joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407c98
Capabilities:
Create process on windows
Enumerate gui resources
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x447394]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
push dword [edi]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x21], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + 0x105]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004229ac
mov ebx, eax
pop ecx
test ebx, ebx
je 0x407e23
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004229ac
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
je 0x407e1c
push dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call esi
push dword [edi]
push dword [ebp - 0x28]
call esi
push str..exe
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp - 0x28]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [edi + 0x14]
push ebx
call fcn.00407c48
test al, al
je 0x407e13
push str.runas
lea esi, [ebp - 0x20]
call fcn.004052d9
push 0x38
xor esi, esi
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.00427ce0
add esp, 0xc
cmp byte [edi + 0x10], 0
mov dword [ebp - 0x68], 0x3c
mov dword [ebp - 0x64], 0x40
mov dword [ebp - 0x60], esi
je 0x407d83
mov dword [ebp - 0x5c], esi
jmp 0x407d92
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x407d8f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp byte [edi + 8], al
mov dword [ebp - 0x58], ebx
sete al
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x407dfd
cmp dword [ebp - 0x30], esi
je 0x407dfd
cmp byte [edi + 9], 0
mov byte [ebp - 0x21], 1
je 0x407de4
cmp byte [edi + 8], 0
jne 0x407de4
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 0x407e37
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [edi + 0xc]
cmp edi, esi
je 0x407df2
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
jmp 0x407e08
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407e08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi + 0x14]
mov dword [ecx], eax
push esi
push 1
lea esi, [ebp - 0x20]
call fcn.00405329
push dword [ebp - 0x28]
call fcn.004231e4
pop ecx
push ebx
call fcn.004231e4
pop ecx
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422a42
leave
ret 4
Function at 0x407e75
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x84
push ebx
push 0x38
lea eax, [ebp + 0x34]
push 0
push eax
call fcn.00427ce0
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
add esp, 0xc
lea eax, [ebp + 0x30]
push eax
mov dword [ebp + 0x30], 0x3c
mov dword [ebp + 0x34], 0x100
mov dword [ebp + 0x4c], 1
mov dword [ebp + 0x3c], str.open
mov dword [ebp + 0x40], esi
call ebx
test eax, eax
jne 0x407f38
cmp dword [ebp + 0x50], 0x1b
je 0x407ecc
cmp dword [ebp + 0x50], 0x1f
jne 0x407f38
push edi
xor eax, eax
lea edi, [ebp + 0x70]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push str.shell32.dll
mov dword [ebp + 0x6c], esi
mov dword [ebp + 0x74], 0x24
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SHOpenWithDialog
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
test eax, eax
jne 0x407f30
push 0x38
push eax
lea eax, [ebp - 8]
push eax
call fcn.00427ce0
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x3c
mov dword [ebp - 8], 0x100
mov dword [ebp + 0x10], 1
mov dword [ebp], str.openas
mov dword [ebp + 4], esi
call ebx
jmp 0x407f38
lea ecx, [ebp + 0x6c]
push ecx
push 0
call eax
pop ebx
add ebp, 0x78
leave
ret
Function at 0x40866a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x4366ba
call fcn.00425136
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 0x20019
xor edi, edi
push edi
push str.Software4sharedDownloadHelper
mov dword [ebp - 0x34], edi
push 0x80000001
mov dword [ebp - 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408732
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x3c]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
push edi
push ebx
push dword [ebp - 0x34]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
call esi
test eax, eax
jne 0x408732
cmp dword [ebp - 0x38], 1
jne 0x408732
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x3c]
cmp eax, edi
jbe 0x408716
shr eax, 1
lea ecx, [ebp - 0x2c]
call fcn.00408885
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4086fa
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea eax, [ebp - 0x38]
push eax
push edi
push ebx
push dword [ebp - 0x34]
call esi
mov eax, dword [ebp - 0x18]
dec eax
lea ecx, [ebp - 0x2c]
call fcn.00408885
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040728a
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.00405329
mov eax, dword [ebp - 0x30]
jmp 0x408741
mov esi, dword [ebp - 0x30]
push 0x43cee0
call fcn.004052d9
mov eax, esi
call fcn.004251b9
ret

