joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d80
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x401d8f
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push 1
push 0
push esi
push ebp
call ebx
test eax, eax
je 0x401dd3
lea ecx, [esp + 0x24]
push ecx
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x401dd3
lea edx, [esp + 0x24]
push edx
push 1
push 0
push esi
push connect
call ebx
mov esi, dword [esp + 0x28]
sub esi, 1
push esi
push 0
push edi
call fcn.00410e00
mov edx, dword [esp + 0x2c]
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push edi
lea ecx, [esp + 0x18]
push ecx
push 0
push edx
sub esi, 2
push eax
mov dword [esp + 0x40], esi
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
pop esi
pop ebp
pop ebx
jne 0x401e28
mov ecx, dword [esp + 0x1c]
mov byte [edi + ecx], al
mov edx, dword [esp + 0x1c]
mov byte [edi + edx + 1], al
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ecx
ret

Function at 0x401e40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x2c]
xor eax, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 1
push 0
push esi
push ebp
mov dword [esp + 0x30], 0
call edi
test eax, eax
je 0x401e9d
lea ecx, [esp + 0xc]
push ecx
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x401e9d
lea edx, [esp + 0xc]
push edx
push 1
push 0
push esi
push connect
call edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x2c], 5
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401ed2
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x10], 1
jne 0x401f00
lea ecx, [esp + 0x1c]
xor eax, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x401ee2
sub ecx, esi
je 0x401efc
lea eax, [esp + 0x1c]
push eax
call fcn.00411a5a
add esp, 4
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x401f20
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push 0x2001b
push 0
push esi
push edi
mov dword [esp + 0x24], 0
call ebx
test eax, eax
je 0x401f9c
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0x2001b
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x401f9c
lea eax, [esp + 0xc]
push eax
push 0x2001b
push 0
push esi
push connect
call ebx
test eax, eax
je 0x401f9c
lea ecx, [esp + 0xc]
push ecx
push esi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x401fb6
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x401fe1
mov eax, edx
lea esi, [eax + 1]
jmp 0x401fc0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401fc0
mov ecx, dword [esp + 0x20]
sub eax, esi
push eax
push edx
mov edx, dword [esp + 0x14]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test esi, esi
pop esi
sete al
pop ebx
add esp, 8
ret

Function at 0x402000
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push eax
push 0x2001b
push 0
push esi
push ebx
call edi
test eax, eax
je 0x40205e
lea ecx, [esp + 0xc]
push ecx
push esi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call ebx
test eax, eax
je 0x40205e
lea edx, [esp + 0xc]
push edx
push 0x2001b
push 0
push esi
push connect
call edi
test eax, eax
je 0x40205e
lea eax, [esp + 0xc]
push eax
push esi
push connect
call ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret
Function at 0x402330
Capabilities:
Get socket status

