], 0
je 0x403a59
cmp dword [ebp + 0xc], 0
jne 0x403a60
xor al, al
jmp 0x403bc8
push 0x1000
push 0
mov eax, dword [ebp - 0x200c]
add eax, 0x1024
push eax
call fcn.004104c0
add esp, 0xc
push 0x800
mov ecx, dword [ebp - 0x200c]
add ecx, 0x1024
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00403920
xor eax, eax
mov word [ebp - 0x2008], ax
push 0xffe
push 0
lea ecx, [ebp - 0x2006]
push ecx
call fcn.004104c0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x200c]
add eax, 0x1024
push eax
push 0x4231e0
lea ecx, [ebp - 0x2008]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor edx, edx
mov word [ebp - 0x1008], dx
push 0xffe
push 0
lea eax, [ebp - 0x1006]
push eax
call fcn.004104c0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x200c]
add edx, 0x24
push edx
push 0x4231ec
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x1008]
push ecx
lea edx, [ebp - 0x2008]
push edx
mov ecx, dword [ebp - 0x200c]
call fcn.00403de0
movzx eax, al
test eax, eax
je 0x403bc6
mov ecx, dword [ebp - 0x200c]
add ecx, 8
push ecx
lea edx, [ebp - 0x1008]
push edx
call fcn.004048f0
test eax, eax
je 0x403bb9
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x200c]
add ecx, 0x24
push ecx
mov edx, dword [ebp - 0x200c]
add edx, 8
push edx
call fcn.00404c50
test eax, eax
je 0x403bb7
mov ecx, dword [ebp - 0x200c]
call fcn.00403e70
mov ecx, dword [ebp - 0x200c]
add ecx, 8
call fcn.00404000
test eax, eax
jbe 0x403bb3
mov eax, dword [ebp - 0x200c]
cmp dword [eax + 4], 0
jbe 0x403bb3
mov al, 1
jmp 0x403bc8
xor al, al
jmp 0x403bc8
jmp 0x403bc6
lea ecx, [ebp - 0x1008]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee26
mov esp, ebp
pop ebp
ret 8
Function at 0x403de0
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x426030]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
mov byte [ebp - 0x808], 0
push 0x7ff
push 0
lea eax, [ebp - 0x807]
push eax
call fcn.004104c0
add esp, 0xc
push 0x800
lea ecx, [ebp - 0x808]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004038c0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x428310
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jne 0x403e56
mov al, 1
jmp 0x403e58
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee26
mov esp, ebp
pop ebp
ret 8

Function at 0x404850
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0xc], 0
jne 0x404863
xor eax, eax
jmp 0x4048e6
lea ecx, [ebp - 0x10]
call fcn.0040c200
push 0
push 3
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c270
test eax, eax
je 0x4048d4
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x14]
shl ecx, 3
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406330
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0040c360
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x10]
call fcn.0040c250
mov eax, dword [ebp - 0x18]
jmp 0x4048e6
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x10]
call fcn.0040c250
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x404f30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041b730
mov eax, dword [0x426030]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x800
lea eax, [ebp - 0x1008]
push eax
call fcn.00404830
add esp, 0x10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1008]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040ee26
mov esp, ebp
pop ebp
ret

Function at 0x40c270
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x80
mov eax, dword [ebp + 0xc]
push eax
push 0
push 3
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x40c2bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR_CFileMap::CreateMap_CreateFile_error0x_08X
call fcn.00404f30
add esp, 8
xor eax, eax
jmp 0x40c353
push 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 2
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x40c30c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR_CFileMap::CreateMap_CreateFileMapping_error0x_08X
call fcn.00404f30
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40c353
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x40c34e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40c353
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40ee26
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426030]
jne 0x40ee30
repz ret
jmp fcn.004101a6
Function at 0x41abf1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410e49
and dword [ebp - 4], 0
cmp dword [0x428120], 0
mov ebx, eax
jne 0x41aca2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41ad53
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41ad53
push eax
call fcn.00410dd7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428120], eax
call esi
push eax
call fcn.00410dd7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428124], eax
call esi
push eax
call fcn.00410dd7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x428128], eax
call esi
push eax
call fcn.00410dd7
pop ecx
mov dword [0x428130], eax
test eax, eax
je 0x41aca2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410dd7
pop ecx
mov dword [0x42812c], eax
mov eax, dword [0x42812c]
cmp eax, ebx
je 0x41acfa
cmp dword [0x428130], ebx
je 0x41acfa
push eax
call fcn.00410e52
push dword [0x428130]
mov esi, eax
call fcn.00410e52
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41acfa
test edi, edi
je 0x41acfa
call esi
test eax, eax
je 0x41acf1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41acf1
test byte [ebp - 0xc], 1
jne 0x41acfa
or dword [ebp + 0x10], 0x200000
jmp 0x41ad33
mov eax, dword [0x428124]
cmp eax, ebx
je 0x41ad33
push eax
call fcn.00410e52
pop ecx
test eax, eax
je 0x41ad33
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ad33
mov eax, dword [0x428128]
cmp eax, ebx
je 0x41ad33
push eax
call fcn.00410e52
pop ecx
test eax, eax
je 0x41ad33
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428120]
call fcn.00410e52
pop ecx
test eax, eax
je 0x41ad53
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41ad55
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret