joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bf40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x208
mov ebx, ecx
call fcn.0040fa6a
push 0x208
mov edi, eax
call fcn.0040fa6a
add ebx, 0x8a
push ebx
push str.Software_s
mov esi, eax
push 0x104
push esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea ecx, [ebp - 4]
push ecx
push esi
xor eax, eax
push SysReAllocString
mov word [edi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40bfaa
push str.exec
lea ecx, [ebp - 4]
mov ebx, 0x104
call fcn.00404440
add esp, 4
push esi
call fcn.0040fa9f
add esp, 4
xor bl, bl
cmp word [edi], 0
je 0x40bfe1
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40bfdf
test al, 0x10
jne 0x40bfdf
push edi
mov bl, 1
call fcn.0040fa9f
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
xor bl, bl
push edi
call fcn.0040fa9f
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c7f0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [ebx + 0x8a]
push eax
lea esi, [ebx + 0x1326]
push esi
push str._s_s.exe
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push 0x208
call fcn.0040fa6a
push esi
push str._sZona.exe__MINIMIZED
mov edi, eax
push 0x104
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x28
cmp byte [ebx + 5], 0
je 0x40c877
mov ecx, dword [ebp - 0x414]
push ecx
mov esi, edi
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, SysReAllocString
call fcn.00404610
add esp, 4
jmp 0x40c8b3
lea edx, [ebp - 0x410]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40c8b3
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x410]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x410]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0040fa9f
movzx eax, byte [ebx + 6]
push ebx
push eax
call fcn.0040c200
add esp, 0xc
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp byte [ebx + 7], 0
je 0x40c952
push 0x20c
call fcn.0040fafb
mov esi, eax
add esp, 4
test esi, esi
je 0x40c922
lea edx, [ebp - 0x20c]
push edx
lea eax, [esi + 4]
xor ecx, ecx
push 0x104
push eax
mov dword [esi], vtable.CommandWithOneArg.0
mov word [eax], cx
call fcn.0040fe56
add esp, 0xc
mov dword [esi], vtable.FirewallAdd.0
mov dword [ebp - 0x410], esi
jmp 0x40c92c
mov dword [ebp - 0x410], 0
mov ecx, dword [ebp - 0x410]
mov esi, dword [ebx + 0x1530]
lea edi, [ebp - 0x40c]
call fcn.004036c0
mov eax, dword [ebp - 0x410]
push eax
call fcn.0040fa9f
add esp, 4
mov ecx, dword [ebp - 0x414]
push ecx
call fcn.00405660
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret
Function at 0x40c9e0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x208
call fcn.0040fa6a
mov ebx, eax
lea eax, [esi + 0x8a]
push eax
push str.Software_s
push 0x104
push ebx
mov dword [ebp - 0x430], ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea edx, [ebp - 0x42c]
push edx
push ebx
xor ecx, ecx
lea edi, [esi + 0x2e76]
push SysReAllocString
mov word [edi], cx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40ca62
push str.DownloadsDir
lea ecx, [ebp - 0x42c]
mov ebx, 0x104
call fcn.00404440
mov ebx, dword [ebp - 0x430]
add esp, 4
cmp word [edi], 0
jne 0x40cb1d
lea eax, [ebp - 0x42c]
push eax
lea ebx, [ebp - 0x14]
call fcn.00404680
add esp, 4
lea edx, [ebp - 0x42c]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
xor ecx, ecx
push SysReAllocString
mov word [ebp - 0x220], cx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40cac0
push str.Personal
lea ecx, [ebp - 0x42c]
mov ebx, 0x104
lea edi, [ebp - 0x220]
call fcn.00404440
add esp, 4
mov ax, word [ebp - 0x14]
push str.Zona_Downloads
cmp ax, word [ebp - 0x220]
jne 0x40caec
lea ecx, [ebp - 0x220]
push ecx
push 0x421048
push 0x104
lea edx, [ebp - 0x428]
push edx
jmp 0x40cb01
lea eax, [ebp - 0x14]
push eax
push 0x420978
push 0x104
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [ebp - 0x428]
