joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bb88
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x4712b5
call fcn.0044ed89
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x41bc98
cmp byte [esi + 0x41], 0
je 0x41bc98
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x41bbbe
xor al, al
jmp 0x41bc9a
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040981a
mov dword [ebp - 4], edi
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407861
mov ecx, eax
call fcn.00405867
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407861
mov ecx, eax
call fcn.00405867
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x41bc32
dec eax
je 0x41bc36
dec eax
dec eax
je 0x41bc94
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402a7d
mov al, bl
jmp 0x41bc9a
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407861
mov ecx, eax
call fcn.00405867
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x41bc76
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407861
mov ecx, eax
call fcn.00405867
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00452f22
add esp, 0x10
cmp edi, eax
jne 0x41bc1c
cmp byte [esi + 0x41], 0
je 0x41bc94
test edi, edi
jne 0x41bbcc
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00403120
jmp 0x41bbcc
mov bl, 1
jmp 0x41bc1e
mov al, 1
call fcn.0044ee0c
ret

Function at 0x41cd7b
Capabilities:
Get common file path

Disassembly:
push 0x430
mov eax, 0x471501
call fcn.0044edbf
mov edi, dword [ebp + 8]
mov dword [ebp - 0x430], edi
and dword [ebp - 0x42c], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push str.getTempFilename
mov ecx, 0x49baa0
call fcn.004034df
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x424]
push eax
push 0
mov esi, 0x477c34
push esi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x428]
call fcn.00403cf5
mov byte [ebp - 4], 2
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x428]
call fcn.004076e5
push esi
push 0x47a608
lea ecx, [ebp - 0x428]
call fcn.004076e5
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
call fcn.00402e10
mov dword [ebp - 0x42c], ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x428]
call fcn.004028d3
mov eax, edi
jmp 0x41cedb
call fcn.0044ee1b
ret
Function at 0x41eb36
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push 0x260
mov eax, 0x4719f5
call fcn.0044edbf
xor edi, edi
mov dword [ebp - 4], edi
push 0x478d50
mov ecx, 0x49baa0
call fcn.004034df
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
push ecx
mov ecx, esp
mov dword [ebp - 0x25c], esp
lea eax, [ebp + 8]
push eax
call fcn.00402e10
mov byte [ebp - 4], 2
lea eax, [ebp - 0x258]
push eax
mov byte [ebp - 4], bl
call fcn.0041e88d
pop ecx
pop ecx
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 8]
call fcn.004078fa
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x258]
call fcn.004028d3
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x254]
call fcn.00406438
mov byte [ebp - 4], 4
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x254]
call fcn.0041b64b
mov esi, eax
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x254]
call fcn.0041b629
push dword [esi + 4]
push dword [esi]
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x238]
call fcn.0041c1de
mov byte [ebp - 4], 5
cmp dword [ebp - 0x220], 0x10
mov eax, dword [ebp - 0x234]
jae 0x41ec20
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ec61
mov byte [ebp - 4], 4
push edi
push ebx
lea ecx, [ebp - 0x238]
call fcn.00402a7d
mov byte [ebp - 4], bl
push edi
