joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d4e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450318
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x1c], ebp
lea eax, [ebp + 0xd4]
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0xb0]
add ebp, 0xb0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [eax]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], esi
nop
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp]
test edi, edi
je 0x42d55e
cmp edi, eax
je 0x42d563
call fcn.0043ae46
cmp esi, ebx
je 0x42d63c
test edi, edi
jne 0x42d5ce
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42d580
call fcn.0043ae46
mov ecx, dword [esp + 0x18]
sub ecx, dword [esi + 0x10]
test ecx, ecx
jle 0x42d626
test edi, edi
jne 0x42d5d2
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42d5a4
call fcn.0043ae46
cmp dword [esi + 0x28], 0
je 0x42d60e
test edi, edi
jne 0x42d5d6
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42d5bf
call fcn.0043ae46
mov ebx, 8
cmp dword [esi + 0x2c], ebx
jb 0x42d5da
mov eax, dword [esi + 0x18]
jmp 0x42d5dd
mov eax, dword [edi]
jmp 0x42d576
mov eax, dword [edi]
jmp 0x42d59a
mov eax, dword [edi]
jmp 0x42d5b5
lea eax, [esi + 0x18]
test eax, eax
je 0x42d60e
test edi, edi
jne 0x42d600
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42d5f6
call fcn.0043ae46
cmp dword [esi + 0x2c], ebx
jb 0x42d604
mov eax, dword [esi + 0x18]
jmp 0x42d607
mov eax, dword [edi]
jmp 0x42d5ec
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push edi
lea edx, [esp + 0x34]
push edx
mov ecx, ebp
call fcn.0042ed40
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp 0x42d547
lea ecx, [esp + 0x24]
call fcn.0042dd70
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
jmp 0x42d550
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0xd0]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
sub eax, ecx
push edx
setns bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45046b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
xor edx, edx
push 0xffffffffffffffff
lea ecx, [esi + 0x38]
lea eax, [edi + 0x38]
push edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push eax
mov word [ecx + 4], dx
call fcn.004017f2
xor edx, edx
push 0xffffffffffffffff
lea ecx, [esi + 0x54]
lea eax, [edi + 0x54]
push edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push eax
mov dword [esp + 0x24], 0
mov word [ecx + 4], dx
call fcn.004017f2
mov eax, dword [edi + 0x70]
mov dword [esi + 0x70], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x42eb40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4504f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi], ecx
mov dword [esi + 4], edx
lea ecx, [esi + 8]
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x30]
xor edx, edx
mov dword [ecx + 0x18], 7
push eax
mov word [ecx + 4], dx
call fcn.004017f2
cmp dword [esp + 0x40], 8
jb 0x42ebb1
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0043a14d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x42f2e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450318
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x1c], ebp
lea eax, [ebp + 0x334]
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0x310]
add ebp, 0x310
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [eax]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], esi
nop
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp]
test edi, edi
je 0x42f35e
cmp edi, eax
je 0x42f363
call fcn.0043ae46
cmp esi, ebx
je 0x42f43c
test edi, edi
jne 0x42f3ce
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42f380
call fcn.0043ae46
mov ecx, dword [esp + 0x18]
sub ecx, dword [esi + 0x10]
test ecx, ecx
jle 0x42f426
test edi, edi
jne 0x42f3d2
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42f3a4
call fcn.0043ae46
cmp dword [esi + 0x28], 0
je 0x42f40e
test edi, edi
jne 0x42f3d6
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42f3bf
call fcn.0043ae46
mov ebx, 8
cmp dword [esi + 0x2c], ebx
jb 0x42f3da
mov eax, dword [esi + 0x18]
jmp 0x42f3dd
mov eax, dword [edi]
jmp 0x42f376
mov eax, dword [edi]
jmp 0x42f39a
mov eax, dword [edi]
jmp 0x42f3b5
lea eax, [esi + 0x18]
test eax, eax
je 0x42f40e
test edi, edi
jne 0x42f400
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42f3f6
call fcn.0043ae46
cmp dword [esi + 0x2c], ebx
jb 0x42f404
mov eax, dword [esi + 0x18]
jmp 0x42f407
mov eax, dword [edi]
jmp 0x42f3ec
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push edi
lea edx, [esp + 0x34]
push edx
mov ecx, ebp
call fcn.0042ed40
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp 0x42f347
lea ecx, [esp + 0x24]
call fcn.0042dd70
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
jmp 0x42f350
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x330]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
sub eax, ecx
push edx
setns bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430380
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4506ae
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x463630]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
mov eax, dword [0x466458]
test eax, eax
jne 0x430473
push 0x206
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.0043ab70
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x430436
lea eax, [esp + 0xc]
lea edx, [eax + 2]
jmp 0x430400
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x430400
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0xa], 0x5c
jne 0x430436
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x430420
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0xa], cx
push 0x34c
call fcn.0043a173
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
mov dword [esp + 0x220], 0
test esi, esi
je 0x43046c
lea edx, [esp + 0xc]
push edx
call fcn.00430590
push eax
mov ecx, esi
call fcn.00430270
jmp 0x43046e
xor eax, eax
mov dword [0x466458], eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0043a5be
add esp, 0x21c
ret
Function at 0x430f00
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x450718
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 3
mov edx, dword [esp + 0x2c]
push edx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x1c], 0
mov dword [esi], vtable.t_ipcServerTaskConditionWait.0
call fcn.00424160
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dl, byte [esp + 0x24]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], dl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18

Function at 0x430fb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x450718
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 3
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x24], 0
mov dword [esi], vtable.t_ipcServerTaskConditionStart.0
call fcn.00424230
mov eax, dword [esp + 0x28]
mov cl, byte [esp + 0x24]
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], cl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c

Function at 0x431060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x450718
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 3
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x24], 0
mov dword [esi], vtable.t_ipcServerTaskConditionDownloading.0
call fcn.00424400
mov eax, dword [esp + 0x28]
mov cl, byte [esp + 0x24]
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], cl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c
Function at 0x432dc0
Capabilities:
Check http status code

Disassembly:
push 0xffffffffffffffff
push 0x45094b
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.0043b0f0
mov eax, dword [0x463630]
xor eax, esp
mov dword [esp + 0x1028], eax
push ebp
push esi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0x1038]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1050]
mov ebp, dword [esp + 0x1048]
mov esi, ecx
xor ecx, ecx
push 0xffe
push ecx
lea edx, [esp + 0x3e]
push edx
mov dword [esp + 0x1c], eax
mov dword [ebx], 0
mov word [esp + 0x40], cx
call fcn.0043ab70
add esp, 0xc
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x3c]
push ecx
push 0x21
push esi
mov dword [esp + 0x20], 0x1000
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x432e5d
mov dword [ebx], 9
jmp 0x432f1b
mov edx, dword [esp + 0xc]
shr edx, 1
xor eax, eax
push esi
mov word [esp + edx*2 + 0x38], ax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], eax
mov word [esp + 0x1c], cx
mov esi, 8
mov dword [esp + 0x1040], eax
cmp dword [edi + 0x18], esi
jb 0x432e9c
mov eax, dword [edi + 4]
jmp 0x432e9f
lea eax, [edi + 4]
push eax
lea edx, [esp + 0x38]
lea ecx, [esp + 0x1c]
call fcn.004328f0
add esp, 4
test al, al
jne 0x432ecf
mov dword [ebx], 0xa
cmp dword [esp + 0x30], esi
jb 0x432f1b
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043a14d
add esp, 4
jmp 0x432f1b
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.004017f2
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x432eed
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 0x104c]
push 0
or eax, 0x200000
push eax
push 0
push 0
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
jne 0x432f43
mov dword [ebx], 5
lea ecx, [esp + 0x18]
call fcn.004016dd
xor al, al
mov ecx, dword [esp + 0x1038]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x1028]
xor ecx, esp
call fcn.0043a5be
add esp, 0x1038
ret
mov esi, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push 0x20000013
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x432f6f
mov dword [ebx], 6
jmp 0x432f12
mov eax, dword [esi]
cmp eax, 0xc8
je 0x432f12
cmp eax, 0x12c
jb 0x432f12
cmp eax, 0x190
jae 0x432f12
lea ecx, [esp + 0x18]
call fcn.004016dd
mov al, 1
jmp 0x432f1d
Function at 0x432fa0
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
push 0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push esi
mov edi, ecx
mov ecx, dword [ebp]
push 0x20000013
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x432fda
pop edi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
cmp dword [esi], 0xc8
jne 0x432feb
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
mov dword [ebx], 0
mov eax, dword [esi]
cmp eax, 0x12c
jb 0x433038
cmp eax, 0x190
jae 0x433038
mov dword [esp + 0xc], 0
lea esp, [esp]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
push esi
push edx
push eax
call fcn.00432dc0
add esp, 0xc
test al, al
je 0x433038
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 5
mov dword [esp + 0xc], eax
jl 0x433010
xor eax, eax
cmp dword [ebx], eax
pop edi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x433c20
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
push 0
push 4
mov esi, ecx
push esi
push 0x433bf0
push 0
push 0
call fcn.0043a6ce
mov edi, eax
add esp, 0x18
test edi, edi
je 0x433c64
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x433c64
mov eax, dword [esi + 4]
push edi
push eax
call fcn.0042d3d0
test al, al
je 0x433c64
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, 1
pop esi
ret
push 0x457420
push 0
push 0
push 0
push 0xc
mov ecx, esi
call fcn.00432100
pop edi
mov eax, 1
pop esi
ret

Function at 0x433d70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x250
mov eax, dword [0x463630]
xor eax, esp
mov dword [esp + 0x24c], eax
push edi
lea eax, [esp + 4]
push 0x21
push eax
mov edi, ecx
call fcn.004220e0
add esp, 8
test al, al
jne 0x433db0
pop edi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.0043a5be
add esp, 0x250
ret
lea ecx, [esp + 4]
push esi
push ecx
call fcn.00422080
mov esi, eax
add esp, 4
test esi, esi
jne 0x433ddd
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.0043a5be
add esp, 0x250
ret
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x56]
push eax
mov word [esp + 0x58], dx
call fcn.0043ab70
add esp, 0xc
lea ecx, [esp + 0x4c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x433e46
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433e12
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x4a], 0x5c
jne 0x433e46
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433e30
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x4a], dx
push 1
lea eax, [esp + 0x50]
push eax
push 0x454f60
push reloc.WS2_32.dll_accept
push esi
call fcn.00401294
push esi
mov byte [edi + 0x18], al
call fcn.0043a14d
mov al, byte [edi + 0x18]
mov ecx, dword [esp + 0x26c]
add esp, 0x18
pop esi
pop edi
xor ecx, esp
call fcn.0043a5be
add esp, 0x250
ret
Function at 0x4348f0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push esi
push 0x4348c0
push 0
push 0
call fcn.0043a6ce
add esp, 0x18
test eax, eax
jne 0x434921
push 0x457420
push eax
push 0xc
mov ecx, esi
call fcn.00434530
or eax, 0xffffffff
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
Function at 0x434da0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x450bbb
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
call fcn.004296c0
xor ebx, ebx
cmp dword [esp + 0x50], ebx
mov esi, eax
jl 0x434fac
cmp esi, ebx
je 0x434fac
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov dword [esp + 0x50], ebx
call fcn.00431610
mov edi, dword [esi + 0x18]
mov esi, dword [esi]
mov ebp, dword [esp + 0x20]
cmp esi, ebx
je 0x434e22
cmp esi, ebp
je 0x434e27
call fcn.0043ae46
mov esi, dword [esp + 0x24]
cmp edi, esi
jne 0x434eb3
mov ebx, 1
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x28]
call fcn.00425630
mov edx, dword [esp + 0x50]
push edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 1
call fcn.00425660
push ebx
lea ecx, [esp + 0x2c]
call fcn.004257e0
mov eax, dword [esi + 8]
push eax
lea ecx, [esp + 0x2c]
call fcn.004237a0
test eax, eax
je 0x434f93
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x434f93
push eax
call fcn.00429d30
push 0x14
call fcn.0043a173
add esp, 4
mov dword [esp + 0x50], eax
mov byte [esp + 0x48], 2
test eax, eax
je 0x434f62
mov ecx, dword [esi + 0x18]
push ecx
mov ecx, eax
call fcn.00434930
jmp 0x434f64
test ebp, ebp
jne 0x434ed8
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x434ec8
call fcn.0043ae46
cmp dword [esi + 0x10], 1
jne 0x434edd
mov ebx, 2
jmp 0x434e38
mov eax, dword [ebp]
jmp 0x434ebe
test ebp, ebp
jne 0x434efc
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x434ef2
call fcn.0043ae46
cmp dword [esi + 0x14], 0xffffffff
je 0x434f01
xor edi, edi
jmp 0x434f05
mov eax, dword [ebp]
jmp 0x434ee8
mov edi, dword [esp + 0x1c]
test ebp, ebp
jne 0x434f5d
call fcn.0043ae46
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x434f1a
call fcn.0043ae46
mov dword [esi + 0x10], 1
test edi, edi
jne 0x434e38
mov esi, dword [esp + 0x14]
push edi
push edi
push esi
push 0x434d80
push edi
push edi
call fcn.0043a6ce
add esp, 0x18
test eax, eax
je 0x434e3c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x434fae
mov eax, dword [ebp]
jmp 0x434f10
xor eax, eax
mov byte [esp + 0x48], 1
test eax, eax
je 0x434f76
mov ecx, dword [esi + 0x18]
push eax
call fcn.004308d0
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 0
call fcn.00423910
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x434fae
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 0
call fcn.00423910
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
Function at 0x4357d0
Capabilities:
Read data from internet
Receive data

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
xor ebx, ebx
push 8
mov ebp, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.0043a173
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x435809
push ebx
call fcn.0043b264
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x43580b
xor edi, edi
cmp esi, ebx
jle 0x435854
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x435871
push 0
call fcn.0043b264
sub eax, dword [edi]
add esp, 4
imul eax, eax, 0x3e8
mov dword [esp + 0x1c], edx
cmp eax, dword [ebp + 0x24]
ja 0x43587b
mov eax, dword [esp + 0x14]
test eax, eax
je 0x435854
sub esi, eax
add ebx, eax
test esi, esi
jg 0x435813
mov eax, dword [esp + 0x2c]
sub dword [eax], esi
push edi
call fcn.0043a14d
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov dword [esp + 0x10], 0xffffffff
jmp 0x43585a
mov dword [esp + 0x10], 0xfffffffe
jmp 0x43585a

Function at 0x435890
Capabilities:
Send data

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
push 8
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.0043a173
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4358c4
push ebx
call fcn.0043b264
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], edx
jmp 0x4358c6
xor esi, esi
mov edi, dword [esp + 0x2c]
cmp edi, ebx
jbe 0x435927
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
push edi
push ebx
push ebp
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x435914
push 0
call fcn.0043b264
sub eax, dword [esi]
mov ecx, dword [esp + 0x1c]
imul eax, eax, 0x3e8
add esp, 4
mov dword [esp + 0x20], edx
cmp eax, dword [ecx + 0x24]
ja 0x43591e
mov eax, dword [esp + 0x14]
add ebx, eax
sub edi, eax
jne 0x4358d7
jmp 0x435926
mov dword [esp + 0x10], 0xffffffff
jmp 0x435926
mov dword [esp + 0x10], 0xfffffffe
pop ebp
push esi
call fcn.0043a14d
mov eax, dword [esp + 0x10]
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc

Function at 0x435b00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x450718
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x463630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 3
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push edx
push ecx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x20], 0
mov dword [esi], vtable.t_ipcServerTaskConditionUploadEnd.0
call fcn.00424850
mov edx, dword [esp + 0x24]
mov dword [esi + 0x2c], edx
mov byte [esi + 0x30], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14