joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0
push 0x23
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42b696
xor al, al
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b6a0
mov ecx, dword [ebp + 0xc]
sub eax, edx
add ecx, 0xfffffff4
cmp eax, ecx
jae 0x42b690
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x104]
mov edx, esi
mov ecx, eax
push edi
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42b6c4
lea edi, [esi - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42b6d1
mov dx, word [0x46d3d4]
mov word [edi], dx
lea edi, [esi - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42b6e6
cmp byte [ebp + 0x10], 0
mov eax, dword [0x46c7c0]
mov dword [edi], eax
je 0x42b730
lea edi, [esi - 1]
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42b700
mov cx, word [0x46d3d4]
mov word [edi], cx
lea eax, [esi - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42b715
mov edx, dword [str.cache]
mov dword [eax], edx
mov cx, word [0x46d3a4]
mov word [eax + 4], cx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42f9d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42f9e8
xor al, al
pop ebp
ret 4
and al, 0x10
cmp al, 0x10
sete al
pop ebp
ret 4
Function at 0x42fcd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, ebx
mov dword [ebp - 8], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42fce8
sub eax, edx
cmp eax, 0x104
jbe 0x42fd02
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x104
lea eax, [ebp - 0x10c]
push eax
push ebx
mov ecx, esi
call fcn.0042f8c0
push 0
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, esi
call fcn.0042fa00
test al, al
je 0x42fcf8
push edi
xor edi, edi
mov byte [ebp + 0xb], 0
jmp 0x42fd36
mov esi, dword [ebp - 8]
push 0x467824
push ebx
call fcn.00435aa3
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x42fdb6
push ebx
push str.Unable_to_open__s_for_writing__will_try_again_in_1_sec
call fcn.004372aa
add esp, 8
lea edx, [ebp - 4]
push edx
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0042fc20
mov esi, dword [ebp - 4]
push esi
push str.__s__n
call fcn.004372aa
push esi
call fcn.00434f98
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x19
jb 0x42fd33
push ebx
push str.ERROR:_Couldnt_open__s_for_writing_n
call fcn.00435832
add eax, 0x40
push eax
call fcn.00435d21
mov al, byte [ebp + 0xb]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov byte [ebp + 0xb], 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x10], edi
jbe 0x42fe65
jmp 0x42fdd0
mov esi, dword [ebp + 0x10]
sub esi, edi
cmp esi, 0x8000
jbe 0x42fde2
mov esi, 0x8000
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
push edx
push esi
push 1
push eax
call fcn.00437840
add esp, 0x10
cmp eax, esi
jne 0x42fe1b
add dword [ebp + 0xc], esi
add edi, esi
cmp edi, dword [ebp + 0x10]
jb 0x42fdd0
mov eax, dword [ebp - 4]
push eax
call fcn.00436199
mov al, byte [ebp + 0xb]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push ebx
push edi
push esi
push str.ERROR:_Unable_to_write__li_bytes_at_offset__li_to__s_n
call fcn.00435832
add eax, 0x40
push eax
call fcn.00435d21
add esp, 0x14
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 8]
mov dword [ebp + 0x10], 0
call fcn.0042fc20
mov esi, dword [ebp + 0x10]
push esi
push str.__s__n
call fcn.004372aa
push esi
call fcn.00434f98
mov eax, dword [ebp - 4]
add esp, 0xc
mov byte [ebp + 0xb], 0
push eax
call fcn.00436199
mov al, byte [ebp + 0xb]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42fe80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x3c]
push eax
mov edi, ecx
push esi
mov dword [ebp - 0xc], edi
xor ebx, ebx
mov byte [ebp - 1], 1
call fcn.00436c75
add esp, 8
test eax, eax
jne 0x42fef9
push 0x46e914
push esi
call fcn.00435aa3
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x42ff04
push esi
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.004372aa
add esp, 8
lea ecx, [ebp + 0xc]
push ecx
mov ecx, edi
mov dword [ebp + 0xc], ebx
call fcn.0042fc20
mov esi, dword [ebp + 0xc]
push esi
push str.__s__n
call fcn.004372aa
push esi
call fcn.00434f98
mov eax, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
je 0x42fef9
mov dword [eax], ebx
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx], ebx
xor edi, edi
jmp 0x42ff10
mov esi, dword [ebp - 0x28]
push esi
call fcn.004346fc
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x42ff65
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x1e
jl 0x42ff10
mov edx, dword [ebp + 0xc]
