joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43382c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x433922
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x433938
call fcn.004054b8
push 5
lea eax, [ebp - 0xe]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
sete bl
test bl, bl
je 0x433892
push 5
lea eax, [ebp - 9]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
je 0x433896
xor eax, eax
jmp 0x433898
mov al, 1
mov ebx, eax
test bl, bl
je 0x4338b3
lea eax, [ebp - 4]
lea edx, [ebp - 0xe]
call fcn.00405618
mov eax, esi
lea edx, [ebp - 9]
call fcn.00405618
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040909c
mov eax, dword [ebp - 0x14]
mov edx, 0x433944
call fcn.00405848
jne 0x4338f5
lea edx, [ebp - 0x18]
mov eax, dword [esi]
call fcn.0040909c
mov eax, dword [ebp - 0x18]
mov edx, 0x433950
call fcn.00405848
jne 0x4338f5
mov eax, edi
mov edx, dword [0x4910f8]
call fcn.00405474
jmp 0x4338ff
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433929
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405444
lea eax, [ebp - 4]
call fcn.00405420
ret

Function at 0x437314
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
call fcn.00405618
cmp dword [ebx], 0
je 0x437364
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x43734f
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x437364
mov eax, ebx
mov edx, 0x437374
call fcn.004056ec
add esp, 0x10c
pop ebx
ret

Function at 0x439b68
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x808], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x439c1b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x5c3], 0
jne 0x439bb2
lea edx, [ebp - 0x808]
mov eax, ebx
call fcn.00439d54
mov edx, dword [ebp - 0x808]
mov eax, esi
call fcn.00405d8c
jmp 0x439c02
mov eax, dword [ebx + 0x407]
test eax, eax
je 0x439c02
cmp byte [ebx + 0x431], 0
jne 0x439c02
push eax
call sub.user32.dll_GetWindowTextLengthW
cmp eax, 0x400
jle 0x439bd7
mov eax, 0x400
test eax, eax
jle 0x439c02
inc eax
push eax
lea eax, [ebp - 0x802]
push eax
mov eax, dword [ebx + 0x407]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, esi
lea edx, [ebp - 0x802]
mov ecx, 0x401
call fcn.00405d70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439c22
lea eax, [ebp - 0x808]
call fcn.00405420
ret
Function at 0x439d54
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x439e0f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x5c3], 0
je 0x439d93
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00439b68
mov eax, dword [ebp - 8]
mov edx, edi
call fcn.00439cec
jmp 0x439df9
mov eax, dword [ebx + 0x407]
test eax, eax
je 0x439dec
cmp byte [ebx + 0x431], 0
jne 0x439dec
push eax
call sub.user32.dll_GetWindowTextLengthA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x439db9
xor esi, esi
jmp 0x439dd6
mov eax, dword [ebp - 4]
inc eax
call fcn.00402f00
mov esi, eax
mov eax, dword [ebp - 4]
inc eax
push eax
push esi
mov eax, dword [ebx + 0x407]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, edi
mov edx, esi
call fcn.00405618
test esi, esi
je 0x439df9
mov eax, esi
call fcn.00402f1c
jmp 0x439df9
mov eax, edi
mov edx, dword [ebx + 0x425]
call fcn.00405618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439e16
lea eax, [ebp - 8]
call fcn.00405bfc
ret
Function at 0x43ff78
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
call fcn.00405618
cmp dword [ebx], 0
je 0x43ffc8
mov eax, dword [ebx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x108]
test eax, eax
je 0x43ffb3
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x43ffc8
mov eax, ebx
mov edx, 0x43ffd8
call fcn.004056ec
add esp, 0x10c
pop ebx
ret

Function at 0x43ffdc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040a374
add esp, 0x208
pop ebx
ret

Function at 0x441428
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x11
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 9], ebx
test ebx, ebx
jbe 0x4414bc
xor eax, eax
push ebp
push 0x4414a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0044137c
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xd], esi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 9]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x11]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4414bc
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x441848
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a0
xor eax, eax
push ebp
push 0x4419a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405420
mov edx, dword [ebp - 4]
mov eax, 0x4419c0
call fcn.004059fc
test eax, eax
jne 0x441918
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405b40
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004058b0
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004058b0
mov edi, eax
push edi
push 0
call sub.kernel32.dll_SearchPathA
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405b40
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004058b0
push eax
push ebx
push 0
push edi
push 0
call sub.kernel32.dll_SearchPathA
test eax, eax
je 0x44190c
mov eax, dword [ebp - 8]
call fcn.004058b0
call fcn.0040a1d4
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405b40
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00405474
jmp 0x44198e
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405474
jmp 0x44198e
lea eax, [ebp - 8]
mov edx, 1
call fcn.00405b40
push 0
mov eax, dword [ebp - 8]
call fcn.004058b0
push eax
mov eax, dword [ebp - 4]
call fcn.004058b0
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405b40
push ebx
mov eax, dword [ebp - 8]
call fcn.004058b0
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x441984
mov eax, dword [ebp - 8]
call fcn.004058b0
call fcn.0040a1d4
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405b40
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00405474
jmp 0x44198e
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4419b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405444
ret
Function at 0x442070
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a0
mov eax, dword [ebp - 8]
call fcn.004058a0
xor eax, eax
push ebp
push 0x4421a2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x442175
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004058b0
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00405618
mov eax, dword [ebp - 0x14]
call fcn.004058b0
push eax
call sub.kernel32.dll_DeleteFileA
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41b544]
call fcn.0041e77c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x44215c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41b6c4]
call fcn.0041eba4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44213f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0041e5c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442146
mov eax, dword [ebp - 0xc]
call fcn.0040440c
ret
Function at 0x442998
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x442b15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebp + 0xc]
call fcn.00405474
xor edx, edx
push ebp
push 0x442af2
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x40c]
mov eax, edi
call fcn.00442704
mov edx, dword [ebp - 0x40c]
lea eax, [ebp - 0x110]
mov ecx, 0xff
call fcn.0040a2a8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
xor edx, edx
push ebp
push 0x442ae1
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
je 0x442a34
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x442afc
lea eax, [ebp - 0x210]
mov ecx, 0xff
mov edx, dword [ebp - 4]
call fcn.0040a2a8
lea ebx, [ebp - 0x405]
mov dword [ebp - 8], 0x1f4
mov byte [ebx], 0
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x442a81
mov edx, esi
mov eax, ebx
call fcn.0040a374
jmp 0x442ac4
cmp eax, 0xea
jne 0x442ac4
mov eax, dword [ebp - 8]
call fcn.00402ee8
mov ebx, eax
mov byte [ebx], 0
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x442abd
mov edx, esi
mov eax, ebx
call fcn.0040a374
mov eax, ebx
call fcn.00402f1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442ae8
cmp dword [ebp - 0xc], 0
je 0x442ae0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442b1c
lea eax, [ebp - 0x40c]
call fcn.00405420
ret
Function at 0x442b28
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x400], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x14]
xor eax, eax
push ebp
push 0x442d16
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x442cf3
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x400]
mov eax, dword [ebp - 4]
call fcn.00442704
mov edx, dword [ebp - 0x400]
lea eax, [ebp - 0x205]
call fcn.0040a280
cmp byte [ebp + 0x10], 0
je 0x442b9d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x205]
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyA
mov dword [ebp - 0xc], eax
jmp 0x442bb1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x205]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x442ce2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0xc], 0
je 0x442bd7
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x442cfd
xor edx, edx
push ebp
push 0x442caf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, edi
test eax, eax
je 0x442bf0
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, 0x1f4
jge 0x442c07
lea eax, [ebp - 0x205]
mov dword [ebp - 0x10], eax
jmp 0x442c0f
call fcn.00402ee8
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x442c80
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, edi
mov eax, dword [ebp - 0x10]
call fcn.0040a280
mov byte [ebp - 0x3fa], 0
lea eax, [ebp - 0x3fa]
mov edx, esi
call fcn.0040a280
test esi, esi
jne 0x442c43
xor eax, eax
jmp 0x442c49
lea eax, [ebp - 0x3fa]
push ebx
mov edx, dword [ebp - 0x10]
push edx
push 1
push 0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442c87
lea eax, [ebp - 0x205]
cmp eax, dword [ebp - 0x10]
je 0x442c7f
mov eax, dword [ebp - 0x10]
call fcn.00402f1c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442d1d
lea eax, [ebp - 0x400]
call fcn.00405420
ret
Function at 0x442e3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc08
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x3f8], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x442f42
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x442f1f
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x3f8]
mov eax, esi
call fcn.00442704
mov edx, dword [ebp - 0x3f8]
lea eax, [ebp - 0x1fd]
call fcn.0040a280
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1fd]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyA
xor edx, edx
push ebp
push 0x442f0e
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
je 0x442ec6
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x442f29
lea eax, [ebp - 0x3f2]
mov edx, edi
call fcn.0040a280
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3f2]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442f15
cmp dword [ebp - 8], 0
je 0x442f0d
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442f49
lea eax, [ebp - 0x3f8]
call fcn.00405420
ret
Function at 0x442f58
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa00
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x600], ebx
mov dword [ebp - 0x5fc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x443102
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], ebx
xor edx, edx
push ebp
push 0x4430da
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x5fc]
mov eax, edi
call fcn.00442704
mov edx, dword [ebp - 0x5fc]
lea eax, [ebp - 0x20d]
call fcn.0040a280
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20d]
push eax
push esi
call sub.advapi32.dll_RegOpenKeyA
xor edx, edx
push ebp
push 0x4430c9
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
je 0x442fee
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4430e4
lea eax, [ebp - 0x402]
mov edx, dword [ebp - 4]
call fcn.0040a280
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x402]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 4
je 0x4430a5
cmp dword [ebp - 0x18], 3
je 0x4430a5
cmp dword [ebp - 0x18], 4
je 0x4430a5
cmp dword [ebp - 0x18], 5
je 0x4430a5
mov dword [ebp - 0xc], 0x1f4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x5f7]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x402]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4430a5
lea eax, [ebp - 0x600]
lea edx, [ebp - 0x5f7]
mov ecx, 0x1f5
call fcn.00405690
mov eax, dword [ebp - 0x600]
mov edx, ebx
call fcn.0040969c
mov dword [ebp - 8], eax
call fcn.00404dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4430e4
test eax, eax
je 0x4430ac
mov dword [ebp - 8], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4430d0
cmp dword [ebp - 0x10], 0
je 0x4430c8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443109
lea eax, [ebp - 0x600]
mov edx, 2
call fcn.00405444
ret