Disassembly:
sub esp, 0x61c
mov eax, dword [0x4b1598]
xor eax, esp
mov dword [esp + 0x618], eax
mov eax, dword [esp + 0x624]
mov eax, dword [eax + 8]
push ebx
mov ebx, dword [esp + 0x624]
push ebp
push esi
push edi
mov edi, ecx
xor esi, esi
xor ebp, ebp
cmp dword [edi + 0x128], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
jne 0x4023a0
push 0x4add68
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x19a
call fcn.0041125d
lea ebx, [ebx]
mov esi, dword [esp + 0x14]
jmp 0x4023a0
test esi, esi
mov eax, dword [edi + 0x12c]
mov ecx, 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x128], eax
mov dword [esp + 0x124], ecx
je 0x4023cd
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
lea edx, [esp + 0x18]
push edx
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x130]
push edx
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4024f3
test eax, eax
je 0x402517
mov ecx, dword [edi + 0x12c]
lea eax, [esp + 0x124]
push eax
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x402431
test esi, esi
je 0x4023a0
mov eax, dword [edi + 0x12c]
lea edx, [esp + 0x20]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4023a0
mov dword [esp + 0x14], 0
lea esp, [esp]
push 0x400
lea ecx, [esp + 0x22c]
push ecx
push ebx
call fcn.00424120
mov esi, eax
push esi
push ebx
call fcn.004255f0
add esp, 0x14
test eax, eax
jne 0x4024d3
lea edi, [esi + ebp]
cmp edi, 0x27ff
jg 0x402541
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x128]
push esi
lea edx, [esp + ebp + 0x22c]
push edx
push ecx
call fcn.00412200
push ebx
mov ebp, edi
call fcn.00424100
mov edi, dword [esp + 0x20]
add esp, 0x10
test eax, eax
jne 0x402440
mov ecx, dword [edi + 0x128]
xor eax, eax
cmp ebp, eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x20], eax
mov byte [ecx + ebp], al
jne 0x402589
push 0x4add68
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0x190
call fcn.0041125d
cmp eax, 6
je 0x40249e
cmp eax, 2
je 0x402390
cmp eax, 3
jne 0x402565
mov dword [esp + 0x14], 1
jmp 0x402390
xor eax, eax
push 0x4add68
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x12c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0x6d
call fcn.0041125d
push 0x4add68
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x12c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x192
call fcn.0041125d
xor eax, eax
push 0x4add68
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x12c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0x198
call fcn.0041125d
xor eax, eax
push 0x4add68
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x12c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0x19e
call fcn.0041125d
mov ecx, dword [esp + 0x628]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004117a8
add esp, 0x61c
ret 8
Function at 0x4025b0
Capabilities:
Get socket status
Print debug messages

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [ebp + 0x124]
push edi
xor edi, edi
mov eax, ecx
mov dword [esp + 0x10], edi
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4025d0
sub eax, esi
mov ebx, eax
mov eax, dword [esp + 0x230]
mov edx, dword [eax + 4]
xor esi, esi
cmp ecx, esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
jne 0x40260c
push 0x4add68
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x19b
call fcn.0041125d
cmp ebx, esi
jle 0x402721
jmp 0x402620
cmp edi, esi
mov eax, dword [ebp + 0x12c]
mov ecx, 1
mov dword [esp + 0x20], esi
mov dword [esp + 0x128], eax
mov dword [esp + 0x124], ecx
je 0x402649
