joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477249
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x5e7adc
call fcn.005b146f
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x4772f1
push dword [ebp + 8]
call fcn.00477574
mov dword [ebp - 0x10], eax
test eax, eax
je 0x477383
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x4772da
push ecx
call fcn.0048593a
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4772da
xor edi, edi
inc edi
jmp 0x4772e4
push dword [ebx]
call fcn.00485943
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.0042c180
jmp 0x477381
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x5f7a84]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x477379
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.0048593a
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x477373
mov esi, dword [ebp + 0x10]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402d0f
lea ecx, [edi + edi]
mov bl, al
push ecx
lea ecx, [ebp - 0x10]
call fcn.00402d0f
mov ecx, dword [esi]
shl bl, 4
sub bl, 0x51
add al, bl
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
cmp edi, dword [eax]
jb 0x47733e
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.0040248c
mov eax, edi
call fcn.005b143d
ret 0x10

Function at 0x47738b
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4773de
push esi
push dword [ebp + 8]
call fcn.00477574
mov edi, eax
test edi, edi
je 0x4773d9
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4773d9
mov eax, dword [ebp - 8]
jmp 0x4773f0
mov eax, dword [ebp + 0x10]
jmp 0x4773f0
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x4773f6
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7b09
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.005b15f0
mov eax, dword [0x660ff8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
cmp dword [ecx + 0x58], ebx
je 0x477527
push ebx
push edx
call fcn.00477574
mov ebx, eax
test ebx, ebx
jne 0x47745e
push esi
jmp 0x47754f
lea ecx, [ebp - 0x2014]
call fcn.004024ae
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x4774e6
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.00402180
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.004690ac
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x477514
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.0040238e
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.0040248c
jmp 0x477556
push esi
mov ecx, edi
call fcn.00403118
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x47750d
test esi, esi
jne 0x477530
mov esi, 0x62bf34
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.00403118
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0d47
leave
ret 0x10

Function at 0x47af36
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x47af75
call fcn.0048244e
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47af75
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47af7d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00483a75
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x47b979
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x47ba05
cmp dword [esi + 0x20], 0
je 0x47ba05
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47ba05
cmp dword [ebp + 8], 0
je 0x47ba05
xor edi, edi
mov ebx, edi
call fcn.0048244e
push 0x5faaa0
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x47b9e9
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47ba05
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00503654
mov edi, eax
add esp, 0xc
test edi, edi
je 0x47ba01
mov ecx, esi
call fcn.0047b717
mov eax, edi
jmp 0x47ba07
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x480360
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5e6ef6
call fcn.005b146f
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x480386
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4803e0
lea ecx, [ebp - 0x10]
call fcn.004024ae
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5f7a84]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.005c3889
push eax
call fcn.00403358
add esp, 0x14
test esi, esi
je 0x4803d3
push esi
call fcn.005bc57a
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040248c
mov eax, ebx
call fcn.005b143d
ret 8

Function at 0x4826fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x482744
call fcn.0048244e
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x482744
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x482751
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x48278d
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x482770
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x482779
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x48278b
test di, di
jne 0x48278b
test dx, dx
je 0x48278d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x482792
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x4827bd
cmp dword [esi + 0x80], 0
jne 0x4827bd
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.0048244e
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4827ed
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4827ed
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.00482a59
jmp 0x4827ef
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4827f6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.0048244e
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x482836
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x482836
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0048283e
jmp 0x482838
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x482b2e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x5e80d8
call fcn.005b14d8
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.0048244e
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x482b8d
call fcn.0048244e
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x482ba1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x482b9d
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x482ba9
or eax, 0xffffffff
jmp 0x482cfb
mov ecx, edi
call fcn.00483138
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.00479c0c
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x482c35
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x482c35
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x482c35
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.00467cc3
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x482c32
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x5f7a84]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x482c32
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004804a0
test eax, eax
je 0x482c32
push 0
mov ecx, esi
call fcn.0047fdc0
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.0047988f
push ebx
call fcn.0047afa3
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00482ad1
test eax, eax
jne 0x482c7e
cmp dword [edi + 0x9c], eax
jne 0x482c7e
call fcn.0048244e
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.0047afa3
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.00482ad1
and dword [edi + 0x9c], 0
jmp 0x482ca9
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x482cbd
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0047fdc0
test esi, esi
je 0x482cca
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x482ce0
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x482ce0
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x5f7a84]
mov ecx, edi
call esi
mov ecx, edi
call fcn.004830ef
mov eax, dword [edi + 0x68]
call fcn.005b143d
ret
Function at 0x48441a
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x5e81b6
call fcn.005b146f
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push edi
push ebx
call fcn.00484504
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.004024ae
mov byte [ebp - 4], 1
test edi, edi
jne 0x48445c
xor eax, eax
jmp 0x484463
push edi
call fcn.005bc57a
pop ecx
push eax
push edi
lea ecx, [esi + 0x18]
call fcn.00402234
push dword [esi + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [ebx + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
je 0x4844a6
push dword [esi + 0xc]
mov ecx, 0x668c5c
push eax
call fcn.00485635
mov eax, esi
call fcn.005b143d
ret 0x18
push 0
push dword [esi + 8]
call fcn.00484c20
int3

Function at 0x48461d
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x484646
call fcn.0048244e
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x484673
push esi
push eax
mov ecx, 0x668c5c
call fcn.00485635
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.00484c20
int3
Function at 0x485449
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
jne 0x48548a
push 0x1000
call fcn.0048569a
test eax, eax
je 0x4854a2
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [esi + 0x40]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x48552f
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
mov dword [esi + 0x3c], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x3c]
add ecx, edx
push edi
mov edi, dword [ebp + 8]
lea ebx, [eax*2 - 2]
jmp 0x4854eb
xor eax, eax
jmp 0x485505
cmp edx, dword [esi + 0x44]
jb 0x4854d3
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [esi + 0x40]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x48552b
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
test eax, eax
je 0x48550b
and dword [esi + 0x3c], 0
mov ecx, dword [esi + 0x40]
mov al, byte [ecx]
cmp al, 0xd
je 0x4854dd
mov byte [edi], al
inc edi
dec ebx
mov edx, dword [esi + 0x3c]
inc edx
mov dword [esi + 0x3c], edx
mov al, byte [ecx]
inc ecx
cmp al, 0xa
je 0x4854ef
test ebx, ebx
jne 0x4854a6
and ebx, 1
add ebx, 2
push ebx
push 0
push edi
call fcn.005b4d50
mov eax, dword [ebp + 8]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 8
and ebx, 1
add ebx, 2
push ebx
push 0
push edi
call fcn.005b4d50
sub edi, dword [ebp + 8]
add esp, 0xc
neg edi
sbb edi, edi
and edi, dword [ebp + 8]
mov eax, edi
jmp 0x485504
push 0
jmp 0x485530
push ebx
push dword [esi + 0x20]
call fcn.00484c20
int3

Function at 0x485745
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 1
je 0x4857ec
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4857ec
cmp dword [esi + 0x34], 0
mov edi, dword [ebp + 0xc]
jne 0x485789
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4857f0
cmp dword [ebp - 4], edi
jne 0x4857f0
pop edi
pop esi
leave
ret 8
mov edx, dword [esi + 0x30]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x2c]
jb 0x4857ad
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 0x34]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4857f0
and dword [esi + 0x30], 0
xor edx, edx
mov ecx, dword [esi + 0x2c]
cmp edi, ecx
jb 0x4857cb
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x485783
jmp 0x4857f0
lea eax, [edx + edi]
cmp eax, ecx
ja 0x485783
mov eax, dword [esi + 0x34]
sub ecx, edx
push edi
push dword [ebp + 8]
add eax, edx
push ecx
push eax
call fcn.0040cda2
add esp, 0x10
add dword [esi + 0x30], edi
jmp 0x485783
push 6
jmp 0x4857f2
push 0
push dword [esi + 0x20]
call fcn.00484c20
int3
Function at 0x4877e2
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], ecx
inc eax
inc ebx
mov dword [ebp - 4], eax
cmp dword [edi + 8], ebx
jle 0x487859
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x48781f
mov eax, dword [ecx + 0x10]
cmp dword [eax + ebx*8 + 4], edx
je 0x48781f
mov eax, dword [edi + 0xc]
cmp dword [eax + ebx*4], 0
je 0x48784c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x48784f
mov eax, dword [edi + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x487845
mov eax, dword [eax]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f7a84]
mov ecx, dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
and dword [eax + ebx*4], 0
mov eax, dword [ebp - 4]
inc ebx
cmp ebx, dword [edi + 8]
jl 0x487802
test eax, eax
je 0x48789b
lea esi, [ecx + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebp - 8]
push edi
lea ecx, [ebx + 0x14]
call fcn.00487acc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x5f7a84]
mov ecx, edi
call esi
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x487b1e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x5e84f9
call fcn.005b14d8
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x487c15
cmp edi, dword [ebx + 0xc]
jge 0x487c15
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x487b75
cmp edi, dword [esi + 8]
jl 0x487c03
cmp dword [ebp + 0xc], 0
je 0x487c03
xor edi, edi
jmp 0x487ba7
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.004875e1
mov esi, eax
test esi, esi
je 0x487b8f
mov dword [esi], vtable.CThreadData.0
jmp 0x487b91
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.004622e0
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x487bc3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x487bcf
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x487c3c
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.005b4d50
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x487c15
cmp edi, dword [esi + 8]
jge 0x487c15
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.005b143d
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0046760b
int3
Function at 0x49b4d9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x49b4f2
call fcn.0048244e
mov esi, dword [eax + 0xc]
push 0x5fc474
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x49b534
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49b534
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x49b534
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0049b53d
jmp 0x49b536
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x501860
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x50188a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x501890
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.00404af7
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0050f566
int3

Function at 0x501b6b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x501b7c
xor eax, eax
jmp 0x501b98
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x501b9d
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.00404af7
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0050f566
int3

Function at 0x501c0f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x5f7a84]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x501c42
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.00404af7
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0050f566
int3

Function at 0x501d1b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x501d46
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x501d4c
cmp dword [ebp - 4], esi
jne 0x501d63
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.00404af7
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.0050f566
lea ecx, [edi + 0xc]
call fcn.00404af7
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0050f1bc
int3