Function at 0x443aac
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403a6c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x447750
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push ebp
push 0x44779f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test bl, bl
jne 0x447791
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x447791
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.004476f4
test eax, eax
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4477a6
ret

Function at 0x4483ac
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a0
xor eax, eax
push ebp
push 0x44844d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a6c
lea eax, [ebp - 0x40]
call fcn.0044817c
xor eax, eax
push ebp
push 0x448430
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x40], 0x3c
lea eax, [ebp - 0x40]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004058b0
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, ebx
mov edx, dword [ebp - 0x30]
call fcn.00405618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448437
lea eax, [ebp - 0x40]
call fcn.0044828c
ret

Function at 0x44845c
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a0
xor eax, eax
push ebp
push 0x4484f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a6c
lea eax, [ebp - 0x44]
call fcn.0044817c
xor eax, eax
push ebp
push 0x4484d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x44], 0x3c
lea eax, [ebp - 0x44]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004058b0
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4484e0
lea eax, [ebp - 0x44]
call fcn.0044828c
ret
Function at 0x45464c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a0
xor eax, eax
push ebp
push 0x45470a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x4546e2
push dword fs:[esi]
mov dword fs:[esi], esp
test bl, bl
je 0x4546a2
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040930c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004054b8
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x4546b3
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x4546d5
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4922c0]
inc ecx
dec edx
jne 0x4546bc
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4546ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454711
lea eax, [ebp - 0xc]
call fcn.00405420
lea eax, [ebp - 4]
call fcn.00405420
ret

Function at 0x45471c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a0
xor eax, eax
push ebp
push 0x45481c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push ebp
push 0x4547f4
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x45477b
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040930c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.004054b8
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x454795
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x4547de
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00406618
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4926c4]
mov eax, dword [eax*8 + 0x4926c0]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x4547a0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4547fe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454823
lea eax, [ebp - 0x1c]
call fcn.00405420
lea eax, [ebp - 4]
call fcn.00405420
ret
Function at 0x45bd10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058a0
xor eax, eax
push ebp
push 0x45bdd2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00405420
mov eax, dword [ebp - 4]
test eax, eax
je 0x45bd4d
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x45bd96
mov edi, 1
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
movzx ebx, byte [edx + edi - 1]
mov edx, ebx
call fcn.00405608
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov edx, ebx
xor dl, 0xff
movzx edx, dl
sub edx, edi
call fcn.00405608
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004057b4
inc edi
dec esi
jne 0x45bd58
mov eax, dword [ebp - 8]
call fcn.0045487c
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.004095e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bdd9
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405444
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405444
ret