joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xbc], ecx
lea ecx, [ebp - 0x1c]
call fcn.004219a0
lea ecx, [ebp - 0xc0]
call fcn.00413220
mov eax, dword [ebp - 0xbc]
mov dword [eax + 0x680], 0
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x61c
call fcn.0058fc60
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040d360
lea ecx, [ebp - 0xcc]
call fcn.00413870
lea ecx, [ebp - 0xc0]
call fcn.0040dcd0
test eax, eax
jne 0x43f4a2
lea ecx, [ebp - 0xc0]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c30
jmp 0x43f6f5
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0xc8]
push eax
call fcn.00480970
add esp, 8
lea ecx, [ebp - 0xc8]
call fcn.0040dcd0
cmp eax, 0x104
jl 0x43f4ed
lea ecx, [ebp - 0xc8]
call fcn.00413870
lea ecx, [ebp - 0xc0]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c30
jmp 0x43f6f5
mov ecx, dword [ebp - 0xbc]
mov dword [ecx + 0x6b4], 0
lea ecx, [ebp - 0xc0]
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0xb8]
call fcn.00421700
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x34]
call fcn.00421970
lea ecx, [ebp - 0xb8]
call fcn.00421ba0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00480a50
add esp, 8
test eax, eax
je 0x43f55b
push 0
push 0x687e60
lea ecx, [ebp - 0x1c]
call fcn.00451450
cmp eax, 0xffffffff
jne 0x43f661
mov ecx, dword [ebp - 0xbc]
mov dword [ecx + 0x680], 1
lea edx, [ebp - 0xd8]
push edx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x66c
call fcn.00418cd0
push eax
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x66c
call fcn.0042fc70
mov ecx, eax
call fcn.00413ab0
movzx edx, al
test edx, edx
je 0x43f65f
lea eax, [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0xbc]
add ecx, 0x66c
call fcn.0044bf60
mov dword [eax], 1
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx + 0x69c]
push edx
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax + 0x60c]
mov edx, dword [ecx + 4]
push edx
push 1
push ecx
mov ecx, esp
push 0x687e6c
call fcn.004131e0
push ecx
mov ecx, esp
lea eax, [ebp - 0xc0]
push eax
call fcn.00421650
call fcn.004da4c0
add esp, 0x14
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0xd4]
push ecx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x61c
call fcn.0058fbf0
push eax
lea edx, [ebp - 0xd0]
push edx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x674
call fcn.0044beb0
mov ecx, eax
call fcn.0040d360
lea ecx, [ebp - 0xd4]
call fcn.00413870
jmp 0x43f6cf
mov eax, dword [ebp - 0xbc]
mov dword [eax + 0x680], 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0xbc]
call fcn.0043f7e0
test eax, eax
jne 0x43f6cf
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0xc4]
push eax
call fcn.00480970
add esp, 8
lea ecx, [ebp - 0xc4]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xc4]
call fcn.00413870
lea ecx, [ebp - 0x34]
call fcn.00421c30
jmp 0x43f4fd
lea ecx, [ebp - 0x34]
call fcn.00421c30
lea ecx, [ebp - 0xc8]
call fcn.00413870
lea ecx, [ebp - 0xc0]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x440dd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
add eax, 0x694
push eax
lea ecx, [ebp - 0x28]
call fcn.0044a660
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00418b90
jmp 0x440e0e
push 0
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 4]
call fcn.0042ed80
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x28]
call fcn.00418cd0
push eax
lea ecx, [ebp - 4]
call fcn.00413ae0
movzx ecx, al
test ecx, ecx
je 0x440f38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [ebp - 4]
call fcn.00413b70
sub esi, dword [eax + 0x10]
cmp esi, 0xbb8
jbe 0x440f33
lea ecx, [ebp - 4]
call fcn.00413b70
cmp dword [eax + 0x14], 3
ja 0x440f33
mov edx, dword [ebp - 8]
add edx, 0x654
push edx
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 4
push eax
call fcn.0044bd50
add esp, 8
movzx eax, al
test eax, eax
je 0x440f33
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [ebp - 4]
call fcn.00413b70
mov dword [eax + 0x10], esi
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 0x14
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
push 0x2109
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x60c]
mov eax, dword [edx + 4]
push eax
push 0
push ecx
mov esi, esp
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 0xc
push eax
mov ecx, esi
call fcn.00421650
push ecx
mov esi, esp
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 8
push eax
mov ecx, esi
call fcn.00421650
call fcn.004da4c0
add esp, 0x14
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 4
push eax
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x694
call fcn.0044be50
mov ecx, eax
call fcn.0044bbf0
mov dword [ebp - 0x10], 0
jmp 0x440e00
cmp dword [ebp - 0x10], 0
je 0x440f48
push 1
mov ecx, dword [ebp - 8]
call fcn.004f7cf0
lea ecx, [ebp - 0x28]
call fcn.0044b0e0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x459aa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
push 1
push 0
push 0
mov ecx, 0x6fbb3c
call fcn.00422c50
push eax
