joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010b0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x130
push ebx
mov ebx, dword [esp + 0x138]
push ebp
push esi
xor esi, esi
push edi
cmp ebx, esi
mov edi, ecx
jne 0x4010d8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x130
ret 0x14
mov ebp, dword [esp + 0x150]
cmp ebp, esi
jne 0x401110
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x40110c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 0x14
lea ebp, [esp + 0x3c]
mov ecx, dword [esp + 0x148]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push esi
push eax
push esi
push esi
push 4
push ecx
push ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
test eax, eax
jne 0x4011e7
mov ebx, dword [esp + 0x14c]
cmp ebx, 2
je 0x40114f
cmp ebx, 1
jne 0x40115e
mov edx, dword [esp + 0x14]
push ebp
push 3
push edx
mov ecx, edi
call fcn.00401040
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x1c]
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x158]
push ebx
push eax
lea ecx, [esp + 0x28]
push ebp
push ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
jne 0x4011dc
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x144]
push 0
push edx
push 0
push 0
push 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov esi, eax
mov eax, dword [esp + 0x10]
neg esi
sbb esi, esi
inc esi
test eax, eax
je 0x4011dc
push eax
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4011e7
push eax
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 0x14

Function at 0x402880
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
call sub.MFC42.DLL_CTime::GetTickCount
lea ecx, [esp]
push 0x4417e0
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CTime::Format
mov eax, dword [esp]
mov edx, dword [eax - 8]
push edx
push eax
push 1
push 0x4417dc
push 0x4417c4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString
mov eax, 1
add esp, 8
ret
Function at 0x4039a0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x104
mov edx, ecx
xor eax, eax
push esi
mov esi, dword [esp + 0x10c]
push edi
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push 0x3048
lea ecx, [esp + 0x10]
push 0x441944
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403a04
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
push 0x493e0
push esi
push 0x441918
call fcn.00406330
add esp, 0xc
neg eax
sbb eax, eax
xor edx, edx
and eax, 2
pop edi
dec eax
pop esi
cmp eax, 1
sete dl
mov eax, edx
add esp, 0x104
ret

Function at 0x403a80
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x128]
test eax, eax
je 0x403b6e
mov edx, 0x441964
lea ecx, [esp + 0x20]
mov esi, 0x104
lea eax, [esp + 0x20]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x403ad1
mov byte [eax], cl
inc eax
dec esi
jne 0x403ac2
jmp 0x403ad5
test esi, esi
jne 0x403ad6
dec eax
mov byte [eax], 0
mov al, byte [esp + 0x20]
cmp al, 0x5a
jg 0x403b6e
mov edi, dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, dword [sym.imp.MSVCRT.dll_fgets]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403b60
xor eax, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x11], eax
push 0x441960
mov dword [esp + 0x19], eax
push ecx
mov dword [esp + 0x21], eax
mov byte [esp + 0x18], 0
mov word [esp + 0x25], ax
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x403b60
push esi
lea edx, [esp + 0x14]
push 0xe
push edx
call ebp
add esp, 0xc
test eax, eax
je 0x403b56
push 0xe
lea eax, [esp + 0x14]
push 0x441950
push eax
call ebx
test eax, eax
je 0x403b7b
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov al, byte [esp + 0x20]
inc al
cmp al, 0x5a
mov byte [esp + 0x20], al
jle 0x403af7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov eax, dword [esp + 0x128]
lea edx, [esp + 0x20]
mov edi, 0x104
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x403b9c
mov byte [eax], cl
inc eax
dec edi
jne 0x403b8d
jmp 0x403ba0
test edi, edi
jne 0x403ba1
dec eax
push esi
mov byte [eax], 0
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x403bc0
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x208
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xe]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x114]
lea edx, [esp + 0x10]
push ecx
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea edi, [esp + 0x110]
or ecx, 0xffffffff
xor eax, eax
push 0x441970
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x21c]
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
not ecx
dec ecx
push eax
lea ebp, [esp + ecx + 0x117]
call edi
mov esi, eax
test esi, esi
je 0x403c6b
mov cl, byte [ebp]
add esi, 0xa
mov byte [esi], cl
lea edx, [esp + 0xc]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0xc]
push 0x4417f4
push eax
call edi
push 0x4417f4
push esi
mov ebp, eax
call edi
test ebp, ebp
mov edx, eax
je 0x403ce0
test edx, edx
je 0x403ce0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x7fffffff
ja 0x403ce0
test ecx, ecx
mov esi, ecx
mov eax, edx
je 0x403ce0
sub ebp, edx
mov cl, byte [eax + ebp]
test cl, cl
je 0x403cd8
mov byte [eax], cl
inc eax
dec esi
jne 0x403cb8
dec eax
pop edi
pop esi
pop ebp
mov byte [eax], 0
mov eax, 1
add esp, 0x208
ret
test esi, esi
jne 0x403cdd
dec eax
mov byte [eax], 0
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x208
ret
Function at 0x404da0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
lea eax, [esp]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x404dbe
test byte [esp], 7
mov eax, 1
jne 0x404dc3
call fcn.00404d00
pop ecx
ret
Function at 0x405170
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [esp + 0x10c]
lea edx, [esp + 4]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrA]
neg eax
sbb eax, eax
pop edi
neg eax
add esp, 0x104
ret

Function at 0x4051c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
lea eax, [esp + 8]
push ebx
mov ebx, dword [esp + 0x118]
push ebp
push esi
push edi
push eax
push ebx
xor esi, esi
xor ebp, ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x405297
