joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429148
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x429176
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x42917d
cmp ebx, dword [eax + 4]
jae 0x42917d
xor eax, eax
jmp 0x42936d
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x42918e
xor eax, eax
inc eax
jmp 0x42936c
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4291a4
cmp ecx, edx
jae 0x4292e9
cmp dword [eax + 4], 0
je 0x4291ad
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x429195
cmp dword [ebp + 8], 0
je 0x4291cf
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4292e9
cmp eax, esi
jae 0x4292e9
mov eax, dword [0x466b10]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4291f4
cmp dword [esi*4 + 0x466b18], edi
je 0x4292ed
inc esi
cmp esi, eax
jl 0x4291e2
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x44d14c]
test eax, eax
je 0x429369
cmp dword [ebp - 8], 0x1000000
jne 0x429369
test byte [ebp - 0xc], 0xcc
je 0x429272
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x429369
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x429369
cmp word [eax + 0x18], 0x10b
jne 0x429369
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x429369
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x429272
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x429272
test byte [ecx + 0x27], 0x80
jne 0x4292e9
push 1
push 0x466b58
call dword [0x44d388]
test eax, eax
jne 0x429186
mov ecx, dword [0x466b10]
test ecx, ecx
mov edx, ecx
jle 0x4292a6
lea eax, [ecx*4 + 0x466b14]
cmp dword [eax], edi
je 0x4292a6
dec edx
sub eax, 4
test edx, edx
jg 0x42929a
test edx, edx
jne 0x4292d7
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4292b3
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4292cb
lea eax, [edx*4 + 0x466b18]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4292b9
cmp ecx, 0x10
jge 0x4292d7
inc ecx
mov dword [0x466b10], ecx
push 0
push 0x466b58
call dword [0x44d388]
jmp 0x429186
xor eax, eax
jmp 0x42936c
test esi, esi
jle 0x429186
mov ebx, dword [0x44d388]
push 1
push 0x466b58
call ebx
test eax, eax
jne 0x429186
cmp dword [esi*4 + 0x466b18], edi
je 0x429343
mov eax, dword [0x466b10]
lea esi, [eax - 1]
test esi, esi
jl 0x429331
cmp dword [esi*4 + 0x466b18], edi
je 0x42932d
dec esi
jns 0x429321
test esi, esi
jge 0x429341
cmp eax, 0x10
jge 0x42933c
inc eax
mov dword [0x466b10], eax
lea esi, [eax - 1]
jmp 0x429343
je 0x42935b
xor ecx, ecx
test esi, esi
jl 0x42935b
lea eax, [ecx*4 + 0x466b18]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x429349
push 0
push 0x466b58
call ebx
jmp 0x429186
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42fa1b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x44bd90
call fcn.0042344c
sub esp, 0x9c
mov eax, dword [0x462884]
push ebx
push esi
push edi
push dword [ebp + 0x1c]
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa8], esi
call fcn.00432f02
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CFileDialog.0
call fcn.00401750
cmp dword [ebp + 0x20], ebx
mov byte [ebp - 4], 1
jne 0x42faac
mov edi, 0x94
push edi
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.00423b90
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], edi
call dword [0x44d374]
cmp dword [ebp - 0x94], 2
jne 0x42faa5
cmp dword [ebp - 0xa0], 5
mov dword [ebp + 0x20], 0x58
jae 0x42faac
mov dword [ebp + 0x20], 0x4c
push dword [ebp + 0x20]
call fcn.00422f1c
cmp eax, ebx
pop ecx
mov dword [esi + 0x70], eax
jne 0x42fac1
call fcn.0042f79b
push dword [ebp + 0x20]
push ebx
push eax
call fcn.00423b90
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x74], eax
add esp, 0xc
neg eax
sbb eax, eax
add eax, 0x7005
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x1c0], ebx
lea ecx, [esi + 0x7c]
mov byte [ecx], bl
lea edi, [esi + 0xbc]
mov byte [edi], bl
mov dword [eax], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x70]
mov dword [eax + 0x20], 0x104
mov eax, dword [esi + 0x70]
mov dword [eax + 0x3c], edx
mov eax, dword [esi + 0x70]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 0x70]
push 0x40
pop ecx
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x70]
or edx, 0x80020
or dword [eax + 0x34], edx
test byte [ebp + 0x14], cl
je 0x42fb3e
mov eax, dword [esi + 0x70]
and byte [eax + 0x36], 0x7f
call fcn.00445a11
