joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410090
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 2
mov edi, eax
call fcn.0048fb2f
mov ebx, dword [ebp + 8]
lea esi, [edi*2 + 2]
xor ecx, ecx
push esi
mov dword [ebx], eax
mov word [eax], cx
push dword [ebx]
call fcn.0048fbc1
push esi
push 0
push eax
mov dword [ebx], eax
call fcn.004906c0
add esp, 0x18
push edi
push dword [ebx]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410170
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 4]
mov ecx, 0x4dfa88
push eax
call fcn.004074f0
mov esi, dword [ebp - 4]
test esi, esi
je 0x410192
mov eax, dword [esi]
jmp 0x410194
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
test esi, esi
je 0x4101e2
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4101e2
mov eax, dword [esi]
test eax, eax
je 0x4101c2
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4101d9
push eax
call fcn.0049243b
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0048f453
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4101f0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 4]
mov ecx, 0x4dfa88
push eax
call fcn.004074f0
mov esi, dword [ebp - 4]
test esi, esi
je 0x410212
mov eax, dword [esi]
jmp 0x410214
xor eax, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, eax
test esi, esi
je 0x41026e
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x41026e
mov eax, dword [esi]
test eax, eax
je 0x41024e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x410265
push eax
call fcn.0049243b
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0048f453
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410500
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x41056c
mov eax, dword [ebp - 4]
push esi
inc eax
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea esi, [eax*2 + 2]
push esi
push dword [edi]
call fcn.0048fbc1
push esi
push 0
push eax
mov dword [edi], eax
call fcn.004906c0
add esp, 0x14
push dword [ebp - 4]
push dword [edi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x410616
mov eax, dword [ebp - 4]
push ebx
mov ebx, dword [ebp + 0x10]
inc eax
push esi
push edi
mov dword [ebp - 4], eax
lea esi, [eax*2 + 2]
push esi
push dword [ebx]
call fcn.0048fbc1
push esi
push 0
push eax
mov dword [ebx], eax
call fcn.004906c0
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 0x1c]
inc eax
shr eax, 1
inc eax
lea esi, [eax + eax]
push esi
push dword [edi]
call fcn.0048fbc1
push esi
push 0
push eax
mov dword [edi], eax
call fcn.004906c0
add esp, 0x28
lea eax, [ebp - 8]
push eax
push dword [edi]
lea eax, [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebx]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410620
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410685
mov eax, dword [ebp - 4]
inc eax
shr eax, 1
push esi
inc eax
push edi
mov edi, dword [ebp + 0x18]
lea esi, [eax + eax]
push esi
push dword [edi]
call fcn.0048fbc1
push esi
push 0
push eax
mov dword [edi], eax
call fcn.004906c0
add esp, 0x14
lea eax, [ebp - 4]
push eax
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x4106ea
mov eax, dword [ebp - 4]
inc eax
shr eax, 1
push esi
inc eax
push edi
mov edi, dword [ebp + 0x10]
lea esi, [eax + eax]
push esi
push dword [edi]
call fcn.0048fbc1
push esi
push 0
push eax
mov dword [edi], eax
call fcn.004906c0
add esp, 0x14
lea eax, [ebp - 4]
push eax
push dword [edi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41d6b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa8f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4dc6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
call fcn.0048fb2f
xor ecx, ecx
mov dword [ebp - 0x10], eax
add esp, 4
mov word [eax], cx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ecx
push eax
push dword [0x4de020]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00406320
add esp, 0x14
test eax, eax
jne 0x41d78c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x14]
call fcn.00410620
add esp, 0x14
test eax, eax
jne 0x41d77e
cmp byte [ebp + 0x1c], al
jne 0x41d75b
push eax
push SysReAllocString
push 0x4afa48
lea ecx, [ebp - 0x10]
call fcn.004021f0
push 0
push SysReAllocString
push 0x4b4ae4
lea ecx, [ebp - 0x10]
call fcn.004021f0
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0x10]
push dword [ebp + 0x18]
push eax
push eax
push dword [ebp + 8]
call fcn.0041d7b0
add esp, 0x14
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41d78f
push dword [ebp - 0x14]
mov esi, dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41d78f
mov esi, dword [ebp + 0x18]
push dword [ebp - 0x10]
call fcn.0048faf7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x4d59b8], 0
push ebx
mov ebx, dword [0x4d59b4]
push esi
push edi
mov esi, ecx
je 0x423735
cmp ebx, 0x1388
jne 0x423735
shl ebx, 2
mov byte [0x4d59b8], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4237b7
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42376e
cmp dword [ebp - 4], 0x103
jne 0x42376e
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x42377a
push dword [esi + 0x18]
call edi
mov dword [esi + 0x18], 0
cmp dword [esi + 0x18], 0
jne 0x423821
mov eax, dword [esi + 0xc]
test eax, eax
je 0x423795
push eax
call edi
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4237a6
push eax
call edi
mov dword [esi + 0x10], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4237b7
push eax
call edi
mov dword [esi + 0x14], 0
cmp dword [esi + 0x18], 0
jne 0x423821
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0xc], eax
test eax, eax
jne 0x4237e2
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x4237d4
push 0
push 0
push 0
push 0
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x4237d4
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x425290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
test eax, eax
je 0x4237d4
mov eax, dword [esi + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
push 0xffffffffffffffff
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0
push eax
push 2
call edi
test eax, eax
jne 0x423859
mov eax, dword [esi + 8]
mov ecx, 0x80004005
pop edi
test eax, eax
pop esi
cmovns eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 1
jne 0x4237d4
mov eax, dword [esi + 0x10]
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 0
push eax
push 2
call edi
cmp eax, 1
je 0x4238a6
cmp eax, 0xffffffff
jne 0x423898
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4238c5
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0x80070102
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
push 0x4b563c
push dword [esi + 0x1c]
call dword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov dword [esi + 8], eax
test eax, eax
js 0x4238c5
mov dword [esi + 0x1c], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x427ba0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x4b5ef8
mov dword [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0
mov edi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x4c549c
push 1
push 0
push 0x4c556c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jne 0x427c10
mov eax, dword [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov ecx, dword [eax]
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x427c0f
push eax
push eax
push 3
push 4
push eax
push eax
push 0xa
push dword [ebx]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
pop ebx
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x427c24
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428140
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aba50
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x4dc6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x14]
push eax
push 0x4b6118
call fcn.00427d50
mov esi, dword [ebp + 0xc]
mov edi, eax
add esp, 8
test edi, edi
js 0x428290
lea eax, [ebp - 0x10]
push eax
push 0x4b6138
push dword [ebp - 0x14]
call fcn.00427cc0
mov edi, eax
add esp, 0xc
test edi, edi
js 0x428285
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov dword [ebp - 0x18], eax
test eax, eax
mov edi, 0x8007000e
cmovne edi, ecx
test edi, edi
js 0x42827c
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov eax, 8
push esi
mov word [ebp - 0x38], ax
call edi
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x4281ea
test esi, esi
je 0x4281ea
push 0x8007000e
call fcn.0048ee00
mov esi, dword [ebp + 0x10]
mov eax, 8
push esi
mov dword [ebp - 4], 0
mov word [ebp - 0x28], ax
call edi
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x428215
test esi, esi
je 0x428215
push 0x8007000e
call fcn.0048ee00
mov ecx, dword [ebp - 0x10]
sub esp, 0x10
mov esi, dword [ebp - 0x18]
mov eax, esp
xorps xmm0, xmm0
mov byte [ebp - 4], 1
sub esp, 0x10
mov edx, dword [ecx]
movdqu xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movdqu xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movdqu xmm0, xmmword [ebp - 0x28]
movdqu xmmword [eax], xmm0
mov eax, esp
movdqu xmm0, xmmword [ebp - 0x38]
push esi
push ecx
movdqu xmmword [eax], xmm0
call dword [edx + 0x7c]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x28]
push eax
call esi
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
push eax
call esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test edi, edi
je 0x4282ac
push 1
push 0
push esi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
cmova edi, ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42dd50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push edi
mov edi, ecx
je 0x42ddc4
lea eax, [ebp - 0x14]
push eax
push dword [edi + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
push 3
mov dword [ebp - 0x14], ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 8]
mov edx, ecx
sub edx, eax
mov eax, dword [ebp - 0xc]
push 0x44
sub ecx, edx
mov dword [ebp - 0x10], edx
push ecx
mov ecx, dword [ebp - 0x14]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 4

Function at 0x42dde0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov esi, ecx
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov cl, byte [ebp + 0xc]
shr eax, 0x1c
and al, 1
cmp al, cl
setne bl
mov byte [ebp - 0x31], bl
test cl, cl
je 0x42dead
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 3
call ebx
push 2
mov dword [ebp - 0x3c], eax
call ebx
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x40], eax
cmp edi, ecx
jne 0x42de4a
mov dword [ebp - 0x38], 0
jmp 0x42de53
mov eax, dword [esi + 0x90]
mov dword [ebp - 0x38], eax
cmp edi, ecx
jne 0x42de5f
mov esi, dword [esi + 0x90]
jmp 0x42de65
mov esi, dword [ebp - 0xc]
sub esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 8]
sub ebx, dword [ebp - 0x10]
sub ebx, dword [ebp - 0x3c]
push 3
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, ebx
cmp byte [ebp + 0x10], 0
je 0x42de81
sub esi, dword [ebp - 0x40]
push 0x44
sub eax, ebx
push eax
mov eax, dword [ebp - 0x38]
sub esi, eax
push esi
push ebx
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov al, byte [ebp - 0x31]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0xc
test al, al
je 0x42def7
push 1
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x1c
