joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a41bd66
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [ebp + 0x18], eax
je 0x2a4398bb
cmp dword [edx], 0
jne 0x2a41be60
cmp byte [ebp - 0x7ee], 0
jne 0x2a4398e5
cmp byte [ebp - 0x7ed], 0
je 0x2a41be83
jmp 0x2a439946
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7fc
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x7f4], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x7f8], edx
mov dword [ebp - 0x7fc], esi
test eax, eax
je 0x2a439951
test ecx, ecx
je 0x2a439951
test edx, edx
je 0x2a439951
push ebx
push edi
lea ebx, [eax + 6]
mov al, byte [eax + 2]
lea edi, [ecx + 6]
mov cl, byte [ecx + 2]
mov byte [ebp - 0x7ee], al
mov byte [ebp - 0x7ed], cl
test esi, esi
jne 0x2a439832
movzx ecx, word [ebx]
xor esi, esi
test cx, cx
je 0x2a41bdfc
lea ebx, [ebx]
mov edx, dword [ebp - 0x7f4]
movzx eax, word [edx + 0x23c]
add edx, 0x23c
test ax, ax
jne 0x2a43983d
movzx ecx, word [edi]
xor edx, edx
mov word [ebp + esi*2 - 0x7ec], dx
xor esi, esi
test cx, cx
je 0x2a41be2e
lea ebx, [ebx]
mov edx, dword [ebp - 0x7f4]
movzx eax, word [edx + 0x23c]
add edx, 0x23c
test ax, ax
jne 0x2a43987c
mov ecx, dword [ebp - 0x7fc]
xor eax, eax
push ecx
mov ecx, dword [ebp - 0x7f4]
mov word [ebp + esi*2 - 0x3f8], ax
mov esi, dword [ebp + 0x14]
push esi
push edi
push ebx
call fcn.2a41be9d
mov edx, dword [ebp - 0x7f8]
mov dword [edx], eax
test eax, eax
je 0x2a41bd30
cmp byte [ebp - 0x7ee], 0
jne 0x2a439925
cmp byte [ebp - 0x7ed], 0
jne 0x2a439930
cmp dword [edx], 0
je 0x2a41bdd4
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2a401bd9
mov esp, ebp
pop ebp
ret 0x18
mov dword [esi], 0
jmp 0x2a41bdd4
add edx, 2
cmp cx, ax
je 0x2a439853
movzx eax, word [edx]
test ax, ax
je 0x2a41bdfc
jmp 0x2a43983d
cmp esi, 0x1f8
jge 0x2a41bdfc
add ebx, 2
mov word [ebp + esi*2 - 0x7ec], cx
movzx ecx, word [ebx]
inc esi
test cx, cx
je 0x2a41bdfc
jmp 0x2a41bde0
add edx, 2
cmp cx, ax
je 0x2a439892
movzx eax, word [edx]
test ax, ax
je 0x2a41be2e
jmp 0x2a43987c
cmp esi, 0x1f8
jge 0x2a41be2e
add edi, 2
mov word [ebp + esi*2 - 0x3f8], cx
movzx ecx, word [edi]
inc esi
test cx, cx
je 0x2a41be2e
jmp 0x2a41be12
mov ecx, dword [ebp - 0x7f4]
push eax
push esi
lea edx, [ebp - 0x3f8]
push edx
lea eax, [ebp - 0x7ec]
push eax
call fcn.2a41be9d
mov ecx, dword [ebp - 0x7f8]
mov dword [ecx], eax
mov edx, ecx
jmp 0x2a41bd39
cmp byte [ebp - 0x7ed], 0
je 0x2a43993b
cmp word [ebx], 0
mov eax, ebx
je 0x2a4398ff
add eax, 2
cmp word [eax], 0
jne 0x2a4398f6
sub eax, ebx
sar eax, 1
cmp word [edi], 0
mov ecx, edi
je 0x2a439914
add ecx, 2
cmp word [ecx], 0
jne 0x2a43990b
sub ecx, edi
sar ecx, 1
lea ebx, [ebx + eax*2 + 2]
lea edi, [edi + ecx*2 + 2]
jmp 0x2a41be60
dec byte [ebp - 0x7ee]
jmp 0x2a41be6d
dec byte [ebp - 0x7ed]
jmp 0x2a41be7a
mov dword [edx], 1
jmp 0x2a41be60
mov dword [edx], 0xffffffff
jmp 0x2a41be6d
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x80004003
pop esi
call fcn.2a401bd9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x2a41cac9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x18], eax
je 0x2a41cb59
push 0x23
pop eax
mov word [ebp - 0x14], ax
push 0xa
lea eax, [ebp - 0x12]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0xc
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x2a41cb93
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
test eax, eax
je 0x2a41cb93
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x2a41cb93
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2a401bd9
leave
ret 0x14
test esi, esi
je 0x2a41cb8f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x2a41cb8f
lea edi, [eax + eax]
mov eax, edi
call fcn.2a41925b
mov eax, esp
push 3
push edi
push esi
push eax
call fcn.2a41cb9c
push eax
push dword [ebp - 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
jmp 0x2a41cb1b
xor eax, eax
jmp 0x2a41cb82
xor eax, eax
