joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a194
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41a2b9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00419f9c
mov esi, eax
mov eax, dword [0x426780]
cmp byte [eax], 0
je 0x41a261
mov eax, dword [0x426678]
call fcn.00404e08
call fcn.00404af4
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41a164]
call fcn.00408a08
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41a2d4
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x41a29d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x426654]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x42a62c]
call fcn.00408bf4
push eax
call sub.user32.dll_LoadStringW
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a2c0
lea eax, [ebp - 4]
mov edx, dword [0x41a164]
call fcn.00408b2c
ret
Function at 0x41b0a4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41b1a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406c68
lea eax, [ebp - 4]
call fcn.00406d70
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407034
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x41b18e
mov eax, ebx
call fcn.004049a0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x41b187
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407034
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x41b171
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x41b1b8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x41b171
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b18e
mov eax, dword [ebp - 0x10]
call fcn.004049bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b1ab
lea eax, [ebp - 4]
call fcn.0040688c
ret
Function at 0x403d36
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
xor ebx, ebx
cmp dword [0x41358c], ebx
je 0x403e4a
push str.Adobe_LM_Service
push str.Adobe_Systems
push str.SOFTWARE_sLicenses_s
lea eax, [ebp - 0x168]
push 0x100
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00405220
add esp, 0x14
lea eax, [ebp - 8]
push ebx
push eax
push 0x4134a0
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x168]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x403da7
xor ax, ax
jmp 0x403e4e
push esi
push 0x60
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00404f80
push ebx
call fcn.00405e63
push eax
call fcn.00405e34
call fcn.00405e41
mov esi, eax
shl esi, 0x10
call fcn.00405e41
add esi, eax
lea eax, [ebp - 4]
push 4
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], esi
push eax
call fcn.00404b90
mov eax, dword [ebp - 4]
add esp, 0x20
add dword [ebp + 8], eax
push 4
pop esi
lea eax, [ebp + 8]
push eax
call fcn.00403b97
lea eax, [ebp + 8]
push 4
push eax
lea eax, [ebp + esi - 0x68]
push eax
call fcn.00404b90
mov eax, dword [ebp + 8]
add esi, 4
add eax, eax
add esp, 0x10
sub eax, dword [ebp - 4]
cmp esi, 0x60
mov dword [ebp + 8], eax
jb 0x403def
lea eax, [ebp - 0x68]
push 0x60
push eax
push 3
push ebx
push 0x4135a0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
sete al
pop esi
jmp 0x403e4e
mov ax, 1
pop ebx
leave
ret

Function at 0x403e51
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4139c0
call esi
push 0x4139d8
call esi
xor eax, eax
push eax
push eax
push eax
push 0x403e98
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x405f3f
Capabilities:
Encode data using xor

Disassembly:
lea eax, [0x806d880d]
xor ch, dl
imul ebp, eax
mov ebx, 0xea5f6afb
imul eax, eax, 0x96189d5e
mov ebx, eax
lea edx, [0x48d816e]
test dh, dl
dec edi
cmp ebp, 0x833d
jbe 0x405f6d
dec ecx
dec ebp
movsx ecx, bp
push 0x4f3b49
push 0xdddc54
dec edx
mov bh, 0x23
sbb dh, dl
push 0
pop ecx
mov esi, 0xb9979a47
mov dl, 0x61
imul eax, ebp, 0x5429ad2f
mov bh, 0x12
movsx edi, ch
add ecx, 0xfffff011
sbb bl, 0x1e
dec edx
test ch, 0x59
add ecx, 0xff0
adc bl, bl
mov al, ah
mov bh, 0x6c
lea ebp, [0x93fcb79c]
lea ebp, [0x4b5da9]
xor ebp, 0x67c34330
cmp ecx, 0x986
jbe 0x405f80
movzx eax, si
lea eax, [0x6c9e718c]
mov ebx, esi
imul edx, eax, 0x70bf3e4
mov ebx, edx
call 0x405fe5
imul ecx, ecx, 0
cmp ebx, 0x975b
jbe 0x405ff7
dec eax
imul edi, edi, 0x57e501f1
mov ah, ch
imul esi, ebp
xchg al, ah
mov dl, 0x16
add ecx, 0x857
cmp edx, 0x5f33
js 0x406010
sbb ah, ch
sub ecx, 0x856
mov dl, al
cmp ebx, 0x5ce0
je 0x406023
movsx edi, di
test bh, dl
cmp ecx, 0x350
invalid
invalid
mov bh, 0xff
Function at 0x4034b0
Capabilities:
