joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40210c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4175c0], eax
cmp byte [0x4175bc], 0
jne 0x402144
call fcn.00401890
test al, al
jne 0x402144
mov dword [0x4175c0], 8
mov dword [ebp - 4], 8
jmp 0x4022a5
xor ecx, ecx
push ebp
push 0x40229e
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x417045], 0
je 0x402165
push 0x4175c4
call sub.KERNEL32.DLL_LocalAlloc
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402180
mov dword [0x4175c0], 9
jmp 0x402275
dec dword [0x4175ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4175b0], eax
test bl, 1
je 0x4021e0
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x4021b0
test edx, 0x80000003
je 0x4021bf
mov dword [0x4175c0], 0xa
jmp 0x402275
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4021d7
mov dword [0x4175c0], 0xa
jmp 0x402275
add ebx, edx
mov esi, eax
call fcn.00401a34
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x417618]
jne 0x402220
sub dword [0x417618], ebx
add dword [0x417614], ebx
cmp dword [0x417614], 0x3c00
jle 0x402211
call fcn.00401d24
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403a4c
jmp 0x4022a5
mov edx, dword [eax]
test dl, 2
je 0x402243
and edx, 0x7ffffffc
cmp edx, 4
jge 0x40223e
mov dword [0x4175c0], 0xb
jmp 0x402275
or dword [eax], 1
jmp 0x40226c
mov eax, edi
cmp dword [eax + 4], 0
je 0x402256
cmp dword [eax], 0
je 0x402256
cmp dword [eax + 8], 0xc
jge 0x402262
mov dword [0x4175c0], 0xb
jmp 0x402275
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401a34
mov edx, ebx
mov eax, esi
call fcn.00401c9c
mov eax, dword [0x4175c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022a5
cmp byte [0x417045], 0
je 0x40229d
push 0x4175c4
call sub.KERNEL32.DLL_TlsGetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402674
Capabilities:
Resume thread

Disassembly:
call sub.KERNEL32.DLL_ResumeThread
call fcn.00402664
ret

Function at 0x4027cc
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403f40
test esi, esi
jne 0x402802
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_SetFileAttributesA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404030
jmp 0x402820
call sub.KERNEL32.DLL_ReadProcessMemory
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004026e0
mov edi, eax
test esi, esi
je 0x402820
cmp dword [ebx], 0
je 0x402820
dec esi
jmp 0x402809
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x40282c
Capabilities:
Create process on windows

Disassembly:
add esp, 0xfffffff8
push esp
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
je 0x402844
mov eax, dword [esp]
mov dword [0x413008], eax
pop ecx
pop edx
ret
call sub.KERNEL32.DLL_WinExec
mov dword [0x413008], eax
pop ecx
pop edx
ret
Function at 0x402bf8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x10]
movzx edx, word [ebx + 4]
and edx, eax
cmp eax, edx
jne 0x402c6a
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 8]
imul esi
push eax
push edi
mov eax, dword [ebx]
push eax
call dword [ebp + 0xc]
test eax, eax
jne 0x402c3a
call sub.KERNEL32.DLL_ResumeThread
call fcn.00402664
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402c79
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebx + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x402c56
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [eax], edx
jmp 0x402c79
cmp esi, dword [ebp - 4]
je 0x402c79
mov eax, dword [ebp + 8]
call fcn.00402664
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402c79
mov eax, 0x67
call fcn.00402664
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10

Function at 0x402d54
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x413008], 0x8088405
inc edx
mov dword [ebx + 0x413008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402f68
Capabilities:
Get common file path
Resume thread

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor edx, edx
mov ebx, eax
mov dx, word [eax + 4]
sub edx, 0xd7b0
je 0x402f94
cmp edx, 3
ja 0x40302a
call dword [ebx + 0x24]
test eax, eax
je 0x402f94
call fcn.00402664
mov word [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x402f40
mov dword [ebx + 0x1c], 0x402918
cmp byte [ebx + 0x48], 0
je 0x403011
mov eax, 0xc0000000
mov dl, byte [0x41300c]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x413060]
mov ecx, 2
sub edi, 3
je 0x402ff3
mov ecx, 3
inc edi
je 0x402ff3
mov eax, 0x40000000
inc edi
mov word [ebx + 4], 0xd7b2
je 0x402ff3
mov eax, 0x80000000
mov word [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_GetStdHandle
cmp eax, 0xffffffff
je 0x403031
mov dword [ebx], eax
jmp 0x403041
mov dword [ebx + 0x24], 0x402918
cmp edi, 3
je 0x403021
push 0xfffffffffffffff6
jmp 0x403023
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetTempPathA
jmp 0x403008
mov eax, 0x66
jmp 0x40303c
mov word [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_ResumeThread
call fcn.00402664
pop edi
pop esi
pop ebx
ret
Function at 0x403dc4
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ecx
cmp byte [0x417044], 0
je 0x403e25
cmp word [0x417218], 0xd7b2
jne 0x403ded
cmp dword [0x417220], 0
jbe 0x403ded
mov eax, 0x417214
call dword [0x417230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x413088
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetTempPathA
push eax
call sub.KERNEL32.DLL_LockResource
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403e4c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetTempPathA
push eax
call sub.KERNEL32.DLL_LockResource
pop edx
ret
cmp byte [0x413028], 0
jne 0x403e41
push 0
push 0x413080
push 0x413088
push 0
call sub.user32.dll_SetTimer
pop edx
ret

Function at 0x403e50
Capabilities:
Move file
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x417630
mov esi, section.DATA
mov edi, 0x417040
cmp byte [ebx + 0x28], 0
jne 0x403e7f
cmp dword [edi], 0
je 0x403e7f
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403e6e
cmp dword [0x413004], 0
je 0x403e99
call fcn.00403d38
call fcn.00403dc4
xor eax, eax
mov dword [0x413004], eax
cmp byte [ebx + 0x28], 2
jne 0x403ea9
cmp dword [esi], 0
jne 0x403ea9
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403bec
cmp byte [ebx + 0x28], 1
jbe 0x403eb9
cmp dword [esi], 0
je 0x403eda
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403eda
call fcn.00405114
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x403eda
test eax, eax
je 0x403eda
push eax
call sub.KERNEL32.DLL_ReadFile
call fcn.00403bc4
cmp byte [ebx + 0x28], 1
jne 0x403ee8
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x403ef3
call fcn.00403d94
cmp dword [ebx], 0
jne 0x403f0f
cmp dword [0x417024], 0
je 0x403f07
call dword [0x417024]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_MoveFileA
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403e99

Function at 0x404bfc
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
cmp dword [ebx + 0x10], 0
jne 0x404c37
push 0x105
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, esp
mov dl, 1
call fcn.00404e38
mov esi, eax
mov dword [ebx + 0x10], esi
test esi, esi
jne 0x404c37
mov eax, dword [ebx + 4]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x10]
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x404e38
Capabilities:
Clear file content
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_SetFileAttributesA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405068
push 0x80000001
call sub.user32.dll_MessageBoxA
test eax, eax
je 0x404ebb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405068
push 0x80000002
call sub.user32.dll_MessageBoxA
test eax, eax
je 0x404ebb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405084
push 0x80000001
call sub.user32.dll_MessageBoxA
test eax, eax
jne 0x404f44
xor eax, eax
push ebp
push 0x404f3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404c80
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x404f22
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4050a4
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x404f22
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404f44
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_LoadStringA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_Sleep
push eax
call sub.KERNEL32.DLL_SetEndOfFile
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40505e
cmp byte [ebp - 0xd], 0
jne 0x404f8b
cmp byte [ebp - 0x12], 0
je 0x40505e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_VirtualFree
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404fa4
dec ebx
cmp byte [ebx], 0x2e
je 0x404fb3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404fa3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40505e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404ff0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_VirtualAlloc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov esi, eax
test esi, esi
jne 0x40505e
cmp byte [ebp - 0xd], 0
je 0x40505e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_VirtualAlloc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov esi, eax
test esi, esi
jne 0x40505e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_VirtualAlloc
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405220
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405286
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404194
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403054
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405270
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40528d
lea eax, [ebp - 0x10]
call fcn.00403f40
ret
Function at 0x40ab10
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, pe_nt_image_headers32
call fcn.0040584c
ret
Function at 0x40bb14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004043b0
xor eax, eax
push ebp
push 0x40bb9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403f40
mov eax, dword [ebp - 4]
call fcn.004043c0
call fcn.004060cc
mov ebx, eax
test ebx, ebx
jle 0x40bb80
mov edi, 1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + edi - 1]
xor edx, dword [ebp - 8]
call fcn.0040410c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004041c8
inc edi
dec ebx
jne 0x40bb5f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bba5
lea eax, [ebp - 0xc]
call fcn.00403f40
lea eax, [ebp - 4]
call fcn.00403f40
ret

Function at 0x40bde4
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffe4
mov byte [esp], al
xor ebx, ebx
lea eax, [esp + 4]
push eax
push 0x20
call fcn.00405634
push eax
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x40be66
mov dword [esp + 0xc], 1
lea eax, [esp + 0x10]
push eax
push 0x40be70
push 0
call sub.KERNEL32.DLL_CreateMutexA
cmp byte [esp], 0
je 0x40be2c
mov dword [esp + 0x18], 2
jmp 0x40be32
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.KERNEL32.DLL_CreateFileA
call fcn.0040566c
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call fcn.0040557c
mov eax, ebx
add esp, 0x1c
pop ebx
ret