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x18]
push ecx
push esi
lea edx, [esp + 0x12c]
push edx
lea ecx, [esp + 0x2c]
push ecx
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x40273b
cmp eax, esi
je 0x40275d
mov eax, dword [ebp + 0x12c]
lea edx, [esp + 0x124]
push edx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4026ac
cmp edi, esi
je 0x402717
mov edx, dword [ebp + 0x12c]
lea ecx, [esp + 0x20]
push ecx
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x402717
mov eax, dword [ebp + 0x124]
add eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x22c]
push ebx
push eax
push ecx
xor edi, edi
call fcn.004241c0
mov edx, dword [esp + 0x238]
mov esi, eax
push esi
push edx
call fcn.004255f0
add esp, 0x14
sub eax, edi
je 0x402711
sub eax, 2
je 0x40270a
sub eax, 1
je 0x402717
push 0x4add68
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x12c], edi
mov dword [esp + 0x1c], 0x19e
call fcn.0041125d
mov edi, 1
jmp 0x402717
sub ebx, esi
add dword [esp + 0x10], esi
xor esi, esi
cmp ebx, esi
jg 0x402620
mov eax, dword [ebp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 8
push 0x4add68
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x12c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], 0x6d
call fcn.0041125d
push 0x4add68
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x12c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], 0x192
call fcn.0041125d
int3
Function at 0x4027c0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x214
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x18c]
xor ebp, ebp
cmp eax, ebp
jne 0x4027ed
push 0x4add68
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x19e
call fcn.0041125d
push eax
call fcn.00424d10
add esp, 4
cmp eax, ebp
mov dword [esi + 0x190], eax
jne 0x402817
push 0x4add68
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x19e
call fcn.0041125d
mov edx, dword [esi + 0x12c]
push ebx
push edi
push edx
push eax
call fcn.004240a0
mov eax, dword [esi + 0x190]
push ebp
push 4
push 0x21
push eax
call fcn.004251b0
add esp, 0x18
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x14], 0xb4
mov dword [esp + 0x18], ebp
lea ebx, [ebx]
cmp edi, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x120], ebp
je 0x402871
mov ecx, dword [esi + 0x12c]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], 1
cmp ebx, ebp
je 0x40288d
mov edx, dword [esi + 0x12c]
mov dword [esp + 0x124], edx
mov dword [esp + 0x120], 1
cmp edi, ebp
jne 0x402895
cmp ebx, ebp
je 0x4028c5
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 0x12c]
push ebp
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x12c]
push edx
add eax, 1
push eax
xor edi, edi
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x402907
cmp eax, ebp
je 0x402929
mov ecx, dword [esi + 0x190]
push ecx
call fcn.00425710
mov edx, dword [esi + 0x190]
push eax
push edx
call fcn.004255f0
add esp, 0xc
sub eax, ebp
je 0x40296d
sub eax, 2
je 0x4028fd
sub eax, 1
jne 0x40294b
mov edi, 1
jmp 0x402850
mov ebx, 1
jmp 0x402850
push 0x4add68
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x128], ebp
mov dword [esp + 0x18], 0x6d
call fcn.0041125d
push 0x4add68
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x128], ebp
mov dword [esp + 0x18], 0x192
call fcn.0041125d
push 0x4add68
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x128], ebp
mov dword [esp + 0x18], 0x19e
call fcn.0041125d
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x214
ret
Function at 0x404c60
Capabilities:
Get hostname

