joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bd80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x529d8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x5d4be8
mov eax, dword [0x66f704]
mov dword [esp + 0x8c], 0
mov dword [esp + 0xc], eax
push str.This_is_a_free_30_day_unregistered_version_for_evaluation_use_only._If_you_want_to_use_the_software_beyond_the_evaluation_period__you_are_expected_to_register_the_software.
push 0x622
mov byte [esp + 0x94], 1
call fcn.004dd120
add esp, 8
lea ecx, [esp + 0xc]
push eax
call fcn.0050e13f
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x98]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
add edi, eax
mov eax, 0xa
sub ecx, eax
add edx, eax
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edx
mov word [0x613fe8], 1
call fcn.0045bd00
lea edx, [esp + 0x28]
push edx
call dword [0x6719dc]
push eax
lea ecx, [esp + 0x14]
call fcn.005152a4
mov esi, dword [esp + 0x94]
lea ecx, [esp + 0x10]
mov byte [0x6125a1], 0xbb
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [esi]
push 0
mov ecx, esi
mov edi, eax
call dword [edx + 0x30]
push 1
mov ecx, esi
call fcn.00514afc
push 0
push 0
push 0x612700
call fcn.004b7620
and eax, 0x7fffffff
push 0
push eax
push 0x612700
call fcn.004b7850
mov eax, dword [esp + 0x24]
mov edx, dword [esi]
add esp, 0x18
lea ebp, [esp + 0x18]
mov ecx, dword [eax - 8]
push 0x10
push ebp
push ecx
push eax
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x28]
lea ecx, [esp + 0x10]
call fcn.005152fb
lea ecx, [esp + 0xc]
mov dword [0x613fec], 0x78f3
mov byte [esp + 0x8c], 0
call fcn.0050dfa8
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 2
call fcn.005152fb
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x84
ret 8
Function at 0x45e2f0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x529f36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 8]
call fcn.0050c47e
lea ecx, [esi + 0x10]
mov dword [esp + 0x10], 0
call fcn.0050c47e
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.0050c47e
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi], 0x5d56c8
mov dword [esi + 4], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x462a10
Capabilities:
Check for time delay via gettickcount
Get disk information

Disassembly:
sub esp, 0x1c
mov eax, dword [0x614128]
push esi
mov esi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov cx, word [0x61412c]
push edi
mov edi, 1
test eax, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov word [esp + 0x20], cx
je 0x462a47
mov dword [0x6c7b40], edi
mov eax, dword [esi + 0x4888]
mov edx, dword [0x6c7b40]
cmp eax, edi
mov dword [esp + 0x14], edx
je 0x462c6b
mov eax, dword [esi + 0x4884]
test eax, eax
je 0x462c6b
mov eax, dword [0x6d7708]
test eax, eax
jne 0x462c6b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x6c7b40]
test ecx, ecx
jne 0x462a9b
sub eax, dword [0x6c7b3c]
cmp eax, 0x9c4
jb 0x462c6b
push ebx
push ebp
mov dword [esi + 0x4888], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x20], eax
mov ebp, 0x41
mov dword [esp + 0x30], 0x6593b8
lea edi, [esi + 0x48cc]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
or bl, 0xff
mov dword [esp + 0x18], 1
test eax, ecx
je 0x462b34
lea ecx, [esp + 0x24]
mov word [esp + 0x24], bp
push ecx
call dword [0x671a4c]
cmp eax, 5
jne 0x462b34
cmp dword [edi], 0
jne 0x462afc
push ebp
call fcn.004ca340
add esp, 4
mov dword [edi], eax
mov esi, dword [edi]
test esi, esi
je 0x462b30
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.004cbad0
add esp, 4
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x37
je 0x462b30
cmp eax, 6
je 0x462b30
mov dword [esp + 0x18], 0
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
cmp byte [eax], bl
je 0x462b46
mov dword [esp + 0x1c], 1
mov byte [eax], bl
mov eax, dword [esp + 0x18]
test eax, eax
je 0x462b63
mov eax, dword [edi]
test eax, eax
je 0x462b63
push eax
call fcn.004b6a60
add esp, 4
