joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036d30
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
push 1
push 8
push str.PReg
call dword [sym.imp.MSVCR80.dll_fwrite]
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
add esp, 0x10
cmp ebx, edi
jbe 0x10036d5d
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov esi, ebx
nop
cmp ebx, edi
jbe 0x10036d6a
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, edi
je 0x10036dd4
jb 0x10036d76
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp byte [esi], 0
je 0x10036da1
cmp esi, edi
jb 0x10036d85
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, edi
mov ebx, dword [esi + 4]
jb 0x10036d92
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x18]
mov dword [eax + ebx - 6], ecx
mov ebx, dword [esp + 0x20]
cmp esi, edi
jb 0x10036db1
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push ebp
push 1
push edx
push eax
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp esi, edi
jb 0x10036dcf
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add esi, 0xc
jmp 0x10036d60
test ebx, ebx
je 0x10036de1
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
Function at 0x100375d0
Capabilities:
Access peb ldr_data
Get common file path
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10047d6e
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x10056024]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push edi
mov eax, dword [0x10056024]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
xor edi, edi
mov dword [esi], vtable.CShutdownManager.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
push 0x206
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
lea eax, [esp + 0x1a]
push edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
push eax
mov dword [esi + 0x2c], edi
mov word [esp + 0x20], di
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x208
lea ebx, [esi + 0x30]
push edi
push ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x208
lea ebp, [esi + 0x238]
push edi
push ebp
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x208
lea eax, [esi + 0x440]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x208
lea eax, [esi + 0x648]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100376fd
movzx edx, word [esp + 0x14]
push edx
push str._c:WINDOWS_system32GroupPolicy
mov edx, ebx
call fcn.1000d3e0
movzx eax, word [esp + 0x1c]
push eax
push str._c:WINDOWS_system32GroupPolicyMachineScripts_
mov edx, ebp
call fcn.1000d3e0
movzx ecx, word [esp + 0x24]
push ecx
push str._c:WINDOWS_system32GroupPolicyMachineScripts_scripts.ini
lea edx, [esi + 0x440]
call fcn.1000d3e0
movzx edx, word [esp + 0x2c]
push edx
push str._c:WINDOWSSystem32GroupPolicyMachine
lea edx, [esi + 0x648]
call fcn.1000d3e0
add esp, 0x20
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10045f6c
add esp, 0x21c
ret
Function at 0x10037b10
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
xor eax, eax
push ebp
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 0x14]
mov esi, ecx
call fcn.10001ab0
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
lea ebx, [esi + 0x440]
push ebx
call ebp
push 0x1004e668
lea eax, [esp + 0x14]
push ebx
push eax
call dword [sym.imp.MSVCR80.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x10037bcc
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x1c]
push ecx
push edx
xor ecx, ecx
call fcn.10038200
mov eax, dword [esp + 0x10]
lea edi, [esi + 4]
push edi
push eax
mov ecx, 1
call fcn.10038200
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
push 2
push ebx
call ebp
push edi
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyStateMachineScriptsShutdown0
mov ecx, esi
call fcn.10038630
test eax, eax
je 0x10037bcc
push edi
mov edx, str.SOFTWAREPoliciesMicrosoftWindowsSystemScriptsShutdown0
mov ecx, esi
call fcn.10038630
test eax, eax
je 0x10037bcc
mov eax, dword [esp + 0x14]
call fcn.10001b90
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037ef0
Capabilities:
Check if file exists
Create directory
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebp
push esi
lea esi, [edi + 0x30]
push esi
call ebx
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jne 0x10037f21
push 0
push esi
call ebp
test eax, eax
jne 0x10037f18
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea esi, [edi + 0x648]
push esi
call ebx
test eax, eax
jne 0x10037f36
push eax
push esi
call ebp
test eax, eax
je 0x10037f12
lea esi, [edi + 0x238]
push esi
call ebx
test eax, eax
jne 0x10037f4b
push eax
push esi
call ebp
test eax, eax
je 0x10037f12
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x10038420
Capabilities:
Set registry value

Disassembly:
sub esp, 0x244
mov eax, dword [0x10056024]
xor eax, esp
mov dword [esp + 0x23c], eax
push esi
push edi
push 0x206
lea eax, [esp + 0x3e]
push 0
push eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x18], 0
mov word [esp + 0x44], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100384da
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push 0
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x60]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x100384f3
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.10045f6c
add esp, 0x244
ret
cmp dword [esp + 0x14], 0
ja 0x100385fb
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xc
push str.Local
push 1
push 0
push str.SOM_ID
push eax
call esi
test eax, eax
je 0x10038543
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.10045f6c
add esp, 0x244
ret
mov edx, dword [esp + 8]
push 0x26
push str.Local_Group_Policy
push 1
push 0
push str.GPOName
push edx
call esi
test eax, eax
je 0x10038582
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.10045f6c
add esp, 0x244
ret
mov ecx, dword [esp + 8]
push 0x12
push str.LocalGPO
push 1
push 0
push str.GPO_ID
push ecx
call esi
test eax, eax
jne 0x100384cf
lea edx, [edi + 0x648]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100385b0
mov ecx, dword [esp + 8]
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push str.FileSysPath
push ecx
call esi
test eax, eax
jne 0x100384cf
push 0x26
push str.Local_Group_Policy
push 1
push eax
mov eax, dword [esp + 0x18]
push str.DisplayName
push eax
call esi
test eax, eax
jne 0x1003851f
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x244]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10045f6c
add esp, 0x244
ret
Function at 0x10039c00
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x10039c57
cmp byte [ebp + 0x2c], 0
jne 0x10039c4e
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov ebx, dword [str.Failed_to_open_file]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10039c30
sub eax, edx
lea edi, [ebp + 0x34]
mov esi, eax
call fcn.1003cb60
or eax, 0xffffffff
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x3c], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 4
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x10039c71
mov edi, edi
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x10039c60
mov esi, dword [sym.imp.MSVCR80.dll_fseek]
push 2
or eax, 0xffffffff
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x1c], edi
push edi
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call esi
push ebx
call dword [sym.imp.MSVCR80.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
add esp, 0x1c
test edi, edi
jg 0x10039cce
cmp byte [ebp + 0x2c], 0
jne 0x10039c4e
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 0xc
mov ebx, dword [str.Error_document_empty.]
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10039cc0
jmp 0x10039c39
lea eax, [edi + 1]
push eax
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
push ebx
push 1
mov esi, eax
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x10039d26
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [ebp + 0x2c], 0
jne 0x10039c4e
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov ebx, dword [str.Failed_to_open_file]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10039d18
jmp 0x10039c39
mov byte [esi + edi], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x10039d57
mov dl, byte [eax]
cmp dl, 0xd
jne 0x10039d4a
mov byte [ecx], 0xa
add eax, 1
add ecx, 1
cmp byte [eax], 0xa
jne 0x10039d52
jmp 0x10039d4f
mov byte [ecx], dl
add ecx, 1
add eax, 1
cmp byte [eax], 0
jne 0x10039d33
push 1
mov byte [ecx], 0
mov edx, dword [ebp]
mov eax, dword [edx + 8]
push 0
push esi
mov ecx, ebp
call eax
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
xor eax, eax
cmp byte [ebp + 0x2c], al
pop esi
pop ebp
sete al
pop ebx
ret 4
Function at 0x1003d8b0
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x10056024]
xor eax, esp
mov dword [esp + 0x250], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x206
lea ecx, [esp + 0x56]
push ebx
push ecx
mov dword [esp + 0x28], eax
mov word [esp + 0x5c], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea edx, [esp + 0x54]
push 0x104
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jl 0x1003da45
lea eax, [esp + 0x18]
push eax
push 0x1004eee4
push 1
push ebx
push 0x1004ef04
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1003d97b
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x1004eed4
lea edx, [esp + 0x58]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov edi, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp edi, ebx
jge 0x1003d99d
mov esi, dword [sym.imp.MSVCR80.dll_wprintf]
push str.Failed_calling_ITaskScheduler::Activate:
call esi
add esp, 4
push edi
push str.error__0x_x_n
call esi
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.10045f6c
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
call fcn.1003df10
xor edi, edi
cmp word [esp + 0x14], bx
jbe 0x1003da1d
push 0x2e
lea ecx, [esp + 0x26]
push ebx
push ecx
mov word [esp + 0x2c], bx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x20]
call fcn.10027ae0
movzx eax, word [esp + 0x14]
add edi, 1
cmp edi, eax
jl 0x1003d9c0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x8c]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10045f6c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10040400
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x10056024]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
cmp byte [eax], 2
push esi
jne 0x100404c0
cmp byte [eax + 1], 2
jne 0x100404c0
mov eax, ecx
lea esi, [eax + 1]
jmp 0x10040430
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10040430
sub eax, esi
cmp byte [eax + ecx - 1], 0xa
jne 0x10040456
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10040447
sub eax, esi
mov byte [eax + ecx - 1], dl
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100404c0
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0x10]
push ecx
call sub.MSVCR80.dll_memcpy
mov edx, dword [esp + 0x14]
add esp, 0xc
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x100404c0
mov ecx, eax
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x10040490
sub ecx, esi
push ecx
push eax
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov al, 1
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10045f6c
add esp, 0x14
ret 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
xor al, al
call fcn.10045f6c
add esp, 0x14
ret 4
Function at 0x10042940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10042957
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10042988
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10042984
cmp esi, eax
jae 0x10042988
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10042974
cmp esi, eax
jb 0x1004298e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x10042cd0
Capabilities:
Access peb ldr_data
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x100491ab
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10056024]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [0x10056f24]
mov edx, dword [eax + 0xc]
mov ecx, 0x10056f24
call edx
add eax, 0x10
mov dword [esi + 0x34], eax
mov dword [esp + 0x18], ebx
call fcn.10045670
mov dword [esi + 0x3c], eax
mov byte [eax + 0x19], 1
mov eax, dword [esi + 0x3c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3c]
mov dword [eax], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
xor eax, eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
push ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
push ebx
mov dword [esi + 0x24], eax
push ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push ebx
mov dword [esi + 0x30], eax
push str.Aomei_Backupper_for_Windows
mov dword [esi + 0xc], 0x28
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea ecx, [esp + 0x24]
push ecx
push 2
mov ebx, 0x36ee80
push eax
mov dword [esi], eax
mov dword [esp + 0x30], ebx
call edi
mov eax, dword [esi]
push 4
lea edx, [esp + 0x24]
push edx
push 5
push eax
mov dword [esp + 0x30], ebx
call edi
mov edx, dword [esi]
push 4
lea ecx, [esp + 0x24]
push ecx
push 6
push edx
mov dword [esp + 0x30], ebx
call edi
push 4
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], ebx
push 4
mov ecx, dword [esi]
push ecx
call edi
mov eax, dword [esi]
push 4
lea edx, [esp + 0x24]
push edx
push 3
push eax
mov dword [esp + 0x30], 2
call edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x10042ec0
Capabilities:
Connect to http server

Disassembly:
push 0xffffffffffffffff
push 0x10049178
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10056024]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x10042efd
push eax
call edi
mov dword [esi + 8], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x10042f0a
push eax
call edi
mov dword [esi + 4], ebx
cmp dword [esi], ebx
je 0x10042f66
mov eax, dword [0x10056f24]
mov edx, dword [eax + 0xc]
mov ecx, 0x10056f24
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [0x10056f24]
mov edx, dword [eax + 0xc]
mov ecx, 0x10056f24
mov byte [esp + 0x14], bl
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], bx
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x34]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.10042b30
test al, al
jne 0x10042f7d
lea esi, [esp + 0x10]
call fcn.10042ff0
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
push ebx
push ebx
push 3
push ebx
push ebx
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x10042f5d
cmp byte [esp + 0x14], bl
mov ecx, 0x4480200
je 0x10042fad
mov ecx, 0x4c80200
push ebx
push ecx
mov ecx, dword [esp + 0x28]
push ebx
push ebx
push ebx
push ecx
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
cmp eax, ebx
mov dword [esi + 8], eax
lea esi, [esp + 0x10]
je 0x10042f61
call fcn.10042ff0
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x10043360
Capabilities:
Send data

Disassembly:
sub esp, 0x10
push ebx
push ebp
push edi
mov edi, dword [esp + 0x24]
mov ebp, dword [edi + 4]
xor ebx, ebx
cmp ebp, ebx
jne 0x100433b7
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x100433a4
push ebx
push ebx
push ebx
lea ecx, [esi + 0xc]
push ecx
push eax
mov dword [esi + 0x28], ebx
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
setne al
cmp al, bl
mov byte [esi + 0x44], bl
je 0x100433a4
mov edx, dword [esi + 8]
push ebx
push ebx
push ebx
push edx
call dword [sym.imp.WININET.dll_HttpEndRequestW]
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], 1
pop ebx
add esp, 0x10
ret 0x10
cmp byte [esp + 0x28], bl
je 0x100433f4
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x100433e1
push ebx
push ebx
push ebx
lea ecx, [esi + 0xc]
push ecx
push eax
mov dword [esi + 0x28], ebp
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
setne al
cmp al, bl
mov byte [esi + 0x44], bl
jne 0x100433f4
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], 5
pop ebx
add esp, 0x10
ret 0x10
mov edx, dword [edi]
mov eax, dword [edx + 4]
push 0x2800
mov ecx, edi
call eax
test al, al
jne 0x10043419
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], 2
pop ebx
add esp, 0x10
ret 0x10
xor edi, edi
cmp byte [esp + 0x2c], bl
mov byte [esp + 0xc], 1
je 0x1004342c
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebx
cmp ebp, ebx
jbe 0x100434c7
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call edx
test al, al
je 0x100434e9
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x100434c7
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x100433e1
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x100434c7
cmp byte [esp + 0x2c], bl
je 0x100434b5
add edi, eax
xor eax, eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x48]
cmp eax, ebx
mov dword [esi + 0x68], edi
mov dword [esi + 0x58], edi
je 0x100434b5
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esi + 0x50]
push edx
call eax
add esp, 8
cmp byte [esp + 0xc], bl
je 0x100434bf
mov byte [esp + 0xc], bl
cmp edi, ebp
jb 0x10043434
cmp byte [esp + 0x28], bl
je 0x100434da
mov eax, dword [esi + 8]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpEndRequestW]
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], ebx
pop ebx
add esp, 0x10
ret 0x10
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], 3
pop ebx
add esp, 0x10
ret 0x10