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 2
movdqu xmmword [ebp - 0x28], xmm0
push edi
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x1c], 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
push 0
push edi
mov ecx, esi
call fcn.0042bb10
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42df10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
lea eax, [ebp - 0x14]
push eax
push dword [edi + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xfffffffffffffff0
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov cl, byte [ebp + 8]
shr eax, 0x1c
and al, 1
cmp al, cl
setne bl
test cl, cl
je 0x42dfa1
push 3
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
mov dword [ebp - 0x34], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov edx, ecx
sub edx, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp byte [ebp + 0xc], 0
je 0x42df79
sub eax, dword [ebp - 0x34]
push 0x44
push eax
sub ecx, edx
push ecx
push 0
push edx
push 0
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 8
test al, al
je 0x42dfee
push 1
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x1c
push eax
push 2
push dword [edi + 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movdqu xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x1c], 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
push 0
mov ecx, edi
call fcn.0042e480
push 0
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret 8
Function at 0x432f70
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
test eax, eax
je 0x432f81
mov eax, dword [eax]
jmp 0x432f83
xor eax, eax
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 7
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x432fad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x433020
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [ebp - 8], 0
mov edi, dword [ebp - 0xc]
jl 0x432fd2
jg 0x432fcb
cmp edi, 0x2000000
jbe 0x432fd2
mov edi, 0xdf
jmp 0x433020
push edi
call fcn.0048fb2f
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43300a
push ebx
call fcn.0048faf7
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x433020
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov ecx, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x43306c
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43306c
test esi, esi
je 0x43306c
mov eax, dword [esi]
test eax, eax
je 0x43304c
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x433063
push eax
call fcn.0049243b
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0048f453
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4335f0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac020
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4dc6e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push 0x13
push 0x4b6dc4
push dword [ebp + 8]
call fcn.004337f0
mov esi, dword [ebp - 0x14]
test eax, eax
js 0x43372e
test esi, esi
je 0x43364b
mov eax, dword [esi]
jmp 0x43364d
xor eax, eax
mov ecx, 0x4b6dac
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x433678
test dx, dx
je 0x433674
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x433678
add eax, 4
add ecx, 4
test dx, dx
jne 0x433652
xor eax, eax
jmp 0x43367d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43372e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x433726
mov eax, dword [ebp - 0x10]
inc eax
push eax
call fcn.0048f2de
mov edi, eax
add esp, 4
test edi, edi
je 0x43371d
mov ecx, dword [ebp - 0x10]
inc ecx
push ecx
push 0
push edi
call fcn.004906c0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x4336e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x433708
push edi
lea ecx, [ebp - 0x18]
call fcn.00419410
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00403b70
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.0048c930
push edi
call fcn.0049243b
add esp, 4
cmp dword [ebp - 0x10], 0
ja 0x433685
jmp 0x433792
mov dword [ebp - 0x10], 0
jmp 0x433792
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x433790
test esi, esi
je 0x433736
mov eax, dword [esi]
jmp 0x433738
xor eax, eax
mov ecx, 0x4b6dbc
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x433766
test dx, dx
je 0x433762
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x433766
add eax, 4
add ecx, 4
test dx, dx
jne 0x433740
xor eax, eax
jmp 0x43376b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x433776
mov ebx, 0xe8
jmp 0x433792
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x433789
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, edi
call fcn.004338a0
mov ebx, eax
test esi, esi
je 0x4337d7
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4337d7
mov eax, dword [esi]
test eax, eax
je 0x4337b7
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4337ce
push eax
call fcn.0049243b
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0048f453
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4337f0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x433835
call edi
cmp eax, 0x7a
je 0x433835
call edi
test eax, eax
jle 0x433896
movzx eax, ax
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 0x10
push ebx
push dword [ebp - 4]
call fcn.0048fb2f
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push ebx
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x433881
call edi
mov esi, eax
test esi, esi
jle 0x43388a
movzx esi, si
push ebx
or esi, 0x80070000
call fcn.0048faf7
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
push ebx
call fcn.00403940
push ebx
call fcn.0048faf7
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10