joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f5c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc04
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor edx, edx
push ebp
push 0x42f735
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x40000
call fcn.00402ae0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x42f724
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x40000
call fcn.00403608
lea eax, [ebp - 0x3fa]
xor ecx, ecx
mov edx, 0x1f5
call fcn.00403608
lea eax, [ebp - 0x205]
mov edx, dword [ebp - 4]
call fcn.0040a0c4
cmp byte [ebp + 8], 0
je 0x42f647
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x205]
push eax
push edi
call sub.advapi32.dll_RegCreateKeyA
jmp 0x42f658
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x205]
push eax
push edi
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
je 0x42f66e
call fcn.00404778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42f73f
xor edx, edx
push ebp
push 0x42f707
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.0040a0c4
mov eax, esi
call fcn.00405060
mov esi, eax
lea eax, [ebp - 0x3fa]
xor ecx, ecx
mov edx, 0x1f5
call fcn.00403608
lea eax, [ebp - 0x3fa]
mov edx, ebx
call fcn.0040a0c4
test ebx, ebx
jne 0x42f6b9
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x42f6c2
lea eax, [ebp - 0x3fa]
mov dword [ebp - 8], eax
push esi
mov eax, dword [ebp - 0x10]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x42f6f0
call fcn.00404778
call fcn.00404778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42f73f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f70e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42fdb8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x42fdc0
push ecx
push ebx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42ff66
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 1
mov dl, 1
mov eax, dword [0x41a700]
call fcn.00403e6c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x42fee9
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, dword [ebp - 0xc]
mov edx, 0x3f
mov eax, dword [ebp - 4]
call fcn.0042fca4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x42fed3
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00409d5c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
pop ecx
call fcn.004050ac
mov bl, 1
mov eax, dword [ebp - 0x10]
call fcn.00405260
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x42fe92
test al, 0x10
je 0x42fe92
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.0040dde4
lea eax, [ebp - 0x24]
mov edx, 0x42ff80
call fcn.00405068
mov eax, dword [ebp - 0x24]
mov dl, 1
call fcn.0042fdb8
mov ebx, eax
jmp 0x42febf
test bl, bl
je 0x42febf
push 0x80
mov eax, dword [ebp - 0x10]
call fcn.00405260
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x42febf
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.0042ff84
mov ebx, eax
test bl, bl
jne 0x42fec7
mov byte [ebp - 6], 0
inc dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x42fe2a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fef0
lea eax, [ebp - 0xc]
call fcn.0040ee04
ret
Function at 0x43026c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x430275
mov eax, dword [ebp - 4]
add esp, 0xfffffbfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2408], ecx
mov dword [ebp - 0x2404], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x43044f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404da0
lea eax, [ebp - 0x209]
mov edx, 0x430468
call fcn.0040a0c4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x209]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
jne 0x430431
push ebp
push 0x43042a
push dword fs:[0]
mov dword fs:[0], esp
xor esi, esi
lea eax, [ebp - 0x3fe]
xor ecx, ecx
mov edx, 0x1f5
call fcn.00403608
mov dword [ebp - 0xc], 0xfff
lea eax, [ebp - 0x13fe]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00403608
mov dword [ebp - 8], 0x1f5
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x23fe]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x3fe]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
inc esi
test ebx, ebx
jne 0x430381
lea edx, [ebp - 0x2404]
lea eax, [ebp - 0x3fe]
call fcn.0040a1f4
mov eax, dword [ebp - 0x2404]
mov edx, 0x4304a4
call fcn.004051ac
jne 0x4302f9
test ebx, ebx
jne 0x430413
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jle 0x4303cb
lea eax, [ebp - 0x23fe]
cmp byte [eax], 0
jne 0x4303ab
cmp byte [eax + 1], 0
jne 0x4303ab
mov byte [eax], 0x3d
mov byte [eax + 1], 9
jmp 0x4303c7
mov cl, byte [eax]
test cl, cl
jne 0x4303c0
cmp byte [eax + 1], 0x21
jne 0x4303c0
mov byte [eax], 0x3d
mov byte [eax + 1], 0x21
jmp 0x4303c7
test cl, cl
jne 0x4303c7
mov byte [eax], 9
inc eax
dec edx
jne 0x430397
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x23fe], 0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x23fe]
call fcn.0040a1f4
mov al, byte [0x4304c0]
push eax
lea eax, [ebp - 0x2408]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, 0x4304cc
mov edx, 0x4304d8
call fcn.0040e5ec
mov edx, dword [ebp - 0x2408]
mov eax, dword [ebp - 4]
call fcn.00404df4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430431
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430456
lea eax, [ebp - 0x2408]
mov edx, 2
call fcn.00404dc4
ret
Function at 0x4304dc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff68
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1098], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405250
xor eax, eax
push ebp
push 0x430658
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push ebp
push 0x430630
push dword fs:[ebx]
mov dword fs:[ebx], esp
lea eax, [ebp - 0x91]
mov edx, 0x430670
call fcn.0040a0c4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x91]
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
je 0x430553
call fcn.00404778
jmp 0x430637
mov al, byte [0x4306a4]
push eax
lea eax, [ebp - 0x1098]
push eax
mov ecx, 0x4306b0
mov edx, 0x4306bc
mov eax, dword [ebp - 4]
call fcn.0040e5ec
mov edx, dword [ebp - 0x1098]
lea eax, [ebp - 4]
call fcn.00404e38
mov edx, dword [ebp - 4]
mov eax, 0x4306bc
call fcn.004053a4
test eax, eax
jne 0x430553
lea eax, [ebp - 4]
mov edx, 0x4306cc
call fcn.00405068
mov eax, dword [ebp - 4]
call fcn.00405060
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
test esi, esi
jle 0x4305dd
mov edx, 1
lea eax, [ebp - 0x1091]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx - 1]
cmp cl, 0xd
je 0x4305d1
cmp cl, 0xa
je 0x4305d1
cmp cl, 0x3d
jne 0x4305d6
mov byte [eax], 0
jmp 0x4305d8
mov byte [eax], cl
inc edx
inc eax
dec esi
jne 0x4305bb
lea eax, [ebp - 0x91]
mov edx, 0x4306d8
call fcn.0040a0c4
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1091]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x91]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x430619
call fcn.00404778
jmp 0x430637
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430637
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43065f
lea eax, [ebp - 0x1098]
call fcn.00404da0
lea eax, [ebp - 4]
call fcn.00404da0
ret

Function at 0x430c88
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x11
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 9], ebx
test ebx, ebx
jbe 0x430d1c
xor eax, eax
push ebp
push 0x430d06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00430bec
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xd], esi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 9]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x11]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x430d1c
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x43618c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403608
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4375c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4377d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.00404df4
xor edx, edx
push ebp
push 0x4377a7
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x219]
mov edx, esi
call fcn.0040a0c4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x219]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
je 0x437642
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4377b1
xor edx, edx
push ebp
push 0x437796
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x40000
call fcn.00402ae0
mov dword [ebp - 0x20], eax
xor edx, edx
push ebp
push 0x437778
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x40e]
xor ecx, ecx
mov edx, 0x1f5
call fcn.00403608
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, 0x40000
call fcn.00403608
mov dword [ebp - 0x10], 0x3ffff
mov dword [ebp - 0xc], 0x1f5
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40e]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumValueA
inc dword [ebp - 0x18]
test eax, eax
je 0x4376ea
call fcn.00404778
call fcn.00404778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4377b1
xor eax, eax
push ebp
push 0x437710
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x40e]
call fcn.0040a1f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x437722
lea edx, [ebp - 0x414]
mov eax, dword [ebp - 0x24]
call fcn.00409298
mov eax, dword [ebp - 0x414]
push eax
lea edx, [ebp - 0x418]
mov eax, dword [ebp - 4]
call fcn.00409298
mov edx, dword [ebp - 0x418]
pop eax
call fcn.004051ac
jne 0x437670
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
call fcn.0040a1f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43777f
mov eax, dword [ebp - 0x20]
call fcn.00402b10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4377de
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.00404dc4
lea eax, [ebp - 0x24]
call fcn.00404da0
ret
Function at 0x4377e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc04
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor edx, edx
push ebp
push 0x437935
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x40000
call fcn.00402ae0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x437924
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x40000
call fcn.00403608
lea eax, [ebp - 0x3fa]
xor ecx, ecx
mov edx, 0x1f5
call fcn.00403608
lea eax, [ebp - 0x205]
mov edx, dword [ebp - 4]
call fcn.0040a0c4
cmp byte [ebp + 8], 0
je 0x43786f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x205]
push eax
push edi
call sub.advapi32.dll_RegCreateKeyA
jmp 0x437880
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x205]
push eax
push edi
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
je 0x437896
call fcn.00404778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43793f
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.0040a0c4
mov eax, esi
call fcn.00405060
mov esi, eax
lea eax, [ebp - 0x3fa]
xor ecx, ecx
mov edx, 0x1f5
call fcn.00403608
lea eax, [ebp - 0x3fa]
mov edx, ebx
call fcn.0040a0c4
test ebx, ebx
jne 0x4378d3
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4378dc
lea eax, [ebp - 0x3fa]
mov dword [ebp - 8], eax
push esi
mov eax, dword [ebp - 0x10]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x437905
call fcn.00404778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43793f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43792b
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x10]
call fcn.00402b10
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x437a84
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
mov byte [ebx], 0
mov eax, dword [ebp - 0x88]
cmp eax, 2
jne 0x437ae4
mov byte [ebp - 1], 4
mov byte [ebx], 1
cmp dword [ebp - 0x94], 5
jb 0x437b31
mov byte [ebp - 1], 5
mov eax, dword [ebp - 0x90]
cmp eax, 1
jb 0x437ad9
mov byte [ebp - 1], 6
cmp eax, 2
jb 0x437b31
mov byte [ebp - 1], 7
jmp 0x437b31
cmp eax, 1
jne 0x437b2d
mov byte [ebp - 1], 1
cmp dword [ebp - 0x94], 4
ja 0x437b08
cmp dword [ebp - 0x94], 4
jne 0x437b0c
cmp dword [ebp - 0x90], 0xa
jb 0x437b0c
mov byte [ebp - 1], 2
cmp dword [ebp - 0x94], 4
ja 0x437b27
cmp dword [ebp - 0x94], 4
jne 0x437b31
cmp dword [ebp - 0x90], 0x5a
jb 0x437b31
mov byte [ebp - 1], 3
jmp 0x437b31
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x437b76
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x46ca3c], eax
lea eax, [ebp - 0x144]
push eax
call fcn.004221d0
test eax, eax
je 0x437b6c
mov eax, dword [ebp - 0x144]
mov ecx, 0x3c
cdq
idiv ecx
add eax, 0xfffffff8
mov dword [0x46ca3c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x437b80
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437cf8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
call fcn.00404f98
cmp dword [ebx], 0
je 0x437d36
mov eax, dword [ebx]
call fcn.00405060
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x437d36
mov eax, ebx
mov edx, 0x437d48
call fcn.00405068
add esp, 0x108
pop ebx
ret

Function at 0x43869c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push ebp
push 0x4386eb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test bl, bl
jne 0x4386dd
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4386dd
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00438640
test eax, eax
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4386f2
ret
Function at 0x439578
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405250
xor eax, eax
push ebp
push 0x43965c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0043742c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00426a20
lea eax, [ebp - 8]
mov edx, 0x439670
call fcn.00405068
mov eax, dword [ebp - 8]
call fcn.004269a8
test al, al
je 0x439641
test bl, bl
je 0x439602
lea eax, [ebp - 0x14]
call fcn.0043742c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00426a20
lea eax, [ebp - 0x10]
mov edx, 0x439670
call fcn.00405068
mov eax, dword [ebp - 0x10]
mov ecx, 1
mov edx, dword [ebp - 4]
call fcn.0043837c
jmp 0x439641
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00405260
push eax
lea eax, [ebp - 0x1c]
call fcn.0043742c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00426a20
lea eax, [ebp - 0x18]
mov edx, 0x439670
call fcn.00405068
mov eax, dword [ebp - 0x18]
call fcn.00405260
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439663
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00404dc4
ret
Function at 0x45d21c
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.00405250
xor eax, eax
push ebp
push 0x45d2dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403608
push ebp
call fcn.0045d154
pop ecx
xor eax, eax
push ebp
push 0x45d2bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x40]
call fcn.00405260
push eax
call sub.wininet.dll_InternetCrackUrlA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call fcn.00404f98
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.00404f98
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00404f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d2c6
push ebp
call fcn.0045d1dc
pop ecx
ret
Function at 0x45f2dc
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405250
xor eax, eax
push ebp
push 0x45f37e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x46cc6c
xor ecx, ecx
mov edx, 0x3c
call fcn.00403608
call fcn.0045f1f8
xor eax, eax
push ebp
push 0x45f361
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x46cc6c], 0x3c
push 0x46cc6c
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405260
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, ebx
mov edx, dword [0x46cc7c]
call fcn.00404f98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f368
call fcn.0045f278
ret
Function at 0x45f474
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405250
lea edi, [ebp - 0x2c]
xor eax, eax
push ebp
push 0x45f61c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0042670c
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00404e38
cmp dword [ebp - 4], 0
je 0x45f5fe
push 0
lea eax, [ebp - 0x10]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
jne 0x45f4e8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045d4fc
test eax, eax
je 0x45f5fe
xor ecx, ecx
mov dl, 1
mov eax, dword [0x431044]
call fcn.004322a0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45f5f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x45f5a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
add eax, 0x39
mov edx, dword [ebp - 4]
call fcn.00404df4
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0043288c
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x52], 0
mov eax, dword [ebp - 0xc]
call fcn.004325c4
mov eax, ebx
add eax, eax
test eax, eax
jbe 0x45f597
mov ebx, eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 0x92]
test esi, esi
je 0x45f591
push 0x1f4
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x45f597
jmp 0x45f57f
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x45f573
inc dword [ebp - 0x10]
dec ebx
jne 0x45f54f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45f5ab
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f5fe
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x92]
test ebx, ebx
je 0x45f5d0
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x79]
call fcn.00404df4
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x45f5e6
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x6d]
call fcn.00404df4
mov eax, dword [ebp - 0xc]
call fcn.00432718
mov eax, dword [ebp - 0xc]
call fcn.00403e9c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f623
lea eax, [ebp - 0x30]
call fcn.00404da0
lea eax, [ebp - 4]
call fcn.00404da0
ret