joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4121ae
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x604180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x4121ef
lea eax, [ebp - 0x28]
push eax
push ecx
push edi
mov ecx, esi
call fcn.00411aa5
neg eax
sbb ebx, ebx
and ebx, dword [ebp - 0x28]
jmp 0x4121f8
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x412323
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x20]
cmp ecx, ebx
je 0x412230
test bl, 1
je 0x412230
push ecx
push edi
test esi, esi
je 0x41221f
mov ecx, esi
call fcn.00412156
jmp 0x412225
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x412323
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 8]
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x4122ea
lea eax, [ebp - 0x50]
push eax
push ecx
call fcn.00411928
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
lea edx, [ecx + 0x10]
mov eax, dword [edx]
or eax, dword [edx + 4]
je 0x41226c
lea eax, [ebp - 0x40]
push eax
push edx
call fcn.00411928
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x412285
lea eax, [ebp - 0x48]
push eax
push ecx
call fcn.00411928
pop ecx
lea eax, [ebp - 0x48]
pop ecx
mov dword [ebp - 0x38], eax
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push edi
test esi, esi
je 0x4122a5
mov ecx, esi
call fcn.004119cf
jmp 0x4122ab
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x30], eax
cmp eax, 0xffffffff
je 0x412323
lea ecx, [ebp - 0x50]
push ecx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4122dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x30]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push esi
jmp 0x41232b
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x412323
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x20], ebx
je 0x412312
test bl, 1
jne 0x412312
push dword [eax + 0x20]
push edi
test esi, esi
je 0x412308
mov ecx, esi
call fcn.00412156
jmp 0x41230e
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x412323
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00559f3e
leave
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00467495
int3
Function at 0x416d62
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x416da1
call fcn.00423e0f
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x416da1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x416da9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00414177
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4177e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41786c
cmp dword [esi + 0x20], 0
je 0x41786c
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41786c
cmp dword [ebp + 8], 0
je 0x41786c
xor edi, edi
mov ebx, edi
call fcn.00423e0f
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x417850
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41786c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.0046a967
mov edi, eax
add esp, 0xc
test edi, edi
je 0x417868
mov ecx, esi
call fcn.00417577
mov eax, edi
jmp 0x41786e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41c3e7
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x58e011
call fcn.00559f7e
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x41c40d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41c467
lea ecx, [ebp - 0x10]
call fcn.00401fff
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x5a4a38]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0057884f
push eax
call fcn.00402a53
add esp, 0x14
test esi, esi
je 0x41c45a
push esi
call fcn.005788d0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004047a1
mov eax, ebx
call fcn.00559f4c
ret 8
Function at 0x41c959
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x41c9a1
call fcn.00423e0f
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41c9a1
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41c9ae
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x41c9ea
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x41c9cd
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x41c9d6
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x41c9e8
test di, di
jne 0x41c9e8
test dx, dx
je 0x41c9ea
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41c9ef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x41ca1a
cmp dword [esi + 0x80], 0
jne 0x41ca1a
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.00423e0f
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41ca4a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41ca4a
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.0041ccb1
jmp 0x41ca4c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41ca53
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.00423e0f
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41ca93
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41ca93
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0041ca9b
jmp 0x41ca95
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x41cd86
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x58e07d
call fcn.00559fe8
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.00423e0f
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x41cde5
call fcn.00423e0f
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41cdf9
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x41cdf5