push ebx
lea ecx, [ebp - 0x254]
call fcn.00405a81
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004028d3
xor al, al
call fcn.0044ee1b
ret
test al, 0x10
je 0x41ec96
mov byte [ebp - 4], 4
push edi
push ebx
lea ecx, [ebp - 0x238]
call fcn.00402a7d
mov byte [ebp - 4], bl
push edi
push ebx
lea ecx, [ebp - 0x254]
call fcn.00405a81
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004028d3
mov al, bl
jmp 0x41ec5b
mov byte [ebp - 4], 4
push edi
push ebx
lea ecx, [ebp - 0x238]
call fcn.00402a7d
mov byte [ebp - 4], bl
push edi
push ebx
lea ecx, [ebp - 0x254]
call fcn.00405a81
mov dword [ebp - 4], edi
jmp 0x41ec4d
Function at 0x4200da
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x4c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x42025f
push edi
mov edi, 0x10000000
cmp ecx, 0x7c
je 0x42025e
cmp ecx, 0x29
jne 0x42011e
cmp dword [esi + 0x1c], 0
jne 0x42025e
test dword [esi + 0x50], edi
jne 0x42011e
push 5
call fcn.0046b331
pop ecx
jmp 0x420247
cmp ecx, 0x2e
jne 0x420139
push 5
lea ecx, [esi + 0x24]
call fcn.0041931f
mov ecx, esi
call fcn.0041ae43
jmp 0x420247
cmp ecx, 0x5c
jne 0x420196
mov ecx, esi
call fcn.0041ae43
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x42016b
cmp byte [esi + 0x4a], 0x62
jne 0x42016b
push 4
lea ecx, [esi + 0x24]
call fcn.0041931f
mov ecx, esi
call fcn.0041ae43
jmp 0x42024e
test eax, eax
je 0x42018a
cmp byte [esi + 0x4a], 0x42
jne 0x42018a
push 4
lea ecx, [esi + 0x24]
call fcn.0041931f
mov eax, dword [esi + 0x28]
add eax, 8
or dword [eax], 1
jmp 0x42015f
mov ecx, esi
call fcn.0041e5a0
jmp 0x420247
cmp ecx, 0x5b
jne 0x4201b9
mov ecx, esi
call fcn.0041ae43
mov ecx, esi
call fcn.0042008e
push 4
push 0x5d
mov ecx, esi
call fcn.0041aed3
jmp 0x420247
cmp ecx, 0x28
jne 0x4201db
mov ecx, esi
call fcn.0041ae43
mov ecx, esi
call fcn.0041aef6
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.0041aed3
jmp 0x420243
cmp ecx, 0x5e
jne 0x4201e7
push 2
jmp 0x420157
cmp ecx, 0x24
jne 0x4201f3
push 3
jmp 0x420157
cmp ecx, 0x2a
je 0x42023b
cmp ecx, 0x2b
je 0x42023b
cmp ecx, 0x3f
je 0x42023b
cmp ecx, 0x7b
je 0x42023b
cmp ecx, 0x7d
jne 0x420218
test dword [esi + 0x50], edi
jne 0x420218
push 6
jmp 0x420113
cmp ecx, 0x5d
jne 0x420229
test dword [esi + 0x50], edi
jne 0x420229
push 4
jmp 0x420113
movzx eax, byte [esi + 0x4a]
push eax
lea ecx, [esi + 0x24]
call fcn.0041dce3
jmp 0x42012d
push 0xa
call fcn.0046b331
pop ecx
test bl, bl
je 0x42024e
mov ecx, esi
call fcn.0041e059
mov ecx, dword [esi + 0x4c]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x4200f4
pop edi
pop esi
pop ebx
ret
Function at 0x425441
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xc
mov eax, 0x472805
call fcn.0044ed53
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x8c], edi
je 0x42548c
call fcn.00425044
test eax, eax
je 0x425494
lea eax, [ebp - 0x18]
push eax
push 4
push esi
push 0x425336
push edi
push edi
call fcn.00454808
add esp, 0x18
mov dword [esi + 0xa8], eax
cmp eax, edi
je 0x42548c
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
call fcn.0044edf8
ret
mov eax, dword [esi + 0xb0]
cmp eax, edi
je 0x42548c
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
push edi
mov edx, dword [ebp - 0x14]
neg edx
push edx
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push edi
push dword [esi + 0x68]
push dword [esi + 0x64]
push edi
push edi
push dword [esi + 0x90]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x42548c
push edi
mov ecx, esi
call fcn.0042495d
xor eax, eax
inc eax
jmp 0x42548e