mov ecx, esi
call fcn.0040cb40
mov ebx, dword [ebp - 0x430]
push ebx
call fcn.0040fa9f
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
pop ebx
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret

Function at 0x40cb40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push esi
push edi
push eax
mov edi, ecx
push 0x420918
lea esi, [edi + 0x2e76]
push 0x104
push esi
call ebx
push 0x208
call fcn.0040fa6a
add edi, 0x8a
push edi
push str.Software_s
push 0x104
push eax
mov dword [ebp - 4], eax
call ebx
mov edi, dword [ebp - 4]
add esp, 0x24
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40cbe4
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cbb2
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [ebp - 4]
push edx
push esi
push 1
push 0
push str.DownloadsDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0040fa9f
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cc00
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push edi
mov ebx, ecx
lea ecx, [ebx + 0x8a]
push ecx
lea eax, [ebx + 0x1326]
push eax
push str._s_s.exe
lea edx, [ebp - 0x414]
push 0x104
push edx
call esi
add esp, 0x14
push 0
lea eax, [ebp - 0x824]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareZona
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40ccb3
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cc75
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x824]
push ecx
lea edx, [ebp - 0x414]
push edx
push 1
push 0
push str.exec
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x824]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor edx, edx
lea eax, [ebp - 0x20c]
push eax
push edx
push edx
push edx
push edx
mov word [ebp - 0x20c], dx
call edi
lea ecx, [ebp - 0x20c]
push ecx
push str._sZona.lnk
mov edx, ecx
push 0x104
push edx
call esi
lea esi, [ebx + 0x2e76]
add esp, 0x10
cmp word [esi], 0
jne 0x40cd08
push 0
push str.DEBUG
push str.Unknown_download_dir
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.004056e0
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x20c]
push eax
push edx
push edx
push 0xb
push edx
mov word [ebp - 0x20c], dx
call edi
lea ecx, [ebp - 0x20c]
push ecx
push str._sProgramsZona.lnk
mov edx, ecx
push 0x104
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
cmp word [esi], 0
jne 0x40cd6d
push 0
push str.DEBUG
push str.Unknown_download_dir
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.004056e0
lea eax, [ebx + 0x1326]
push eax
lea eax, [ebp - 0x81c]
xor edx, edx
push 0x104
push eax
mov dword [ebp - method.LinkLabel.virtual_0], vtable.CommandWithOneArg.0
mov word [ebp - 0x81c], dx
call fcn.0040fe56
mov esi, dword [ebx + 0x1530]
add esp, 0x18
lea edi, [ebp - 0x614]
lea ecx, [ebp - 0x820]
mov dword [ebp - method.AddUninstallInfoCommand.virtual_0], vtable.AddUninstallInfoCommand.0
call fcn.004036c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret
Function at 0x40ceb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
test esi, esi
je 0x40cf73
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
je 0x40cf73
push esi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40cf73
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x40cf6c
push esi
push edi
push eax
call fcn.004152d0
add esp, 0xc
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40cf65
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040ce70
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
add esp, 4
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esi]
cmp eax, edi
je 0x40cf65
mov ecx, dword [eax + 8]
mov dword [eax + 8], edi
cmp ecx, edi
jne 0x40cf55
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi]
cmp ecx, edi
je 0x40cf63
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d1a0
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x421024