jmp 0x2a41cb45

Function at 0x2a41d897
Capabilities:
Parse pe header

Disassembly:
push 0x48
jmp 0x2a41d8cf
sub eax, 8
je 0x2a42d89b
dec eax
jmp 0x2a41d848
sub eax, 0x62
je 0x2a41d86a
dec eax
je 0x2a41d866
dec eax
je 0x2a41d862
dec eax
je 0x2a41d85e
dec eax
jne case.default.0x2a41d8c6
push 0x50
jmp 0x2a41d8cf
push 0x4f
jmp 0x2a41d8cf
push 0x4e
jmp 0x2a41d8cf
push 0x4d
jmp 0x2a41d8cf
push 0x4c
jmp 0x2a41d8cf
push 0x41
jmp 0x2a41d8cf
mov edi, edi
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
cmp eax, 0x61
jg 0x2a41d845
je 0x2a42d89b
cmp eax, 0x38
jg 0x2a4288de
je 0x2a4288d7
sub eax, 0x30
cmp eax, 7
ja case.default.0x2a41d8c6
jmp dword [eax*4 + 0x2a41d86e]
push 0x44
pop eax
pop ebp
ret 4
push 0x46
jmp 0x2a41d8cf
push 0x42
jmp 0x2a41d8cf
push 0x45
jmp 0x2a41d8cf
push 0x49
jmp 0x2a41d8cf
sub eax, 0x39
jne 0x2a41d839
push 0x4a
jmp 0x2a41d8cf
push 0x43
jmp 0x2a41d8cf
push 0x4b
jmp 0x2a41d8cf
push 0x5a
jmp 0x2a41d8cf
push 0x47
jmp 0x2a41d8cf
Function at 0x2a42149a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x70
mov eax, 0x2a4a0f02
call fcn.2a401721
mov esi, ecx
and dword [ebp - 4], 0
and dword [ebp - 0x7c], 0
lea ecx, [ebp - 0x10]
call fcn.2a40ab0f
mov eax, dword [esi + 8]
dec eax
mov dword [ebp - 4], 1
jne 0x2a439373
push ecx
lea eax, [esi + 0x10]
mov ecx, esp
mov dword [ebp - 0x78], esp
push eax
call fcn.2a409959
lea eax, [ebp - 0x74]
push eax
mov ecx, esi
call fcn.2a42165c
mov edi, eax
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 2
call fcn.2a424327
mov ebx, eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 3
call fcn.2a422309
push ebx
push eax
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 4
call fcn.2a40b635
push 0x2a416de4
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 5
call fcn.2a419d5f
push edi
push eax
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 4], 6
call fcn.2a40b635
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.2a40962b
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.2a40567c
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.2a40567c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 4
call fcn.2a40567c
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 3
call fcn.2a40567c
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.2a40567c
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.2a40567c
lea eax, [esi + 0x14]
mov ecx, dword [eax]
cmp dword [ecx - 8], 0
jg 0x2a4395a9
push eax
push 0x2a4395dc
lea eax, [ebp - 0x78]
push eax
call fcn.2a419daf
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call fcn.2a41435b
lea ecx, [ebp - 0x78]

Function at 0x2a424087
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xfbc
mov eax, 0x2a4a0a5b
call fcn.2a40924e
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0xfc0]
push eax
mov byte [ebp - 0xfb1], 0
call fcn.2a424173
and dword [ebp - 4], 0
push edi
push eax
lea eax, [ebp - 0xfbc]
push eax
call fcn.2a40b635
lea ecx, [ebp - 0xfc0]
mov byte [ebp - 4], 2
call fcn.2a40567c
lea eax, [ebp - 0xfb8]
push eax
push dword [ebp - 0xfbc]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x2a424151
mov esi, dword [esi]
lea eax, [ebp - 0xfc8]
push eax
lea eax, [ebp - 0xfb0]
push eax
lea eax, [ebp - 0xfc4]
push eax
push 0
push esi
push dword [ebp - 0xfb8]
mov dword [ebp - 0xfc8], 0xfa0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2a424145
cmp dword [ebp - 0xfc4], 1
jne 0x2a424145
mov word [ebp - 0x12], ax
lea eax, [ebp - 0xfb0]
push eax
mov ecx, ebx
call fcn.2a409996
mov byte [ebp - 0xfb1], 1
push dword [ebp - 0xfb8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfbc]
call fcn.2a40567c
mov al, byte [ebp - 0xfb1]
call fcn.2a40cba9
ret 0xc
Function at 0x2a428734
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x2a4a199d
call fcn.2a40924e
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x230], ebx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x228], ebx
call fcn.2a40ab0f
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 4], ebx
call fcn.2a4287ca
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.2a40962b
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], bl
call fcn.2a40567c
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x224]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2a439f57
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.2a40567c
mov al, 1
call fcn.2a40cba9
ret 4
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x234], 0x208
call fcn.2a4188e5
mov eax, dword [eax]
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
push ecx
push ebx
push eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2a439fa6
cmp dword [ebp - 0x230], 1
mov byte [ebp - 0x219], 1
je 0x2a439fac
mov byte [ebp - 0x219], bl
lea ecx, [ebp - 0x220]
call fcn.2a40567c
cmp byte [ebp - 0x219], bl
je 0x2a43a04f
xor eax, eax
mov word [ebp - 0x12], ax
cmp word [ebp - 0x218], bx
je 0x2a43a04f
lea eax, [ebp - 0x220]
push eax
call fcn.2a47737f
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.2a41fefd
lea eax, [ebp - 0x22c]
push eax
call fcn.2a4188e5
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 3
call fcn.2a41fefd
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x220]
push eax
mov ecx, esi
call fcn.2a41c70f
mov ecx, eax
call fcn.2a428355
mov ecx, eax
call fcn.2a426b52
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 2
call fcn.2a40567c
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], bl
call fcn.2a40567c
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2a4287ac

Function at 0x2a42eb0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x2a42eb61
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x2a42eb65
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x2a42eb53
cmp esi, eax
jae 0x2a42eb65
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x2a42eb45
cmp esi, eax
jae 0x2a42eb65
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
xor eax, eax
jmp 0x2a42eb60
Function at 0x2a44098d
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
or dword [edi], 0xffffffff
mov esi, 0x104
xor ebx, ebx
push esi
mov byte [ebp - 1], bl
call fcn.2a409d14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x2a440a2c
cmp eax, esi
ja 0x2a440a2c
mov ecx, dword [ebp + 0xc]
mov esi, dword [ecx]
push ebx
call fcn.2a409d48
push eax
push ebx
push 0x2a440a84
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x2a440a2c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
push 0x4000000
push 2
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x2a440a3d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea ecx, [ebp + 0x10]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.2a440619
cmp dword [ebp - 8], ebx
jne 0x2a440a50
cmp dword [ebp + 0x10], ebx
je 0x2a440a2c
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x2a440a3d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 0xffffffff
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.2a409d14
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov esi, dword [ebp - 0xc]
push ebx
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x10], ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x2a440a1e
cmp esi, dword [ebp - 0x10]
jne 0x2a440a1e
mov byte [ebp - 1], 1
cmp dword [ebp + 0x10], ebx
je 0x2a440a46
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x2a440a46

Function at 0x2a441c4d
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp dword [esi + 0x228], ebx
mov dword [ebp - 4], ebx
jle 0x2a441cbb
push edi
xor edi, edi
mov eax, dword [esi + 0x224]
add eax, edi
cmp word [eax], bx
je 0x2a441ca6
push ebx
push 0x80
push 5
push ebx
push 7
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x2a441c97
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x224]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, 0x208