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x405297
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x405297
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x441b4c
push esi
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x405295
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
xor edx, edx
mov ecx, dword [eax]
mov dx, word [eax]
shr ecx, 0x10
push ecx
push edx
push 0x441b24
lea eax, [esp + 0x28]
push 0x104
push eax
call edi
add esp, 0x14
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push ecx
push edx
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x405297
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
push ecx
push 0x441b20
push edx
push eax
call edi
add esp, 0x10
mov ebp, 1
jmp 0x4052a1
xor ebp, ebp
mov ecx, dword [esp + 0x128]
mov byte [ecx], 0
test esi, esi
je 0x4052af
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x4052c0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], 5
mov dword [esp + 0x10], ebx
call fcn.00404e40
mov esi, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebp, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40534d
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebx
push eax
push 8
call edi
push eax
call esi
test eax, eax
jne 0x40531d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push 4
push edx
push 0x14
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ebx
call ebp
test eax, eax
jne 0x405401
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1c]
push edx
push 8
call edi
push eax
call esi
test eax, eax
je 0x405429
push 0x400
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40543a
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
push 0x400
push esi
push 2
push ecx
call ebp
mov edx, dword [esp + 0x1c]
mov edi, eax
push edx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x40542d
lea eax, [esp + 0x20]
lea ecx, [esp + 0x2c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40542d
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
mov dword [esp + 0x10], ebx
jbe 0x40541c
lea ebp, [esi + 4]
mov edx, dword [ebp]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x405414
mov eax, dword [esi]
inc edi
add ebp, 8
cmp edi, eax
jb 0x4053d7
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x40542d
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
cmp ecx, ebx
pop esi
pop ebp
setne al
pop ebx
add esp, 0x24
ret
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
jmp 0x40542d
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x40543a
push esi
call fcn.0042a030
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4059e0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
sub esp, 0x428
push ebx
push esi
mov esi, dword [esp + 0x434]
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 8], ebx
je 0x405bc6
add esi, 0x104
cmp esi, ebx
je 0x405bc6
push ebp
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x232]
mov word [esp + 0x230], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x230]
push 0x104
push eax
call fcn.00429fe0
mov ecx, eax
call fcn.00429fc0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
push ebx
push ebx
stosw word es:[edi], ax
lea ecx, [esp + 0x30]
push 0x104
lea edx, [esp + 0x23c]
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
push eax
lea eax, [esp + 0x244]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [0x441bc4]
mov edx, dword [0x441bc8]
mov eax, dword [0x441bcc]
mov dword [esp + 0x18], ecx
mov cx, word [0x441bd0]
push 0x1000
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov word [esp + 0x28], cx
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x405bb7
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x14], edi
je 0x405bae
push ebx
push ebx
push 3
push ebx
push ebx
lea edx, [esp + 0x2c]
push 0x50
push edx
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
je 0x405ba7
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x12c]
push 0x104
push eax
call fcn.00405450
mov edx, dword [esp + 0x444]
add esp, 8
lea ecx, [esp + 0x12c]
lea eax, [esp + 0x28]
push 0x4418e8
push ecx
push edx
push esi
push eax
push 0x441c1c
push 0x1000
push ebp
call fcn.0042b070
add esp, 0x20
push 0
push 0x4000000
push 0
push 0
push 0x441b80
push ebp
push 0x441b7c
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x405b9c
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x405b95
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call fcn.0042a030
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x428
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x428
ret
Function at 0x406160
Capabilities:
Check for time delay via gettickcount
Check http status code
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x436ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x441cb4]
mov ecx, dword [0x441cb8]
mov edx, dword [0x441cbc]
push ebx
push ebp
mov dword [esp + 0x18], eax
mov eax, dword [0x441cc0]
push esi
mov dword [esp + 0x20], ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
call sub.MFC42.DLL_CString::CString_4
xor edi, edi
push 0x4000
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], edi
call sub.MFC42.DLL_CString::GetBuffer
push edi
lea ecx, [esp + 0x24]
push 0x84000100
push ecx
mov esi, eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x2c]
push edx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebp, eax
cmp ebp, edi
mov dword [esp + 0x44], ebp
je 0x4062c2
mov edx, dword [esp + 0x48]
push 0x441cb0
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
cmp ebx, edi
je 0x4062c2
lea eax, [esp + 0x1c]
push edi
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0x20000013
push ebp
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x4062b8
mov eax, dword [esp + 0x18]
cmp eax, 0xc8
jb 0x4062b8
cmp eax, 0x12c
jae 0x4062b8
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
lea edx, [esp + 0x14]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
push edx
