joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4164c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c935
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, dword [edi]
cmp byte [eax], 0
je 0x41655c
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push edi
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call ebx
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x41655c
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push edi
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call ebx
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x416640
test eax, 0x400
je 0x416640
cmp byte [ebp + 0x10], 0
je 0x41655c
mov ecx, edi
call fcn.00416aa0
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
mov ecx, edi
mov esi, dword [esi]
call fcn.0041c550
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.0041a740
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
add ecx, 0xfffffff8
cmp ecx, 0x583008
je 0x4165a4
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
cmp eax, ebx
jne 0x4165a4
push ecx
call fcn.005128b5
add esp, 4
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp + 8]
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov byte [ebp - 4], 3
test al, 0x10
je 0x4165d7
mov dword [ebp + 8], 1
cmp eax, 0xffffffff
jne 0x4165de
mov dword [ebp + 8], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.00414490
push edi
mov esi, dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.00414490
add esp, 0x10
push dword [ebp + 8]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
test al, al
mov eax, dword [ebp - 0x10]
setne byte [ebp + 0xb]
add eax, 0xfffffff8
cmp eax, 0x583008
je 0x41662b
lock xadd dword [eax], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x41662b
push eax
call fcn.005128b5
add esp, 4
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416aa0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c9c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
cmp byte [eax], 0
je 0x416b81
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x416b81
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push esi
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
test al, 0x10
je 0x416b56
cmp eax, 0xffffffff
je 0x416b56
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x416ba0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ca06
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov bl, 1
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 0xffffffff
test al, 0x10
je 0x416cd1
cmp eax, 0xffffffff
je 0x416cd1
cmp byte [ebp + 8], 0
jne 0x416c1f
mov ecx, esi
call fcn.0041f690
test al, al
jne 0x416cd1
lea eax, [ebp - 0x10]
push 0x54da40
push eax
call fcn.0040a5d0
add esp, 8
push 2
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 2
push eax
push 0
push 3
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov ecx, esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 1
call fcn.00419850
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
mov byte [ebp - 4], 3
cmp ecx, 0x583008
je 0x416c90
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x416c90
push ecx
call fcn.005128b5
add esp, 4
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x416cbf
nop dword [eax]
push dword [ebp + 8]
mov ecx, esi
call fcn.00416ba0
test al, al
je 0x416cb6
test bl, bl
je 0x416cb6
mov bl, 1
jmp 0x416cb8
xor bl, bl
add esi, 4
cmp esi, edi
jne 0x416ca0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0040e6b0
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00416aa0
test al, al
je 0x416cf6
test bl, bl
je 0x416cf6
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4180a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cb30
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
cmp byte [eax], 0
je 0x4180fc
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4180fc
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x418120
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cb30
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
cmp byte [eax], 0
je 0x41817b
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x41817b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x419370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x2c]