Function at 0x425f48
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x4728a2
call fcn.0044ed53
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
call fcn.0043a3b0
mov eax, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x425fb4
call fcn.0043a3b0
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x425fb4
call fcn.0043a3b0
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x425fbe
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
call fcn.0044edf8
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp + 0xc], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x42600b
cmp dword [ebp + 0xc], 0
je 0x42600b
push edi
push eax
push dword [ebp + 0xc]
call fcn.00451d40
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push esi
mov ecx, dword [ebp - 0x14]
call fcn.00425c2c
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
jmp 0x425fb6
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x425fad
Function at 0x426a19
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0x2c4
mov eax, 0x472c09
call fcn.0044edbf
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x22c], ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x220], esi
xor edi, edi
mov dword [ebp - 4], edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, edi
jne 0x426a50
xor eax, eax
inc eax
jmp 0x426a88
lea eax, [ebp - 0x224]
push eax
push 0x20019
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x426a8e
cmp eax, 2
jne 0x426a7b
push str.Key_not_found._n
call fcn.004540b4
pop ecx
jmp 0x426a4b
push str.Error_opening_key._n
call fcn.004540b4
pop ecx
xor eax, eax
call fcn.0044ee1b
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
mov dword [ebp - 0x234], esi
cmp word [esi - 2], 0x5c
je 0x426ab8
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
mov dword [ebp - 0x234], esi
xor eax, eax
mov word [esi], ax
mov dword [ebp - 0x228], 0x104
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x426afd
lea eax, [ebp - 0x21c]
push eax
push 0x208
push esi
call fcn.0042601e
push dword [ebp - 0x220]
push dword [ebp - 0x22c]
call fcn.00426a19
pop ecx
pop ecx
test eax, eax
je 0x426b22
mov dword [ebp - 0x228], 0x104
lea eax, [ebp - 0x23c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0x224]
call ebx
cmp eax, edi
je 0x426aca
dec esi
dec esi
mov dword [ebp - 0x234], esi
xor eax, eax
mov word [esi], ax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x220]
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, edi
je 0x426a4b
or dword [ebp - 4], 0xffffffff
jmp 0x426a86
Function at 0x4272c7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x38
mov eax, 0x472de8
call fcn.0044ed53
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004028a9
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call esi
test eax, eax
je 0x427360
lea eax, [ebp - 0x1c]
push eax
push 0x20119
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x427360
push 0x477c34
mov ecx, dword [ebp + 8]
call fcn.00403cf5
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.004028d3
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004028d3
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x14]
call fcn.004028d3
mov eax, dword [ebp + 8]
jmp 0x42752b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 5
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
mov dword [ebp - 0x28], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
call fcn.00402a51
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 4
jmp 0x4273ee
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00426086
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x28], ebx
je 0x427418
push 0x47c14c
call fcn.00403654
jmp 0x42732e
lea eax, [ebp - 0x14]
push eax
call fcn.00402e10
jmp 0x42732e
call fcn.0044edf8
ret
Function at 0x427659
Capabilities:
Set registry value

Disassembly:
push 0x2d0
mov eax, 0x472fb8
call fcn.0044edbf
mov dword [ebp - 4], 3
mov byte [ebp - 4], 4
lea ecx, [ebp + 0xc]
call fcn.004207d8
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x234], esp
lea eax, [ebp + 8]
push eax
call fcn.00402e10
mov byte [ebp - 4], 5
mov byte [ebp - 4], 4
call fcn.00426185
pop ecx
push eax
call fcn.00426ef2
pop ecx
pop ecx
lea eax, [ebp - 0x238]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x234], esp
lea eax, [ebp + 8]
push eax
call fcn.00402e10
mov byte [ebp - 4], 6
mov byte [ebp - 4], 4
call fcn.00426185
pop ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42774d
lea eax, [ebp - 0x238]
push eax
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x234], esp
lea eax, [ebp + 8]
push eax
call fcn.00402e10
mov byte [ebp - 4], 7
mov byte [ebp - 4], 4
call fcn.00426185
pop ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x42774d
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.004028d3
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.004028d3
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x10]
call fcn.004028d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.004028d3
push 0xfffffffffffffff6
pop eax
jmp 0x427919
lea ecx, [ebp - 0x230]
call fcn.00405be6
mov byte [ebp - 4], 8
push dword [ebp + 0x14]
lea ecx, [ebp - 0x230]
call fcn.004061e2
cmp dword [ebp - 0x218], 8
mov eax, dword [ebp - 0x22c]
jae 0x42777f
lea eax, [ebp - 0x22c]
mov ecx, dword [ebp - 0x21c]
add ecx, ecx
push ecx
push eax
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
call fcn.00426086
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.00405a81
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.004028d3
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.004028d3
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x10]
call fcn.004028d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.004028d3
mov eax, esi
jmp 0x427919
call fcn.0044ee1b
ret
Function at 0x429a24
Capabilities:
Reference wmi statements