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x41ce01
or eax, 0xffffffff
jmp 0x41cf53
mov ecx, edi
call fcn.0041d39c
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.004159e8
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x41ce8d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x41ce8d
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41ce8d
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.0041562d
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x41ce8a
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [0x5a4a38]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x41ce8a
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041c4b2
test eax, eax
je 0x41ce8a
push 0
mov ecx, esi
call fcn.0041c268
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.00415699
push ebx
call fcn.00416dcf
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0041cd29
test eax, eax
jne 0x41ced6
cmp dword [edi + 0x9c], eax
jne 0x41ced6
call fcn.00423e0f
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.00416dcf
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.0041cd29
and dword [edi + 0x9c], 0
jmp 0x41cf01
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x41cf15
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.0041c268
test esi, esi
je 0x41cf22
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x41cf38
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x41cf38
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [0x5a4a38]
mov ecx, edi
call esi
mov ecx, edi
call fcn.0041d350
mov eax, dword [edi + 0x68]
call fcn.00559f4c
ret
Function at 0x422f6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x422fc2
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x422f9b
call fcn.00412de3
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x422fb0
call fcn.00412de3
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x422fc2
call fcn.00412de3
call fcn.00423e0f
cmp dword [eax + 0x3c], 0
je 0x422fd7
push esi
mov ecx, ebx
call fcn.004225d8
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.004231c1
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x423000
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x42300c
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x423fad
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.0041c310
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x423fe9
call fcn.0042426e
mov dword [esi + 0xc], 1
jmp 0x423fee
call fcn.0042426e
cmp dword [esi], 0
je 0x424039
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x424014
push edi
call fcn.0040d29f
lea ecx, [edi + 1]
push ecx
jmp 0x424023
push 0xff
call fcn.004045b7
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004047b9
pop edi
jmp 0x42405d
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x42405d
push dword [esi]
push dword [ebp - 4]
call fcn.00468894
pop esi
leave
ret 0xc

Function at 0x4241c5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0042426e
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x42420d
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040d29f
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004047b9
jmp 0x424218
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00468894
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x42b6ae
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x42b6d7
call fcn.00423e0f
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
je 0x42b704
push esi
push eax
mov ecx, 0x62eaa8
call fcn.0042c573
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.0042bb28
int3

Function at 0x42be74
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ecx + 0x18], esi
je 0x42be99
push esi
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx + 0x18]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x42be99
mov esi, dword [ebp - 4]
mov eax, esi
xor edx, edx
pop esi
leave
ret

Function at 0x42c3bd
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x40]
cmp dword [edi], ebx
jne 0x42c411
push 0x1000
call fcn.0042c5fc
test eax, eax
je 0x42c40a
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [edi]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42c4b7
mov eax, dword [ebp - 4]
lea edx, [esi + 0x40]
mov dword [esi + 0x44], eax
mov dword [esi + 0x3c], ebx
mov dword [ebp - 0xc], edx
jmp 0x42c416
xor eax, eax
jmp 0x42c493
mov edx, edi
mov dword [ebp - 0xc], edi
mov eax, dword [esi + 0x3c]
mov ecx, dword [edi]
mov ebx, dword [ebp + 8]
add ecx, eax
mov dword [ebp - 0x10], eax
mov edi, ebx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp - 8], eax
je 0x42c484
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x44]
jb 0x42c461
lea eax, [ebp - 4]
push eax
push dword [esi + 0x38]
push dword [edx]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42c4b3
mov eax, dword [ebp - 4]
mov dword [esi + 0x44], eax
test eax, eax
je 0x42c49a
mov edx, dword [ebp - 0xc]
and dword [esi + 0x3c], 0
mov ecx, dword [edx]
mov al, byte [ecx]
cmp al, 0xd
je 0x42c46d
mov byte [edi], al
inc edi
dec dword [ebp - 8]
mov eax, dword [esi + 0x3c]
inc eax
mov dword [ebp - 0x10], eax
mov dword [esi + 0x3c], eax
mov al, byte [ecx]
inc ecx
cmp al, 0xa
je 0x42c484
cmp dword [ebp - 8], 0
jne 0x42c430
push 1
push 0
push edi
call fcn.00566f00
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
push 1
push 0
push edi