push 0x688e34
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x660], 0
je 0x459b47
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x660]
call fcn.004f7590
test eax, eax
je 0x459b07
push 0
push 1
push 0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x660]
call fcn.004f91d0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x660]
call fcn.004f79f0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x660]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x459b33
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x10], eax
jmp 0x459b3a
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x660], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x461ba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
call fcn.005ca950
test eax, eax
je 0x461c08
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.005cbd30
lea ecx, [ebp - 4]
call fcn.0040dd70
movzx ecx, al
test ecx, ecx
jne 0x461bfe
push 0
lea ecx, [ebp - 4]
call fcn.0040d3c0
push eax
call dword [sym.imp.SHLWAPI.dll_UrlIsW]
test eax, eax
je 0x461bfe
push 1
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0040d3c0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00413870
jmp 0x461c7e
push str.ttag
lea ecx, [ebp - 8]
call fcn.00421610
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.0044bf20
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x10]
call fcn.0044a380
lea ecx, [ebp - 8]
call fcn.00413870
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.005cab00
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x60c]
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x10]
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0xc]
call fcn.0040d3c0
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00429b70
lea ecx, [ebp - 0xc]
call fcn.00413870
lea ecx, [ebp - 0x10]
call fcn.00413870
mov esp, ebp
pop ebp
ret 4
Function at 0x462b90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
push 1
push 0
push 0
mov ecx, 0x6fbb3c
call fcn.00422c50
push eax
push 0x689280
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x660], 0
je 0x462c37
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x660]
call fcn.004f7590
test eax, eax
je 0x462bf7
push 0
push 1
push 0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x660]
call fcn.004f91d0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x660]
call fcn.004f79f0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x660]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x462c23
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x10], eax
jmp 0x462c2a
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x660], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x462c40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xbc], ecx
lea ecx, [ebp - 0x1c]
call fcn.004219a0
lea ecx, [ebp - 0xc0]
call fcn.00413220
mov eax, dword [ebp - 0xbc]
mov dword [eax + 0x684], 0
lea ecx, [ebp - 0xc8]
push ecx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x620
call fcn.0058fc60
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040d360
lea ecx, [ebp - 0xc8]
call fcn.00413870
lea ecx, [ebp - 0xc0]
call fcn.0040dcd0
test eax, eax
jne 0x462cd2
lea ecx, [ebp - 0xc0]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c30
jmp 0x462ecf
mov edx, dword [ebp - 0xbc]
mov dword [edx + 0x6b8], 0
lea ecx, [ebp - 0xc0]
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0xb8]
call fcn.00421700
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x34]
call fcn.00421970
lea ecx, [ebp - 0xb8]
call fcn.00421ba0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.00480a50
add esp, 8
test eax, eax
je 0x462d40
push 0
push str._errno_:_0_
lea ecx, [ebp - 0x1c]
call fcn.00451450
cmp eax, 0xffffffff
jne 0x462e46
mov edx, dword [ebp - 0xbc]
mov dword [edx + 0x684], 1
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0xbc]
add ecx, 0x670
call fcn.00418cd0
push eax
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0xd8]
push edx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x670
call fcn.0042fc70
mov ecx, eax
call fcn.00413ab0
movzx eax, al
test eax, eax
je 0x462e44
lea ecx, [ebp - 0xc0]
push ecx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x670
call fcn.0044bf60
mov dword [eax], 1
mov edx, dword [ebp - 0xbc]
mov eax, dword [edx + 0x6a0]
push eax
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx + 0x60c]
mov eax, dword [edx + 4]
push eax
push 1
push ecx
mov ecx, esp
push 0x68955c
call fcn.004131e0
push ecx
mov ecx, esp
lea edx, [ebp - 0xc0]
push edx
call fcn.00421650
call fcn.004da4c0
add esp, 0x14
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xd0]
push eax
mov ecx, dword [ebp - 0xbc]
add ecx, 0x620
call fcn.0058fbf0
push eax
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x678
call fcn.0044beb0
mov ecx, eax
call fcn.0040d360
lea ecx, [ebp - 0xd0]
call fcn.00413870
jmp 0x462eb4
mov edx, dword [ebp - 0xbc]
mov dword [edx + 0x684], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xbc]
call fcn.00463200
test eax, eax
jne 0x462eb4
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0xc4]
push edx
call fcn.00480970
add esp, 8
lea ecx, [ebp - 0xc4]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xc4]
call fcn.00413870
lea ecx, [ebp - 0x34]
call fcn.00421c30
jmp 0x462ce2
lea ecx, [ebp - 0x34]
call fcn.00421c30
lea ecx, [ebp - 0xc0]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c30
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x465fc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
add eax, 0x698
push eax
lea ecx, [ebp - 0x28]
call fcn.0044a660
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00418b90
jmp 0x465ffe
push 0
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 4]
call fcn.0042ed80
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x28]
call fcn.00418cd0
push eax
lea ecx, [ebp - 4]
call fcn.00413ae0
movzx ecx, al
test ecx, ecx
je 0x466128
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [ebp - 4]
call fcn.00413b70
sub esi, dword [eax + 0x10]
cmp esi, 0xbb8
jbe 0x466123
lea ecx, [ebp - 4]
call fcn.00413b70
cmp dword [eax + 0x14], 3
ja 0x466123
mov edx, dword [ebp - 8]
add edx, 0x658
push edx
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 4
push eax
call fcn.0044bd50
add esp, 8
movzx eax, al
test eax, eax
je 0x466123
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [ebp - 4]
call fcn.00413b70
mov dword [eax + 0x10], esi
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 0x14
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
push 0x2109
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x60c]
mov eax, dword [edx + 4]
push eax
push 0
push ecx
mov esi, esp
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 0xc
push eax
mov ecx, esi
call fcn.00421650
push ecx
mov esi, esp
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 8
push eax
mov ecx, esi
call fcn.00421650
call fcn.004da4c0
add esp, 0x14
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 4]
call fcn.00413b70
add eax, 4
push eax
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x698
call fcn.0046aba0
mov ecx, eax
call fcn.0044bbf0
mov dword [ebp - 0x10], 0
jmp 0x465ff0
cmp dword [ebp - 0x10], 0
je 0x466138
push 1
mov ecx, dword [ebp - 8]
call fcn.004f7cf0
lea ecx, [ebp - 0x28]
call fcn.0044b0e0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x476680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x190], ecx
mov eax, dword [ebp - 0x190]
cmp dword [eax + 0xa0], 0
jne 0x4766ae
jmp 0x476888
call fcn.00422d30
mov ecx, eax
call fcn.00423160
test eax, eax
jne 0x4766c3
jmp 0x476888
lea ecx, [ebp - 0x19c]
call fcn.00413220
call fcn.005e2270
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
je 0x4767a9
push 0xfde9
mov ecx, dword [ebp - 0x190]
add ecx, 0xc4
call fcn.00424f40
push eax
lea ecx, [ebp - 0x88]
call fcn.00421730
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push 0x68b644
mov ecx, dword [ebp - 0x194]
push ecx
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.00421ba0
mov edx, dword [ebp - 0x194]
push edx
call fcn.005e2520
add esp, 4
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
je 0x47679a
push 0xfde9
mov eax, dword [ebp - 0x198]
push eax
lea ecx, [ebp - 0x18c]
call fcn.004214f0
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x19c]
call fcn.00413a70
lea ecx, [ebp - 0x18c]
call fcn.00421ba0
mov ecx, dword [ebp - 0x198]
push ecx
call fcn.0063e41a
add esp, 4
mov edx, dword [ebp - 0x194]
push edx
call fcn.005e2350
add esp, 4
mov ecx, dword [ebp - 0x190]
add ecx, 0xc4
call fcn.00425070
movzx eax, al
test eax, eax
jne 0x476870
lea ecx, [ebp - 0x19c]
call fcn.0040d3c0
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], 0
mov ecx, dword [ebp - 0x190]
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x1b0], 0x4769a0
mov dword [ebp - 0x1ac], 0
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b8], edx
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b4], eax
sub esp, 0x28
mov esi, esp
sub esp, 0x10
mov ecx, esp
push 0x68ad4f
push 0x68ad4e
lea edx, [ebp - 0x1a0]
push edx
lea eax, [ebp - 0x1b8]
push eax
push ecx
call fcn.00420f50
add esp, 0x14
mov ecx, esi
call fcn.00476c30
lea ecx, [ebp - 0x1a4]
push ecx
push 1
lea edx, [ebp - 0x1a8]
push edx
push 0x68b64c
mov ecx, dword [ebp - 0x190]
add ecx, 0x8c
call fcn.005d2470
push str.notify_CMemberSummaryPage_login_success
call fcn.005564a0
add esp, 4
lea ecx, [ebp - 0x19c]
call fcn.00413870
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x478120
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0x1bb
jne 0x478141
mov eax, dword [ebp - 8]
or eax, 0x800000
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 3
push 0
push 0
movzx edx, word [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47819c
movzx edx, byte [ebp + 0x14]
test edx, edx
je 0x47819c
mov dword [ebp - 0xc], 0x4e20
push 4
lea eax, [ebp - 0xc]
push eax
push 5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea edx, [ebp - 0xc]
push edx
