joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420e9c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push ecx
mov dword [ebp - 0x90], eax
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x98], esi
cmp esi, 0xffffffff
jne 0x420ee6
push eax
jmp 0x420f20
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x420f1b
cmp eax, dword [ebp + 0xc]
jbe 0x420f1b
sub eax, dword [ebp + 0xc]
mov edi, 0x10000
push edi
mov dword [ebp - 0x8c], eax
call fcn.004315aa
pop ecx
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x420f37
push ebx
call fcn.004315b5
pop ecx
cmp esi, ebx
je 0x420f26
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043159b
leave
ret
lea eax, [ebp - 0x78]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x79], bl
call fcn.004014b4
jmp 0x420f56
mov esi, dword [ebp - 0x98]
push ebx
lea eax, [ebp - 0x84]
push eax
push edi
push dword [ebp - 0x80]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420fb2
mov esi, dword [ebp - 0x84]
cmp esi, ebx
je 0x420fb2
mov eax, dword [ebp - 0x88]
lea ecx, [esi + eax]
cmp ecx, dword [ebp - 0x8c]
jbe 0x420f9a
mov esi, dword [ebp - 0x8c]
sub esi, eax
mov dword [ebp - 0x84], esi
mov byte [ebp - 0x79], 1
push dword [ebp - 0x80]
mov eax, esi
lea ecx, [ebp - 0x78]
call fcn.00401345
add dword [ebp - 0x88], esi
cmp byte [ebp - 0x79], bl
je 0x420f50
lea esi, [ebp - 0x78]
call fcn.004013f6
mov ebx, dword [ebp - 0x90]
mov eax, esi
call fcn.0040146d
push dword [ebp - 0x80]
mov bl, al
call fcn.004315b5
cmp dword [ebp - 0x98], 0
pop ecx
je 0x420fe7
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x420f28

Function at 0x4218bf
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push edi
push eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x421952
push ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
call fcn.004044e8
lea ebx, [ebp - 0x7c]
call fcn.004095a0
mov eax, dword [ebp - 0x7c]
inc dword [ebp - 0x74]
add eax, 0xfffffff0
call fcn.004045dc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x104
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42190c
pop ebx
mov ecx, dword [ebp + 0x198]
pop edi
xor ecx, ebp
pop esi
call fcn.0043159b
add ebp, 0x19c
leave
ret 4
Function at 0x42196b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov esi, eax
mov eax, dword [ebx]
push 0
push eax
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
cmp eax, 0xea
jne 0x4219cd
push dword [ebp - 4]
call fcn.00404422
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
call fcn.00402010
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
or eax, 0xffffffff
call fcn.00409bad
xor eax, eax
cmp dword [ebp - 8], eax
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x4219da
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea esi, [ebp + 8]
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x274], eax
call fcn.00409c45
mov eax, dword [0x45a180]
mov ecx, 0x45a180
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
lea esi, [ebp - 0x264]
mov ebx, esp
call fcn.00409bcb
add eax, 0x10
mov edx, esi
mov ecx, edi
mov dword [ebx], eax
call fcn.00421c38
test al, al
je 0x421acb
mov eax, esi
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.0041ad6b
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.0041af34
mov esi, dword [ebp - 0x274]
mov ebx, eax
call fcn.004095a0
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.004045dc
lea eax, [ebp - 0x288]
push eax
mov eax, dword [ebp - 0x270]
call fcn.00421d1d
test al, al
je 0x421acb
xor esi, esi
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004045dc
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043159b
leave
ret 0x10
cmp dword [ebp + 0xc], 1
jge 0x421ad6
xor esi, esi
inc esi
jmp 0x421a9f
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00409bcb
add eax, 0x10
mov dword [ebp - 0x25c], eax
push 0x44b9dc
lea eax, [ebp - 0x25c]
push eax
call fcn.004020a2
lea eax, [ebp - 0x258]
push eax
lea esi, [ebp - 0x25c]
call fcn.00402010
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp dword [ebp - 0x26c], 0xffffffff
setne al
test al, al
je 0x421bb2
lea eax, [ebp - 0x258]
call fcn.00421c10
test al, al
je 0x421b9a
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp + 8]
lea ecx, [ebp - 0x260]
call fcn.00408cc4
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x260]
pop ecx
push dword [ebp - 0x274]
dec eax
push edi
push eax
push ecx
add esi, 0xfffffff0
mov eax, esi
mov ebx, esp
call fcn.00409bcb
mov ecx, dword [ebp - 0x270]
add eax, 0x10
mov dword [ebx], eax
call fcn.004219da
test eax, eax
je 0x421bda
mov eax, esi
call fcn.004045dc
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x421b3b
cmp dword [ebp - 0x26c], 0
je 0x421bc7
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.004045dc
jmp 0x421ad1
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.004045dc
cmp dword [ebp - 0x26c], 0
je 0x421bfd
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.004045dc
jmp 0x421a9d
Function at 0x421ec6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp byte [ebp + 0xc], bl
jne 0x421f07
push dword [ebp + 8]
call fcn.00421e4a
pop ecx
cmp byte [ebp + 0x10], bl
je 0x421eff
cmp eax, ebx
setne byte [ebp + 0x13]
cmp eax, ebx
je 0x421ef7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp + 0x13]
jmp 0x421f97
cmp eax, ebx
sete byte [ebp + 0x13]
jmp 0x421eec
push 0x5c
call fcn.00408b4f
mov edi, eax
cmp edi, ebx
mov dword [ebp + 0xc], 3
jl 0x421f82
lea eax, [ebp - 4]
push eax
mov ecx, edi
xor edx, edx
mov eax, esi
call fcn.00408be5
push dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00421e4a
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x421f77
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
lea eax, [ebp + 0xc]
lea edx, [edi + 1]
push eax
sub ecx, edx
mov eax, esi
call fcn.00408be5
mov esi, dword [ebp + 0xc]
push ebx
push ebx
push ebx
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 0xc], eax
lea eax, [esi - 0x10]
call fcn.004045dc
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004045dc
xor eax, eax
cmp byte [ebp + 0x10], bl
je 0x421f91
cmp dword [ebp + 0xc], ebx
sete al
jmp 0x421f97
cmp dword [ebp + 0xc], ebx
setne al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4225c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, 0x400
push ebx
call fcn.004315aa
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
cmp eax, ecx
jne 0x4225ec
push ecx
call fcn.004315b5
pop ecx
push 3
jmp 0x42273f
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ecx
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
sub dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
inc dword [ebp - 0xc]
add dword [ebp - 0x10], 0xa
cmp dword [ebp - 0xc], 1
cdq
mov esi, eax
mov ecx, edx
jle 0x422624
mov eax, dword [ebp - 0x10]
cdq
add esi, eax
adc ecx, edx
push 2
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
call edi
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x422649
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4226f9
mov esi, dword [ebp - 4]
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422736
cmp dword [ebp - 0x14], ebx
jne 0x422736
add esi, 0x3f6
jmp 0x42268b
push 0xa
push str.ADVINSTSFX
push esi
call fcn.00432b98
add esp, 0xc
test eax, eax
je 0x4226f4
dec esi
cmp esi, dword [ebp - 4]
jae 0x422676
or esi, 0xffffffff
test esi, esi
jl 0x422604
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x24], 0
push 0
lea ecx, [ebp - 0x24]
lea eax, [esi + eax - 0x40]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
call edi
cmp eax, 0xffffffff
je 0x4226f9
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 0x14]
push eax
push 0x4a
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422726
cmp dword [ebp - 0x14], 0
je 0x422726
push 0xa
lea eax, [esi + 0x40]
push str.ADVINSTSFX
push eax
call fcn.00432b98
add esp, 0xc
test eax, eax
je 0x4226fe
push 5
jmp 0x422728
sub esi, dword [ebp - 4]
jmp 0x422693
push dword [ebp - 4]
jmp 0x422737
cmp dword [esi + 0xc], 0x64
jne 0x4226f0
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 0x28]
push dword [ebp - 4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x24]
sbb eax, ecx
mov dword [esi + 0x50], edx
mov dword [esi + 0x54], eax
call fcn.004315b5
pop ecx
xor eax, eax
jmp 0x422740
push 2
pop esi
push dword [ebp - 4]
call fcn.004315b5
pop ecx
mov eax, esi
jmp 0x422740
push esi
call fcn.004315b5
pop ecx
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4227a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [eax + 0x10], ebx
cmp dword [eax + 4], edi
je 0x422832
cmp ebx, edi
je 0x4227dd
push edi
push edi
push edi
push edi
lea esi, [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.00408d3b
push dword [esi]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebp + 8]
xor edi, edi
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push 0x42283b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp ebx, edi
je 0x4227fd
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x422827
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x422823
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x422834
cmp esi, edi
je 0x422832
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x422d81
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2e
mov esi, edi
mov ebx, eax
call fcn.00408b4f
test eax, eax
jg 0x422da3
mov al, 1
jmp 0x422f07
mov ecx, eax
lea edx, [ebp - 8]
mov eax, edi
call fcn.00408c5c
mov eax, dword [0x45a180]
mov esi, 0x45a180
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp - 8]
add eax, 0x10
push dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x10]
push str.__verbose___log_file__s____remove_pack_file___s____s_
push eax
call fcn.00409682
add esp, 0x14
cmp dword [ebx + 0x10], 0
je 0x422dee
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
push edi
call dword [eax + 0x14]
push 0
push 0x8000008
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
call fcn.0040f8c4
add esp, 0x14
lea edi, [ebp - 0x20]
lea ecx, [ebp - 8]
mov byte [ebp - 1], 1
call fcn.0040a3a4
test al, al
je 0x422e2c
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x422ed0
mov eax, dword [0x45a180]
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.0041017c
mov eax, dword [0x45a180]
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
push 0xca
lea esi, [ebp - 0x18]
mov dword [ebp - 0xc], eax
call fcn.00420b9e
mov eax, dword [ebp - 8]
mov edi, dword [eax - 0xc]
pop ecx
push 0x5c
lea esi, [ebp - 8]
call fcn.00408b4f
mov ecx, edi
sub ecx, eax
lea eax, [ebp - 0x1c]
push eax
mov eax, esi
call fcn.00410708
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
push esi
push dword [eax]
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.00409682
mov eax, dword [ebp - 0x1c]
add esp, 0x10
add eax, 0xfffffff0
call fcn.004045dc
push 0
lea eax, [ebp - 0xc]
call fcn.00416de2
pop ecx
lea eax, [edi - 0x10]
mov byte [ebp - 1], 0
call fcn.004045dc
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.004045dc
lea eax, [esi - 0x10]
call fcn.004045dc
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebx + 0x10], 0
je 0x422eee
mov ebx, dword [ebx + 0x10]
push dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004045dc
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.004045dc
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42306a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebx + 0x10], eax
cmp dword [eax], edi
je 0x4230a1
push edi
push edi
push edi
push edi
lea esi, [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.00408d3b
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x4232c9
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x18], esi
cmp dword [eax], edi
je 0x4230f7
mov edi, ebx
call fcn.00423135
mov ebx, dword [ebx + 4]
mov esi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], edx
call fcn.0040c06d
add esi, eax
adc dword [ebp - 0xc], edx
mov eax, dword [edi + 0x10]
push dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
call dword [eax]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebp - 0x18]
xor edi, edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x423121
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x42311d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x42312e
cmp esi, edi
je 0x42312c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42363e
Capabilities:
Get geographical location

Disassembly:
push ebp
push esi
push edi
push 0
push 0x44d06e
movzx ebx, bx
push 0x1001
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, eax
mov ecx, 0x45a180
lea edi, [ebp - 1]
call fcn.004045c1
test edi, edi
jle 0x423687
push edi
call fcn.0040205c
push edi
push 0x78
push eax
call fcn.004315c0
add esp, 0xc
mov eax, edi
mov edx, esi
call fcn.00402082
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x42369b
push dword [eax + 4]
push esi
call fcn.00402176
mov eax, dword [esi]
push ebp
push eax
push 0x1001
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x424479
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
push dword [edi + 0x5c]
lea ebx, [edi + 0x38]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebp + 0x14]
mov byte [edi + 0x41], 0
push dword [ebp + 0x10]
mov dword [edi + 0x34], 3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x42450f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x424511
jmp 0x4244ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4244f1
lea esi, [edi + 0xc]
push ebx
call fcn.0042fa94
mov eax, esi
call fcn.0042fa7d
test al, al
jne 0x4244fc
push 0xa
push dword [edi + 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x4244c0
cmp dword [edi + 0x30], 0
jne 0x424503
mov eax, dword [edi + 0x2c]
jmp 0x424511
mov eax, 0xe0000008
jmp 0x424511
mov edi, dword [edi + 0x2c]
test edi, edi
jle 0x42450f
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x424518
Capabilities:
Query remote server for available data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push dword [edi + 0x5c]
lea ebx, [edi + 0x38]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push dword [esp + 0x1c]
mov byte [edi + 0x41], 0
push dword [esp + 0x1c]
mov dword [edi + 0x34], 8
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x4245ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4245ae
jmp 0x424588
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x42458d
lea esi, [edi + 0xc]
push ebx
call fcn.0042fa94
mov eax, esi
call fcn.0042fa7d
test al, al
jne 0x424598
push 0xa
push dword [edi + 0x5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x42455c
cmp dword [edi + 0x30], 0
jne 0x42459f
mov eax, dword [edi + 0x2c]
jmp 0x4245ae
mov eax, 0xe0000008
jmp 0x4245ae
mov edi, dword [edi + 0x2c]
test edi, edi
jle 0x4245ac
mov eax, dword [esp + 0x14]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x425263
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x44
mov byte [eax], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x425283
mov eax, 0x2ee6
jmp 0x425302
cmp eax, ebx
push esi
mov dword [ebp - 4], ebx
jle 0x4252ff
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.00409616
push 0x3c
mov esi, eax
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.004315c0
mov esi, dword [esi]
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push esi
mov dword [ebp - 0x44], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4252cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 8]
jmp 0x4252d4
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 8], ecx
xor eax, eax
cmp eax, ebx
jne 0x425301
cmp ecx, 1
jne 0x4252e2
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
cmp ecx, 3
je 0x4252f1
cmp ecx, 4
je 0x4252f1
cmp ecx, 1
jne 0x425307
inc dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 4]
jl 0x42528b
xor eax, eax
pop esi
pop ebx
leave
ret 8
mov eax, 0x2ee6
jmp 0x425301

Function at 0x425aa2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea esi, [edi + 4]
push dword [esi]
call fcn.004109f7
pop ecx
push esi
call fcn.0040ebe7
mov eax, dword [edi + 0x28]
push dword [eax]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi]
call ebx
mov eax, dword [0x45a180]
mov ecx, 0x45a180
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
push 0xdc
lea eax, [ebp - 4]
push eax
call fcn.00404304
push 0x40a
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp - 4]
push eax
call ebx
lea eax, [edi + 0x40]
push eax
mov eax, dword [esi]
call fcn.00428692
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push edi
push 0x425b7e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004045dc
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x425d08
Capabilities:
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
push esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call sub.NETAPI32.dll_NetLocalGroupGetMembers
test eax, eax
jne 0x425d95
mov dword [ebp - 4], esi
cmp dword [ebp - 8], esi
jbe 0x425d8d
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp + 0xc]
add edi, 8
mov esi, dword [edi]
push esi
lea eax, [ebp + 0xc]
call fcn.004044e8
lea eax, [ebp + 0xc]
push eax
call fcn.00426330
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.004045dc
push ebx
push ecx
mov eax, esp
push esi
call fcn.004044e8
mov ecx, dword [ebp - 0x14]
call fcn.00425d08
add edi, 0xc
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x425d4e
push dword [ebp - 0xc]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004045dc
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x425da7
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 8]
push ecx
xor esi, esi
push 1
push esi
push eax
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x425e15
push edi
mov edi, dword [ebp - 8]
cmp dword [ebp - 4], esi
jbe 0x425e0c
push ebx
push dword [edi]
lea eax, [ebp - 0xc]
call fcn.004044e8
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00426330
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.004045dc
add edi, 4
inc esi
cmp esi, dword [ebp - 4]
jb 0x425de1
pop ebx
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
pop edi
pop esi
leave
ret 4