cmp dword [ebp + 0x10], ebx
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x70]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 0x44], 0x42fdc7
je 0x42fb6a
push 0x104
push dword [ebp + 0x10]
push edi
call dword [0x44d308]
cmp dword [ebp + 0x18], ebx
je 0x42fba0
push dword [ebp + 0x18]
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.00403590
push ebx
mov ecx, edi
call fcn.00401770
jmp 0x42fb89
mov byte [eax], bl
inc eax
push 0x7c
push eax
call fcn.00422979
cmp eax, ebx
pop ecx
pop ecx
jne 0x42fb86
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x78]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00421828
leave
ret 0x1c

Function at 0x435b21
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x435b5a
push dword [esi + 0x1c]
call dword [0x44d620]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00418cb4
push eax
push dword [esi + 0x1c]
call dword [0x44d5c4]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00409ca0
pop esi
ret 4
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x436f5a
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x44d9a8
mov ecx, edi
call fcn.00403590
cmp dword [esi + 0x48], 0
push dword [esp + 0xc]
jne 0x436fad
push dword [esi + 0x1c]
call dword [0x44d49c]
mov esi, eax
test esi, esi
je 0x436fc0
push esi
call dword [0x44d620]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00418cb4
push eax
push esi
call dword [0x44d5c4]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00409ca0
jmp 0x436fc0
mov ecx, esi
call fcn.00437100
test eax, eax
je 0x436fc0
push edi
mov ecx, eax
call fcn.00435b21
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
pop edi
pop esi
ret 8

Function at 0x437870
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x44bc8d
call fcn.0042344c
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x437895
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [0x44d5c4]
jmp 0x4378e1
call fcn.00432bbe
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [0x44d308]
push dword [ebp + 8]
call dword [0x44d330]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004011b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x43a372
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x462884]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [0x44d330]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x43a3c1
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [0x44d5c4]
cmp eax, esi
jne 0x43a3c1
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [0x44d328]
test eax, eax
je 0x43a3cd
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x44d63c]
mov ecx, dword [ebp - 4]
pop esi
call fcn.00421828
leave
ret 8
Function at 0x43cfbe
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
call fcn.00433907
test eax, eax
jne 0x43d1ae
mov edi, dword [edi + 4]
push ebx
mov ecx, esi
call fcn.00418c9d
test byte [esi + 0x7c], 0x20
mov dword [ebp - 0x10], eax
mov ebx, 0x201
jne 0x43d002
cmp edi, ebx
je 0x43d002
cmp edi, 0x202
jne 0x43d15b
cmp edi, 0x200
jb 0x43d012
cmp edi, 0x209
jbe 0x43d02a
cmp edi, 0xa0
jb 0x43d15b
cmp edi, 0xa9
ja 0x43d15b
call fcn.00445a37
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1c]
mov dword [ebp - 0x18], ecx
call dword [0x44d544]
push 0x30
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00423b90
mov eax, dword [esi]
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 0x18]
mov dword [ebp - 0x48], 0x28
call dword [eax + 0x6c]
cmp dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], eax
je 0x43d088
push dword [ebp - 0x24]
call fcn.0042256d
pop ecx
cmp edi, ebx
jne 0x43d09b
test byte [ebp - 0x41], 0x80
je 0x43d09b
mov dword [ebp - 8], 1
jmp 0x43d0b9
and dword [ebp - 8], 0
cmp edi, ebx
je 0x43d0b9
push 1
call dword [0x44d4f8]
test ax, ax
jge 0x43d0b9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x43d125
cmp dword [ebp - 8], 0
jne 0x43d125
cmp edi, 0x202
jne 0x43d0e5
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xc8
push 0xe001
jmp 0x43d10d
test byte [esi + 0x78], 8
jne 0x43d116
push 1
call dword [0x44d4f8]
test ax, ax
jl 0x43d116
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx + 0x78]
je 0x43d152
push 0x12c
push 0xe000
mov ecx, esi
call fcn.0043c66f
jmp 0x43d152
push dword [ebp - 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x160]
jmp 0x43d152
push 1
call dword [0x44d4f8]
test ax, ax
jge 0x43d138
cmp dword [ebp - 8], 0
je 0x43d152
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xe001
push dword [esi + 0x1c]
call dword [0x44d508]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x78], eax
mov ecx, esi
call fcn.004357ee
test eax, eax
pop ebx
je 0x43d16d
cmp dword [eax + 0x64], 0
jne 0x43d1b3
cmp dword [ebp - 0x10], 0
je 0x43d195
mov edi, dword [ebp - 0x10]
push dword [ebp + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
jne 0x43d1ae
mov ecx, edi
call fcn.004357af
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x43d173
push dword [esi + 0x1c]
call dword [0x44d504]
test eax, eax
je 0x43d1b3
push dword [ebp + 8]
mov ecx, esi
call fcn.00434323
jmp 0x43d1b5
xor eax, eax
inc eax
jmp 0x43d1b5
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x43d431
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x462884]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x43d47e
push dword [ebp + 8]
call fcn.004463cb
mov esi, eax
test esi, esi
je 0x43d4a6
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [0x44d020]
push esi
mov edi, eax
call dword [0x44d024]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x43d4a6
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x44f208
push eax
call dword [0x44d580]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x44d348]
mov ecx, dword [ebp - 4]
pop esi
call fcn.00421828
leave
ret 0xc

Function at 0x441734
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x44175d
call fcn.00445a11
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [0x44d6b8]
test eax, eax
mov dword [esi + 8], eax
jne 0x441780
push eax
push dword [esi + 4]
call fcn.004416c1
push esi
push eax
mov ecx, 0x4665dc
call fcn.0044154d
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x441915
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
je 0x441a3e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x441a3e
mov ecx, dword [esi + 0x3c]
test ecx, ecx
jne 0x44195c
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [0x44d6d0]
test eax, eax
jne 0x441954
push 0
jmp 0x441a40
mov eax, dword [ebp - 4]
jmp 0x441a1f
mov eax, dword [esi + 0x38]
push ebx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, dword [esi + 0x34]
jb 0x4419b0
mov ebx, dword [esi + 0x40]
sub ebx, eax
jns 0x441974
xor ebx, ebx
jmp 0x44197c
cmp ebx, edi
ja 0x441a24
push ebx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00423640
mov eax, dword [esi + 0x34]
add esp, 0xc
mov dword [esi + 0x38], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub edi, ebx
push edi
add eax, ebx
push eax
push dword [esi + 0x14]
call dword [0x44d6d0]
test eax, eax
je 0x44194d
mov eax, dword [ebp - 4]
jmp 0x441a1b
mov edx, dword [esi + 0x40]
lea ebx, [eax + edi]
cmp ebx, edx
jb 0x441a28
sub edx, eax
jns 0x4419c2
xor ebx, ebx
jmp 0x4419c8
mov ebx, edx
cmp ebx, edi
ja 0x441a24
push ebx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00423640
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [0x44d6d0]
test eax, eax
je 0x44194d
mov eax, dword [ebp + 0xc]
sub edi, ebx
cmp edi, eax
mov dword [esi + 0x40], eax
jae 0x441a01
mov dword [ebp + 0xc], edi
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [esi + 0x3c]
add eax, ebx
push eax
call fcn.00423640
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [esi + 0x38], eax
add eax, ebx
pop edi
pop ebx
pop esi
leave
ret 8
xor eax, eax
jmp 0x441a1d
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00423640
add esp, 0xc
add dword [esi + 0x38], edi
mov eax, edi
jmp 0x441a1d
push 6
push dword [esi + 0x1c]
call fcn.004416c1
int3
Function at 0x441a49
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x18], 1
push edi
je 0x441af2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x441af2
mov ecx, dword [esi + 0x30]
test ecx, ecx
mov edi, dword [ebp + 0xc]
jne 0x441a8d
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [ebp + 8]
push eax
call dword [0x44d6a4]
test eax, eax
jne 0x441a86
push 0
jmp 0x441af4
cmp dword [ebp + 0xc], edi
je 0x441acb
jmp 0x441a82
mov eax, dword [esi + 0x2c]
lea edx, [eax + edi]
cmp edx, dword [esi + 0x28]
push ebx
mov ebx, dword [0x44d6a4]
jb 0x441ab2
lea edx, [ebp + 0xc]
push edx
push eax
push ecx
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x441a82
and dword [esi + 0x2c], 0
mov ecx, dword [esi + 0x28]
cmp edi, ecx
jb 0x441ad1
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x441a82
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x2c]
lea edx, [eax + edi]
cmp edx, ecx
ja 0x441aca
mov ecx, dword [esi + 0x30]
push edi
push dword [ebp + 8]
add ecx, eax
push ecx
call fcn.00423640
add esp, 0xc
add dword [esi + 0x2c], edi
jmp 0x441aca
push 6
push dword [esi + 0x1c]
call fcn.004416c1
int3

Function at 0x441b2c
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
jne 0x441b69
push 0x1000
call fcn.00441307
test eax, eax
je 0x441bc4
lea eax, [ebp - 4]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [0x44d6d0]
test eax, eax
je 0x441bca
mov eax, dword [ebp - 4]
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], ebx
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x3c]
push edi
mov edi, dword [ebp + 8]
jmp 0x441bb9
mov ecx, dword [esi + 0x38]
cmp ecx, dword [esi + 0x40]
jb 0x441ba4
lea eax, [ebp - 4]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [0x44d6d0]
test eax, eax
je 0x441bca
mov eax, dword [ebp - 4]
cmp eax, ebx
mov dword [esi + 0x40], eax
je 0x441bd3
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x38], ebx
mov cl, byte [eax]
cmp cl, 0xd
je 0x441bae
mov byte [edi], cl
inc edi
inc dword [esi + 0x38]
mov cl, byte [eax]
inc eax
cmp cl, 0xa
je 0x441bbe
dec dword [ebp + 0xc]
jne 0x441b75
mov eax, dword [ebp + 8]
mov byte [edi], bl
pop edi
pop esi
pop ebx
leave
ret 8
push ebx
push dword [esi + 0x1c]
call fcn.004416c1
mov eax, edi
sub eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
jmp 0x441bc1
Function at 0x441d72
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x44bea5
call fcn.0042344c
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00438a58
xor edi, edi
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
mov dword [esi], vtable.CInternetFile.0
call fcn.00401750
mov ebx, dword [ebp + 0x10]
push dword [ebx + 0xc]
mov ecx, 0x4665dc
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0044154d
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.00403590
mov eax, dword [ebx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
mov ecx, ebx
call fcn.0041931f
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004034e0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004011b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x441f0c
Capabilities:
Connect to http server

Disassembly:
mov eax, 0x44bec2
call fcn.0042344c
push ecx
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push edi
call fcn.00441ece
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00401750
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [0x44d69c]
test eax, eax
mov dword [esi + 4], eax
jne 0x441f73
push eax
push dword [esi + 8]
call fcn.004416c1
push dword [esi + 0xc]
mov ecx, 0x4665dc
push eax
call fcn.0044154d
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x442219
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x462884]
push ebx
push esi
push edi
mov edi, dword [0x44d2f4]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [0x44d2f8]
cmp eax, ebx
je 0x4422bb
call eax
mov esi, dword [0x44d28c]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [0x44d2f8]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x4423bd
call dword [0x44d2c0]
test eax, eax
jns 0x44236b
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [ebp - 0x1c], ebx
call dword [0x44d004]
test eax, eax
jne 0x4423be
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [0x44d008]
test eax, eax
jne 0x442360
cmp dword [ebp - 0x24], 1
jne 0x442360
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x451210
push eax
call fcn.00423418
add esp, 0xc
cmp eax, 1
jne 0x442360
mov eax, dword [ebp - 0x28]
mov esi, dword [0x44d28c]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [0x44d024]
jmp 0x4423be
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x4423be
lea ecx, [ebp - 0x18]
push ecx
push 0x442203
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [0x44d290]
cmp word [ebp - 0x18], bx
je 0x4423be
movzx eax, word [ebp - 0x18]
mov esi, dword [0x44d28c]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x4423e4
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.00442184
cmp eax, ebx
pop ecx
pop ecx
jne 0x4423e6
inc edi
cmp edi, esi
jl 0x4423cd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00421828
leave
ret 4