joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4186e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [edx]
mov eax, ecx
mov dword [eax], esi
mov esi, dword [edx + 4]
mov dword [eax + 4], esi
mov esi, dword [edx + 8]
mov dword [eax + 8], esi
mov esi, dword [edx + 0xc]
mov dword [eax + 0xc], esi
mov esi, dword [edx + 0x10]
mov dword [eax + 0x10], esi
mov edx, dword [edx + 0x14]
mov dword [eax + 0x14], edx
mov dl, byte [ecx]
pop esi
xor eax, eax
lea ebx, [ebx]
xor byte [eax + ecx + 4], dl
add eax, 8
cmp eax, 0x10
jl 0x418710
mov dl, byte [ecx + 1]
mov eax, 2
xor byte [eax + ecx + 4], dl
add eax, 8
cmp eax, 0x10
jl 0x418724
mov dl, byte [ecx + 2]
mov eax, 4
jmp 0x418740
xor byte [eax + ecx + 4], dl
add eax, 8
cmp eax, 0x10
jl 0x418740
mov dl, byte [ecx + 3]
mov eax, 6
xor byte [eax + ecx + 4], dl
add eax, 8
cmp eax, 0x10
jl 0x418754
mov dl, byte [ecx + 0x17]
mov eax, 1
jmp 0x418770
xor byte [eax + ecx + 4], dl
add eax, 8
cmp eax, 0x10
jl 0x418770
mov dl, byte [ecx + 0x16]
mov eax, 3
xor byte [eax + ecx + 4], dl
add eax, 8
cmp eax, 0x10
jl 0x418784
mov dl, byte [ecx + 0x15]
mov eax, 5
jmp 0x4187a0
xor byte [eax + ecx + 4], dl
add eax, 8
cmp eax, 0x10
jl 0x4187a0
mov dl, byte [ecx + 0x14]
mov eax, 7
xor byte [eax + ecx + 4], dl
add eax, 8
cmp eax, 0x10
jl 0x4187b4
ret

Function at 0x418ca0
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
xor ecx, ecx
push esi
push edi
mov edi, edx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
lea esi, [edi + 4]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x418cc0
push 0x14
mov edx, 9
mov ecx, edi
call fcn.004f1800
push 0x14
mov edx, 0x13
mov ecx, edi
call fcn.004f17f0
mov cl, byte [edi]
mov dword [edi + 0x14], eax
xor eax, eax
lea ecx, [ecx]
xor byte [eax + esi], cl
add eax, 8
cmp eax, 0x10
jl 0x418cf0
mov cl, byte [edi + 1]
mov eax, 2
xor byte [eax + esi], cl
add eax, 8
cmp eax, 0x10
jl 0x418d03
mov cl, byte [edi + 2]
mov eax, 4
xor byte [eax + esi], cl
add eax, 8
cmp eax, 0x10
jl 0x418d16
mov cl, byte [edi + 3]
mov eax, 6
lea esp, [esp]
xor byte [eax + esi], cl
add eax, 8
cmp eax, 0x10
jl 0x418d30
mov cl, byte [edi + 0x17]
mov eax, 1
xor byte [eax + esi], cl
add eax, 8
cmp eax, 0x10
jl 0x418d43
mov cl, byte [edi + 0x16]
mov eax, 3
xor byte [eax + esi], cl
add eax, 8
cmp eax, 0x10
jl 0x418d56
mov cl, byte [edi + 0x15]
mov eax, 5
lea esp, [esp]
xor byte [eax + esi], cl
add eax, 8
cmp eax, 0x10
jl 0x418d70
mov cl, byte [edi + 0x14]
mov eax, 7
xor byte [eax + esi], cl
add eax, 8
cmp eax, 0x10
jl 0x418d83
pop edi
pop esi
ret
Function at 0x4529d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x44
call fcn.00609610
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0x61b564
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call fcn.0050d7e0
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x1c], edi
call fcn.0050c700
mov ecx, dword [esi + 0x78]
call fcn.004fb200
mov ebp, eax
cmp ebp, edi
je 0x452b4c
mov ecx, ebp
call fcn.00453150
mov ebx, eax
cmp ebx, 0x5d
je 0x452ab8
cmp ebx, 0x5e
je 0x452ab8
cmp ebx, 0x60
je 0x452a53
cmp ebx, 0x61
jne 0x452b3b
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0x9c]
push eax
push ecx
mov ecx, ebp
call fcn.00453140
mov ecx, dword [esi]
push eax
lea edx, [esp + 0x28]
push edx
call fcn.004ad110
push 1
push 0x20
mov ecx, 0x675cb0
call fcn.004e1e00
cmp eax, edi
je 0x452b2f
mov dword [eax], 0x6216b0
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0xc], ebx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x10], ecx
mov edx, dword [esp + 0x28]
mov dword [eax + 0x14], edx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0x18], ecx
jmp 0x452b31
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 0x10]
mov esi, dword [eax + 4]
cmp esi, edi
je 0x452ad9
mov ecx, ebp
call fcn.00453130
cmp eax, dword [esi + 0xc]
je 0x452af1
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x452ac6
lea ecx, [esp + 0x10]
call fcn.004e6380
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 8
push 1
push 0x20
mov ecx, 0x675cb0
call fcn.004e1e00
cmp eax, edi
je 0x452b2f
mov dword [eax], 0x6216b0
lea ecx, [esi + 0x20]
cmp ecx, edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0xc], ebx
je 0x452b31
mov edx, dword [ecx]
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x14], edx
mov ecx, dword [ecx + 8]
mov dword [eax + 0x18], ecx
jmp 0x452b31
xor eax, eax
lea ecx, [esp + 0x10]
push eax
call fcn.004e61c0
mov ecx, ebp
call fcn.004ecf70
mov ebp, eax
cmp ebp, edi
jne 0x452a32
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push edx
lea edx, [esp + 0x14]
call fcn.00452910
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.004e6380
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8
Function at 0x4bec30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x394
call fcn.00609610
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x34]
push edi
xor edi, edi
push eax
lea ecx, [esp + 0x25c]
xor esi, esi
mov dword [esp + 0x18], edi
call fcn.004be4f0
mov ecx, dword [ebx + 0x34]
push ecx
lea ecx, [esp + 0x74]
call fcn.004be4f0
lea ecx, [esp + 0x4c]
call fcn.004e71a0
lea ecx, [esp + 0x5c]
call fcn.004e71a0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4bec8a
mov edx, dword [eax]
cmp edx, dword [ebx + 0x34]
je 0x4bec9f
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x20]
mov ecx, eax
push ecx
mov ecx, dword [ebx + 0x34]
mov dword [ebp + 0x14], eax
call fcn.00418a20
mov ecx, ebx
call fcn.00461b10
mov ecx, eax
call fcn.004e66f0
test eax, eax
mov dword [esp + 0x10], eax
je 0x4bed2a
jmp 0x4becc0
mov eax, dword [esp + 0x10]
jmp 0x4becc0
mov edx, dword [ebp + 0x14]
add edx, 0x3c
push edx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x264]
push edx
mov ecx, eax
call fcn.004b7220
test eax, eax
jne 0x4bed19
test esi, esi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
je 0x4becfc
cmp eax, edi
jg 0x4becfc
jne 0x4bed19
cmp edx, dword [esp + 0x14]
jbe 0x4bed19
mov ecx, 0x52
lea esi, [esp + 0x258]
lea edi, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
mov esi, 1
mov edi, eax
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x10]
call fcn.004ecf70
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4becb7
lea ecx, [esp + 0x1b8]
call fcn.0052ac30
mov eax, dword [esp + 0x128]
xor esi, esi
cmp eax, esi
je 0x4bed65
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x124]
neg eax
adc ecx, esi
neg ecx
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], ecx
cmp dword [esp + 0x140], esi
mov dword [esp + 0x128], esi
je 0x4bed97
mov edx, dword [esp + 0x138]
mov eax, dword [esp + 0x13c]
neg edx
adc eax, esi
neg eax
mov dword [esp + 0x138], edx
mov dword [esp + 0x13c], eax
cmp dword [ebp + 0x18], esi
mov dword [esp + 0x140], esi
je 0x4bedb6
lea ecx, [esp + 0x78]
push ecx
lea ecx, [esp + 0x1bc]
call fcn.0052aaa0
jmp 0x4bedd9
lea edx, [ebx + 0xb8]
push edx
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x158]
push ecx
lea ecx, [esp + 0x1c4]
call fcn.0052b200
mov edx, dword [esp + 0x1c0]
or edx, dword [esp + 0x1c4]
jne 0x4bee1c
mov eax, dword [esp + 0x1d8]
or eax, dword [esp + 0x1dc]
jne 0x4bee1c
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 1
push esi
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.004be970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x1b8]
push edx
call fcn.0052aaa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4dc860
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [ecx + 0xc0]
jmp fcn.00505750
Function at 0x4ddb50
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
mov eax, 0x190
call fcn.00609610
push esi
lea eax, [esp + 4]
push eax
push 0x101
mov esi, ecx
call sub.WSOCK32.dll_WSAStartup
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
xor ecx, ecx
mov dword [esi + 0x20], eax
mov cx, word [0x65c278]
push ecx
call sub.WSOCK32.dll_htons
push 0
call sub.WSOCK32.dll_htonl
mov dword [0x65c278], 0
pop esi
add esp, 0x190
ret 4

Function at 0x4ddc70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
test esi, esi
push edi
jbe 0x4ddcbe
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp ebp, 0x927c0
ja 0x4ddcc7
push 0
push esi
push edi
push ebx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x4ddcb6
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4ddcc7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 0x64
jmp 0x4ddcba
sub esi, eax
add edi, eax
test esi, esi
ja 0x4ddc86
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
Function at 0x4dedf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov ecx, 0x2001
mov dword [esp + 0x14], 0x2000
mov dword [esp + 0x10], ebp
call fcn.004dc530
mov ebx, eax
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x4dee28
cmp eax, 0x2000
jae 0x4dee28
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x34]
lea esp, [esp]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x30]
push 0
push ecx
push ebx
push edx
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x4dee7e
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4dee68
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 0x64
cmp ebp, 0x927c0
jbe 0x4dee30
mov ecx, ebx
call fcn.004dc710
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 0x10
push 1
mov byte [esi + ebx], 0
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
push esi
push ebx
call dword [eax + 0x30]
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x3c]
mov eax, dword [ebp + 8]
add edx, esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], edx
je 0x4deeb4
cmp eax, esi
jbe 0x4deed6
sub eax, esi
mov dword [ebp + 8], eax
xor ebp, ebp
jmp 0x4dee30
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4deecf
push 1
mov ecx, eax
mov edx, dword [ecx]
push 0xf
push 0x65c2ac
call dword [edx + 0x54]
test eax, eax
je 0x4deed6
xor ebp, ebp
jmp 0x4dee30
mov ecx, ebx
call fcn.004dc710
mov eax, dword [ebp + 4]
test eax, eax
je 0x4def3c
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4deef4
mov ecx, eax
mov eax, dword [ecx]
call dword [eax + 0x50]
jmp 0x4deef6
xor eax, eax
mov ecx, dword [esp + 0x10]
push 0
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.0051cbc0
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
push 1
call dword [edx + 0x14]
lea ecx, [esp + 0x18]
call fcn.0051ca60
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0051ca50
mov edi, dword [edi + 0xc]
mov edx, dword [edi]
push 1
push esi
push eax
mov ecx, edi
call dword [edx + 0x30]
lea ecx, [esp + 0x18]
call fcn.0051cb80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0x10

Function at 0x4def50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push edi
mov ecx, 0x400
call fcn.004dc530
mov edi, dword [esp + 0xc]
push 0
push 0x400
mov esi, eax
push esi
push edi
call sub.WSOCK32.dll_recv
test eax, eax
je 0x4def8b
cmp eax, 0xffffffff
je 0x4def8b
push 0
push 0x400
push esi
push edi
call sub.WSOCK32.dll_recv
test eax, eax
jne 0x4def74
mov ecx, esi
call fcn.004dc710
pop edi
pop esi
ret 4
Function at 0x4e0110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x75e4f4]
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, ecx
je 0x4e012d
mov esi, dword [eax + 4]
mov dword [esp + 0x10], esi
jmp 0x4e0133
mov dword [esp + 0x10], ebx
mov esi, ebx
mov ax, word [0x663ac8]
lea ebp, [edi + 0x64]
push ebp
mov ecx, esi
mov word [ebp], ax
call fcn.0051bdf0
cmp word [esi + 0x28], 1
jbe 0x4e016e
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x28]
push 0
push 0x186a0
push ecx
push edx
call fcn.00609a20
movzx ebx, word [esi + 0x28]
dec ebx
imul ebx, eax
mov ecx, dword [edi + 0x70]
mov eax, dword [esi + 0x40]
movsx edx, word [ecx + 0x26]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x20]
sub eax, edx
movsx edx, word [ecx + 0x24]
sub eax, edx
cmp dword [esp + 0x14], eax
jle 0x4e01af
movsx edx, word [ecx + 0x26]
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x10]
sub eax, edx
movsx edx, word [ecx + 0x24]
sub eax, edx
imul eax, eax, 0x2710
cdq
idiv dword [esp + 0x14]
jmp 0x4e01b5
mov ax, word [0x663ac8]
movsx edx, word [ecx + 0x2a]
mov word [esp + 0x14], ax
mov eax, dword [ecx + 0x1c]
sub eax, edx
movsx edx, word [ecx + 0x28]
sub eax, edx
cmp dword [esi + 0x3c], eax
jle 0x4e01e9
movsx edx, word [ecx + 0x2a]
mov eax, dword [ecx + 0x1c]
movsx ecx, word [ecx + 0x28]
sub eax, edx
sub eax, ecx
imul eax, eax, 0x2710
cdq
idiv dword [esi + 0x3c]
jmp 0x4e01ef
mov ax, word [0x663ac8]
movzx edx, word [esp + 0x14]
movzx ecx, ax
sub edx, ecx
jns 0x4e0206
mov dx, word [esp + 0x14]
mov word [ebp], dx
jmp 0x4e020a
mov word [ebp], ax
mov eax, dword [esi + 0x40]
push eax
mov ecx, ebp
call fcn.005192d0
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x3c]
push edx
mov ecx, ebp
mov esi, eax
call fcn.005192d0
push ebx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.005192d0
mov ebp, eax
mov eax, dword [edi + 0x70]
movsx ecx, word [eax + 0x26]
mov edx, dword [eax + 0x20]
sub edx, ecx
movsx ecx, word [eax + 0x24]
sub edx, ecx
lea ecx, [esi + ebp]
cmp ecx, edx
jle 0x4e025e
movsx edx, word [eax + 0x26]
mov esi, dword [eax + 0x20]
movsx eax, word [eax + 0x24]
sub esi, edx
sub esi, eax
sub esi, ebp
mov eax, dword [edi + 0x70]
mov eax, dword [eax + 0x20]
mov ecx, dword [edi + 0x78]
sub eax, esi
sub eax, ebp
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [edi + 0x70]
mov eax, dword [eax + 0x1c]
sub eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
sar ebx, 1
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x20], esi
call fcn.00517010
mov eax, dword [edi + 0x70]
mov eax, dword [eax + 0x1c]
mov ecx, dword [edi + 0x74]
add ebx, esi
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], ebp
call fcn.00517010
movzx ecx, word [0x663ac8]
movzx edx, word [edi + 0x64]
sub edx, ecx
lea eax, [edi + 0x64]
je 0x4e02d4
mov ecx, dword [esp + 0x10]
push eax
call fcn.0051bdf0
mov eax, dword [esp + 0x10]
push eax
mov ecx, edi
call fcn.004dfd80
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4e16b0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov eax, 0x450
call fcn.00609610
push ebx
push ebp
push esi
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
xor ebx, ebx
push 0x626de8
mov dword [esp + 0x34], 0x626de4
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x1c], esi
je 0x4e1835
push edi
push ebp
push ebp
push 3
push ebp
push ebp
push ebp
push str.experts.tallysolutions.com
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
cmp edi, ebp
mov dword [esp + 0x1c], edi
je 0x4e182d
mov dword [esp + 0x10], ebp
call fcn.006095b1
push eax
lea eax, [esp + 0x30]
push 0x61c22c
push eax
call fcn.006097c6
lea eax, [esp + 0x38]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e1733
lea ecx, [esp + 0x60]
sub eax, edx
push str.TallyShop.php
push ecx
mov ebx, eax
call fcn.006097c6
add esp, 8
push ebp
push 0x84200000
lea edx, [esp + 0x2c]
push edx
push ebp
push ebp
lea eax, [esp + 0x74]
push eax
push 0x626db4
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ebp, eax
test ebp, ebp
je 0x4e1822
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x4e181b
lea ecx, [esp + 0x14]
push ecx
push 0x3ff
lea edx, [esp + 0x68]
push edx
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4e181b
mov eax, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x30]
lea ecx, [esp + 0x14]
lea esi, [esp + 0x64]
mov byte [esp + eax + 0x64], 0
call fcn.004e2360
mov eax, dword [esp + 0x14]
cmp eax, 0x80
jbe 0x4e1841
xor edi, edi
test eax, 0xffffff80
jbe 0x4e17fd
jmp 0x4e17e0
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.0053681a
mov ecx, dword [esp + 0x14]
add esi, 0x80
inc edi
shr ecx, 7
cmp edi, ecx
jb 0x4e17e0
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
call fcn.004dc710
mov esi, dword [esp + 0x20]
mov byte [esp + ebx + 0x60], 0
mov dword [esp + 0x18], 1
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, dword [esp + 0x18]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x450
ret
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x60]
call fcn.0053681a
jmp 0x4e1801
Function at 0x4e28d0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xb0]
test ecx, ecx
je 0x4e28fb
mov dword [eax + 0xb0], 0
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
push 0x7f
push 0x80
mov ecx, eax
call dword [edx + 0x28]
mov ecx, dword [esi + 0x14]
call fcn.0050b010
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x4e2941
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0x10]
call fcn.004ed990
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
call dword [edx + 8]
cmp eax, 1
jne 0x4e2936
push str.Migration_needs_exclusive_access_to_the_company...
push 3
push 0x64
call fcn.004edf70
add esp, 0xc
mov ecx, dword [esi + 0x14]
call fcn.0050b080
inc dword [esi + 0x2c]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x24], 0
pop esi
jmp fcn.00537090

Function at 0x4e9fb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x88
call fcn.00609610
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ea001
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.Version
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ea00b
xor ax, ax
add esp, 0x88
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 8]
push edx
call fcn.00609a1b
add esp, 4
add esp, 0x88
ret

Function at 0x4ed7d0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x18
mov al, byte [ecx]
push ebx
xor ebx, ebx
cmp al, bl
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp + 0x10], ebx
je 0x4ed82b
mov dl, 0x3a
cmp byte [ecx + 1], dl
jne 0x4ed82b
mov ecx, dword [0x757e48]
movsx eax, al
mov al, byte [eax + ecx]
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x19], dl
lea edx, [esp + 8]
push edx
mov byte [esp + 0x1c], al
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
mov byte [esp + 0x26], 0x5c
mov byte [esp + 0x27], bl
push edx
jmp 0x4ed840
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp eax, ebx
pop ebx
jne 0x4ed855
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0x18
ret
mov eax, dword [esp]
imul eax, dword [esp + 4]
imul eax, dword [esp + 8]
xor edx, edx
add esp, 0x18
ret
Function at 0x4ed870
Capabilities:
Create directory

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
mov al, byte [ebp]
test al, al
je 0x4ed8ad
cmp al, 0x5c
jne 0x4ed8b7
cmp byte [ebp + 1], 0x5c
jne 0x4ed8b7
lea eax, [ebp + 2]
push 0x5c
push eax
call fcn.0060a7f0
add esp, 8
test eax, eax
je 0x4ed8ad
inc eax
push 0x5c
push eax
call fcn.0060a7f0
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4ed8bb
mov eax, 3
pop ebp
pop ecx
ret 4
mov dword [esp + 0xc], ebp
push esi
mov eax, ebp
push edi
xor edi, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed8c4
sub eax, edx
lea ecx, [eax + ebp + 1]
cmp ebp, ecx
mov dword [esp + 0xc], ecx
mov esi, ebp
je 0x4ed97d
push ebx
mov bl, byte [esi]
cmp bl, 0x5c
je 0x4ed8eb
test bl, bl
jne 0x4ed937
cmp esi, dword [esp + 0x18]
jbe 0x4ed937
mov al, byte [esi - 1]
cmp al, 0x3a
je 0x4ed937
cmp al, 0x5c
je 0x4ed937
xor edi, edi
push edi
push ebp
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
je 0x4ed916
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x35
mov byte [esi], bl
je 0x4ed946
cmp edi, 0x7b
je 0x4ed962
cmp edi, 5
je 0x4ed96a
test edi, edi
je 0x4ed933
cmp edi, 0xb7
jne 0x4ed97c
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, ecx
jne 0x4ed8e0
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret 4
push ebp
push str.Could_not_create_directory__s_nNetwork_path_not_found_
push 7
push 4
call fcn.004edf70
add esp, 0x10
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret 4
push ebp
push str.Could_not_create_directory__s_nInvalid_directory_name_
jmp 0x4ed970
push ebp
push str.Could_not_create_directory__s_nAccess_denied_
push 3
push 4
call fcn.004edf70
add esp, 0x10
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret 4

Function at 0x4ed990
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, ecx
push esi
call edi
cmp eax, 1
jne 0x4ed9a7
pop edi
xor eax, eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4ed9c9
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call edi
dec eax
neg eax
sbb eax, eax
and eax, 5
pop edi
pop esi
ret

Function at 0x4ed9d0
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
xor eax, eax
cmp ecx, 0x676240
push edi
mov edi, 0x676140
je 0x4ed9e6
mov edi, 0x676240
test ecx, ecx
je 0x4eda16
push ebx
mov ebx, edi
mov esi, ecx
sub ebx, ecx
mov al, byte [esi]
mov byte [ebx + esi], al
inc esi
test al, al
jne 0x4ed9f1
mov eax, ecx
lea esi, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4eda01
sub eax, esi
cmp byte [edi + eax - 1], 0x5c
je 0x4eda16
mov byte [edi + eax], 0x5c
inc eax
push edx
add eax, edi
push 0x61beac
push eax
mov byte [eax], 0
call fcn.006097c6
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
push edi
call esi
cmp eax, 1
jne 0x4eda3d
pop edi
xor eax, eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4eda5f
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call esi
dec eax
neg eax
sbb eax, eax
and eax, 5
pop edi
pop esi
ret