Disassembly:
push ecx
push ebx
push esi
push 0xff
mov ebx, ecx
call fcn.0040f369
mov esi, eax
add esp, 4
test esi, esi
jne 0x404c8f
push 0x4add68
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x198
call fcn.0041125d
push 0xff
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x404cc0
push esi
call fcn.00412565
add esp, 4
push 0x4add68
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x6b
call fcn.0041125d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404cc5
push edi
sub eax, edx
push eax
lea edi, [ebx + 4]
push esi
mov ecx, edi
call fcn.00401780
push esi
call fcn.00412565
add esp, 4
cmp dword [ebx + 0x18], 0
jne 0x404cf3
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
cmp dword [edi + 0x18], 0x10
jb 0x404d01
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
pop ecx
ret
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x405e80
Capabilities:
Get socket status

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x128]
push str.STARTTLS
push eax
call fcn.004021d0
add esp, 8
test al, al
jne 0x405eb3
push 0x4add68
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x1a0
call fcn.0041125d
push edi
push 0xf
call fcn.00402190
mov edx, dword [str.STARTTLS_r_n]
mov edi, eax
mov eax, dword [esi + 0x124]
mov dword [eax], edx
mov ecx, dword [0x487c5c]
mov dword [eax + 4], ecx
mov dx, word [0x487c60]
mov word [eax + 8], dx
mov cl, byte [0x487c62]
add esp, 4
mov byte [eax + 0xa], cl
push edi
mov ecx, esi
call fcn.00402d90
push edi
mov ecx, esi
call fcn.00405610
pop edi
mov ecx, esi
pop esi
add esp, 4
jmp fcn.004027c0
Function at 0x408c70
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x4859d0
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x4b1598]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
mov eax, dword [0x4b1598]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CSmtp.0
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], ebx
mov dword [esp + 0x10], esi
mov byte [esi + 8], bl
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], ebx
mov dword [esp + 0x1b0], ebx
mov byte [esi + 0x24], bl
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], ebx
mov byte [esi + 0x40], bl
mov dword [esi + 0x70], eax
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x5c], bl
mov dword [esi + 0x8c], eax
mov dword [esi + 0x88], ebx
mov byte [esi + 0x78], bl
mov dword [esi + 0xa8], eax
mov dword [esi + 0xa4], ebx
mov byte [esi + 0x94], bl
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xb0], bl
mov dword [esi + 0xe0], eax
mov dword [esi + 0xdc], ebx
mov byte [esi + 0xcc], bl
mov dword [esi + 0xfc], eax
mov dword [esi + 0xf8], ebx
mov byte [esi + 0xe8], bl
mov dword [esi + 0x118], eax
mov dword [esi + 0x114], ebx
mov byte [esi + 0x104], bl
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x170], ebx
mov dword [esi + 0x178], ebx
mov dword [esi + 0x17c], ebx
mov dword [esi + 0x180], ebx
lea eax, [esp + 0x14]
push eax
push 0x202
mov byte [esp + 0x1b8], 0xe
mov dword [esi + 0x12c], ebx
mov byte [esi + 0x130], bl
mov dword [esi + 0x120], 3
mov word [esi + 0x11c], bx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x408dfa
push 0x4add68
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x64
call fcn.0041125d
mov ax, word [esp + 0x14]
cmp al, 2
jne 0x408eab
cmp ah, al
jne 0x408eab
push 0x2800
call fcn.0040f369
add esp, 4
cmp eax, ebx
mov dword [esi + 0x128], eax
jne 0x408e3d
push 0x4add68
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x198
call fcn.0041125d
push 0x2800
call fcn.0040f369
add esp, 4
cmp eax, ebx
mov dword [esi + 0x124], eax
jne 0x408e6b
push 0x4add68
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x198
call fcn.0041125d
mov dword [esi + 0x188], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x190], ebx
mov byte [esi + 0x184], bl
mov eax, esi
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.004117a8
add esp, 0x1a8
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x4add68
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x65
call fcn.0041125d
int3
Function at 0x409620
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push esi
push 0
push 0x487c3a
push 0x487c3a
mov esi, ecx
push 0
lea eax, [esi + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 0x39fe00], eax
jne 0x409669
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esi + 0x39fe0c], eax
push str.InternetOpen__d
add esi, 0x6c
push esi
call fcn.00411b16
add esp, 0xc
xor eax, eax
pop esi
ret 0x14
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0x4400000
push 3
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 0x39fe04], eax
jne 0x4096c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esi + 0x39fe0c], eax
lea eax, [esi + 0x6c]
push str.InternetConnect__d
push eax
call fcn.00411b16
mov ecx, dword [esi + 0x39fe00]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret 0x14
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x409712
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esi + 0x6c]
push str.InternetAttemptConnect__d
push edx
mov dword [esi + 0x39fe0c], eax
call fcn.00411b16
mov eax, dword [esi + 0x39fe04]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push eax
call edi
mov ecx, dword [esi + 0x39fe00]
push ecx
call edi
pop edi
xor eax, eax
pop esi
ret 0x14
mov eax, 1
pop esi
ret 0x14

Function at 0x409760
Capabilities:
Send data
Send http request

Disassembly:
push ecx
push esi
push 0
push 0x4400000
lea eax, [esp + 0xc]
push eax
push 0x487c3a
mov esi, ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x39fe04]
push str.HTTP_1.0
push ecx
push 0x487f44
push edx
mov dword [esp + 0x24], 0x487f40
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
test eax, eax
mov dword [esi + 0x39fe08], eax
jne 0x4097c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esi + 0x39fe0c], eax
push str.HttpOpenRequest__d
add esi, 0x6c
push esi
call fcn.00411b16
add esp, 0xc
xor eax, eax
pop esi
pop ecx
ret 4
push connect
push 0xd
push str.Accept:___r_n
push eax
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
test eax, eax
jne 0x409804
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esi + 0x39fe0c], eax
push str.HttpAddRequestHeaders__d
add esi, 0x6c
push esi
call fcn.00411b16
add esp, 0xc
xor eax, eax
pop esi
pop ecx
ret 4
mov eax, dword [esi + 0x39fe08]
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x409842
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esi + 0x39fe0c], eax
push str.HttpSendRequest__d
add esi, 0x6c
push esi
call fcn.00411b16
add esp, 0xc
xor eax, eax
pop esi
pop ecx
ret 4
mov eax, 1
pop esi
pop ecx
ret 4
Function at 0x409850
Capabilities:
Read data from internet
Receive data