push 6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x47a2b0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6048
call fcn.00613c30
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x6008], ecx
mov ecx, dword [ebp - 0x6008]
add ecx, 4
call fcn.004219f0
mov ecx, dword [ebp - 0x6008]
add ecx, 0x20
call fcn.004219f0
push 0x3c
push 0
lea eax, [ebp - 0x6048]
push eax
call fcn.0063a460
add esp, 0xc
mov dword [ebp - 0x6048], 0x3c
mov dword [ebp - 0x600c], 0x1000
push 0x2000
push 0
lea ecx, [ebp - 0x2004]
push ecx
call fcn.0063a460
add esp, 0xc
lea edx, [ebp - 0x2004]
mov dword [ebp - 0x6038], edx
mov dword [ebp - 0x6034], 0x1000
push 0x2000
push 0
lea eax, [ebp - 0x4004]
push eax
call fcn.0063a460
add esp, 0xc
lea ecx, [ebp - 0x4004]
mov dword [ebp - 0x601c], ecx
mov dword [ebp - 0x6018], 0x1000
push 0x2000
push 0
lea edx, [ebp - 0x6004]
push edx
call fcn.0063a460
add esp, 0xc
lea eax, [ebp - 0x6004]
mov dword [ebp - 0x6014], eax
mov dword [ebp - 0x6010], 0x1000
lea ecx, [ebp - 0x6048]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x47a3ba
push str.Error:InternetCrackUrl_failed__n
call fcn.0047fcb0
add esp, 4
mov eax, dword [ebp - 0x6008]
mov ecx, dword [ebp - 0x603c]
mov dword [eax], ecx
lea edx, [ebp - 0x2004]
push edx
mov ecx, dword [ebp - 0x6008]
add ecx, 4
call fcn.00421ef0
movzx eax, word [ebp - 0x6030]
mov ecx, dword [ebp - 0x6008]
mov dword [ecx + 0x1c], eax
lea edx, [ebp - 0x4004]
push edx
mov ecx, dword [ebp - 0x6008]
add ecx, 0x20
call fcn.00421ef0
cmp dword [ebp - 0x6010], 0
jbe 0x47a420
mov eax, dword [ebp - 0x6014]
push eax
mov ecx, dword [ebp - 0x6008]
add ecx, 0x20
call fcn.0047b540
mov eax, dword [ebp - 0x6008]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x480e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 8]
call fcn.00424f20
push eax
lea ecx, [ebp - 8]
call fcn.0044a380
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00480970
add esp, 8
lea ecx, [ebp - 8]
call fcn.00413870
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x14]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x480f1f
cmp dword [ebp - 4], 0xffffffff
je 0x480f1f
push 0
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00425220
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00424f20
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x480f0e
mov ecx, dword [ebp + 0xc]
call fcn.00425220
cmp dword [ebp - 0xc], eax
jne 0x480f0e
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x14]
call fcn.00413870
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x483c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
push 0
push 0
push 0
push 0xff
lea ecx, [ebp - 0x2c]
call fcn.00428c40
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x483cfe
jmp 0x483e10
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x483d1a
jmp 0x483e10
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x483d36
jmp 0x483e10
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x483d4e
jmp 0x483e10
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00639960
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp dword [ebp - 4], 0
jne 0x483d8c
jmp 0x483e10
push 0x10
call fcn.00428de0
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x483db2
push 0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.00482e70
mov dword [ebp - 0x24], eax
jmp 0x483db9
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040d090
lea ecx, [ebp - 0xc]
call fcn.0040d3c0
test eax, eax
jne 0x483ddb
lea ecx, [ebp - 0xc]
call fcn.00483220
jmp 0x483e10
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0xc]
call fcn.00431280
mov ecx, eax
call fcn.00483b60
test eax, eax
je 0x483e00
lea ecx, [ebp - 0xc]
call fcn.00483220
jmp 0x483e10
lea ecx, [ebp - 0xc]
call fcn.00483220
xor eax, eax
jne 0x483cdd
cmp dword [ebp - 4], 0
je 0x483e24
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [edx + 8]
call ecx
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x483e3b
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x483eb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x68d568
mov ecx, dword [ebp + 8]
call fcn.0040d3c0
push eax
lea eax, [ebp - 4]
push eax
call fcn.00643e81
add esp, 0xc
test eax, eax
jne 0x483f74
cmp dword [ebp - 4], 0
je 0x483f74
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00644811
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.00644e0a
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00644811
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004828f0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 1
lea ecx, [ebp - 0x14]
call fcn.00484ce0
mov ecx, dword [eax]
push ecx
call fcn.0064440b
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00643f54
add esp, 4
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00484ce0
mov ecx, dword [eax]
push ecx
call fcn.00483f80
add esp, 8
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
call fcn.00483080
mov eax, dword [ebp - 0xc]
jmp 0x483f76
xor eax, eax
mov esp, ebp
pop ebp
ret