Get geographical location
Get system information on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d804
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x45506c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa8], 0
call fcn.004082c0
push eax
mov ecx, 0x458660
call fcn.004057f0
mov edx, dword [ebp - 0x90]
cmp edx, 0x10
jb 0x403535
mov ecx, dword [ebp - 0xa4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40352b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403719
push edx
push ecx
call fcn.0040d849
add esp, 8
lea ecx, [ebp - 0xa4]
call fcn.00408600
push eax
mov ecx, 0x458678
call fcn.004057f0
mov edx, dword [ebp - 0x90]
cmp edx, 0x10
jb 0x403585
mov ecx, dword [ebp - 0xa4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40357b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40371e
push edx
push ecx
call fcn.0040d849
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa4]
push 2
push 0x44ddbc
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0xf
mov byte [ebp - 0xa4], 0
call fcn.004067e0
lea eax, [ebp - 0x8c]
mov dword [ebp - 0xa8], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x8c]
cmp ax, 9
je 0x4035e9
cmp ax, 6
je 0x4035e9
cmp ax, 0xc
jne 0x4035fb
push 2
push 0x44ddc0
lea ecx, [ebp - 0xa4]
call fcn.004067e0
lea eax, [ebp - 0xa4]
mov ecx, 0x458690
push eax
call fcn.004057f0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x90]
cmp edx, 0x10
jb 0x40364d
mov ecx, dword [ebp - 0xa4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403643
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403723
push edx
push ecx
call fcn.0040d849
add esp, 8
mov dword [ebp - 4], 1
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0xf
mov byte [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0x55
lea eax, [ebp - 0x68]
push eax
push 0x59
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4036b9
lea ecx, [ebp - 0x68]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4036a0
sub ecx, edx
lea eax, [ebp - 0x68]
push ecx
push eax
lea ecx, [ebp - 0xa4]
call fcn.004067e0
lea eax, [ebp - 0xa4]
mov ecx, 0x4586a8
push eax
call fcn.004057f0
mov edx, dword [ebp - 0x90]
cmp edx, 0x10
jb 0x403700
mov ecx, dword [ebp - 0xa4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4036f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403728
push edx
push ecx
call fcn.0040d849
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d833
mov esp, ebp
pop ebp
ret
call fcn.00428840
call fcn.00428840
call fcn.00428840
call fcn.00428840
int3
Function at 0x404950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43da04
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x45506c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x120], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x11c]
push 0x104
push 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push eax
mov byte [edi], 0
mov dword [ebp - 0x120], 2
call fcn.00425860
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x102
ja 0x404a08
lea ecx, [ebp - 0x11c]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4049f0
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
mov ecx, edi
call fcn.004067e0
mov dword [ebp - 4], 0
mov eax, edi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x120], 1
jb 0x404a23
mov eax, dword [edi]
push 0
push eax
call fcn.00428b14
add esp, 8
test eax, eax
je 0x404a77
lea ecx, [ebp - 0x140]
call fcn.00409040
push eax
mov ecx, edi
call fcn.004057f0
mov edx, dword [ebp - 0x12c]
cmp edx, 0x10
jb 0x404a9c
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404a92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404b0f
jmp 0x404a92
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x404a81
mov eax, dword [edi]
push 4
push eax
call fcn.00428b14
add esp, 8
test eax, eax
je 0x404a9c
jmp 0x404a32
push edx
push ecx
call fcn.0040d849
add esp, 8
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 0x14
jb 0x404ad3
lea eax, [ecx + 0x14]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x404aba
mov eax, dword [edi]
push 0x14
lea esi, [eax + ecx]
push str.TempAltRemoveKeyPath
push esi
call fcn.004252e0
add esp, 0xc
mov byte [esi + 0x14], 0
jmp 0x404af0
push 0x14
push str.TempAltRemoveKeyPath
mov byte [ebp - 0x124], 0
mov ecx, edi
push dword [ebp - 0x124]
push 0x14
call fcn.00407360
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040d833
