joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7832f7d9
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0x124
mov eax, 0x783ae23d
call fcn.783a7761
mov eax, dword [ebp + 0x10]
push dword [ebp + 0x1c]
mov esi, ecx
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0x18]
push esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x128], eax
call fcn.78330461
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [esi + 0x7c]
push 0x783c8d10
mov dword [esi], sym.MFC80U.DLL_Ordinal_3194
call sym.MFC80U.DLL_Ordinal_269
mov ebx, dword [ebp + 0x20]
cmp ebx, edi
mov byte [ebp - 4], 1
jne 0x7832f870
mov ebx, 0x114
push ebx
lea eax, [ebp - 0x124]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 2
jne 0x7832f86d
cmp dword [ebp - 0x120], 5
jb 0x7832f86d
push 0x58
jmp 0x7832f86f
push 0x4c
pop ebx
push ebx
call dword [sym.imp.MSVCR80.dll_malloc]
cmp eax, edi
pop ecx
mov dword [esi + 0x74], eax
jne 0x7832f884
call sym.MFC80U.DLL_Ordinal_1178
push ebx
push edi
push eax
call sub.MSVCR80.dll_memset
xor eax, eax
mov dword [esi + 0x308], eax
mov edx, dword [ebp + 0xc]
lea ecx, [esi + 0x80]
mov word [ecx], ax
lea edi, [esi + 0x100]
mov word [edi], ax
mov eax, dword [ebp + 8]
mov dword [esi + 0x78], eax
add esp, 0xc
neg eax
sbb eax, eax
add eax, 0x7005
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x74]
mov dword [eax], ebx
mov eax, dword [esi + 0x74]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x74]
mov ebx, 0x104
mov dword [eax + 0x20], ebx
mov eax, dword [esi + 0x74]
mov dword [eax + 0x3c], edx
mov eax, dword [esi + 0x74]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 0x74]
push 0x40
pop ecx
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x74]
or edx, 0x80020
or dword [eax + 0x34], edx
test byte [ebp + 0x14], cl
je 0x7832f907
mov eax, dword [esi + 0x74]
and dword [eax + 0x34], 0xff7fffff
call sym.MFC80U.DLL_Ordinal_1079
cmp dword [ebp - 0x12c], 0
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x74]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x74]
mov dword [eax + 0x44], 0x7832f614
je 0x7832f938
push dword [ebp - 0x12c]
push ebx
push edi
call fcn.78307759
add esp, 0xc
cmp dword [ebp - 0x128], 0
je 0x7832f97d
push dword [ebp - 0x128]
lea edi, [esi + 0x7c]
mov ecx, edi
call sym.MFC80U.DLL_Ordinal_6014
push 0
mov ecx, edi
call sym.MFC80U.DLL_Ordinal_5190
mov edi, dword [sym.imp.MSVCR80.dll_wcschr]
jmp 0x7832f969
and word [eax], 0
add eax, 2
push 0x7c
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x7832f962
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x7c]
mov dword [eax + 0xc], ecx
mov eax, esi
call fcn.783a77e4
ret 0x1c
Function at 0x78331c11
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0x78331d50
mov ecx, 0x783ceb44
call sym.MFC80U.DLL_Ordinal_2590
mov ebx, eax
test ebx, ebx
jne 0x78331c30
call sym.MFC80U.DLL_Ordinal_1176
cmp word [ebx + 8], 0
jne 0x78331d2b
push esi
call sym.MFC80U.DLL_Ordinal_1079
mov eax, dword [eax + 0x94]
mov esi, dword [eax]
call fcn.783167fb
test eax, eax
mov dword [ebp - 4], eax
je 0x78331ce9
push edi
push 0x782eefd0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x782eefe0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov esi, dword [ebp + 0x10]
mov edi, 0x3ee
je 0x78331cb2
call eax
and ax, 0x3ff
cmp ax, 0x11
jne 0x78331cb2
call fcn.78331b7e
test eax, eax
je 0x78331cb2
mov eax, esi
neg eax
sbb eax, eax
push 0xfc11
and eax, 0xe
add eax, edi
push eax
push 5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x78331ccb
neg esi
sbb esi, esi
push 5
and esi, 0xe
add esi, edi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x78331ce8
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x78331ce8
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call sym.MFC80U.DLL_Ordinal_2767
add esp, 0xc
pop edi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
push 2
inc eax
call fcn.7830742d
pop ecx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebx + 4], eax
jne 0x78331d0f
call sym.MFC80U.DLL_Ordinal_1178
mov ecx, dword [esi]
push ecx
mov ecx, dword [ecx - 0xc]
inc ecx
push ecx
push eax
call fcn.7830a4ba
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
add esp, 0xc
mov word [ebx + 8], ax
pop esi
push dword [ebx + 4]
mov ecx, dword [ebp + 8]
call sym.MFC80U.DLL_Ordinal_6014
movzx eax, word [ebx + 8]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
xor ecx, ecx
cmp ax, 0xffff
setne cl
pop ebx
mov eax, ecx
leave
ret 0xc
Function at 0x7833aae7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x783aab38
call fcn.783a76f8
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x7833ab0c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x7833ab55
push 0x783c8d10
lea ecx, [ebp - 0x10]
call sym.MFC80U.DLL_Ordinal_269
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x94]
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.78307759
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.78303c47
mov eax, esi
call fcn.783a77d0
ret 8

Function at 0x7833bd4b
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
push 1
mov ecx, esi
je 0x7833bd6f
mov eax, dword [esi]
push 0
call dword [eax + 0xa0]
test eax, eax
jne 0x7833bd7d
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0xa0]
jmp 0x7833bd69
xor eax, eax
inc eax
pop esi
ret
Function at 0x7833d44e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x783c8018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.MSVCR80.dll__wcsdup]
mov esi, eax
test esi, esi
pop ecx
je 0x7833d4f7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
test eax, eax
je 0x7833d4ec
push edi
mov edi, 0x80000000
push ebx
and word [eax], 0
lea eax, [ebp - 0x214]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7833d4ea
push 0x105
lea eax, [ebp - 0x210]
push eax
xor ebx, ebx
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x7833d4c3
inc ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x7833d4ea
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
jne 0x7833d48c
pop ebx
pop edi
push esi
call dword [sym.imp.MSVCR80.dll_free]
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.783a505e
leave
ret 4

Function at 0x7833d506
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, eax
jne 0x7833d534
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
neg eax
sbb eax, eax
inc eax
jmp 0x7833d57f
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x7833d57d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x7833d57d
test esi, esi
jne 0x7833d57d
inc eax
jmp 0x7833d57f
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x78348c19
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x783c8018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x234], eax
mov edi, ecx
lea eax, [ebp - 0xc]
jne 0x78348c5c
push 0x782f2770
push 4
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
call fcn.78303ae0
jmp 0x78348c6e
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x78348ce4
push ebx
push esi
mov esi, dword [sym.imp.MSVCR80.dll__errno]
call esi
mov ebx, dword [eax]
call esi
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push edi
push 0x111
mov edi, 0x112
push edi
push eax
call dword [sym.imp.MSVCR80.dll__snwprintf_s]
add esp, 0x18
mov dword [ebp - 0x234], eax
call esi
cmp dword [eax], 0
je 0x78348cbe
call esi
push dword [eax]
call fcn.78316ae8
pop ecx
jmp 0x78348cc2
call esi
mov dword [eax], ebx
cmp dword [ebp - 0x234], 0xffffffff
pop esi
pop ebx
je 0x78348ce4
cmp dword [ebp - 0x234], edi
jae 0x78348ce4
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x78348ce6
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.783a505e
leave
ret
Function at 0x783492db
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
mov dword [eax + 0xa0], edi
cmp dword [str.___x_], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], edi
mov ebx, str.___x_
je 0x78349397
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7834938b
mov esi, dword [ebx + 4]
jmp 0x78349379
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x78349369
cmp dword [ebp - 0xc], 4
jne 0x78349369
cmp dword [ebp - 8], edi
mov ecx, dword [esi + 4]
mov eax, dword [ebp + 8]
je 0x78349361
or dword [eax + 0xa0], ecx
jmp 0x78349369
not ecx
and dword [eax + 0xa0], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x7834932d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], edi
add ebx, 8
cmp dword [ebx], edi
jne 0x78349310
pop esi
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret 4
Function at 0x7834ad8a
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x783ab393
call fcn.783a76f8
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [esi], edi
mov dword [eax], edi
cmp dword [ecx + 0x54], edi
je 0x7834ae2e
push dword [ebp + 8]
call sym.MFC80U.DLL_Ordinal_3349
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x7834adc4
xor eax, eax
call fcn.783a77d0
ret 0x10
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 8]
push ecx
push edi
lea ecx, [ebp + 0x10]
push ecx
mov dword [ebp - 4], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push dword [ebp + 0xc]
mov dword [ebp + 0x10], edi
push eax
mov dword [ebp + 8], edi
call ebx
cmp eax, edi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
jne 0x7834ae21
push ecx
call sym.MFC80U.DLL_Ordinal_762
pop ecx
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [esi], eax
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call ebx
cmp eax, edi
jne 0x7834ae21
xor edi, edi
inc edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x7834adbc
push dword [esi]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov dword [esi], edi
jmp 0x7834ae14
push edi
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push dword [ebp + 8]
push eax
call sym.MFC80U.DLL_Ordinal_3104
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax - 0xc]
cmp ebx, edi
mov dword [ebp + 8], ebx
jne 0x7834ae5f
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.78303c47
jmp 0x7834ae1d
mov ecx, dword [ebp + 0x14]
mov eax, ebx
shr eax, 1
push eax
mov dword [ecx], eax
call sym.MFC80U.DLL_Ordinal_762
cmp ebx, edi
pop ecx
mov dword [esi], eax
jle 0x7834aead
lea eax, [edi + 1]
push eax
lea ecx, [ebp + 0xc]
call sym.MFC80U.DLL_Ordinal_860
mov bx, ax
dec bl
shl bl, 4
push edi
lea ecx, [ebp + 0xc]
sub bl, 0x41
call sym.MFC80U.DLL_Ordinal_860
mov cx, ax
mov eax, edi
cdq
sub eax, edx
mov edx, dword [esi]
add cl, bl
sar eax, 1
inc edi
inc edi
cmp edi, dword [ebp + 8]
mov byte [eax + edx], cl
jl 0x7834ae75
xor edi, edi
inc edi
jmp 0x7834ae52
Function at 0x7834afd3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
cmp dword [ebx + 0x54], 0
push esi
push edi
je 0x7834b019
push dword [ebp + 8]
call sym.MFC80U.DLL_Ordinal_3349
mov esi, eax
test esi, esi
je 0x7834b089
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x7834b089
mov edi, dword [ebp + 0x14]
xor ecx, ecx
push 2
pop edx
lea eax, [edi + edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sym.MFC80U.DLL_Ordinal_762
mov esi, eax
xor eax, eax
test edi, edi
pop ecx
jbe 0x7834b06a
mov ecx, dword [ebp + 0x10]
add ecx, eax
mov dl, byte [ecx]
and dl, 0xf
movzx dx, dl
add dx, 0x41
mov word [esi + eax*4], dx
mov cl, byte [ecx]
shr cl, 4
movzx cx, cl
add cx, 0x41
mov word [esi + eax*4 + 2], cx
inc eax
cmp eax, edi
jb 0x7834b03d
and word [esi + eax*4], 0
push esi
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
call sym.MFC80U.DLL_Ordinal_6302
push esi
mov edi, eax
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x7834c1bc
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0xfec]
mov eax, 0x106c
call fcn.783a79b0
mov eax, dword [0x783c8018]
xor eax, ebp
mov dword [ebp + 0xfe8], eax
mov eax, dword [ebp + 0xff4]
mov dword [ebp - 0x64], ecx
mov ecx, dword [ebp + 0xff8]
push ebx
mov dword [ebp - 0x80], ecx
mov ebx, edx
xor ecx, ecx
cmp ebx, ecx
push esi
push edi
mov dword [ebp - 0x70], eax
je 0x7834c2b0
cmp eax, ecx
je 0x7834c2b0
mov esi, dword [ebp + 0xffc]
and esi, 0x2e000000
test dword [ebp + 0xffc], 0x90000000
mov dword [ebp - 0x6c], 0x824
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
je 0x7834c250
cmp dword [ebx + 0x30], ecx
je 0x7834c250
test dword [ebp + 0xffc], 0x2000000
je 0x7834c249
mov dword [ebp - 0x78], 1
jmp 0x7834c250
mov dword [ebp - 0x74], 0x80000000
mov edi, dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
push esi
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push eax
call edi
test eax, eax
jne 0x7834c2cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x7834c2b0
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sym.MFC80U.DLL_Ordinal_762
test eax, eax
pop ecx
mov dword [ebp - 0x7c], eax
je 0x7834c2b0
push esi
lea ecx, [ebp - 0x6c]
push ecx
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x68], 1
call edi
test eax, eax
jne 0x7834c2d1
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0xfe8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.783a505e
add ebp, 0xfec
leave
ret 0xc
lea edi, [ebp - 0x60]
jmp 0x7834c2d4
mov edi, dword [ebp - 0x7c]
push ebx
push dword [ebp - 0x74]
xor esi, esi
push esi
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp dword [ebp - 0x78], esi
mov dword [ebp - 0x70], eax
je 0x7834c312
push 0x2100000
push esi
push esi
push dword [ebx + 0x2c]
call dword [sym.imp.SHLWAPI.dll_UrlUnescapeW]
test eax, eax
jge 0x7834c306
cmp dword [ebp - 0x68], esi
je 0x7834c2b0
push edi
jmp 0x7834c2a9
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebx + 0x30], eax
cmp dword [ebp - 0x68], esi
je 0x7834c31f
push edi
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, dword [ebp - 0x70]
cmp eax, esi
jne 0x7834c331
mov ecx, dword [ebp - 0x64]
mov dword [ecx], 0x1000
jmp 0x7834c2b2
mov cx, word [ebx + 0x18]
mov edx, dword [ebp - 0x80]
mov word [edx], cx
mov ebx, dword [ebx + 0xc]
dec ebx
mov ecx, dword [ebp - 0x64]
je 0x7834c398
dec ebx
je 0x7834c38d
dec ebx
je 0x7834c382
dec ebx
je 0x7834c377
dec ebx
je 0x7834c36c
dec ebx
je 0x7834c361
dec ebx
jne 0x7834c329
mov dword [ecx], 0x1002
jmp 0x7834c2b2
mov dword [ecx], 0x1006
jmp 0x7834c2b2
mov dword [ecx], 0x1001
jmp 0x7834c2b2
mov dword [ecx], 0x100b
jmp 0x7834c2b2
mov dword [ecx], 3
jmp 0x7834c2b2
mov dword [ecx], 2
jmp 0x7834c2b2
mov dword [ecx], 1
jmp 0x7834c2b2
Function at 0x7834c5ee
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], sym.MFC80U.DLL_Ordinal_3219
jne 0x7834c617
call sym.MFC80U.DLL_Ordinal_1079
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 8], eax
jne 0x7834c63a
push eax
push dword [esi + 4]
call sym.MFC80U.DLL_Ordinal_1175
push esi
push eax
call fcn.7834c133
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x7834d4ff
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x783ab345
call fcn.783a76f8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x18]
mov ebx, dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push ebx
call sym.MFC80U.DLL_Ordinal_417
and dword [ebp - 4], 0
lea edi, [esi + 0x18]
push 0x783c8d10
mov ecx, edi
mov dword [esi], sym.MFC80U.DLL_Ordinal_3202
call sym.MFC80U.DLL_Ordinal_269
push dword [ebp + 0xc]
mov ecx, edi
mov byte [ebp - 4], 1
call sym.MFC80U.DLL_Ordinal_6014
push dword [esi + 8]
mov eax, dword [ebp + 0x20]
mov ebx, dword [ebx + 8]
neg eax
sbb eax, eax
and eax, 0x8000000
push eax
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x7834d587
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
call sym.MFC80U.DLL_Ordinal_1175
push dword [esi + 0xc]
push eax
call fcn.7834c133
mov eax, esi
call fcn.783a77d0
ret 0x1c

Function at 0x7834d8dc
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x783ab368
call fcn.783a76f8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x18]
mov edi, dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push edi
call sym.MFC80U.DLL_Ordinal_417
and dword [ebp - 4], 0
push dword [esi + 8]
mov dword [esi], sym.MFC80U.DLL_Ordinal_3205
mov edi, dword [edi + 8]
push 0
push 2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x7834d936
push eax
push dword [esi + 8]
call sym.MFC80U.DLL_Ordinal_1175
push dword [esi + 0xc]
push eax
call fcn.7834c133
mov eax, esi
call fcn.783a77d0
ret 0x18
Function at 0x7834dc64
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x783ab345
call fcn.783a76f8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sym.MFC80U.DLL_Ordinal_417
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push 0x783c8d10
mov dword [esi], sym.MFC80U.DLL_Ordinal_3213
call sym.MFC80U.DLL_Ordinal_269
mov byte [ebp - 4], 1
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x7834dccf
push eax
push dword [esi + 8]
call sym.MFC80U.DLL_Ordinal_1175
push dword [esi + 0xc]
push eax
call fcn.7834c133
mov eax, esi
call fcn.783a77d0
ret 0x18

Function at 0x7834dce2
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x783ab345
call fcn.783a76f8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call sym.MFC80U.DLL_Ordinal_417
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push 0x783c8d10
mov dword [esi], sym.MFC80U.DLL_Ordinal_3213
call sym.MFC80U.DLL_Ordinal_269
mov byte [ebp - 4], 1
push dword [esi + 8]
mov edi, dword [edi + 8]
push dword [ebp + 0x10]
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x7834dd4e
push eax
push dword [esi + 8]
call sym.MFC80U.DLL_Ordinal_1175
push dword [esi + 0xc]
push eax
call fcn.7834c133
mov eax, esi
call fcn.783a77d0
ret 0x1c

Function at 0x7834feb3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x783acfbd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x783c8018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 8
push dword [ebp + 8]
lea ecx, [esp + 0x14]
call sym.MFC80U.DLL_Ordinal_497
xor esi, esi
mov dword [esp + 0x28], esi
call sym.MFC80U.DLL_Ordinal_6693
mov edi, eax
cmp dword [edi + 8], esi
jne 0x7834ff03
call sym.MFC80U.DLL_Ordinal_6334
mov eax, dword [edi + 8]
mov ecx, dword [eax]
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x28]
push eax
call dword [ecx + 0x30]
push eax
call sym.MFC80U.DLL_Ordinal_6332
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4