mov ebp, dword [edi + 0x74]
nop
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, ebp
cmp dword [edi + 0x6c], eax
jb 0x419417
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00514850
mov ebp, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea edx, [eax + ebp*2]
nop
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [esp + 0x14], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [esp + 0x14]
mov word [edx], ax
sub ebp, 1
jne 0x4193c0
mov eax, dword [edi + 0x40]
mov ebp, esi
lea edx, [eax + esi*2]
nop dword [eax]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [esp + 0x14], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [esp + 0x14]
mov word [edx], ax
sub ebp, 1
jne 0x4193f0
add ebx, esi
mov ebp, dword [edi]
mov eax, dword [ebp + 4]
test eax, eax
je 0x4194cb
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add edx, ecx
add edx, dword [edi + 0x38]
cmp eax, ebx
mov dword [esp + 0x14], edx
cmovbe ebx, eax
test ebx, ebx
je 0x41948f
sub eax, ebx
mov dword [ebp + 4], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x41945a
push ebx
push dword [ebp]
push dword [ebp + 0x30]
call fcn.0042ad60
jmp 0x419470
cmp eax, 2
jne 0x419476
mov eax, dword [ebp]
test eax, eax
je 0x419473
push ebx
push eax
push dword [ebp + 0x30]
call fcn.004147b0
add esp, 0xc
mov dword [ebp + 0x30], eax
push ebx
push dword [ebp]
push dword [esp + 0x1c]
call fcn.00514850
add dword [ebp], ebx
add esp, 0xc
add dword [ebp + 8], ebx
mov ecx, dword [edi + 0x74]
lea ebp, [ecx + ebx]
mov dword [edi + 0x74], ebp
cmp ebp, 3
jb 0x4194b7
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebp, 0x106
jae 0x4194cb
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x419380
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41ae50
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x40c]
sub esp, 0x40c
push 0xffffffffffffffff
push 0x53ce9d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58313c]
xor eax, ebp
mov dword [ebp + 0x408], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x414]
xor eax, eax
mov dword [ebp - 0x10], esi
mov word [ebp], ax
lea eax, [ebp]
push eax
push 0x204
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a680
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push esi
call fcn.00421250
mov eax, dword [ebp - 0x10]
add esp, 0x10
add eax, 0xfffffff8
cmp eax, 0x583008
je 0x41aee7
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
cmp ecx, 0xffffffff
jne 0x41aee7
push eax
call fcn.005128b5
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x408]
xor ecx, ebp
call fcn.00512b0b
lea esp, [ebp + 0x40c]
pop ebp
ret
Function at 0x41cb10
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x140c]
mov eax, 0x140c
call fcn.005133f0
push 0xffffffffffffffff
push 0x53d17d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58313c]
xor eax, ebp
mov dword [ebp + 0x1408], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1418]
mov esi, dword [ebp + 0x1414]
mov dword [ebp - 0x10], esi
cmp eax, 0x11
ja case.default.0x41cb61
jmp dword [eax*4 + 0x41cd14]
mov eax, 0x28
jmp 0x41cbb7
mov eax, 5
jmp 0x41cbb7
xor eax, eax
jmp 0x41cbb7
mov eax, 0x1a
jmp 0x41cbb7
mov eax, 0x23
jmp 0x41cbb7
mov eax, 0x2e
jmp 0x41cbb7
mov eax, 0x26
jmp 0x41cbb7
mov eax, 0x2a
jmp 0x41cbb7
mov eax, 0x1c
jmp 0x41cbb7
mov eax, 0xd
jmp 0x41cbb7
mov eax, 0xe
jmp 0x41cbb7
mov eax, 0x27
push 0
push eax
lea eax, [ebp + 0x1000]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x41cb61
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a680
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.00421250
mov ecx, dword [ebp - 0x10]
add esp, 0x10
add ecx, 0xfffffff8
cmp ecx, 0x583008
je 0x41ccee
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x41ccee
push ecx
call fcn.005128b5
add esp, 4
jmp 0x41ccee
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a680
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.00421250
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0040e7a0
jmp 0x41ccee
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push 0x800
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a680
mov dword [ebp - 4], 1
jmp 0x41cc4f
mov eax, dword [0x5896e8]
test eax, eax
jne 0x41ccc9
push 0x5896e8
push 0x5896e8
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x41ccbc
mov eax, dword [0x5896e8]
test eax, eax
jne 0x41ccc9
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x5896e8], eax
push eax
push esi
call fcn.0041ba80
add esp, 8
jmp 0x41ccee
push 0
push esi
call fcn.0041ba80
add esp, 8
jmp 0x41ccee
mov dword [esi], 0
mov dword [esi], 0x583010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x1408]
xor ecx, ebp
call fcn.00512b0b
lea esp, [ebp + 0x140c]
pop ebp
ret 8
Function at 0x41d2a0
Capabilities:
Get http content length

Disassembly:
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x41d2ba
mov ecx, dword [esi + 4]
push 0
mov byte [esi + 8], 1
call fcn.00413ca0
mov eax, dword [esi + 4]
pop esi
mov eax, dword [eax + 0x40]
test eax, eax
je 0x41d305
lea ecx, [esp + 4]
mov dword [esp + 4], 0
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 4], 0
push ecx
lea ecx, [esp + 8]
mov dword [esp + 0x10], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41d305
mov eax, dword [esp]
xor edx, edx
add esp, 0xc
ret
or eax, 0xffffffff
or edx, eax
add esp, 0xc
ret
Function at 0x41f690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cb30
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f6ec
test eax, 0x400
je 0x41f6ec
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4211a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c34d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x550bfc
push ecx
mov ecx, esp
mov eax, dword [eax]
mov dword [ecx], eax
add eax, 0xfffffff8
cmp eax, 0x583008
je 0x4211df
lock inc dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.004101a0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
call fcn.00414490
add esp, 8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff8
cmp ecx, 0x583008
je 0x421228
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x421228
push ecx
call fcn.005128b5
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x421d90
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x421e09
push 0
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x421df9
lea eax, [esp + 0x10]
push eax
call fcn.0041ca50
mov ecx, dword [esi + 0x18]
add esp, 4
mov edx, dword [eax]
mov dword [esi + 0x18], edx
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x583008
je 0x421df9
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x421df9
push ecx
call fcn.005128b5
add esp, 4
mov eax, dword [esp + 4]
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
pop ecx
ret 8
xor eax, eax
add dword [esi + 0x10], eax
adc dword [esi + 0x14], eax
pop esi
pop ecx
ret 8

Function at 0x422010
Capabilities:
Read data from internet
Receive data

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x422027
mov ecx, dword [esi + 4]
push 0
mov byte [esi + 8], 1
call fcn.00413ca0
mov ecx, dword [esp + 8]
xor eax, eax
mov esi, dword [esi + 4]
test ecx, ecx
je 0x422068
mov dword [esp + 8], eax
cmp byte [esi + 0x58], al
jne 0x422068
mov edx, dword [esi + 0x40]
test edx, edx
je 0x422068
lea eax, [esp + 8]
push eax
push dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 8]
add dword [esi + 0x50], eax
adc dword [esi + 0x54], 0
test eax, eax
jne 0x422068
mov byte [esi + 0x58], 1
pop esi
ret 8
Function at 0x427660
Capabilities:
Read data from internet
Receive data

Disassembly:
push ecx
push edi
mov edi, dword [ecx + 4]
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x427673
xor al, al
pop edi
pop ecx
ret 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
cmp ebx, dword [edi + 0x50]
jne 0x42768b
cmp ebp, dword [edi + 0x54]
je 0x427774
push 0
push 0
push 0
push ebx
push eax
mov byte [edi + 0x58], 0
call dword [sym.imp.WININET.dll_InternetSetFilePointer]
xor ecx, ecx
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
cmp eax, ebx
jne 0x4276b6
cmp ebp, ecx
jne 0x4276b8
pop ebp
pop ebx
mov al, 1
pop edi
pop ecx
ret 8
cmp ebp, ecx
jg 0x4276c9
jl 0x4276c0
cmp ebx, eax
jae 0x4276c9
pop ebp
pop ebx
xor al, al
pop edi
pop ecx
ret 8
sub ebx, eax
push esi
sbb ebp, ecx
js 0x4276f0
jg 0x4276da
cmp ebx, 0x4000
jbe 0x4276f0
mov eax, 0x4000
push eax
mov dword [esp + 0x1c], eax
call fcn.0051821c
add esp, 4
mov esi, eax
jmp 0x427710
mov eax, ebx
push eax
mov dword [esp + 0x1c], eax
call fcn.0051821c
add esp, 4
mov esi, eax
test ebp, ebp
jl 0x42776a
jg 0x427710
test ebx, ebx
je 0x42776a
nop dword [eax + eax]
cmp byte [edi + 0x58], 0
jne 0x42776a
mov ecx, dword [esp + 0x18]
mov eax, ecx
cdq
cmp edx, ebp
jg 0x427727
jl 0x427729
cmp eax, ebx
jb 0x427729
mov ecx, ebx
xor eax, eax
test esi, esi
je 0x42775b
mov edx, dword [edi + 0x40]
mov dword [esp + 0x10], eax
test edx, edx
je 0x42775b
lea eax, [esp + 0x10]
push eax
push ecx
push esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x10]
add dword [edi + 0x50], eax
adc dword [edi + 0x54], 0
test eax, eax
jne 0x42775b
mov byte [edi + 0x58], 1
cdq
sub ebx, eax
sbb ebp, edx
test ebp, ebp
jg 0x427710
jl 0x42776a
test ebx, ebx
jne 0x427710
push esi
call fcn.00518201
add esp, 4
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
pop ecx
ret 8
Function at 0x427e50
Capabilities:
Create pipe
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ddd4
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x1c
call fcn.00512877
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x427f8a
push 0
lea ecx, [ebp - 0x20]
mov byte [esi], 0
push ecx
lea ebx, [esi + 8]
mov dword [esi + 4], 0
lea eax, [esi + 4]
mov dword [ebx], 0
push ebx
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x427f8c
push 0
push 1
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x427f8c
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x64], 0x44
test cl, 1
je 0x427f2f
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
jmp 0x427f36
mov dword [ebp - 0x28], 0
test cl, 2
je 0x427f42
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
jmp 0x427f49
mov dword [ebp - 0x24], 0
push dword [ebp + 8]
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], 0x100
push eax
call fcn.00414490
add esp, 8
mov ecx, dword [eax]
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x8000400
push 1
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
mov byte [esi], al
jmp 0x427f8c
xor esi, esi
mov ebx, dword [edi]
mov dword [edi], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x427fc8
cmp byte [ebx], 0
je 0x427fa9
push dword [ebx + 0x10]
call edi
push dword [ebx + 0xc]
call edi
mov eax, dword [ebx + 4]
test eax, eax
je 0x427fb3
push eax
call edi
mov eax, dword [ebx + 8]
test eax, eax
je 0x427fbd
push eax
call edi
push 0x1c
push ebx
call fcn.005128a7
add esp, 8
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebx]
cmp byte [esi], 0
jne 0x42800a
mov dword [ebx], 0
test esi, esi
je 0x42800a
cmp byte [esi], 0
je 0x427feb
push dword [esi + 0x10]
call edi
push dword [esi + 0xc]
call edi
mov eax, dword [esi + 4]
test eax, eax
je 0x427ff5
push eax
call edi
mov eax, dword [esi + 8]
test eax, eax
je 0x427fff
push eax
call edi
push 0x1c
push esi
call fcn.005128a7
add esp, 8
cmp dword [ebx], 0
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4280b0
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor dl, dl
lea eax, [edi + 0x101]
xchg byte [eax], dl
lea eax, [esp + 0xc]
push eax
push 4
push edi
push 0x428850
push dword [edi + 0xf8]
push 0
call fcn.0051b940
add esp, 0x18
lea esi, [edi + 0xc]
xchg dword [esi], eax
mov eax, dword [esi]
nop
test eax, eax
je 0x42816f
mov eax, dword [esp + 0xc]
lea ebx, [edi + 0x10]
xchg dword [ebx], eax
mov ecx, dword [esi]
nop
push dword [esp + 0x14]
mov al, byte [edi + 0x1c]
push ecx
push eax
call fcn.004277e0
add esp, 0xc
test al, al
mov eax, dword [esi]
nop
je 0x42814d
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esi, [edi + 0x3c]
push esi
call fcn.00511c14
add esp, 4
test eax, eax
jne 0x428178
mov cl, 1
lea eax, [edi + 0x94]
xchg byte [eax], cl
lea eax, [edi + 0x6c]
push eax
call fcn.00511d60
push esi
call fcn.00511c39
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
ret 4
test eax, eax
je 0x42815d
mov eax, dword [esi]
nop
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi]
nop
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xchg dword [ebx], eax
xor eax, eax
xchg dword [esi], eax
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 4
push eax
call fcn.00511f0f
int3