mov esp, ebp
pop ebp
ret 4
call fcn.00428840
int3
Function at 0x405980
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43db82
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x45506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x44dcf8
mov dword [edi + 0x10], 0x44dc90
mov dword [edi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.00402b70
push ecx
lea ebx, [edi + 0x18]
mov dword [esi + 0x3c], 0
mov ecx, esi
mov dword [esi + 0x38], ebx
call fcn.004069c0
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x405a38
mov eax, dword [esi + 0xc]
mov ecx, esi
or eax, 4
push 0
push eax
call fcn.00402af0
lea edx, [edi + 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov dword [ebp - 4], 5
mov eax, dword [edi]
push 8
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ebx
lea eax, [ecx - 0x68]
mov dword [ecx + edi - 4], eax
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0040da7e
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 6
call fcn.0040c07a
mov dword [esi + 4], eax
lea ecx, [ebx + 8]
lea eax, [ebx + 4]
mov dword [ebx + 0x34], esi
mov dword [ebx + 0xc], eax
add esp, 4
lea eax, [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [ebx + 0x2c], eax
lea eax, [ebx + 0x28]
mov dword [ebx + 0x30], eax
mov dword [ecx], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, dword [ebx + 0xc]
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, edi
mov dword [ebx], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408b10
Capabilities:
Access peb ldr_data
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43de93
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x45506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x88
mov dword [ebp - 4], 1
call fcn.0040da7e
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x24]
mov dword [edi], vtable.CWinHttp.0
mov dword [edi + 4], 0
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x1388
mov dword [edi + 0x1c], 0x1388
mov dword [edi + 0x20], 0x1388
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CHttpHeader.0
mov dword [esi + 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xf
mov byte [esi + 0x20], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0xf
mov byte [esi + 0x38], 0
add esi, 0x50
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040b1ba
push 0
push 0
push 0
mov dword [esi], eax
xorps xmm0, xmm0
push 0
movq qword [edi + 0x7c], xmm0
push str.Microsoft_Internet_Explorer
mov dword [edi + 0x84], 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [edi + 0xc], eax
test eax, eax
jne 0x408c2b
mov dword [edi + 0x84], 1
jmp 0x408c3d
push dword [edi + 0x20]
push dword [edi + 0x1c]
push dword [edi + 0x18]
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov byte [ebp - 4], 1
lea edx, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
lea ecx, [ebp + 8]
mov eax, dword [edi]
cmovae edx, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 8
push edx
cmovae ecx, dword [ebp + 8]
mov eax, dword [eax + 4]
push ecx
mov ecx, edi
call eax
test al, al
mov ecx, edi
mov eax, dword [edi]
jne 0x408c71
call dword [eax + 0xc]
xor bl, bl
jmp 0x408c76
call dword [eax + 0xc]
mov bl, 1
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x408cac
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408ca2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d0a
push edx
push ecx
call fcn.0040d849
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x408cf6
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408cec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408d0f
push edx
push ecx
call fcn.0040d849
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00428840
call fcn.00428840
int3
Function at 0x409120
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x45506c]
xor eax, esp
mov dword [esp + 0x68], eax
cmp dword [edx + 0x14], 0x10
xorps xmm0, xmm0
mov eax, dword [edx + 0x10]
push esi
mov esi, ecx
movlpd qword [esp + 8], xmm0
mov dword [esp + 4], esi
mov dword [esp + 4], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x54], 0x67452301
mov dword [esp + 0x58], 0xefcdab89
mov dword [esp + 0x5c], 0x98badcfe
mov dword [esp + 0x60], 0x10325476
jb 0x40917b
mov edx, dword [edx]
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.00401890
push esi
lea ecx, [esp + 0xc]
call fcn.00401940
