joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x1c], 0x10
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40a1e0
xor eax, eax
jmp 0x40a294
lea ecx, [ebp - 0x34]
push ecx
push 0x433048
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40a201
xor eax, eax
jmp 0x40a294
mov dword [ebp - 0x2c], 1
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40a243
xor eax, eax
jmp 0x40a294
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
or ecx, 2
mov dword [ebp - 8], ecx
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40a285
xor eax, eax
jmp 0x40a294
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40bec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x40bec9
xor ecx, ecx
jne 0x40bec9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x40beea
mov eax, 0xd
jmp 0x40bf16
xor eax, eax
jne 0x40bed1
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40bf80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x40bf89
xor ecx, ecx
jne 0x40bf89
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40bfce
mov eax, dword [ebp - 0xc]
jmp 0x40c024
cmp dword [ebp - 4], 1
je 0x40bfe1
cmp dword [ebp - 4], 2
je 0x40bfe1
mov eax, 0xd
jmp 0x40c024
cmp dword [ebp + 0xc], 0
je 0x40c01a
cmp dword [ebp - 8], 0
je 0x40c014
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 1
div ecx
test edx, edx
jne 0x40c00b
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movsx eax, byte [edx - 1]
test eax, eax
je 0x40c012
mov eax, 0xd
jmp 0x40c024
jmp 0x40c01a
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40d350
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0040d390
movzx eax, al
test eax, eax
jne 0x40d37b
mov ecx, dword [ebp - 4]
push ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, dword [ebp - 4]
mov dword [edx + 0x190], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp dword [eax + 0x190], 0
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret
Function at 0x40fbd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40fc02
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], 0x2749
xor al, al
jmp 0x40fd08
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40fc29
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], 0x2734
xor al, al
jmp 0x40fd08
mov byte [ebp - 1], 1
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
call fcn.0040fd10
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x40fc98
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e5
je 0x40fc98
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x48], ecx
mov byte [ebp - 1], 0
movzx edx, byte [ebp - 1]
test edx, edx
je 0x40fcfa
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40fcf6
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x40fce4
mov byte [ebp - 1], 1
jmp 0x40fcf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], eax
mov byte [ebp - 1], 0
jmp 0x40fcfa
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
call fcn.0040fd30
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x43c400]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x433290
mov dword [ebp - 0x18], 0x410830
mov dword [ebp - 0x14], 0x433284
mov dword [ebp - 0x10], 0x411090
mov dword [ebp - 0xc], 0x433274
mov dword [ebp - 8], fcn.004107c0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
cmp dword [0x43d86c], 0
je 0x4105fb
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x43c2a4]
jmp 0x4107ab
push 0x104
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x410616
jmp 0x41070b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.004218f5
add esp, 0xc
push 0x43326c
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.00421881
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x410689
push 0x433290
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x410689
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
je 0x410691
jmp 0x41070b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.004218f5
add esp, 0xc
push 0x433264
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.00421881
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x410704
push 0x433290
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x410704
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x41070b
cmp dword [ebp - 0x20], 0
je 0x410796
mov dword [ebp - 4], 0
jmp 0x410727
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 3
jge 0x410765
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*8 - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x410763
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x410765
jmp 0x41071e
cmp dword [ebp - 0x20], 0
je 0x410796
mov dword [ebp - 4], 0
jmp 0x41077d
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 3
jge 0x410796
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*8 - 0x18]
mov dword [edx*8 + 0x43c2a4], ecx
jmp 0x410774
mov dword [0x43d86c], 1
movzx edx, word [ebp + 8]
mov eax, dword [edx*8 + 0x43c2a4]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0041f2bc
mov esp, ebp
pop ebp
ret 4
Function at 0x410ee0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410fa8
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x410f88
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x410f88
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x410f45
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x410f88
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
movzx eax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00410c90
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x410f7b
mov eax, 8
jmp 0x410fee
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x410f3c
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00421c78
add esp, 0x10
xor eax, eax
jmp 0x410fee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x410fc6
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x410ff4]
mov eax, 0x2af9
jmp 0x410fee
mov eax, 0x2afa
jmp 0x410fee
mov eax, 0x2afb
jmp 0x410fee
mov eax, 0x2af9
jmp 0x410fee
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x411600
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + 0x44]
test ecx, ecx
je 0x41161b
mov al, 1
jmp 0x4116d6
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x40], 0xffffffff
jne 0x41162f
xor al, al
jmp 0x4116d6
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x4116ca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2733
je 0x411671
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x48], edx
mov byte [ebp - 1], 0
jmp 0x4116ca
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4116c6
push 0x2c
push 0
lea ecx, [ebp - 0x34]
push ecx
call fcn.0041f300
add esp, 0xc
lea edx, [ebp - 0x34]
push edx
push 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp dword [ebp - 0x20], 0
je 0x4116c4
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov dword [edx + 0x48], eax
mov byte [ebp - 1], 0
jmp 0x4116ca
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 0x38]
mov dl, byte [ebp - 1]
mov byte [ecx + 0x44], dl
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8
Function at 0x412570
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4125a2
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], 0x2749
xor al, al
jmp 0x4126ca
push 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x4125c9
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], 0x2734
xor al, al
jmp 0x4126ca
mov byte [ebp - 9], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov dword [ebp - 0x10], 0
push 0x14
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.0041f300
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.0040fd10
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x41265d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x3e5
je 0x41265d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov dword [ecx + 0x48], edx
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
test eax, eax
je 0x4126bc
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4126b8
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x4126a6
mov byte [ebp - 9], 1
jmp 0x4126b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], eax
mov byte [ebp - 9], 0
jmp 0x4126bc
mov byte [ebp - 9], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.0040fd30
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret 8
Function at 0x415eb0
Capabilities:
Query remote server for available data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431508
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x43c400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x14]
call fcn.004018e0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x80008000
mov ecx, dword [ebp - 0x2c]
add ecx, 0x14
call fcn.0040c520
movzx eax, al
test eax, eax
je 0x415f17
mov ecx, dword [ebp + 8]
push ecx
push 0x433494
lea edx, [ebp - 0x14]
push edx
call fcn.00401e00
add esp, 0xc
jmp 0x415f33
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x14]
push edx
push 0x43348c
lea eax, [ebp - 0x14]
push eax
call fcn.00401e00
add esp, 0x10
cmp dword [ebp + 0xc], 0xffffffff
jne 0x415f4b
cmp dword [ebp + 0x14], 0
je 0x415f4b
mov ecx, dword [ebp - 0x18]
or ecx, 0x4000000
mov dword [ebp - 0x18], ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.0040d820
push eax
push 0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0xc], 0
jne 0x415fa6
mov ecx, dword [ebp - 0x2c]
call fcn.00416a30
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401900
mov eax, dword [ebp - 0x1c]
jmp 0x416051
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x415fef
mov ecx, dword [ebp - 0x2c]
call fcn.00416a30
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401900
mov eax, dword [ebp - 0x20]
jmp 0x416051
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x416038
mov ecx, dword [ebp - 0x2c]
call fcn.00416a30
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401900
mov eax, dword [ebp - 0x24]
jmp 0x416051
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401900
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x416660
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x4166aa
push 0
push 0
push 0
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x820
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x4166a3
mov ecx, dword [ebp - 4]
call fcn.00416a30
xor eax, eax
jmp 0x4166af
mov eax, 1
jmp 0x4166af
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x416730
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4315b0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x43c400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.00403ba0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.00403ba0
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 4], 0
jne 0x4167a2
mov edi, dword [ebp - 0x1c]
add edi, 0x20
mov ecx, 6
mov esi, 0x433500
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x416917
push 0
push 0x433410
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0040c310
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x416853
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.00403da0
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.00403b80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401900
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004041a0
sub eax, dword [ebp - 0x10]
sub eax, 1
push eax
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.00416aa0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.00403b80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401900
jmp 0x41685e
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004045c0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0xc24], 1
jne 0x416879
cmp dword [ebp + 0x18], 1
jne 0x416879
mov dword [ebp - 0x30], 0x8000000
jmp 0x416880
mov dword [ebp - 0x30], 0
cmp dword [ebp + 0xc], 0
jne 0x41689b
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0xc24], 3
jne 0x41689b
mov dword [ebp - 0x34], 0x4332a4
jmp 0x4168a1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
movzx ecx, word [ebp + 0x14]
test ecx, ecx
jne 0x4168b9
mov edx, dword [ebp - 0x1c]
mov ax, word [edx + 0xc20]
mov word [ebp - 0x36], ax
jmp 0x4168c1
mov cx, word [ebp + 0x14]
mov word [ebp - 0x36], cx
push 0
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc24]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x34]
push eax
movzx ecx, word [ebp - 0x36]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0040d820
push eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
jne 0x416912
mov ecx, dword [ebp - 0x1c]
call fcn.00416a30
xor eax, eax
jmp 0x416917
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14