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
push ebx
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x421318
push esi
call fcn.0040e5f0
add esp, 0x1c
lea ecx, [ebp - 0x210]
push ecx
push 0
push eax
push 0x40d0d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret
Function at 0x40e370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e380
push ebx
sub eax, edx
sar eax, 1
push esi
mov ebx, eax
push edi
lea edi, [ebx + 1]
push edi
call fcn.0040fafb
push ebx
mov esi, eax
push 0
push esi
call fcn.00415640
add esp, 0x10
test edi, edi
je 0x40e3db
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
cmp eax, edi
jae 0x40e3d1
mov byte [eax + esi], 0
jmp 0x40e3db
cmp byte [edi + esi - 1], 0
je 0x40e3db
mov byte [esi], 0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e3e0
sub eax, edx
push 0
lea edx, [ebp - 4]
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call fcn.0040fa9f
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40e540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x204]
test ecx, ecx
je 0x40e561
push str.httpget_start_asynch_loading
push 0x4208f8
call fcn.004038b0
mov ecx, dword [edi + 0x204]
test ecx, ecx
je 0x40e57c
mov eax, dword [edi + 0x20c]
push eax
push 0x4208f8
call fcn.004038b0
push 0x18
call fcn.0040fafb
mov esi, eax
add esp, 4
test esi, esi
je 0x40e5c9
push 0x200
mov dword [esi], edi
mov edi, dword [sym.imp.KERNEL32.DLL_LocalAlloc]
push 0x40
mov byte [esi + 8], 0
mov dword [esi + 4], 0
call edi
push 0x200
push 0x40
mov dword [esi + 0x10], eax
call edi
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x14], eax
xor edx, edx
mov word [ecx], dx
mov eax, dword [esi + 0x14]
xor ecx, ecx
mov word [eax], cx
jmp 0x40e5cb
xor esi, esi
lea edx, [ebp - 4]
push edx
push 0
push esi
push 0x40e4d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ebf0
Capabilities:
Download and write a file
Hash data with md5
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2084
call fcn.004175d0
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi]
lea ecx, [ebp - 0x2074]
push ecx
push 0x2000
lea edx, [ebp - 0x2018]
mov dword [ebp - 0x207c], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push edx
push eax
mov dword [ebp - 0x2078], eax
mov dword [ebp - 0x2074], esi
mov dword [ebp - 0x2070], 0x67452301
mov dword [ebp - 0x206c], 0xefcdab89
mov dword [ebp - 0x2068], 0x98badcfe
mov dword [ebp - 0x2064], 0x10325476
mov dword [ebp - 0x2060], esi
mov dword [ebp - 0x205c], esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40ed36
mov edi, edi
mov eax, dword [ebp - 0x2074]
test eax, eax
je 0x40ed79
push 0
lea ecx, [ebp - 0x2080]
push ecx
push eax
mov eax, dword [ebp - 0x207c]
lea edx, [ebp - 0x2018]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x40edde
mov eax, dword [ebp - 0x2080]
cmp dword [ebp - 0x2074], eax
jne 0x40edde
push eax
lea ecx, [ebp - 0x2018]
push ecx
lea eax, [ebp - 0x2070]
call fcn.0040f1a0
mov edx, dword [edi + 4]
add esi, dword [ebp - 0x2074]
add esp, 8
push edx
push 0x64
push esi
call dword [sym.imp.KERNEL32.DLL_MulDiv]
cmp eax, 0x64
je 0x40ed0e
cmp eax, dword [edi + 0xc]
je 0x40ed0e
mov dword [edi + 0xc], eax
test ebx, ebx
je 0x40ed0e
mov ecx, dword [ebx + 0x224]
test ecx, ecx
je 0x40ed0e
push ebx
push eax
call ecx
mov edx, dword [ebp - 0x2078]
lea eax, [ebp - 0x2074]
push eax
push 0x2000
lea ecx, [ebp - 0x2018]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x40ec80
mov ecx, edi
call fcn.0040e6a0
mov ebx, dword [ebx + 0x204]
test ebx, ebx
je 0x40ed58
push 0x422f40
push str.ERROR
mov ecx, ebx
call fcn.004038b0
mov edi, dword [edi]
dec dword [edi + 0x21c]
cmp dword [edi + 0x21c], 0
jle 0x40ee1e
mov eax, dword [edi + 0x220]
push eax
jmp 0x40ee18
cmp esi, dword [edi + 4]
jne 0x40ee2f
lea ecx, [ebp - 0x14]
push ecx
lea esi, [ebp - 0x2070]
mov byte [edi + 8], 1
call fcn.0040f2b0
mov edx, dword [edi + 0x14]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
add esp, 4
mov word [edx], ax
xor esi, esi
jmp 0x40edb0
movzx ecx, byte [ebp + esi - 0x14]
mov eax, dword [edi + 0x14]
push ecx
push eax
push str._s_02x
push eax
call ebx
inc esi
add esp, 0x10
cmp esi, 0x10
jb 0x40edb0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret 8
mov ecx, edi
call fcn.0040e6a0
mov ebx, dword [ebx + 0x204]
test ebx, ebx
je 0x40ee00
push 0x422f74
push str.ERROR
mov ecx, ebx
call fcn.004038b0
mov edi, dword [edi]
dec dword [edi + 0x21c]
cmp dword [edi + 0x21c], 0
jle 0x40ee1e
mov edx, dword [edi + 0x220]
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, 0x2710
add dword [edi + 0x218], eax
add dword [edi + 0x214], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret 8
Function at 0x40ee50
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
push 0x1fe
mov esi, ecx
push eax
lea ecx, [ebp - 0x402]
push ecx
mov edi, edx
mov word [ebp - 0x404], ax
call fcn.00415640
xor edx, edx
push 0x1fe
push edx
lea eax, [ebp - 0x202]
push eax
mov dword [ebp - 0x40c], 0x200
mov word [ebp - 0x204], dx
call fcn.00415640
add esp, 0x18
push 0
push 0x84400000
push 0
push 0
push 0
push ebx
push 0
push edi
mov dword [ebp - 0x408], 0x200
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
test edi, edi
jne 0x40ef2d
mov eax, dword [esi]
mov ecx, dword [eax + 0x204]
test ecx, ecx
je 0x40eef2
push str.HttpOpenRequest
push str.ERROR
call fcn.004038b0
mov ecx, esi
call fcn.0040e6a0
mov esi, dword [esi]
dec dword [esi + 0x21c]
cmp dword [esi + 0x21c], 0
jle 0x40ef17
mov ecx, dword [esi + 0x220]
push ecx
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, 0x2710
add dword [esi + 0x218], eax
add dword [esi + 0x214], eax
jmp 0x40f08c
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x40ef7c
mov ecx, esi
call fcn.0040e6a0
mov eax, dword [esi]
mov ecx, dword [eax + 0x204]
test ecx, ecx
je 0x40ef62
push str.HttpSendRequest
push str.ERROR
call fcn.004038b0
mov esi, dword [esi]
dec dword [esi + 0x21c]
cmp dword [esi + 0x21c], 0
jle 0x40ef17
mov edx, dword [esi + 0x220]
push edx
jmp 0x40ef11
mov ebx, dword [sym.imp.WININET.dll_HttpQueryInfoW]
push 0
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x404]
push ecx
push 5
push edi
call ebx
test eax, eax
je 0x40f05c
push 0
lea edx, [ebp - 0x404]
push 0
push edx
call fcn.00413bd3
mov ecx, dword [esi]
push str.Content_MD5
lea edx, [ebp - 0x204]
push 0x100
mov dword [esi + 4], eax
push edx
mov dword [ecx], eax
call fcn.0040fe56
add esp, 0x18
push 0
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x204]
push ecx
push 0xffff
push edi
call ebx
mov edx, dword [esi + 0x10]
xor eax, eax
mov word [edx], ax
lea ecx, [ebp - 0x204]
mov eax, str.Content_MD5
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40f026
test dx, dx
je 0x40f022
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40f026
add eax, 4
add ecx, 4
test dx, dx
jne 0x40f000
xor eax, eax
jmp 0x40f02b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f047
mov edx, dword [esi + 0x10]
lea ecx, [ebp - 0x204]
push ecx
push 0x100
push edx
call fcn.0040fe56
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret 4
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esi]
mov ecx, dword [eax + 0x204]
test ecx, ecx
je 0x40f07e
push str.HttpQueryInfo
push str.ERROR
call fcn.004038b0
mov ecx, esi
call fcn.0040e6a0
mov eax, esi
call fcn.0040f0b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040fa5b
mov esp, ebp
pop ebp
ret 4

Function at 0x40fa5b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42701c]
jne 0x40fa65
repz ret
jmp fcn.00410580
Function at 0x4149e9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42701c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041171d