call fcn.00566f00
sub edi, ebx
add esp, 0xc
neg edi
sbb edi, edi
and edi, ebx
mov eax, edi
jmp 0x42c493
push 0
jmp 0x42c4b8
push ebx
push dword [esi + 0x20]
call fcn.0042bb28
int3
Function at 0x42c6b9
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1c], 1
je 0x42c760
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x42c760
cmp dword [esi + 0x34], 0
mov edi, dword [ebp + 0xc]
jne 0x42c6fd
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x42c764
cmp dword [ebp - 4], edi
jne 0x42c764
pop edi
pop esi
leave
ret 8
mov edx, dword [esi + 0x30]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x2c]
jb 0x42c721
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 0x34]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x42c764
and dword [esi + 0x30], 0
xor edx, edx
mov ecx, dword [esi + 0x2c]
cmp edi, ecx
jb 0x42c73f
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x42c6f7
jmp 0x42c764
lea eax, [edx + edi]
cmp eax, ecx
ja 0x42c6f7
mov eax, dword [esi + 0x34]
sub ecx, edx
push edi
push dword [ebp + 8]
add eax, edx
push ecx
push eax
call fcn.00404c21
add esp, 0x10
add dword [esi + 0x30], edi
jmp 0x42c6f7
push 6
jmp 0x42c766
push 0
push dword [esi + 0x20]
call fcn.0042bb28
int3
Function at 0x42d353
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x58f37a
call fcn.00559f7e
mov eax, ecx
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebx], edi
mov dword [esi], edi
cmp dword [eax + 0x58], edi
je 0x42d3fb
push dword [ebp + 8]
call fcn.0042d670
mov dword [ebp - 0x10], eax
test eax, eax
je 0x42d482
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
test eax, eax
jne 0x42d3e4
push ecx
call fcn.004239fc
pop ecx
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42d3e4
xor edi, edi
inc edi
jmp 0x42d3ee
push dword [ebx]
call fcn.00423a05
pop ecx
mov dword [ebx], edi
lea ecx, [ebp - 0x24]
call fcn.00409b20
jmp 0x42d480
mov eax, dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0x84]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call dword [0x5a4a38]
mov ecx, dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x42d478
mov esi, dword [ebp + 0x14]
shr ecx, 1
push ecx
mov dword [esi], ecx
call fcn.004239fc
mov dword [ebx], eax
pop ecx
cmp dword [esi], edi
jbe 0x42d472
lea esi, [edi + edi]
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040dce1
push esi
lea ecx, [ebp - 0x10]
lea ebx, [eax - 1]
shl bl, 4
sub bl, 0x41
call fcn.0040dce1
mov ecx, dword [ebp + 0x10]
add al, bl
mov ecx, dword [ecx]
mov byte [edi + ecx], al
inc edi
mov eax, dword [ebp + 0x14]
cmp edi, dword [eax]
jb 0x42d43f
mov eax, dword [ebp - 0x10]
xor edi, edi
inc edi
lea ecx, [eax - 0x10]
call fcn.004047a1
mov eax, edi
call fcn.00559f4c
ret 0x10

Function at 0x42d48a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x42d4dd
push esi
push dword [ebp + 8]
call fcn.0042d670
mov edi, eax
test edi, edi
je 0x42d4d8
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42d4d8
mov eax, dword [ebp - 8]
jmp 0x42d4ef
mov eax, dword [ebp + 0x10]
jmp 0x42d4ef
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc
Function at 0x42d4f5
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58f3a7
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.0055a520
mov eax, dword [0x604180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1024], eax
cmp dword [ecx + 0x58], ebx
je 0x42d623
push ebx
push edx
call fcn.0042d670
mov ebx, eax
test ebx, ebx
jne 0x42d55d
push esi
jmp 0x42d64b
lea ecx, [ebp - 0x1014]
call fcn.00401fff
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x1024]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x101c], eax
test eax, eax
jne 0x42d5e2
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.004045b7
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x1024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x101c], eax
call fcn.004047b9
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x101c], 0
jne 0x42d610
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.00402dbc
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.004047a1
jmp 0x42d652
push esi
mov ecx, edi
call fcn.00401f7c
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x42d609
test esi, esi
jne 0x42d62c
mov esi, 0x5a4db0
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.00401f7c
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00559f3e
leave
ret 0x10
Function at 0x42d77d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [edi + 0x58], ebx
je 0x42d7c5
push ebx
push dword [ebp + 8]
call fcn.0042d670
mov edi, eax
test edi, edi
je 0x42d826
push dword [ebp + 0x14]
push esi
push 3
push ebx
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x42d826
mov eax, dword [ebp + 0x14]
lea eax, [eax*2 + 1]
push eax
call fcn.004239fc
mov edx, dword [ebp + 0x14]
mov ebx, eax
pop ecx
xor ecx, ecx
test edx, edx
je 0x42d7fc
mov al, byte [esi + ecx]
and al, 0xf
add al, 0x41
mov byte [ebx + ecx*2], al
mov al, byte [esi + ecx]
shr al, 4
add al, 0x41
mov byte [ebx + ecx*2 + 1], al
inc ecx
cmp ecx, edx
jb 0x42d7e1
mov byte [ebx + ecx*2], 0
mov eax, dword [edi]
push ebx
push dword [ebp + 0xc]
mov esi, dword [eax + 0x88]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5a4a38]
mov ecx, edi
call esi
push ebx
mov esi, eax
call fcn.00423a05
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10