Disassembly:
push 8
mov eax, 0x473576
call fcn.0044ed20
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
and dword [ebp - 0x10], 0
push str.Caption
push 0x477a5d
push str.SELECT__FROM_Win32_OperatingSystem
push str.ROOTcimv2
push esi
mov dword [ebp - 0x14], esi
call fcn.00428e1c
add esp, 0x14
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, esi
call fcn.0044edf8
ret

Function at 0x429a6e
Capabilities:
Get geographical location

Disassembly:
push 0x4bc
mov eax, 0x4736dc
call fcn.0044edbf
mov esi, dword [ebp + 8]
mov dword [ebp - 0x434], esi
and dword [ebp - 0x430], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov word [ebp - 0x214], ax
push 0x1fc
push eax
lea eax, [ebp - 0x212]
push eax
call fcn.0044ef70
add esp, 0xc
push 0x1fe
lea eax, [ebp - 0x214]
push eax
push 0x59
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ebp - 0x418]
call fcn.004028a9
mov byte [ebp - 4], 2
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x418]
call fcn.004034df
lea eax, [ebp - 0x418]
push eax
mov ecx, esi
call fcn.00402e10
mov dword [ebp - 0x430], ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x418]
call fcn.004028d3
mov eax, esi
jmp 0x429c1e
call fcn.0044ee1b
ret
Function at 0x42b95c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42b9a4
call fcn.0043a3b0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42b9a4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x42b9e7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x42b9d0
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x42b9d0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x42b9e4
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x438e4d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x438e94
call fcn.0043a3b0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x438e94
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x438eb0
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004389c5
mov esi, eax
test edi, edi
je 0x438eae
test ebx, ebx
je 0x438eae
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x439637
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x474220
call fcn.0044ed20
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x43965c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4396a2
lea ecx, [ebp - 0x10]
call fcn.004028a9
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042ad91
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401109
mov eax, esi
call fcn.0044edf8
ret 8

Function at 0x441636
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x44165a
cmp dword [edi + 0x54], 0
jne 0x44165a
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0043a3b0
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004415f7
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x44598c
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x4459b7
call fcn.0043a3b0
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x4459da
push eax
push dword [esi + 4]
call fcn.00445912
push esi
push eax
mov ecx, 0x49d840
call fcn.00445599
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x44645a
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x474c0b
call fcn.0044ed20
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0044641a
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.004028a9
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
jne 0x4464c0
push eax
push dword [esi + 8]
call fcn.00445912
push dword [esi + 0xc]
mov ecx, 0x49d840
push eax
call fcn.00445599
mov eax, esi
call fcn.0044edf8
ret 0x18

Function at 0x44ed11
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49a3a0]
jne 0x44ed1b
repz ret
jmp fcn.0045a37c

Function at 0x462f97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004567f2
and dword [ebp - 4], 0
cmp dword [0x49e690], 0
mov ebx, eax
jne 0x463048
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4630f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4630f9
push eax
call fcn.00456780
mov dword [esp], 0x4812b8
push edi
mov dword [0x49e690], eax
call esi
push eax
call fcn.00456780
mov dword [esp], 0x4812a4
push edi
mov dword [0x49e694], eax
call esi
push eax
call fcn.00456780
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x49e698], eax
call esi
push eax
call fcn.00456780
pop ecx
mov dword [0x49e6a0], eax
test eax, eax
je 0x463048
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00456780
pop ecx
mov dword [0x49e69c], eax
mov eax, dword [0x49e69c]
cmp eax, ebx
je 0x4630a0
cmp dword [0x49e6a0], ebx
je 0x4630a0
push eax
call fcn.004567fb
push dword [0x49e6a0]
mov esi, eax
call fcn.004567fb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4630a0
test edi, edi
je 0x4630a0
call esi
test eax, eax
je 0x463097
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x463097
test byte [ebp - 0xc], 1
jne 0x4630a0
or dword [ebp + 0x10], 0x200000
jmp 0x4630d9
mov eax, dword [0x49e694]
cmp eax, ebx
je 0x4630d9
push eax
call fcn.004567fb
pop ecx
test eax, eax
je 0x4630d9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4630d9
mov eax, dword [0x49e698]
cmp eax, ebx
je 0x4630d9
push eax
call fcn.004567fb
pop ecx
test eax, eax
je 0x4630d9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x49e690]
call fcn.004567fb
pop ecx
test eax, eax
je 0x4630f9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4630fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret