joyce8/EMBER2024-capa huggingface dataset:
Function at 0x646494
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6464c5
dec al
je 0x646500
dec al
je 0x64653d
dec al
je 0x6465a6
jmp 0x646630
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x646630
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6464d5
jmp 0x646630
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x646630
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x646510
jmp 0x646630
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x646630
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x64656c
xor ebp, ebp
jmp 0x64657c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x646585
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x64654d
jmp 0x646630
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x646630
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x6465ff
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00643618
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6465ba
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x64a3c4
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409430
xor eax, eax
push ebp
push 0x64a4d0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x64a4b3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
call fcn.0040934c
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
sete al
test al, al
je 0x64a421
call fcn.00408afc
jmp 0x64a4ba
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.0040a2dc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
sete al
test al, al
je 0x64a44d
call fcn.00408afc
jmp 0x64a4ba
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
cmp eax, 1
sbb eax, eax
neg eax
test al, al
je 0x64a46c
call fcn.00408afc
jmp 0x64a4ba
mov eax, dword [ebp - 0x24]
cmp eax, 1
je 0x64a487
cmp eax, 3
je 0x64a487
mov eax, ebx
mov edx, 0x64a4e8
call fcn.0040972c
jmp 0x64a493
mov eax, ebx
mov edx, 0x64a500
call fcn.0040972c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a4ba
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a4d7
lea eax, [ebp - 4]
call fcn.0040934c
ret
Function at 0x677dfc
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x19
push 0
push 0
dec ecx
jne 0x677e04
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x67800a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x677f98
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov word [ebp - 0x58], ax
lea edx, [ebp - 0x68]
mov eax, 0x678028
call fcn.004fcca0
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x18]
call fcn.00433d88
push 0
push 0
push 0x67806c
push 0x678090
push 0x6780a4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0042e01c
add esp, 0x1c
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x28]
call fcn.00433ec0
push 0x20
push 0x6780c8
push 0x6780dc
push 0x678124
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0042e01c
add esp, 0x18
lea edx, [ebp - 0x88]
lea eax, [ebp - 0x38]
call fcn.00433ec0
push 0x678134
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.0042e01c
add esp, 0xc
lea edx, [ebp - 0x9c]
lea eax, [ebp - 0x8c]
call fcn.0043380c
mov edx, dword [ebp - 0x8c]
lea eax, [ebp - 4]
mov ecx, 0x678140
call fcn.0040d208
jmp 0x677f73
xor eax, eax
push ebp
push 0x677f69
push dword fs:[eax]
mov dword fs:[eax], esp
fld xword [ebp - 0x60]
lea eax, [ebp - 0xac]
call fcn.00433bc8
lea eax, [ebp - 0xac]
push eax
push 0x678150
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0042e01c
add esp, 0xc
lea edx, [ebp - 0xbc]
pop eax
call fcn.00437cb0
lea eax, [ebp - 0xac]
call fcn.00430e7c
fstp xword [ebp - 0x60]
wait
lea eax, [ebp - 0xcc]
call fcn.00437c98
lea edx, [ebp - 0xcc]
lea eax, [ebp - 0x48]
call fcn.00433ec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x677f73
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x677ef0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x677fa2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x678011
lea eax, [ebp - 0xcc]
mov edx, dword [0x401300]
mov ecx, 4
call fcn.0040add0
lea eax, [ebp - 0x8c]
call fcn.0040d1c4
lea eax, [ebp - 0x88]
mov edx, dword [0x401300]
mov ecx, 2
call fcn.0040add0
lea eax, [ebp - 0x68]
call fcn.0040d1c4
lea eax, [ebp - 0x48]
mov edx, dword [0x401310]
mov ecx, 4
call fcn.0040add0
lea eax, [ebp - 4]
call fcn.0040d1c4
ret
Function at 0x6796fc
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x679776
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a470
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a2dc
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x679754
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a6b8
jmp 0x679760
mov eax, ebx
mov edx, 0x679790
call fcn.0040972c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67977d
lea eax, [ebp - 4]
call fcn.0040934c
ret

Function at 0x6797a0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x6798bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.006799a8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004208dc
cmp dword [ebp - 0xc], 0
jne 0x679867
lea edx, [ebp - 4]
mov eax, 0x6798dc
call fcn.00679d54
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004208dc
cmp dword [ebp - 0x10], 0
jne 0x679867
mov dl, 1
mov eax, dword [0x47f0c0]
call fcn.004a21e4
mov dword [ebp - 8], eax
lea edx, [ebp - 0x14]
mov eax, 0x679978
call fcn.0067a1d0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov dl, 1
mov eax, dword [0x47f0c0]
call fcn.004a21e4
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x48]
mov dx, 0x20
mov eax, ebx
call fcn.004a17f4
lea ecx, [ebp - 0x18]
mov edx, 3
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.004a1568
lea ecx, [ebp - 4]
xor edx, edx
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004208dc
cmp dword [ebp - 0x1c], 0
je 0x679889
mov edx, dword [ebp - 4]
mov eax, 0x679994
call fcn.004284c0
test eax, eax
jle 0x679892
mov eax, esi
call fcn.0040934c
jmp 0x67989c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040972c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6798c6
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.004093ac
lea eax, [ebp - 4]
call fcn.0040934c
ret

Function at 0x67a128
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x67a150
cmp dword [esp + 4], 5
jne 0x67a150
cmp dword [esp + 8], 1
je 0x67a154
xor eax, eax
jmp 0x67a156
mov al, 1
add esp, 0x114
ret

Function at 0x67a160
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x67a188
cmp dword [esp + 4], 6
jne 0x67a188
cmp dword [esp + 8], 1
je 0x67a18c
xor eax, eax
jmp 0x67a18e
mov al, 1
add esp, 0x114
ret
Function at 0x67a198
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x67a1c0
cmp dword [esp + 4], 6
jne 0x67a1c0
cmp dword [esp + 8], 1
ja 0x67a1c4
xor eax, eax
jmp 0x67a1c6
mov al, 1
add esp, 0x114
ret
Function at 0x67a1d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409430
xor eax, eax
push ebp
push 0x67a3e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040934c
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreatePipe
xor eax, eax
push ebp
push 0x67a3b2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x44
call fcn.004070cc
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov word [ebp - 0x34], 0
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle_1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x178]
mov eax, 0x67a400
call fcn.00429710
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 8]
mov ecx, 0x67a424
call fcn.0040a548
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 8]
call fcn.0040a2dc
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 4]
mov edx, 0x67a434
call fcn.0040a548
mov eax, dword [ebp - 0x17c]
call fcn.0040a2dc
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
test bl, bl
je 0x67a39b
xor eax, eax
push ebp
push 0x67a394
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
push eax
push 0xff
lea eax, [ebp - 0x174]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x14], 0
jbe 0x67a35f
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x174], 0
lea eax, [ebp - 0x180]
lea edx, [ebp - 0x174]
mov ecx, pe_nt_image_headers32
call fcn.0040a380
mov edx, dword [ebp - 0x180]
mov eax, esi
call fcn.0040a4f0
test bl, bl
je 0x67a369
cmp dword [ebp - 0x14], 0
jne 0x67a30a
push 0xffffffffffffffff
mov eax, dword [ebp - 0x74]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67a39b
mov eax, dword [ebp - 0x70]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x74]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67a3b9
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
ret
Function at 0x67aad0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1d8], eax
xor eax, eax
push ebp
push 0x67ab81
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x47f0c0]
call fcn.004a21e4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1d4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x48]
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x67ab68
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x67ab5c
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1d8]
call fcn.0040a314
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x67ab39
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67ab88
lea eax, [ebp - 0x1d8]
call fcn.0040934c
ret
Function at 0x683460
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x6834b1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x683498
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x683488
jmp 0x6834b1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x683499
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6bda6c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040934c
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x6bda9d
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.004094d4
add esp, 0x24
pop ebx
ret

Function at 0x6e8eb4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6e8ebc
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6e9071
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6e908c
call fcn.0040a548
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0x1c]
call fcn.006e70a4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6e90a0
call fcn.00650e08
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6e8f37
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6e8f78
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.006e70a4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6e9108
call fcn.00650e08
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040a4f0
mov eax, esi
mov edx, 0x6e9134
call fcn.0040a4f0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6e8f90
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6e8ffe
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6e9148
call fcn.00650e08
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040a4f0
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6e8fc7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6e8ff2
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6e9178
call fcn.00650e08
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040a4f0
mov eax, esi
mov edx, 0x6e91a4
call fcn.0040a4f0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6e900a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6e9035
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6e91b8
call fcn.00650e08
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040a4f0
mov eax, esi
mov edx, 0x6e9204
call fcn.0040a4f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e9078
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004093ac
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004093ac
lea eax, [ebp - 4]
call fcn.0040934c
ret
Function at 0x701784
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409430
mov eax, dword [ebp - 8]
call fcn.00409430
xor eax, eax
push ebp
push 0x701812
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x7017eb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040a2dc
push eax
mov eax, dword [ebp - 4]
call fcn.0040a2dc
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7017f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x701819
lea eax, [ebp - 8]
mov edx, 2
call fcn.004093ac
ret

Function at 0x701834
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409430
xor eax, eax
push ebp
push 0x701963
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a2dc
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
mov eax, edi
call fcn.00406ad4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push edi
push 0
push esi
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x701974
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00421268
push dword [ebx]
push 0x701984
mov eax, dword [esi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.00421268
push dword [ebp - 0x18]
mov eax, ebx
mov edx, 3
call fcn.0040a5d0
push dword [ebx]
push 0x701994
mov eax, dword [esi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00421268
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.0040a5d0
push dword [ebx]
push 0x7019a4
mov eax, dword [esi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00421268
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.0040a5d0
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00406af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70196a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004093ac
lea eax, [ebp - 4]
call fcn.0040934c
ret
Function at 0x7019d8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00409430
xor eax, eax
push ebp
push 0x701b27
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004205b0
mov edx, dword [ebp - 0x3c]
mov ecx, 1
mov eax, 0x701b48
call fcn.0040a8c8
test eax, eax
jne 0x701a5a
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.004205b0
mov edx, dword [ebp - 0x40]
mov ecx, 1
mov eax, 0x701b64
call fcn.0040a8c8
test eax, eax
jne 0x701a5a
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x701b84
call fcn.0040a548
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 0
push 0x701b94
call sub.wininet.dll_InternetOpenW
mov ebx, eax
test ebx, ebx
je 0x701b04
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a2dc
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlW
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xa
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x13
push esi
call sub.wininet.dll_HttpQueryInfoW
lea edi, [ebp - 0x38]
lea eax, [ebp - 0x44]
mov edx, edi
call fcn.0040a344
mov eax, dword [ebp - 0x44]
mov edx, 0x701bbc
call fcn.0040a680
je 0x701aef
lea eax, [ebp - 0x48]
mov edx, edi
call fcn.0040a344
mov eax, dword [ebp - 0x48]
mov edx, 0x701bd0
call fcn.0040a680
je 0x701aef
xor eax, eax
jmp 0x701af1
mov al, 1
mov byte [ebp - 5], al
test esi, esi
je 0x701afe
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x701b2e
lea eax, [ebp - 0x48]
mov edx, 4
call fcn.004093ac
lea eax, [ebp - 4]
call fcn.0040934c
ret