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x39fe08], 0
jne 0x40986e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x39fe0c], eax
xor eax, eax
pop esi
ret 8
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push edi
push 0
push ebx
call fcn.00410e00
mov eax, dword [esi + 0x39fe08]
add esp, 0xc
push 0x4c1c84
push edi
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
pop edi
pop ebx
jne 0x4098c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esi + 0x39fe0c], eax
push str.HttpEndRequest__d
add esi, 0x6c
push esi
call fcn.00411b16
add esp, 0xc
xor eax, eax
pop esi
ret 8
mov eax, dword [0x4c1c84]
pop esi
ret 8

Function at 0x40a130
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
push ebp
push esi
lea esi, [ecx + 0x1cc]
push edi
mov edi, dword [esi + 4]
xor ebp, ebp
cmp edi, dword [esi + 8]
jbe 0x40a14a
call fcn.004113d1
mov ebx, esi
lea esp, [esp]
mov esi, dword [esi + 8]
mov eax, ebx
cmp dword [eax + 4], esi
jbe 0x40a15f
call fcn.004113d1
test ebx, ebx
je 0x40a167
cmp ebx, ebx
je 0x40a16c
call fcn.004113d1
cmp edi, esi
jae 0x40a21c
test ebx, ebx
jne 0x40a17d
call fcn.004113d1
cmp edi, dword [ebx + 8]
jb 0x40a187
call fcn.004113d1
mov eax, dword [edi + 0x500]
sub eax, 1
je 0x40a1ff
sub eax, 1
jne 0x40a205
cmp edi, dword [ebx + 8]
jb 0x40a1a1
call fcn.004113d1
push 0
push 0x80
push 3
push 0
push 3
push connect
lea ecx, [edi + 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a1d9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ebp, [eax + ebp + 0x1800]
jmp 0x40a1df
add ebp, 0x7e800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 0x487ff0
call fcn.0040d100
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a205
add ebp, 0x2000
cmp edi, dword [ebx + 8]
jb 0x40a20f
call fcn.004113d1
add edi, 0x50c
mov esi, ebx
jmp 0x40a150
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x40a260
Capabilities:
Send data
Send http request

Disassembly:
sub esp, 0x410
mov eax, dword [0x4b1598]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
mov edi, dword [esp + 0x41c]
push 0x404
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x14], 0x487f40
mov byte [esp + 0x18], 0
call fcn.00410e00
add esp, 0xc
push 0x400
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00409f90
mov eax, dword [esi + 0x39fe04]
push 0
push 0x4400040
lea edx, [esp + 0x10]
push edx
push 0x487c3a
push str.HTTP_1.0
push edi
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
test eax, eax
mov dword [esi + 0x39fe08], eax
jne 0x40a2f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x39fe0c], eax
xor eax, eax
jmp 0x40a354
push connect
push 0xd
push str.Accept:___r_n
push eax
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
test eax, eax
je 0x40a2e4
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40a312
sub eax, edx
mov edx, eax
mov eax, str.Content_Type:_application_x_www_form_urlencoded_r_n
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40a327
push edx
mov edx, dword [esi + 0x39fe08]
lea ecx, [esp + 0x10]
push ecx
sub eax, edi
push eax
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x40a2e4
mov eax, 1
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
call fcn.004117a8
add esp, 0x410
ret 4