push 0x4000
push esi
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4062b8
mov eax, dword [esp + 0x14]
push ebx
test eax, eax
je 0x4062e8
push eax
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [esp + 0x24]
add esp, 0x10
add edi, eax
call ebp
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
sub eax, edx
cmp eax, ecx
ja 0x4062b8
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x14]
push ecx
push 0x4000
push esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x406272
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
call dword [sym.imp.MSVCRT.dll_fflush]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x406330
Capabilities:
Create http request

Disassembly:
push ecx
push edi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x40638e
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x18]
push ebx
push ebp
push eax
push edi
call fcn.00406160
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x40637f
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 3
mov dword [esp + 0x10], eax
jl 0x40635b
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x406400
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov al, byte [0x44e4f8]
push esi
push edi
mov byte [esp + 0x10], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
lea edx, [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 2
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push 0x441d14
push 0x441ce0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x406476
lea ecx, [esp + 0x114]
push 0x441cd8
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
jmp 0x406496
lea eax, [esp + 0x10]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
push 0x441cc4
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, dword [esp + 0x220]
mov edi, dword [esp + 0x21c]
cmp ecx, 0x7fffffff
ja 0x4064e3
test ecx, ecx
mov esi, ecx
mov eax, edi
je 0x4064e3
lea edx, [esp + 0x10]
sub edx, edi
mov cl, byte [edx + eax]
test cl, cl
je 0x4064db
mov byte [eax], cl
inc eax
dec esi
jne 0x4064ba
dec eax
push edi
mov byte [eax], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
pop edi
pop esi
add esp, 0x210
ret
test esi, esi
jne 0x4064e0
dec eax
mov byte [eax], 0
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
pop edi
pop esi
add esp, 0x210
ret
Function at 0x4065a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push 0x441d5c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00406560
add esp, 8
test eax, eax
jne 0x4065c3
add esp, 0x10c
ret
push 0x441d3c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00406560
add esp, 8
test eax, eax
jne 0x4065e0
add esp, 0x10c
ret
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push ecx
push edx
push 0x441d30
push 0x441d3c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp eax, 2
pop edi
jne 0x406631
xor eax, eax
add esp, 0x10c
ret
test eax, eax
je 0x406641
mov eax, 2
add esp, 0x10c
ret
mov ecx, 0x104
lea eax, [esp + 8]
cmp byte [eax], 0
je 0x406655
inc eax
dec ecx
jne 0x40664a
jmp 0x40669b
test ecx, ecx
je 0x40669b
lea eax, [esp]
test eax, eax
je 0x40666a
mov eax, 0x104
sub eax, ecx
jmp 0x40666e
mov eax, dword [esp]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 8]
je 0x40669b
push esi
mov esi, 0x441d24
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x406692
mov byte [eax], cl
inc eax
dec edx
jne 0x406683
jmp 0x406696
test edx, edx
jne 0x406697
dec eax
mov byte [eax], 0
pop esi
lea ecx, [esp + 8]
push ecx
call fcn.00424bd0
add esp, 4
neg eax
sbb eax, eax
neg eax
add esp, 0x10c
ret
Function at 0x406ba0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
sub esp, 0x20c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
call fcn.00402c90
mov eax, dword [esp + 0x22c]
add esp, 8
test eax, eax
pop edi
je 0x406c0c
mov ecx, dword [esp + 0x21c]
push 1
lea edx, [esp + 8]
push ecx
push edx
call fcn.00405c50
add esp, 0xc
mov ecx, 0x104
lea eax, [esp + 4]
cmp byte [eax], 0
je 0x406c20
inc eax
dec ecx
jne 0x406c15
jmp 0x406c68
test ecx, ecx
je 0x406c68
lea eax, [esp]
test eax, eax
je 0x406c35
mov eax, 0x104
sub eax, ecx
jmp 0x406c39
mov eax, dword [esp]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 4]
je 0x406c68
push esi
mov esi, dword [esp + 0x218]
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x406c5f
mov byte [eax], cl
inc eax
dec edx
jne 0x406c50
jmp 0x406c63
test edx, edx
jne 0x406c64
dec eax
mov byte [eax], 0
pop esi
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x406d3e
lea edx, [esp]
lea eax, [esp + 4]
push edx
push eax
mov dword [esp + 8], 0
call fcn.00406960
add esp, 8
test eax, eax
jne 0x406cb8
mov eax, dword [esp]
test eax, eax
je 0x406d3e
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
add esp, 0x20c
ret
mov ecx, dword [esp + 0x218]
mov eax, dword [esp + 0x210]
push ecx
lea edx, [esp + 0x10c]
push 0x104
push edx
push 0
push 0x4418e4
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp]
push ecx
call fcn.00406d50
mov edx, dword [esp + 4]
push 0x14
push edx
call fcn.00406d70
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x114]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x14
test eax, eax
mov eax, dword [esp]
jle 0x406d30
test eax, eax
je 0x406d24
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 1
add esp, 0x20c
ret
test eax, eax
je 0x406d3e
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
add esp, 0x20c
ret
Function at 0x406dc0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
mov dword [esp + 8], 0x104
push eax
push 0x441de8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
pop edi
je 0x406e1a
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x110
ret
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 4]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0x44e4f8
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406e53
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x110
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
neg eax
add esp, 0x110
ret