and dword [ebp - 0x14], 0
cmp dword [0x42a5cc], 0
mov dword [ebp - 0x18], eax
jne 0x414a9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x414b44
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x41f308
push ebx
call edi
test eax, eax
je 0x414b44
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42a5cc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42a5d0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42a5d4], eax
call edi
push eax
call esi
mov dword [0x42a5dc], eax
test eax, eax
je 0x414a9c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42a5d8], eax
mov eax, dword [0x42a5d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x414af5
cmp dword [0x42a5dc], ecx
je 0x414af5
push eax
call esi
push dword [0x42a5dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x414af5
test ebx, ebx
je 0x414af5
call edi
test eax, eax
je 0x414aec
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x414aec
test byte [ebp - 8], 1
jne 0x414af5
or dword [ebp + 0x10], 0x200000
jmp 0x414b28
mov eax, dword [0x42a5d0]
cmp eax, dword [ebp - 0x18]
je 0x414b28
push eax
call esi
test eax, eax
je 0x414b28
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x414b28
mov eax, dword [0x42a5d4]
cmp eax, dword [ebp - 0x18]
je 0x414b28
push eax
call esi
test eax, eax
je 0x414b28
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42a5cc]
call esi
test eax, eax
je 0x414b44
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x414b46
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fa5b
leave
ret
Function at 0x40c610
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
call fcn.0040ea40
push 0xffffffffffffffeb
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
mov esi, eax
push 0
push 0x130b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x40c646
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push edi
push 0x40cde0
push ebx
push dword [esi + edi*4 + 0x18]
push dword [0x43a4c0]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [esi + 4], eax
mov dword [0x43a4cc], eax
mov dword [0x43a4d4], edi
pop edi
pop esi
pop ebx
jmp fcn.0040ffb0
Function at 0x40df00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43a4ec], 8
mov eax, dword [ebp + 8]
push esi
mov dword [0x43a4d0], eax
mov eax, 0x43a4d8
cmovae eax, dword [0x43a4d8]
xor ecx, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x640000
push ecx
push 0x401
mov dword [0x43a4e8], 0
mov word [eax], cx
push 0x3f2
push dword [0x43a4d0]
mov byte [0x43a4f0], cl
mov byte [0x43a4f1], cl
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
push 0
push 0
push 0x402
push 0x3f2
push dword [0x43a4d0]
call edi
push eax
call esi
push 0x4358a4
push 0x3f7
push dword [0x43a4d0]
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call esi
push 0x434b68
push 0x3f9
push dword [0x43a4d0]
call edi
push eax
call esi
mov dword [0x43a4f4], 0
mov dword [0x43a4fc], 0
mov dword [0x43a4f8], 0
mov byte [0x43a504], 0
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x43a500], eax
mov eax, dword [ebp + 0x10]
add eax, 0xfffffc05
pop edi
pop esi
cmp eax, 0x56
ja case.0x40dff5.1021
movzx eax, byte [eax + 0x40e0f0]
jmp dword [eax*4 + 0x40e0c8]
push 0x43a510
push 0
push 0x43a4c8
push 0x401a60
jmp 0x40e0ab
push 0x43a510
push 0
push 0x43a4c8
push 0x401be0
jmp 0x40e0ab
push 0x43a510
push 0
push 0x43a4c8
push 0x401020
jmp 0x40e0ab
push 0x43a510
push 0
push 0x43a4c8
push 0x4054b0
jmp 0x40e0ab
push 0x43a510
push 0
push 0x43a4c8
push 0x40a000
jmp 0x40e0ab
push 0x43a510
push 0
push 0x43a4c8
push 0x40a740
jmp 0x40e0ab
push 0x43a510
push 0
push 0x43a4c8
push 0x4043e0
jmp 0x40e0ab
push 0x43a510
push 0
push 0x43a4c8
push 0x404890
jmp 0x40e0ab
push 0x43a510
push 0
push 0x43a4c8
push 0x411e30
push 0
push 0
call fcn.0041817e
add esp, 0x18
mov dword [0x43a50c], eax
mov eax, 1
pop ebp
ret 0xc