Function at 0x40c278
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004043b0
xor eax, eax
push ebp
push 0x40c35b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004043c0
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.0040411c
mov eax, dword [ebp - 0x10]
call fcn.00406294
test al, al
je 0x40c33d
push ebx
call fcn.0040565c
mov esi, eax
mov eax, esi
and eax, 0x80000001
jns 0x40c2d8
dec eax
or eax, 0xfffffffe
inc eax
dec eax
jne 0x40c2e3
push 0
push ebx
call sub.KERNEL32.DLL_GetCommandLineA
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00405594
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40c336
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0xffffffff
sete byte [ebp - 5]
test esi, esi
je 0x40c31f
push esi
push ebx
call sub.KERNEL32.DLL_GetCommandLineA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c33d
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040557c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c362
lea eax, [ebp - 0x10]
call fcn.00403f40
lea eax, [ebp - 4]
call fcn.00403f40
ret
Function at 0x40c398
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 1
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040c36c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40c425
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_CharToOemA
test eax, eax
jne 0x40c407
mov eax, ebx
lea edx, [ebp - 0x10c]
mov ecx, 0x100
call fcn.00404194
jmp 0x40c40e
mov eax, ebx
call fcn.00403f40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c42c
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_DeleteFileA
ret

Function at 0x40c5b8
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov ebx, eax
push 0
push 0
push 0
push 0
push 0x40c648
call sub.wininet.dll_InternetOpenA
mov edi, eax
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.004043c0
push eax
push edi
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
mov dword [esp + 4], 0x400
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push esi
push 5
push ebx
call sub.wininet.dll_HttpQueryInfoA
mov eax, ebp
call fcn.00402550
mov esi, eax
lea eax, [esp + 0xc]
push eax
push ebp
push esi
push ebx
call sub.wininet.dll_InternetReadFile
push ebx
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
mov edx, dword [esp]
mov eax, esi
call fcn.004060e4
mov eax, esi
call fcn.00402570
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40c660
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40c766
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x2710
lea eax, [ebx + 1]
call fcn.00402550
mov esi, eax
lea eax, [ebx + esi]
mov byte [eax], 0
push 0
push 0
push 0
push 0
push 0x40c774
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004043c0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
mov eax, edi
call fcn.00403f40
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
cmp dword [ebp - 0x10], 0
je 0x40c718
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0040c64c
cmp ebx, dword [ebp - 0x10]
jbe 0x40c70e
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.0040454c
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.004041c8
cmp dword [ebp - 0x10], 0
jne 0x40c6d6
cmp byte [ebp - 0x11], 0
je 0x40c729
cmp ebx, dword [ebp - 0x10]
jae 0x40c737
mov ecx, dword [edi]
mov eax, edi
mov edx, 0x40c780
call fcn.0040420c
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, esi
call fcn.00402570
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c76d
lea eax, [ebp - 0x18]
call fcn.00403f40
ret
Function at 0x40c7b4
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa80
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x580], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c997
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x14]
mov edx, 0x40c9b0
call fcn.00403fd8
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.004043c0
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40c96f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80000000
push 0
push 0
mov eax, ebx
call fcn.004043c0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40c951
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xbb8
call sub.KERNEL32.DLL_lstrlenA
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0xa
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x57c]
push eax
push 0x13
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpQueryInfoA
lea eax, [ebp - 0x580]
lea edx, [ebp - 0x57c]
call fcn.0040411c
mov eax, dword [ebp - 0x580]
mov edx, 0x40c9c0
call fcn.0040430c
jne 0x40c93a
mov eax, esi
call fcn.004043c0
mov edx, eax
lea eax, [ebp - 0x568]
call fcn.00402b34
xor eax, eax
push ebp
push 0x40c933
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
lea eax, [ebp - 0x568]
call fcn.00403048
call fcn.00402644
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x40c907
push 0
lea edx, [ebp - 0x41c]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x568]
call fcn.00402c84
call fcn.00402644
cmp dword [ebp - 0x10], 0
jne 0x40c8cf
cmp dword [ebp - 0x10], 0
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c93a
lea eax, [ebp - 0x568]
call fcn.00402ca4
call fcn.00402644
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c958
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x40ce8c
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jbe 0x40cf22
push 0xf01ff
push esi
push edi
call sub.advapi32.dll_RegCloseKey
mov esi, eax
test esi, esi
jbe 0x40cf1c
cmp byte [esp], 0
je 0x40cee1
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push esi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x40cf16
mov ebp, 0xb
lea eax, [esp + 8]
push eax
push 1
push esi
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [esp + 8]
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x40cf13
cmp dword [esp + 0xc], 1
jne 0x40cf13
mov bl, 1
jmp 0x40cf16
dec ebp
jne 0x40cee6
push esi
call sub.advapi32.dll_RegCreateKeyA
push edi
call sub.advapi32.dll_RegCreateKeyA
mov eax, ebx
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret