joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b3a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49217b
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4fdca8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
push 1
mov ecx, dword [ebp + 8]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea ecx, [ebp - 0x18]
call fcn.0044bb30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0044bba0
movzx edx, al
test edx, edx
jne 0x44b41b
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0044bb60
mov eax, dword [ebp - 0x2c]
jmp 0x44b510
mov byte [ebp - 0xd], 0
cmp dword [ebp + 0x10], 0
jbe 0x44b445
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.0044bb80
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x44b445
mov byte [ebp - 0xd], 1
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x44b4c3
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x18]
call fcn.0044bb80
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x44b489
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0044bb60
mov eax, dword [ebp - 0x30]
jmp 0x44b510
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.0044bb80
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x102
jne 0x44b4c3
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0044bb60
mov eax, dword [ebp - 0x34]
jmp 0x44b510
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0044b280
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x44b4f7
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0044bb60
mov eax, dword [ebp - 0x38]
jmp 0x44b510
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0044bb60
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x469394
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4fdca8]
jne 0x46939e
repz ret
jmp fcn.00469dda
Function at 0x46ec50
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4983c8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4fdca8]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fdca8]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
cmp esi, ebx
jne 0x46ecab
mov esi, 1
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046927a
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
push 0x1f
push str.boost::filesystem::current_path
lea ecx, [esp + 0x28]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00402725
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push ecx
push edi
push esi
mov byte [esp + 0x58], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
sete dl
movzx eax, dl
push eax
call fcn.0046dde0
add esp, 0xc
cmp dword [esp + 0x34], 0x10
jb 0x46ed2c
mov ecx, dword [esp + 0x20]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor edx, edx
mov dword [ebp + 0x14], 7
mov dword [ebp + 0x10], ebx
mov word [ebp], dx
mov byte [esp + 0x48], 2
call fcn.00473580
mov eax, edi
lea edx, [eax + 2]
jmp 0x46ed50
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x46ed50
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, ebp
call fcn.00452690
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00469394
add esp, 0x38
ret
Function at 0x470550
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4987e0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4fdca8]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fdca8]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x54]
cmp dword [edi + 0x14], 8
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
jb 0x47059c
mov eax, dword [edi]
jmp 0x47059e
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4705bc
push esi
push edi
push ebp
call fcn.0046e420
add esp, 0xc
jmp 0x47070f
test ebx, 0x400
je 0x4706cb
cmp dword [edi + 0x14], 8
jb 0x4705d2
mov edx, dword [edi]
jmp 0x4705d4
mov edx, edi
xor eax, eax
mov word [esp + 0x20], ax
mov eax, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4705f0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.00448910
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], 0
jae 0x470621
lea eax, [esp + 0x20]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [esp + 0x34], 8
mov byte [esp + 0x48], 2
jb 0x470656
mov ecx, dword [esp + 0x20]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor edx, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
cmp esi, 0xffffffff
jne 0x470686
mov eax, dword [esp + 0x1c]
push eax
push edi
push ebp
call fcn.0046e420
add esp, 0xc
jmp 0x47070f
push edi
call fcn.0046b150
add esp, 4
test al, al
jne 0x4706b8
push ebx
push edi
call fcn.0046cf80
add esp, 8
push esi
mov dword [ebp], 9
mov dword [ebp + 4], eax
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47070f
push esi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4706dd
mov dword [esi], 0
call fcn.00477610
mov dword [esi + 4], eax
push ebx
push edi
mov dword [esp + 0x1c], 3
test bl, 0x10
jne 0x4706f4
mov dword [esp + 0x1c], 2
call fcn.0046cf80
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 8
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov eax, ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00469394
add esp, 0x38
ret
Function at 0x470730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 0x14], 8
jb 0x470743
mov eax, dword [esi]
jmp 0x470745
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47076e
mov eax, dword [esp + 0x1c]
push eax
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.0046e420
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x470785
mov dword [edi], 0
call fcn.00477610
mov dword [edi + 4], eax
pop edi
test ebx, 0x400
je 0x4707af
push esi
call fcn.0046b150
add esp, 4
push ebx
push esi
mov dword [esp + 0x10], 4
test al, al
jne 0x4707c6
mov dword [esp + 0x10], 9
jmp 0x4707c6
push ebx
push esi
mov dword [esp + 0x10], 3
test bl, 0x10
jne 0x4707c6
mov dword [esp + 0x10], 2
call fcn.0046cf80
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
add esp, 8
pop esi
mov dword [eax + 4], ecx
mov dword [eax], edx
pop ebx
add esp, 8
ret
Function at 0x475540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4991ba
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4fdca8]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fdca8]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, dword [esp + 0x88]
lea eax, [esp + 0x34]
xor ebp, ebp
push eax
mov esi, ecx
mov dword [esp + 0x18], ebp
call fcn.00474ff0
mov esi, dword [esi + 0x10]
mov dword [esp + 0x80], ebp
cmp dword [esp + 0x54], esi
je 0x47562a
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x34]
cmp esi, 1
jbe 0x4755e1
mov eax, edx
cmp ecx, 8
jae 0x4755bb
lea eax, [esp + 0x34]
movzx eax, word [eax]
cmp eax, 0x2f
je 0x4755c8
cmp eax, 0x5c
jne 0x4755e1
mov eax, edx
cmp ecx, 8
jae 0x4755d3
lea eax, [esp + 0x34]
movzx eax, word [eax + 2]
cmp eax, 0x2f
je 0x4755f4
cmp eax, 0x5c
je 0x4755f4
mov eax, edx
cmp ecx, 8
jae 0x4755ec
lea eax, [esp + 0x34]
cmp word [eax + esi*2 - 2], 0x3a
jne 0x47562a
push 0xffffffffffffffff
xor ecx, ecx
push ebp
lea edx, [esp + 0x3c]
mov word [esp + 0x20], cx
mov esi, 7
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebp
call fcn.004460d0
lea eax, [esp + 0x18]
mov byte [esp + 0x80], 1
lea ebx, [esi - 6]
jmp 0x47564e
mov esi, 7
xor eax, eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebp
mov word [esp + 0x58], ax
mov ebx, 2
lea eax, [esp + 0x58]
mov dword [esp + 0x80], ebx
push 0xffffffffffffffff
xor ecx, ecx
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebp
push ebp
mov word [edi], cx
push eax
mov ecx, edi
mov dword [esp + 0x20], ebx
call fcn.004460d0
or ebx, 4
test bl, 2
je 0x475687
and ebx, 0xfffffffd
cmp dword [esp + 0x6c], 8
jb 0x475687
mov edx, dword [esp + 0x58]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, 1
je 0x4756af
cmp dword [esp + 0x2c], 8
jb 0x4756a0
mov eax, dword [esp + 0x18]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ecx, ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], cx
cmp dword [esp + 0x48], 8
jb 0x4756c3
mov edx, dword [esp + 0x34]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00469394
add esp, 0x70
ret 4

Function at 0x479180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
pop ebp
ret
Function at 0x47b2b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4fdca8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x320]
and ecx, 0xfffffffd
mov edx, dword [ebp + 8]
mov dword [edx + 0x320], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [str.WKNC_Id:_fbput.cpp_51055_2014_05_27_07:52:44Z_jsturton___WORKNC]
mov dword [eax + 0x210], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x214], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x21c], 0xa0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x220], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x224], 0
call fcn.0043c4b0
push eax
mov eax, dword [ebp + 8]
add eax, 0x228
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2a8], 1
mov edx, dword [ebp + 8]
mov byte [edx + 0x2a9], 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x2aa], 0
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x2ac], 0
call fcn.0043c400
neg eax
sbb eax, eax
neg eax
mov edx, dword [ebp + 8]
mov byte [edx + 0x2ab], al
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0x2ab]
test ecx, ecx
je 0x47b39c
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x316]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x21c]
lea eax, [eax + edx + 1]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x21c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x21c]
add eax, 0x80
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x218], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0xa0
push 1
mov ecx, dword [ebp + 8]
add ecx, 0x210
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0xa0
je 0x47b3e2
mov eax, 0xffffffe6
jmp 0x47b460
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x2ab]
test eax, eax
je 0x47b432
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x316]
add ecx, 1
push ecx
push 1
mov edx, dword [ebp + 8]
add edx, 0x2d0
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x316]
add edx, 1
cmp eax, edx
je 0x47b432
mov eax, 0xffffffe6
jmp 0x47b460
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
push 0x80
push 1
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 0x80
je 0x47b45e
mov eax, 0xffffffe6
jmp 0x47b460
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00469394
mov esp, ebp
pop ebp
ret
Function at 0x401058
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x82
call fcn.0040b546
xor edx, edx
pop ecx
cmp dword [ebp + 0xc], edx
jle 0x40109d
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x428610
mov edi, eax
sub esi, ecx
sub edi, ecx
mov cx, word [esi + edx*2 + 0x428610]
xor cx, word [edx*2 + 0x428610]
inc edx
mov word [edi + edx*2 + 0x42860e], cx
cmp edx, dword [ebp + 0xc]
jl 0x40107d
pop edi
pop esi
xor ecx, ecx
mov word [eax + edx*2], cx
pop ebp
ret 8

Function at 0x4020d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x66
call fcn.0040b546
xor edx, edx
pop ecx
cmp dword [ebp + 0xc], edx
jle 0x402116
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x427c78
mov edi, eax
sub esi, ecx
sub edi, ecx
mov cx, word [esi + edx*2 + 0x427c78]
xor cx, word [edx*2 + 0x427c78]
inc edx
mov word [edi + edx*2 + 0x427c76], cx
cmp edx, dword [ebp + 0xc]
jl 0x4020f6
pop edi
pop esi
xor ecx, ecx
mov word [eax + edx*2], cx
pop ebp
ret 8

Function at 0x402120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x76
call fcn.0040b546
xor edx, edx
pop ecx
cmp dword [ebp + 0xc], edx
jle 0x402162
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x4283b0
mov edi, eax
sub esi, ecx
sub edi, ecx
mov cx, word [esi + edx*2 + 0x4283b0]
xor cx, word [edx*2 + 0x4283b0]
inc edx
mov word [edi + edx*2 + 0x4283ae], cx
cmp edx, dword [ebp + 0xc]
jl 0x402142
pop edi
pop esi
xor ecx, ecx
mov word [eax + edx*2], cx
pop ebp
ret 8
Function at 0x4023ee
Capabilities:
Create process on windows

Disassembly:
push 0x868
mov eax, 0x41df6a
call fcn.0040f66e
mov ebx, ecx
mov edi, edx
mov esi, dword [ebp + 8]
mov byte [ebp - 0x831], 1
and dword [ebp - 4], 0
mov dword [ebp - 0x874], 0x3c
mov dword [ebp - 0x870], 0x8040
push 4
push str._w_
call fcn.004020d4
mov dword [ebp - 0x868], eax
push 8
pop edx
cmp dword [edi + 0x14], edx
jb 0x402441
mov eax, dword [edi]
jmp 0x402443
mov eax, edi
mov dword [ebp - 0x864], eax
mov ecx, dword [esi + 0x14]
cmp ecx, edx
jb 0x402454
mov eax, dword [esi]
jmp 0x402456
mov eax, esi
mov dword [ebp - 0x860], eax
cmp dword [ebx + 0x14], edx
jb 0x402465
mov eax, dword [ebx]
jmp 0x402467
mov eax, ebx
mov dword [ebp - 0x85c], eax
and dword [ebp - 0x858], 0
mov dword [ebp - 0x854], 0x1d
cmp ecx, edx
jb 0x402484
mov esi, dword [esi]
cmp dword [edi + 0x14], edx
jb 0x40248d
mov eax, dword [edi]
jmp 0x40248f
mov eax, edi
push esi
push eax
push 0xe
push 0x4275c8
call fcn.004020d4
push eax
lea eax, [ebp - 0x814]
push eax
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
call edi
add esp, 0x10
lea eax, [ebp - 0x814]
push eax
lea esi, [ebp - 0x830]
call fcn.004012ca
mov ebx, esi
call fcn.00402325
xor ebx, ebx
push ebx
push 1
mov ecx, esi
call fcn.00401455
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x402598
cmp dword [ebp - 0x83c], ebx
je 0x402554
push dword [ebp - 0x83c]
push 0x15
push 0x4275e4
call fcn.004020d4
push eax
lea eax, [ebp - 0x814]
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
lea esi, [ebp - 0x830]
call fcn.004012ca
mov ebx, esi
call fcn.00402325
push 0
push 1
mov ecx, esi
call fcn.00401455
push 0xffffffffffffffff
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4025e0
push 0x42399c
push 0x19
push 0x427610
call fcn.004020d4
push eax
lea eax, [ebp - 0x814]
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
lea esi, [ebp - 0x830]
call fcn.004012ca
mov ebx, esi
call fcn.00402325
push 0
push 1
mov ecx, esi
call fcn.00401455
jmp 0x4025e0
cmp byte [0x4299cc], bl
je 0x4025e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x11
push 0x427644
call fcn.004020d4
push eax
lea eax, [ebp - 0x814]
push eax
call edi
add esp, 0xc
push 0x40000
push 3
push 0x427668
call fcn.004020d4