cmp dword [edx], ebx
jne 0x42ff62
mov eax, dword [ebp + 8]
push eax
push str.Cabby:_Unable_to_allocate_memory_to_read__s_to_mem_n
call fcn.00435832
add eax, 0x40
push eax
call fcn.00435d21
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ecx]
test eax, eax
je 0x42ff73
mov dword [eax], esi
test esi, esi
je 0x43002f
jmp 0x42ff80
sub esi, ebx
cmp esi, 0x8000
jbe 0x42ff8f
mov esi, 0x8000
mov edx, dword [ebp - 8]
push edx
push esi
push 1
push edi
call fcn.00435d04
add esp, 0x10
cmp eax, esi
jne 0x42ffc6
mov esi, dword [ebp - 0x28]
add ebx, eax
add edi, eax
cmp ebx, esi
jb 0x42ff80
mov eax, dword [ebp - 8]
push eax
call fcn.00436199
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
push str.Cabby:_Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.00435832
add eax, 0x40
push eax
call fcn.00435d21
add esp, 0x14
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 8], 0
call fcn.0042fc20
mov esi, dword [ebp + 8]
push esi
push str.__s__n
call fcn.00435832
add eax, 0x40
push eax
call fcn.00435d21
push esi
call fcn.00434f98
mov edx, dword [ebp + 0xc]
push edx
call fcn.00434f98
mov eax, dword [ebp + 0x10]
add esp, 0x14
test eax, eax
je 0x43002b
mov dword [eax], 0
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
push eax
call fcn.00436199
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x430065
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x4300a6
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x43007f
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x4300c4
dec esi
je 0x4300bb
dec esi
jne 0x4300c9
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x438bcd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x477690]
jne 0x438bd7
repz ret
jmp fcn.00441c6d

Function at 0x441d73
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x477690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004396aa
and dword [ebp - 0x14], 0
cmp dword [0x489c38], 0
mov dword [ebp - 0x18], eax
jne 0x441e26
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x441ece
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46aecc
push ebx
call edi
test eax, eax
je 0x441ece
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x46aebc
push ebx
mov dword [0x489c38], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x489c3c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x489c40], eax
call edi
push eax
call esi
mov dword [0x489c48], eax
test eax, eax
je 0x441e26
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x489c44], eax
mov eax, dword [0x489c44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x441e7f
cmp dword [0x489c48], ecx
je 0x441e7f
push eax
call esi
push dword [0x489c48]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x441e7f
test ebx, ebx
je 0x441e7f
call edi
test eax, eax
je 0x441e76
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x441e76
test byte [ebp - 8], 1
jne 0x441e7f
or dword [ebp + 0x10], 0x200000
jmp 0x441eb2
mov eax, dword [0x489c3c]
cmp eax, dword [ebp - 0x18]
je 0x441eb2
push eax
call esi
test eax, eax
je 0x441eb2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x441eb2
mov eax, dword [0x489c40]
cmp eax, dword [ebp - 0x18]
je 0x441eb2
push eax
call esi
test eax, eax
je 0x441eb2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x489c38]
call esi
test eax, eax
je 0x441ece
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x441ed0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438bcd
leave
ret
Function at 0x44806d
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x448095
call fcn.00437bb3
and dword [eax], 0
call fcn.00437ba0
mov dword [eax], 0x16
call fcn.0043969a
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4480b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00437bc6
pop ecx
jmp 0x448090
test byte [ebp + 0xc], 0x80
je 0x4480bd
and eax, 0xfffffffe
jmp 0x4480c0
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4480a3
xor eax, eax
pop ebp
ret
Function at 0x44a36b
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
call fcn.0044ab99
lea esi, [edi + 0x10]
call fcn.0044ab99
lea esi, [edi + 0x1c]
call fcn.0044ab99
push dword [ebp + 8]
lea eax, [edi + 4]
push eax
xor ebx, ebx
or eax, 0xffffffff
mov dword [edi + 0x48], ebx
call fcn.0044ac8f
lea eax, [edi + 0x40]
push eax
lea eax, [edi + 0x38]
push eax
lea eax, [edi + 0x30]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x44a463
mov esi, 0x104
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [edi + 0x28]
push eax
push esi
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x44a463
lea eax, [ebp - 0x118]
push eax
lea eax, [edi + 0x10]
push eax
or eax, 0xffffffff
call fcn.0044ac8f
lea eax, [ebp - 0x220]
push eax
lea eax, [edi + 0x1c]
push eax
or eax, 0xffffffff
call fcn.0044ac8f
push esi
lea eax, [ebp - 0x328]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.004369af
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004369af
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0043667a
add esp, 0x30
test eax, eax
jne 0x44a45f
or dword [edi + 0x48], 1
xor eax, eax
jmp 0x44a469
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x44ac00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x64
mov esi, eax
pop ebx
call fcn.0044ab3e
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x44ac26
mov ebx, dword [esi + 8]
add ebx, 0x64
call fcn.0044ab3e
mov eax, dword [esi + 8]
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov dword [ebp - 0xc], eax
cmp eax, 0xea
je 0x44ac1b
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x44ac77
cmp dword [ebp - 8], eax
jbe 0x44ac6b
cmp dword [ebp - 8], 2
jbe 0x44ac63
cmp dword [ebp - 8], 7
jne 0x44ac6b
cmp dword [ebp - 4], eax
je 0x44ac6b
dec dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, esi
call fcn.0044abbe
jmp 0x44ac85
xor ebx, ebx
call fcn.0044ab3e
mov eax, dword [esi]
and dword [esi + 4], ebx
mov byte [eax], bl
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x44aedf
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
ret
Function at 0x44af13
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax + 0x1c]
mov byte [ecx + eax + 0x20], 0x80
inc dword [eax + 0x1c]
cmp ecx, 0x37
mov ecx, dword [eax + 0x1c]
jle 0x44af5d
jmp 0x44af33
mov byte [ecx + eax + 0x20], 0
inc dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0x40
jl 0x44af28
call fcn.0044acbb
jmp 0x44af4a
mov ecx, dword [eax + 0x1c]
mov byte [eax + ecx + 0x20], 0
inc dword [eax + 0x1c]
cmp dword [eax + 0x1c], 0x38
jl 0x44af3f
jmp 0x44af62
mov byte [ecx + eax + 0x20], 0
inc dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0x38
jl 0x44af52
mov ecx, dword [eax + 0x18]
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x58], dl
mov edx, ecx
shr ecx, 8
mov byte [eax + 0x5a], cl
mov cl, byte [eax + 0x18]
shr edx, 0x10
mov byte [eax + 0x5b], cl
mov ecx, dword [eax + 0x14]
mov byte [eax + 0x59], dl
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x5c], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 8
mov byte [eax + 0x5e], cl
mov cl, byte [eax + 0x14]
mov byte [eax + 0x5d], dl
mov byte [eax + 0x5f], cl
jmp fcn.0044acbb
Function at 0x44b463
Capabilities:
Print debug messages

Disassembly:
push edi
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call fcn.0044b0b0
push dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call edi
push str._DONE__r_n
call edi
push dword [esi + 4]
call fcn.00433eea
pop ecx
push dword [esi + 8]
call fcn.00433eea
pop ecx
push dword [esi + 0xc]
call fcn.00433eea
pop ecx
push esi
call fcn.00433eea
pop ecx
pop edi
ret

Function at 0x44b522
Capabilities:
Create http request
Create thread

Disassembly:
push ebx
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push str.VIP_TRACKING
mov dword [esi + 8], edi
call dword [sym.imp.WININET.dll_InternetOpenA]
push edi
push edi
push edi
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, eax
lea eax, [esi + 4]
push eax
push edi
push ebx
push 0x44b4aa
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
mov eax, esi
pop ebx
ret

Function at 0x44bcc4
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
push ebx
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 4], 0x80004005
call fcn.00438870
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x10
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x44bdb6
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edi, [ebp - 0x20c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x44bd29
push esi
mov esi, str..url
movsd dword es:[edi], dword [esi]
push 0x3ff
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x60b]
push ebx
push eax
movsw word es:[edi], word [esi]
mov byte [ebp - 0x60c], bl
call fcn.00438870
push dword [ebp + 0x10]
lea eax, [ebp - 0x60c]
push dword [ebp + 0xc]
push str._InternetShortcut__r_nURL_S_r_nIconFile_S_r_nIconIndex0_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push ebx
push ebx
push 2
push ebx
push ebx
mov edi, eax
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44bdb4
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 0x60c]
push eax
push esi
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], ebx
pop esi
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0xc
Function at 0x44bdbe
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x208], ax
xor esi, esi
lea eax, [ebp - 0x206]
push esi
push eax
call fcn.00438870
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push esi
push esi
push 0x10
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x44be4a
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edi, [ebp - 0x208]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x44be18
mov esi, str..url
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x208]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
je 0x44be4a
shr eax, 4
not eax
and eax, 1
jmp 0x44be4c
xor eax, eax
pop esi
leave
ret 4

Function at 0x44be51
Capabilities:
Create http request
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.Mozilla_4.0__compatible__MSIE_5.5__Windows_NT_5.0_
mov dword [ebp - 8], 0x80004005
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x44bf6b
push esi
push edi
push 8
pop ecx
mov esi, str.Accept:___r_n_r_n
lea edi, [ebp - 0x34]
lea eax, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44be94
push ebx
sub eax, edx
push 0x4000000
sar eax, 1
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x80]
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x44bf5b
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x44bf49
push 0xff
lea eax, [ebp - 0x133]
push ebx
push eax
mov byte [ebp - 0x134], bl
call fcn.00438870
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
mov edi, 0x100
jmp 0x44bf2f
cmp dword [ebp + 8], ebx
je 0x44bf46
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x44bf0f
jmp 0x44bf49
mov dword [ebp - 8], ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
cmp dword [ebp - 8], ebx
jge 0x44bf74
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 8]
pop ebx
leave
ret 8
Function at 0x44bff2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x44c06a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push ebx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
mov eax, dword [edi]
inc eax
push eax
call fcn.004346f1
pop ecx
push edi
push eax
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
je 0x44c06e
cmp dword [ebp + 8], ebx
je 0x44c06a
push dword [ebp + 8]
call fcn.00433eea
pop ecx
xor eax, eax
jmp 0x44c071
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x44c07a
mov ecx, dword [edi]
mov byte [eax + ecx], bl
pop ebx
leave
ret 0xc
Function at 0x44c843
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
xor esi, esi
push esi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44c9d6
push edi
push dword [ebp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call edi
test eax, eax
jne 0x44c9d5
push esi
call fcn.00434a8c
mov dword [ebp - 0xc], eax
xor eax, eax
mov word [ebp - 0x214], ax
mov dword [esp], 0x206
lea eax, [ebp - 0x212]
push esi
push eax
mov dword [ebp - 8], edx
call fcn.00438870
xor eax, eax
push 0x206
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push esi
push eax
call fcn.00438870
lea eax, [ebx + 0xd8]
lea edx, [ebp - 0x214]
add esp, 0x18
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x44c8ec
lea eax, [ebx + 0x2e0]
lea edx, [ebp - 0x41c]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x44c909
push dword [ebx + 0x20]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [ebx + 0x20]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebx + 0x4e8]
push eax
push dword [ebp + 8]
call fcn.00434c6b
pop ecx
pop ecx
test eax, eax
jne 0x44c9c2
add ebx, 0x6f0
push ebx
push dword [ebp + 8]
call fcn.00434c6b
pop ecx
pop ecx
test eax, eax
jne 0x44c9c2
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
call fcn.00434be0
pop ecx
pop ecx
test eax, eax
je 0x44c98c
push dword [ebp + 8]
lea eax, [ebp - 0x41c]
push eax
call fcn.00434be0
pop ecx
pop ecx
test eax, eax
jne 0x44c9d5
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push esi
push str.CasinoTimeStamp
push dword [ebp - 4]
call edi
push str.PCMUID
push dword [ebp + 0xc]
call fcn.00434c6b
pop ecx
pop ecx
test eax, eax
je 0x44c9d5
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push esi
push str.UGUIDTimeStamp
jmp 0x44c9d0
push 8
lea eax, [ebp - 0xc]
push eax
push 0xb
push esi
push 0x46f0c0
push dword [ebp - 4]
call edi
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret 0x14