Function at 0x408747
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.Software4sharedDownloadHelper
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4087af
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x408779
sub eax, ecx
sar eax, 1
add eax, eax
push eax
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4087a2
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x4087b1
xor al, al
pop ebx
leave
ret
Function at 0x409d55
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 0
mov esi, ecx
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
push ecx
push 0x1f6
push edx
push 0x14
push 0x64
mov ebx, eax
add dword [ebx], 0xa
mov eax, dword [ebx]
push eax
push 0x1f
push 0x50808f41
mov edi, str.SkipAll
push edi
push str.static
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 1
push dword [esi + 0x78]
mov dword [ebp - 0xc], eax
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push dword [esi + 8]
mov edi, dword [ebp - 0xc]
call fcn.0040c7c5
mov eax, dword [esi + 4]
pop ecx
pop ecx
mov ecx, dword [esi + 8]
push 0
push eax
push 0x1f7
push ecx
push 0x14
push 0x64
push dword [ebx]
mov edi, str.Skip
push 0x8d
push 0x50808f61
push edi
push str.static
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 1
push dword [esi + 0x78]
mov dword [ebp - 8], eax
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push dword [esi + 8]
mov edi, dword [ebp - 8]
call fcn.0040c7c5
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
call edi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call edi
add dword [ebp - 0x24], 0x32
add dword [ebp - 0x14], 0x32
mov edi, dword [sym.imp.USER32.dll_MoveWindow]
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebx]
push 0x1f
push dword [ebp - 8]
call edi
mov eax, dword [ebp - 0x14]
push 1
push dword [ebp - 0x20]
add eax, 0x29
push dword [ebp - 0x24]
push dword [ebx]
mov ebx, dword [ebp - 0xc]
push eax
push ebx
call edi
mov eax, dword [esi + 0x40]
mov eax, dword [eax + 0x230]
test eax, eax
je 0x409e77
push eax
call fcn.00404ef5
mov eax, dword [esi + 0x40]
push dword [eax + 0x230]
mov ebx, dword [ebp - 8]
call fcn.00404ef5
mov eax, dword [esi + 0x40]
mov eax, dword [eax + 0x234]
test eax, eax
je 0x409ea1
push eax
push dword [ebp - 0xc]
call fcn.00405176
mov eax, dword [esi + 0x40]
push dword [eax + 0x234]
push dword [ebp - 8]
call fcn.00405176
add esp, 0x10
cmp byte [ebp + 8], 0
je 0x409ebb
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp - 0xc]
call esi
push 0
push dword [ebp - 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c251
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc0
mov eax, dword [0x447394]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x3b8
lea eax, [ebp - 0xbbc]
push 0
push eax
call fcn.00427ce0
mov edi, dword [esi + 8]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
mov dword [ebp - 0xbc0], 0x3bc
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xbb8], 1
mov dword [ebp - 0xbb4], 7
mov dword [ebp - 0xbb0], 0x401
call fcn.00427ce0
add esp, 0x18
push 0x400
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x80
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0xba8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
movzx ecx, word [esi + 0x18]
mov eax, dword [esi + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0xbac], eax
lea eax, [ebp - 0xbc0]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00422a42
leave
ret

Function at 0x40c324
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc0
mov eax, dword [0x447394]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x3b8
lea eax, [ebp - 0xbbc]
push 0
push eax
call fcn.00427ce0
mov edi, dword [esi + 8]
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
mov dword [ebp - 0xbc0], 0x3bc
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xbb8], 1
mov dword [ebp - 0xbb4], 6
call fcn.00427ce0
add esp, 0x18
push 0x400
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x80
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0xba8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
movzx ecx, word [esi + 0x18]
mov eax, dword [esi + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0xbac], eax
lea eax, [ebp - 0xbc0]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00422a42
leave
ret

Function at 0x40c991
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
test bl, 1
je 0x40c9a6
mov edi, 0x80000000
and ebx, 2
je 0x40c9ca
cmp dword [esi + 0x40], 8
jb 0x40c9b6
mov eax, dword [esi + 0x2c]
jmp 0x40c9b9
lea eax, [esi + 0x2c]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
or edi, 0x40000000
cmp dword [esi + 0x5c], 8
jb 0x40c9d5
mov eax, dword [esi + 0x48]
jmp 0x40c9d8
lea eax, [esi + 0x48]
push 0
push 0x80
push ebx
push 0
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
pop edi
mov dword [esi + 0x24], eax
setne cl
pop esi
mov al, cl
pop ebx
ret 4
Function at 0x40d842
Capabilities:
Receive http response
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, esi
mov byte [ebp - 1], 0
call fcn.0040e724
test al, al
je 0x40d95a
lea eax, [esi + 0xf8]
cmp dword [eax + 0x18], 8
jb 0x40d86c
mov eax, dword [eax + 4]
jmp 0x40d86f
add eax, 4
push dword [esi + 0xc]
mov ecx, eax
push esi
call fcn.0040da8a
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x40d8aa
mov eax, dword [esi + 0xc]
push 4
lea ecx, [ebp + 8]
push ecx
push 0x3f
push eax
mov dword [ebp + 8], 2
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x40d8aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0xc]
call edi
test eax, eax
jne 0x40d8ee
push dword [esi + 0xc]
mov eax, esi
call fcn.0040dc05
test al, al
je 0x40d95c
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi + 0xc]
call edi
test eax, eax
jne 0x40d8ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
jmp 0x40d95c
mov eax, dword [esi + 0xd4]
cmp eax, ebx
je 0x40d913
lea ecx, [ebp + 8]
push ecx
push dword [esi + 0xd8]
mov dword [ebp + 8], ebx
push eax
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
je 0x40d8e0
push ebx
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x40d936
push dword [ebp + 0x10]
mov eax, esi
push dword [ebp + 0xc]
push dword [esi + 0xc]
call fcn.0040e485
mov byte [ebp - 1], al
jmp 0x40d942
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
cmp byte [ebp - 1], bl
je 0x40d95c
mov ecx, dword [esi + 0x94]
cmp ecx, ebx
je 0x40d973
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x40d973
xor ebx, ebx
mov ecx, dword [esi + 0x94]
cmp ecx, ebx
je 0x40d973
push dword [esi]
mov eax, dword [ecx]
push dword [esi + 0x114]
call dword [eax + 4]
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 0xc

Function at 0x40dc8a
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x16
push dword [ebp + 8]
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
jne 0x40dcbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40dd12
mov eax, dword [ebp - 8]
push edi
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004229ac
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40dd11
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push edi
call fcn.00427ce0
add esp, 0xc
push ebx
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x16
push dword [ebp + 8]
call esi
test eax, eax
je 0x40dd0a
push edi
push dword [ebp + 0xc]
call fcn.00405302
mov byte [ebp - 1], 1
push edi
call fcn.004231e4
pop ecx
pop edi
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret 8
Function at 0x40dd1b
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x13
push dword [ebp + 8]
mov dword [ebp - 4], edi
call esi
cmp eax, edi
jne 0x40dd4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40ddab
mov eax, dword [ebp - 4]
push ebx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004229ac
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x40ddaa
mov eax, dword [ebp - 4]
add eax, eax
push eax
push edi
push ebx
call fcn.00427ce0
add esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x13
push dword [ebp + 8]
call esi
test eax, eax
je 0x40dda3
lea eax, [ebp - 8]
push eax
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_StrToIntExW]
test eax, eax
jne 0x40dda3
or dword [ebp - 8], 0xffffffff
push ebx
call fcn.004231e4
pop ecx
pop ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 4
Function at 0x40e27f
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
lea ebx, [esi + 0x84]
mov eax, dword [ebx]
push edi
test eax, eax
je 0x40e29f
push eax
call fcn.004231e4
and dword [ebx], 0
pop ecx
and dword [esi + 0x88], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x40e363
push dword [esi + 0x88]
mov eax, esi
call fcn.0040d97c
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.004229ac
mov edi, eax
pop ecx
test edi, edi
je 0x40e332
mov eax, dword [ebp - 4]
inc eax
push eax
push 0
push edi
call fcn.00427ce0
and dword [ebp - 8], 0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edi
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x40e32b
push dword [ebp + 0xc]
mov ebx, dword [ebp - 8]
push edi
call fcn.0040e186
test al, al
je 0x40e36f
mov ecx, dword [esi + 0x1a4]
cmp dword [ecx + 0x20], 0
je 0x40e36f
push dword [ebp - 8]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
push edi
call fcn.004231e4
pop ecx
cmp dword [ebp - 4], 0
ja 0x40e2a6
push dword [esi + 0x88]
mov eax, esi
call fcn.0040d97c
mov esi, dword [esi + 0x1a4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
and dword [esi + 0x20], 0
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
xor al, al
jmp 0x40e35c

Function at 0x40e4e2
Capabilities:
Initialize winhttp library

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 4], edi
jne 0x40e520
lea eax, [esi + 0x120]
cmp dword [eax + 0x18], 8
jb 0x40e4fb
mov eax, dword [eax + 4]
jmp 0x40e4fe
add eax, 4
push edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 4], eax
cmp eax, edi
jne 0x40e520
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x114], eax
xor al, al
pop edi
ret
mov al, 1
pop edi
ret

Function at 0x40e524
Capabilities:
Set http header

Disassembly:
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x40e562
cmp dword [eax + 0x18], 8
jb 0x40e536
mov eax, dword [eax + 4]
jmp 0x40e539
add eax, 4
push 0x1000000
push ecx
push eax
push dword [esp + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x40e562
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 4]
mov dword [ecx + 0x114], eax
xor al, al
jmp 0x40e564
mov al, 1
ret 8
Function at 0x40e724
Capabilities:
Prepare http request

Disassembly:
push 0x60
mov eax, 0x437bcb
call fcn.00425136
mov esi, ebx
mov edi, ecx
mov byte [ebp - 0x66], 0
call fcn.0040e900
mov esi, dword [ebx + 0x1a4]
call fcn.0040cadf
test al, al
jne 0x40e75b
mov dword [ebx + 0x114], 2
jmp 0x40e8f7
push edi
lea esi, [ebp - 0x64]
call fcn.0040728a
and dword [ebp - 4], 0
cmp dword [ebx + 0x28], 0
je 0x40e8e1
mov edi, esi
call fcn.0040da3b
test al, al
je 0x40e8e1
mov esi, ebx
call fcn.0040e4e2
test al, al
je 0x40e8eb
push dword [ebx + 0x1a0]
push dword [ebx + 0x19c]
push dword [ebx + 0x198]
push dword [ebx + 0x194]
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
xor edi, edi
push edi
push 0x10000
push 0x40e92c
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edi
mov word [ebp - 0x44], cx
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x65]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 2
lea eax, [ebx + 0x14]
mov esi, esp
mov dword [ebp - 0x6c], esp
push eax
call fcn.0040728a
lea ecx, [ebp - 0x6c]
call fcn.0040e5be
test al, al
je 0x40e8c9
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x40e81f
lea eax, [ebp - 0x44]
push edi
push dword [ebp - 0x6c]
push eax
push dword [ebx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [ebx + 8], eax
cmp eax, edi
je 0x40e8c2
movzx ecx, byte [ebp - 0x65]
mov esi, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
and ecx, 0x800000
cmp dword [ebp - 0x14], 8
jae 0x40e852
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x4c], 8
mov edx, dword [ebp - 0x60]
jae 0x40e85e
lea edx, [ebp - 0x60]
push ecx
push edi
push edi
push edi
push esi
push edx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebx + 0xc], eax
cmp eax, edi
je 0x40e8c2
cmp byte [ebx + 0x10], 0
jne 0x40e894
cmp byte [ebp - 0x65], 0
je 0x40e894
push 4
lea ecx, [ebp - 0x6c]
push ecx
push 0x1f
push eax
mov dword [ebp - 0x6c], 0x3100
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push dword [ebx + 0xc]
lea eax, [ebx + 0xdc]
push ebx
call fcn.0040e524
test al, al
je 0x40e8c2
lea eax, [ebx + 0xb8]
push eax
push dword [ebx + 0xc]
mov ecx, ebx
call fcn.0040e567
test al, al
je 0x40e8c2
mov byte [ebp - 0x66], 1
jmp 0x40e8c9
mov esi, ebx
call fcn.0040e900
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.00405329
push edi
push 1
lea esi, [ebp - 0x48]
call fcn.00405329
jmp 0x40e8eb
mov dword [ebx + 0x114], 0x57
push 0
push 1
lea esi, [ebp - 0x64]
call fcn.00405329
mov al, byte [ebp - 0x66]
call fcn.004251b9
ret

Function at 0x410d79
Capabilities:
Create thread

Disassembly:
push edi
mov edi, eax
call fcn.00410d98
xor eax, eax
push eax
push eax
push edi
push 0x410f5d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x18], eax
pop edi
ret
Function at 0x41158d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp dword [esi + 0x2c], edi
jne 0x41160e
mov ecx, dword [esi + 0x10]
cmp ecx, edi
jle 0x41160e
mov eax, dword [esi + 0x14]
cmp eax, edi
jle 0x41160e
push edi
push eax
push ecx
mov al, 1
call fcn.0040796c
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, edi
je 0x41160a
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
call fcn.00406cc3
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x411601
push edi
lea eax, [ebp - 8]
push eax
push dword [esi + 0x10]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x4c], 1
push dword [ebp - 4]
call fcn.004231e4
pop ecx
mov al, 1
jmp 0x411610
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4118b9
Capabilities:
Create thread

Disassembly:
push ebx
push edi
lea eax, [esi + 0x24]
push eax
call fcn.004069cd
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor edi, edi
push edi
push edi
push edi
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x1c], eax
call ebx
push edi
push edi
push esi
push 0x411bb3
push edi
push edi
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
push 0x190
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
pop edi
mov eax, esi
pop ebx
ret
Function at 0x414713
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x2327
push esi
mov esi, ecx
cmp dword [esp + 8], eax
jne 0x414780
push ebx
push ebp
push edi
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 8]
push 0xc
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
push 0
push edi
call ebp
mov eax, dword [esi + 0xcc]
add eax, 0x19c
cmp dword [eax + 0x18], 8
jb 0x41475d
mov eax, dword [eax + 4]
jmp 0x414760
add eax, 4
lea ecx, [esi + 0xe0]
mov ebx, eax
mov edx, edi
call fcn.0040595d
push 5
push edi
call ebp
push dword [esi + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop ebp
pop ebx
pop esi
ret 4

Function at 0x41523e
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esi + 0x1a8], 0
jne 0x41528e
push edi
push 0xfffffffffffffff0
lea edi, [esi + 0xec]
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 8
push eax
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0xe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x1e
push 0x1d20
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [esi + 0x1a8], 1
pop edi
ret

Function at 0x41528f
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esi + 0x1a8], 0
je 0x4152db
push edi
push 0xfffffffffffffff0
lea edi, [esi + 0xec]
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffffff7
push eax
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push dword [esi + 0xe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1d20
push dword [esi + 8]
call dword [sym.imp.USER32.dll_KillTimer]
mov byte [esi + 0x1a8], 0
pop edi
ret