cmp eax, dword [esi + 0x228]
jl 0x2a441c67
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x2a446057
Capabilities:
Check http status code
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x10000000
push ebx
push ebx
mov esi, ecx
push ebx
push 0x2a4462b0
mov byte [ebp - 0x105], bl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], 2
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 4], eax
cmp eax, ebx
je 0x2a446263
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x2a445cf2
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov dword [ebp - 0x10c], ebx
cmp byte [esi + 0x18], bl
je 0x2a4460d3
mov dword [ebp - 0x10c], 0x800
mov edi, dword [edi]
mov dword [ebp - 0x110], edi
cmp edi, ebx
je 0x2a4460ee
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x2a4460f2
xor eax, eax
jmp 0x2a44610d
lea edi, [eax + eax]
mov eax, edi
call fcn.2a41925b
mov eax, esp
push 3
push edi
push dword [ebp - 0x110]
push eax
call fcn.2a41cb9c
push esi
push dword [ebp - 0x10c]
push ebx
push ebx
push eax
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
jne 0x2a446263
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a446263
push dword [esi + 0x14]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x2a446263
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x2a446263
push ebx
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [ebp - 0x104]
push ecx
push 0x13
mov edi, 0x100
push eax
mov dword [ebp - 0x10c], edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x2a446263
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.msvcrt.dll_atol]
pop ecx
cmp eax, 0xc8
jne 0x2a4461aa
mov dword [esi + 0x1c], ebx
mov byte [ebp - 0x105], 1
jmp 0x2a446263
cmp eax, 0x194
je 0x2a446256
cmp eax, 0x196
je 0x2a446256
cmp eax, 0x19a
je 0x2a446256
cmp eax, 0x19d
je 0x2a446256
cmp eax, 0x19e
je 0x2a446256
cmp eax, 0x19f
je 0x2a446256
mov dword [esi + 0x1c], 2
cmp eax, 0x190
jne 0x2a44625d
push 0x2a446294
lea eax, [ebp - 0x104]
push edi
push eax
mov dword [ebp - 0x10c], edi
call fcn.2a445ff8
add esp, 0xc
push ebx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0xffff
push dword [esi + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x2a44625d
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push eax
push 0x2a446280
call dword [sym.imp.msvcrt.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x2a44625d
mov dword [esi + 0x1c], 4
jmp 0x2a44625d
mov dword [esi + 0x1c], 1
mov byte [ebp - 0x105], bl
mov al, byte [ebp - 0x105]
lea esp, [ebp - 0x11c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.2a401bd9
leave
ret 4
Function at 0x2a446ce5
Capabilities:
Read data from internet
Receive data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1038
call fcn.2a4095c0
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 9
mov dword [ebp - 0x1008], eax
mov esi, ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x1038], 0x28
lea edi, [ebp - 0x1034]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1024], eax
mov eax, 0x1000
push 0
mov dword [ebp - 0x1020], eax
mov dword [ebp - 0x1010], eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1004]
push eax
push 5
push dword [esi + 8]
mov byte [ebp - 0x1004], 0
mov dword [esi + 0x1c], 2
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x2a446d7a
mov dword [esi + 0x1c], 3
xor al, al
jmp 0x2a446e16
lea eax, [ebp - 0x1004]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_atol]
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
pop ecx
push dword [esi + 0xc]
mov dword [ebp - 0x100c], eax
call edi
mov ebx, dword [sym.imp.WININET.dll_InternetReadFileExA]
jmp 0x2a446dc8
cmp dword [ebp - 0x1020], 0
je 0x2a446dfa
push dword [ebp - 0x1020]
mov ecx, dword [ebp - 0x1008]
lea eax, [ebp - 0x1004]
push eax
call fcn.2a4469d8
push dword [esi + 0xc]
call edi
push esi
push 1
lea eax, [ebp - 0x1038]
push eax
push dword [esi + 8]
call ebx
test eax, eax
jne 0x2a446da2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a446dfa
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x2a446da2
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 0x1008]
pop ebx
cmp dword [ecx + 0x14], eax
jne 0x2a446d73
and dword [esi + 0x1c], 0
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.2a401bd9
leave
ret 4
Function at 0x2a4515d7
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x24], ebx
jne 0x2a4515ef
xor eax, eax
jmp 0x2a45167d
push edi
push ebx
push ebx
push ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x2a451675
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 4]
push eax
push 0xc
push esi
push dword [esi + 0xc]
call edi
test eax, eax
je 0x2a451675
push ebx
lea eax, [ebp - 4]
push eax
push dword [esi + 0x2c]
push dword [esi + 0x10]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x2a451675
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x2a451675
mov eax, dword [0x2a4b1260]
push ebx
mov dword [esi], eax
mov eax, dword [esi + 0x2c]
push ebx
push ebx
push dword [esi + 0xc]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x2a451675
push ebx
lea eax, [ebp - 4]
push eax
push 0xc
push esi
push dword [esi + 0xc]
call edi
test eax, eax
jne 0x2a451679
xor eax, eax
jmp 0x2a45167c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2a45e1be
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
lea eax, [ebp - 0x20c]
push eax
mov edi, ecx
call fcn.2a47e259
test eax, eax
je 0x2a45e22d
cmp eax, 0x104
ja 0x2a45e22d
mov esi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [edi + 0x1c]
push eax
push 0
push 0x2a45e248
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x2a45e22d
add edi, 0x224
push edi
push 0
push 0x2a45e240
lea eax, [ebp - 0x20c]
push eax
call esi
neg eax
sbb eax, eax
neg eax
jmp 0x2a45e22f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.2a401bd9
leave
ret
Function at 0x2a47a9e5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
test esi, esi
jne 0x2a47aa00
push 0x80004005
call fcn.2a440fd1
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x2a47aa02
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x2a47b0d8
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.2a46d94d
mov edi, eax
cmp edi, esi
je 0x2a47b14a
lea ecx, [ebp - 0x214]
call fcn.2a46d92f
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.2a401bd9
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x2a47b168
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.2a47b0d8
cmp eax, esi
jne 0x2a47b1b3
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x2a47b152
lea ecx, [ebp - 0x214]
call fcn.2a46d92f
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.2a46d833
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.2a46d92f
mov eax, esi
jmp 0x2a47b13a
Function at 0x2a47c31f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x2a49f4ef
call fcn.2a419220
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x2a47c378
call fcn.2a46d819
mov esi, eax
jmp 0x2a47c481
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x2a47c391
call fcn.2a46d819
jmp 0x2a47c473
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x2a47c387
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x2a47c3f7
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a47c3dd
lea ecx, [ebp - 0x418]
call fcn.2a47b077
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.2a424028
mov eax, esi
call fcn.2a4273bc
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a47b60b
mov dword [ebp - 4], 1
jmp 0x2a47c425
cmp dword [ebp - 0x418], esi
jne 0x2a47c434
mov esi, 0x8007000e
jmp 0x2a47c475
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x2a47c387
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.2a47c1e3
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a47c3e2
lea ecx, [ebp - 0x418]
call fcn.2a47b077
jmp 0x2a47c3e2