mov dword [edi], 0
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
inc ebp
add edi, 4
inc edx
shl ecx, 1
cmp bp, 0x5a
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], ecx
jbe 0x462ac0
mov eax, dword [esp + 0x1c]
xor edi, edi
cmp eax, edi
je 0x462c52
push edi
mov ecx, esi
call fcn.00462d70
push edi
push edi
push 0x71d230
call fcn.004ca6e0
mov eax, dword [esi + 0x30dc]
add esp, 0xc
cmp eax, edi
mov ebx, 1
je 0x462bbe
mov dword [eax + 0xa0], ebx
mov ecx, dword [esi + 0x30d8]
cmp ecx, edi
je 0x462bde
cmp dword [0x66f4ec], 0x12
jne 0x462bd8
call fcn.004932f0
jmp 0x462bde
mov dword [ecx + 0x88], ebx
mov eax, dword [0x6d7700]
cmp eax, edi
je 0x462c05
mov dx, word [0x6d76e4]
push edi
push 0x66ae5c
add eax, 0x74
push ebx
push eax
push edi
push edi
push edx
push edi
call fcn.004cb300
add esp, 0x20
mov ecx, dword [esi + 0x30d0]
cmp ecx, edi
je 0x462c1e
cmp dword [0x66f4ec], 0xf
jne 0x462c1e
push edi
call fcn.00493bd0
mov eax, dword [esi + 0x30c8]
cmp eax, edi
je 0x462c46
cmp dword [0x66f4ec], 0xd
jne 0x462c46
cmp dword [0x68ca44], edi
jne 0x462c46
push 6
lea ecx, [eax + 0x9c]
call fcn.004a4a40
mov dword [0x71d80c], ebx
mov dword [0x71d810], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6c7b3c], eax
mov dword [esi + 0x4888], edi
pop ebp
mov dword [0x6c7b40], edi
pop ebx
pop edi
pop esi
add esp, 0x1c
ret 4
Function at 0x467860
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x6c7b30]
sub esp, 0x34
mov eax, dword [eax + 0x30e0]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
je 0x467882
mov dword [eax + 0xc8], 0
mov ebx, dword [0x671be8]
mov edi, dword [esp + 0x48]
cmp edi, 1
mov ecx, edi
jne 0x4678cb
mov eax, dword [0x66f4ec]
cmp eax, 2
je 0x4678c4
cmp eax, 5
je 0x4678c4
cmp eax, 3
je 0x4678bd
cmp eax, 4
je 0x4678bd
cmp eax, 6
je 0x4678b6
cmp eax, 7
jne 0x467905
mov ecx, 7
jmp 0x467905
mov ecx, 6
jmp 0x467905
mov ecx, 5
jmp 0x467905
cmp edi, 2
jne 0x467905
mov eax, dword [0x66f4ec]
cmp eax, edi
je 0x467900
cmp eax, 5
je 0x467900
cmp eax, 3
je 0x4678f9
cmp eax, 4
je 0x4678f9
cmp eax, 6
je 0x4678f2
cmp eax, 7
jne 0x467905
mov ecx, 0xa
jmp 0x467905
mov ecx, 9
jmp 0x467905
mov ecx, 8
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x60], 0xffffffff
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.00512a6e
mov ebp, eax
test ebp, ebp
je 0x467a59
mov edx, dword [esi + 0x1c]
push 1
push edi
push 0x403
push edx
mov dword [esi + 0x4c], 1
call ebx
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
push 2
mov ecx, esi
call fcn.00468150
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push edi
push 0x41d
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004af330
add esp, 8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0050f8d2
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_IntersectRect]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], 0x14
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov dword [0x6c7b64], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x467800
push 0xffffffffffffffff
call dword [0x671c08]
mov dword [0x6c7b68], eax
mov edx, dword [esi + 0x1c]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [ebp + 4]
push eax
push ecx
push 0x42
push edx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov eax, dword [0x6c7b68]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [esi + 0x1c]
xor ebp, ebp
push ebp
push edi
push 0x403
push ecx
call ebx
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [esi + 0x6c]
xor eax, eax
cmp edx, ebp
push edi
setne al
push eax
mov ecx, esi
call fcn.00468150
mov dword [0x6c7b68], ebp
mov dword [0x6c7b64], ebp
mov edi, dword [esi + 0x60]
cmp edi, ebp
jge 0x46788c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x4685b0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x52a866
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.CMenu.0
mov dword [edi + 4], ebx
lea ecx, [edi + 0xc]
mov dword [esp + 0x20], ebx
call fcn.0050cfad
lea ecx, [edi + 0x20]
mov byte [esp + 0x20], 1
call fcn.0050cfad
mov dword [edi], method.CMenu.virtual_0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], vtable.CMenu.0
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call fcn.00512af8
mov eax, dword [esp + 0x28]
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x46862a
push 0x1e
jmp 0x46862c
push 0xf
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
call esi
push 0x1e
mov dword [0x6c7bac], eax
mov dword [0x6c7b90], 0xbae6fc
mov dword [0x6c7ba8], 0xf7f8f9
call esi
push 7
mov dword [0x6c7ba4], eax
call esi
push 0x11
mov dword [0x6c7ba0], eax
call esi
push 4
mov dword [0x6c7b9c], eax
mov dword [0x6c7b98], 0xb7886a
mov dword [0x6c7b94], 0x5a4334
call esi
mov dword [0x6c7b8c], eax
mov eax, 0x10
mov ecx, eax
mov dword [0x6c7b80], eax
mov eax, 3
mov dword [0x6c7b84], ecx
mov ecx, eax
mov dword [0x6c7b78], eax
mov eax, 5
mov dword [0x6c7b7c], ecx
mov dword [0x6c7b70], eax
mov dword [0x6c7b74], ecx
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
mov dword [0x6c7b88], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x46ab60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [0x6c7b30]
push esi
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46abae
push 4
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x46abae
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x46abae
mov edx, dword [esp + 0xc]
push esi
mov dword [eax], edx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret
Function at 0x4829f0
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x1010
call fcn.004f5a60
push ebx
push ebp
push esi
push edi
call fcn.004b7280
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004f59f2
lea ecx, [esp + 0x20]
push str.gBurner.exe___1_
push ecx
call fcn.004f59c8
call fcn.004b7280
lea edx, [esp + 0x82c]
push eax
push edx
call fcn.004f59f2
lea eax, [esp + 0x834]
push str.gBurner.exe_0
push eax
call fcn.004f59c8
mov ebx, dword [esp + 0x1044]
add esp, 0x20
push ebx
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
mov ebp, dword [0x67199c]
push edx
push 0
push 0x20006
push 0
push 0x672d14
push 0
push 0x6124b4
push 0x80000000
call ebp
test eax, eax
jne 0x482b3b
mov esi, dword [0x6719c4]
push eax
mov eax, dword [esp + 0x14]
push str.gBurner_File
push 1
push 0x672d14
push eax
call esi
test eax, eax
je 0x482ac0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 0
push edx
push 1
push str.shellopencommand
push eax
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x81c]
push 0
push ecx
push 1
push str.DefaultIcon
push edx
call esi
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0x20006
push 0
push 0x672d14
push 0
push ebx
push 0x80000000
call ebp
test eax, eax
jne 0x482b3b
push eax
mov eax, dword [esp + 0x14]
push 0x6124b4
push 1
push 0x672d14
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
Function at 0x48eeb0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push 0x14d
call fcn.005153ff
push 0
push 0x6604f8
mov dword [esi], 0x5dac68
call fcn.004b4a10
add esp, 8
push 0xffffffffffffffff
call fcn.004f8157
pop esi
nop
nop
nop
nop
nop
nop
push esi
mov esi, ecx
call fcn.0048ef30
test byte [esp + 8], 1
je 0x48eef8
push esi
call fcn.005129f1
add esp, 4
mov eax, esi
pop esi
ret 4

Function at 0x494140
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x52d83c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8a0
mov eax, dword [0x61809c]
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [0x6180a0]
mov dword [esp + 0x14], eax
mov eax, dword [0x66f704]
push esi
push edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x8b8], ebx
mov byte [esp + 0x8b8], 1
call fcn.004bb840
cmp eax, 2
jl 0x494346
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0xac]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
lea ecx, [ebp + 0x88]
call fcn.004caed0
cmp ax, 0x41
mov word [esp + 0x1c], ax
jb 0x494346
cmp ax, 0x5a
ja 0x494346
mov edx, dword [ebp + 0xd8]
lea edi, [ebp + 0xd8]
cmp dword [edx - 8], ebx
jne 0x494210
push 0x400
lea eax, [esp + 0xb0]
push 0x6cf080
push eax
call fcn.004f6648
add esp, 0xc
jmp 0x49424d
push edi
call fcn.004b89b0
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x49424d
push 0x5c
push esi
call fcn.004f5abd
add esp, 8
test eax, eax
je 0x494244
push 0x400
lea ecx, [esp + 0xb0]
push esi
push ecx
call fcn.004f6648
add esp, 0xc
push esi
call fcn.004b6a50
add esp, 4
cmp word [esp + 0xac], bx
je 0x494273
lea edx, [esp + 0xac]
push 0x5c
push edx
call fcn.004f5abd
add esp, 8
cmp eax, ebx
je 0x49428d
mov word [eax + 2], bx
jmp 0x49428d
push ebx
lea eax, [esp + 0xb0]
push 5
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x494346
lea ecx, [esp + 0x2c]
push 0x40
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.004b8fe0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4942b4
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
call fcn.0050e13f
cmp word [esp + 0xac], bx
je 0x494346
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 8], ebx
je 0x494346
mov edx, dword [ebp + 0xe0]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.004b8620
add esp, 8
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0050dd15
push ecx
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0x8c4], 2
call fcn.0050e01c
lea ecx, [esp + 0x20]
mov byte [esp + 0x8c0], 1
push ecx
call fcn.004b86a0
add esp, 0xc
push eax
mov ecx, edi
mov byte [esp + 0x8bc], 3
call fcn.0050e0ef
lea ecx, [esp + 0x18]
mov byte [esp + 0x8b8], 1
call fcn.0050dfa8
lea ecx, [esp + 0x14]
mov byte [esp + 0x8b8], bl
call fcn.0050dfa8
lea ecx, [esp + 0x10]
mov dword [esp + 0x8b8], 0xffffffff
call fcn.0050dfa8
mov ecx, dword [esp + 0x8b0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x8ac
ret
Function at 0x4a0610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52de31
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x66f704]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 8]
mov dword [ecx], eax
mov edx, dword [0x66f704]
lea ebx, [esi + 0x14]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], edx
mov al, byte [esp + 0xf]
mov dword [esi + 0x38], edi
mov byte [esi + 0x34], al
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
push 0x672d14
mov byte [esp + 0x20], 2
mov dword [esi], 0x5dc8d0
mov dword [esi + 0x61acc], edi
mov dword [esi + 0x61ac8], edi
mov dword [esi + 0x61ac4], edi
call fcn.0050e13f
push 0x672d14
mov ecx, ebx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.0050e13f
mov ecx, dword [esp + 0x14]
or eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4a07b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52de68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ecx + 0x30]
mov dword [esp + 0xc], 0
test eax, eax
je 0x4a07f2
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 4], esp
push eax
call fcn.0050dd15
push 0
push 0
call fcn.004d9070
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.0050dfa8
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4a0820
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
mov eax, dword [esp + 8]
push esi
push 0
push 0x672d14
push 0x672d14
push 0
mov esi, ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 0x61ac4], eax
jne 0x4a084a
pop esi
ret 0x14
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0x4400000
push 3
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 0x61ac8], eax
jne 0x4a08b2
push 0x6629e8
push 0x2732
call fcn.004dd120
add esp, 4
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.0050e01c
mov ecx, esi
call fcn.004a07b0
mov eax, dword [esi + 0x61ac4]
push eax
call fcn.004b6a60
add esp, 4
xor eax, eax
pop esi
ret 0x14
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x4a0904
push 0x6629e8
push 0x2732
call fcn.004dd120
add esp, 4
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.0050e01c
mov ecx, esi
call fcn.004a07b0
mov ecx, dword [esi + 0x61ac8]
push ecx
call fcn.004b6a60
mov edx, dword [esi + 0x61ac4]
push edx
call fcn.004b6a60
add esp, 8
xor eax, eax
pop esi
ret 0x14
mov eax, 1
pop esi
ret 0x14
Function at 0x4a0b60
Capabilities:
Send data
Send http request

Disassembly:
sub esp, 0x108
push esi
push edi
push 0
lea eax, [esp + 0xc]
mov esi, ecx
push 0x4400000
mov ecx, dword [esp + 0x11c]
push eax
mov edx, dword [esi + 0x61ac8]
push 0x672d14
push str.HTTP_1.0
push ecx
push 0x662a9c
push edx
mov dword [esp + 0x28], 0x662a94
mov dword [esp + 0x2c], 0
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov dword [esi + 0x61acc], eax
jne 0x4a0bbf
pop edi
pop esi
add esp, 0x108
ret 0x14
push 0x80000000
push str.Accept:___r_n
call fcn.004f5a40
mov edi, dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
add esp, 4
push eax
mov eax, dword [esi + 0x61acc]
push str.Accept:___r_n
push eax
call edi
test eax, eax
jne 0x4a0bfe
mov ecx, esi
call fcn.004a0760
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 0x14
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x11c]
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
je 0x4a0c62
push ecx
push eax
lea eax, [esp + 0x18]
push str.Range:_bytes_I64d_r_n
push eax
call fcn.004f5dd2
add esp, 0x10
lea ecx, [esp + 0x10]
push 0xa0000000
push ecx
call fcn.004f5a40
add esp, 4
lea edx, [esp + 0x14]
push eax
mov eax, dword [esi + 0x61acc]
push edx
push eax
call edi
test eax, eax
jne 0x4a0c62
mov ecx, esi
call fcn.004a0760
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 0x14
mov ecx, dword [esi + 0x61acc]
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x108
ret 0x14

Function at 0x4a0c90
Capabilities:
Send data
Send http request

Disassembly:
mov eax, 0x4004
call fcn.004f5a60
mov ax, word [0x672d14]
push esi
mov esi, ecx
push edi
mov word [esp + 0xc], ax
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0xe]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push 0x2000
push ecx
mov ecx, esi
mov dword [esp + 0x10], 0x662a94
stosw word es:[edi], ax
call fcn.004a0f30
mov eax, dword [esp + 0x4010]
mov ecx, dword [esi + 0x61ac8]
push 0
lea edx, [esp + 0xc]
push 0x4400040
push edx
push 0x672d14
push str.HTTP_1.0
push eax
push str.POST
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov dword [esi + 0x61acc], eax
jne 0x4a0d16
pop edi
pop esi
add esp, 0x4004
ret 0x14
push 0x80000000
push str.Accept:___r_n
call fcn.004f5a40
mov edx, dword [esi + 0x61acc]
add esp, 4
push eax
push str.Accept:___r_n
push edx
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
test eax, eax
jne 0x4a0d53
mov ecx, esi
call fcn.004a0760
pop edi
xor eax, eax
pop esi
add esp, 0x4004
ret 0x14
lea eax, [esp + 0xc]
push eax
call fcn.004f5a40
add esp, 4
lea ecx, [esp + 0xc]
push eax
push ecx
push str.Content_Type:_application_x_www_form_urlencoded_r_n
call fcn.004f5a40
mov edx, dword [esi + 0x61acc]
add esp, 4
push eax
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x4004
ret 0x14
Function at 0x4a0da0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x61acc]
test eax, eax
jne 0x4a0db3
xor eax, eax
pop ebx
ret 8
mov edx, dword [esp + 0xc]
push ebp
mov ecx, edx
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
push edi
xor eax, eax
mov edi, esi
push 0x6c800c
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
push edx
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x61acc]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [0x6c800c]
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
and eax, ecx
pop ebx
ret 8
Function at 0x4a1ce0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4a1cf2
mov dword [0x6c8828], 1
mov eax, dword [0x6c8820]
test eax, eax
jne 0x4a1d34
mov eax, dword [0x6c8824]
push eax
call fcn.004b6a60
add esp, 4
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x4a1d40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x6c8824], eax
je 0x4a1d34
mov dword [0x6c8820], 1
ret