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040d833
mov esp, ebp
pop ebp
ret
Function at 0x4097c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43dfc8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45506c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp dword [ebp + 0x1c], 8
lea edx, [ebp + 8]
cmovae edx, dword [ebp + 8]
push edx
push 0x84
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4098d5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x4098d5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4098d5
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4098d5
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
mov ebx, eax
push 0x10
mov dword [ebp - 0x14], ebx
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x409896
lea ecx, [esi + 4]
mov dword [esi + 8], 0
push ecx
mov dword [esi + 0xc], 0
push ebx
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [ecx], 0
call dword [sym.imp.gdiplus.dll_GdipLoadImageFromStream]
mov dword [esi + 8], eax
jmp 0x409898
xor esi, esi
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push ecx
mov eax, dword [ebx]
mov dword [eax + 0x4c], esi
mov eax, dword [ecx]
call dword [eax + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x4c]
test ecx, ecx
je 0x4098d5
call fcn.00401150
mov ecx, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x4c]
call fcn.00401190
mov ecx, dword [ebx]
mov bl, 1
mov dword [ecx + 4], eax
jmp 0x4098d7
xor bl, bl
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x40990d
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409903
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409923
push edx
push ecx
call fcn.0040d849
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.00428840
int3

Function at 0x40a18c
Capabilities:
Initialize winhttp library

Disassembly:
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
push str.Microsoft_Internet_Explorer
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x40a1b6
mov dword [esi + 0x84], 1
xor al, al
jmp 0x40a1c9
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
push edi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov al, 1
pop edi
pop esi
ret
Function at 0x40a442
Capabilities:
Receive http response

Disassembly:
push 0x44
mov eax, 0x43e04c
call fcn.0040e3c4
mov esi, ecx
mov dword [ebp - 0x4c], esi
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
call fcn.0040aab7
test al, al
je 0x40a60d
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.0040a9d6
test al, al
jne 0x40a4a3
mov dword [ebp - 0x34], 4
lea eax, [ebp - 0x34]
push 0x453640
jmp 0x40a61c
mov ecx, esi
call fcn.0040aa4b
mov dword [esi + 4], eax
cmp eax, 0x194
jne 0x40a4c8
mov dword [ebp - 0x38], 5
lea eax, [ebp - 0x38]
push 0x453640
jmp 0x40a61c
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x40a4ed
mov dword [ebp - 0x3c], 4
lea eax, [ebp - 0x3c]
push 0x453640
jmp 0x40a61c
cmp dword [ebp - 0x20], 0x800000
jbe 0x40a50a
mov dword [ebp - 0x40], 0xc
lea eax, [ebp - 0x40]
push 0x453640
jmp 0x40a61c
push dword [ebp - 0x20]
call fcn.00428679
mov dword [ebp - 0x1c], eax
mov dword [esp], 0x1000
call fcn.00428679
mov edi, eax
mov eax, dword [ebp - 0x18]
pop ecx
mov dword [ebp - 0x28], edi
cmp eax, 0x1000
jbe 0x40a549
push edi
call fcn.0042865e
push dword [ebp - 0x18]
call fcn.00428679
mov edi, eax
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov dword [ebp - 0x28], edi
lea ecx, [ebp - 0x24]
push ecx
push eax
push edi
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x40a570
mov dword [ebp - 0x44], 8
lea eax, [ebp - 0x44]
push 0x453640
jmp 0x40a61c
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, ebx
push edi
push eax
call fcn.00424d60
add ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x2c], ebx
push eax
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x40a5aa
mov dword [ebp - 0x48], 8
lea eax, [ebp - 0x48]
push 0x453640
jmp 0x40a61c
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x40a52a
mov byte [ebp + 0xb], 1
jmp 0x40a5d9
test edi, edi
je 0x40a5e4
push edi
call fcn.0042865e
pop ecx
cmp byte [ebp + 0xb], 0
je 0x40a5f9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
jmp 0x40a602
push dword [ebp - 0x1c]
call fcn.0042865e
pop ecx
mov al, byte [ebp + 0xb]
call fcn.0040e333
ret 0xc
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x30]
push 0x453640
push eax
call fcn.00424cf2
int3