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x831]
call fcn.0040f6bb
ret 4
Function at 0x402777
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x4265d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x12
push 0x427ad4
call fcn.004020d4
push eax
lea esi, [ebp - 0x420]
call fcn.004012ca
xor ebx, ebx
cmp byte [0x4299cc], bl
je 0x4027c3
push 8
push 0x427af8
call fcn.004020d4
push eax
mov eax, esi
push eax
call fcn.0040131e
cmp dword [ebp + 0x38], 8
mov eax, dword [ebp + 0x24]
jae 0x4027cf
lea eax, [ebp + 0x24]
push eax
push 0x13
push 0x427b08
call fcn.004020d4
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
lea esi, [ebp - 0x43c]
call fcn.004012ca
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x40280b
lea eax, [ebp + 8]
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0x444], eax
cmp eax, ebx
je 0x4028c0
cmp dword [ebp - 0x40c], 8
mov eax, dword [ebp - 0x420]
jae 0x402839
lea eax, [ebp - 0x420]
push edi
push ebx
push 0x50
push eax
push dword [ebp - 0x444]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [ebp - 0x440], eax
cmp eax, ebx
je 0x4028b7
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
jae 0x40286f
lea eax, [ebp - 0x43c]
push ebx
push ebx
push ebx
push ebx
push eax
push 3
push 0x427b30
call fcn.004020d4
push eax
push dword [ebp - 0x440]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
cmp esi, ebx
je 0x4028af
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x4028ac
push ebx
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
push esi
call edi
push dword [ebp - 0x440]
call edi
push dword [ebp - 0x444]
call edi
pop edi
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x43c]
call fcn.00401455
push ebx
push esi
lea ecx, [ebp - 0x420]
call fcn.00401455
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.00401455
push ebx
push esi
lea ecx, [ebp + 0x24]
call fcn.00401455
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c14c
leave
ret 0x38

Function at 0x402901
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push ebx
push edi
push 0xa
push eax
push dword [ebp + 8]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi], eax
test eax, eax
jle 0x402959
push eax
call fcn.0040b546
push dword [esi]
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
mov dword [ecx], eax
push eax
call fcn.0040eec0
add esp, 0x10
inc bl
pop edi
mov al, bl
pop ebx
pop ebp
ret 0xc
Function at 0x404911
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4265d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0xffff
mov eax, ebx
push edi
mov edi, ecx
cmp ax, si
jne 0x40493c
xor eax, eax
jmp 0x404aa4
mov ecx, dword [edi + 0x24]
cmp dword [ecx], 0
je 0x404969
mov eax, dword [edi + 0x34]
mov ecx, dword [ecx]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x404969
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 2]
mov dword [edi], ecx
mov word [eax], si
mov ax, si
jmp 0x404aa4
cmp dword [edi + 0x54], 0
jne 0x404976
mov eax, ebx
jmp 0x404aa4
mov eax, edi
call fcn.00405e9e
cmp dword [edi + 0x44], 0
jne 0x40499c
push dword [edi + 0x54]
push esi
call fcn.0040c9aa
pop ecx
cmp ax, bx
pop ecx
movzx eax, si
jne 0x404aa4
jmp 0x40496f
movzx eax, si
lea esi, [ebp - 0x20]
mov dword [ebp - 0x24], eax
call fcn.0040575f
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x404a49
lea eax, [ebp - 0x20]
mov edx, eax
add eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x28]
push ebx
push eax
push edx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x22]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
jl 0x404a94
cmp eax, 1
jg 0x404a51
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x4049f8
lea eax, [ebp - 0x20]
mov esi, dword [ebp - 0x28]
sub esi, eax
je 0x404a1e
cmp dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x20]
jae 0x404a0b
lea eax, [ebp - 0x20]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0040e231
add esp, 0x10
cmp esi, eax
jne 0x404a94
lea eax, [ebp - 0x24]
mov byte [edi + 0x4a], 1
cmp dword [ebp - 0x2c], eax
jne 0x404a83
cmp esi, ebx
ja 0x4049aa
cmp dword [ebp - 0x10], 0x20
push ebx
jae 0x404a95
push 8
pop ebx
lea esi, [ebp - 0x20]
call fcn.004057a3
jmp 0x4049aa
mov edx, dword [ebp - 0x20]
jmp 0x4049bc
cmp eax, 3
jne 0x404a94
push dword [edi + 0x54]
push dword [ebp - 0x24]
call fcn.0040c9aa
movzx esi, word [ebp + 8]
pop ecx
pop ecx
mov ecx, 0xffff
cmp ax, cx
jne 0x404a73
mov esi, ecx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.00405893
jmp 0x404961
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.00405893
mov ax, word [ebp + 8]
jmp 0x404aa4
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.00405893
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c14c
leave
ret 4