joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45939f
Capabilities:
Resume thread

Disassembly:
mov eax, 0x47faf9
call fcn.00439a10
push ecx
push esi
push 0x40
call fcn.004563d8
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor esi, esi
cmp ecx, esi
mov dword [ebp - 4], esi
je 0x4593ce
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004728d9
mov esi, eax
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
or eax, 4
push eax
mov ecx, esi
call fcn.004592bc
test eax, eax
jne 0x4593f5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x78]
xor eax, eax
jmp 0x459412
push dword [ebp + 0x10]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test byte [ebp + 0x18], 4
jne 0x459410
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x45aa3f
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.00439a30
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x48b210]
je 0x45ab46
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x45aaaf
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x45aab6
cmp ebx, ebx
jne 0x45aab6
xor eax, eax
jmp 0x45ab49
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x45aac3
mov byte [esi + 0x20], bl
jmp 0x45aad7
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.004269d2
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.004269d2
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.004269d2
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x45ab32
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x45ab46
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46068c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4a9e6c]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x4606db
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x4606db
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4606e7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004368a4
leave
ret 8
Function at 0x4624f9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4a9e6c]
push ebx
push esi
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004624e2
cmp dword [esi], 0
mov ebx, eax
je 0x462559
push edi
mov edi, dword [ebp + 0x18]
push 0x40
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push eax
call fcn.0043b43f
add esp, 0xc
cmp eax, 1
pop edi
je 0x462576
push 0xffffffffffffffff
push 0
push dword [ebp + 0x14]
call fcn.00463063
mov ecx, esi
call fcn.00462114
jmp 0x462576
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push eax
call fcn.004378ad
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.0046068c
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004368a4
leave
ret
Function at 0x4630c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x463249
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 8], ebx
je 0x463248
push esi
push edi
mov edi, dword [ebx]
add edi, 0x40
push edi
call fcn.00437c7d
mov esi, eax
test esi, esi
pop ecx
je 0x463246
push edi
push ebx
push esi
call fcn.00439a90
mov edi, dword [esi]
add esp, 0xc
add edi, esi
and dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0xc]
mov ecx, dword [edi + ecx*4]
xor eax, eax
cmp ecx, dword [eax*8 + 0x48e328]
je 0x46313b
inc eax
cmp eax, 4
jb 0x46312a
jmp 0x46319d
cmp dword [ebp + 0x10], 0
je 0x463157
cmp dword [eax*8 + 0x48e32c], 0x12
je 0x46319d
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], 0xffffff
jmp 0x46319d
lea ebx, [eax*8 + 0x48e32c]
push dword [ebx]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetSysColor]
push dword [ebx]
movzx eax, ah
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
mov ch, al
mov eax, ebx
push dword [eax]
shl ecx, 8
mov dword [ebp + 8], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
shr eax, 0x10
movzx eax, al
or ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], ecx
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x10
jl 0x463122
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp - 4], eax
je 0x463228
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
call ebx
mov cl, byte [esi + 0xe]
push 0xcc0020
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push esi
lea ecx, [ecx + edx*4 + 0x28]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push edi
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [ebp - 0xc]
push edi
call ebx
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call fcn.00437b65
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x465102
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
call fcn.004511ad
test eax, eax
jne 0x4652f2
mov edi, dword [edi + 4]
push ebx
mov ecx, esi
call fcn.0042600c
test byte [esi + 0x7c], 0x20
mov dword [ebp - 0x10], eax
mov ebx, 0x201
jne 0x465146
cmp edi, ebx
je 0x465146
cmp edi, 0x202
jne 0x46529f
cmp edi, 0x200
jb 0x465156
cmp edi, 0x209
jbe 0x46516e
cmp edi, 0xa0
jb 0x46529f
cmp edi, 0xa9
ja 0x46529f
call fcn.0047252c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1c]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x30
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00439a30
mov eax, dword [esi]
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 0x18]
mov dword [ebp - 0x48], 0x28
call dword [eax + 0x6c]
cmp dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], eax
je 0x4651cc
push dword [ebp - 0x24]
call fcn.00437b65
pop ecx
cmp edi, ebx
jne 0x4651df
test byte [ebp - 0x41], 0x80
je 0x4651df
mov dword [ebp - 8], 1
jmp 0x4651fd
and dword [ebp - 8], 0
cmp edi, ebx
je 0x4651fd
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4651fd
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x465269
cmp dword [ebp - 8], 0
jne 0x465269
cmp edi, 0x202
jne 0x465229
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xc8
push 0xe001
jmp 0x465251
test byte [esi + 0x78], 8
jne 0x46525a
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x46525a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx + 0x78]
je 0x465296
push 0x12c
push 0xe000
mov ecx, esi
call fcn.004647b3
jmp 0x465296
push dword [ebp - 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x160]
jmp 0x465296
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x46527c
cmp dword [ebp - 8], 0
je 0x465296
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xe001
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x78], eax
mov ecx, esi
call fcn.00453719
test eax, eax
pop ebx
je 0x4652b1
cmp dword [eax + 0x64], 0
jne 0x4652f7
cmp dword [ebp - 0x10], 0
je 0x4652d9
mov edi, dword [ebp - 0x10]
push dword [ebp + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
jne 0x4652f2
mov ecx, edi
call fcn.004536da
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x4652b7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4652f7
push dword [ebp + 8]
mov ecx, esi
call fcn.00451ccf
jmp 0x4652f9
xor eax, eax
inc eax
jmp 0x4652f9
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x4656da
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4a9e6c]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x465727
push dword [ebp + 8]
call fcn.00474834
mov esi, eax
test esi, esi
je 0x46574f
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x46574f
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x483ed0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004368a4
leave
ret 0xc
Function at 0x46ecd0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov edx, dword [ebp + 0xc]
mov eax, dword [0x4a9e6c]
push ebx
xor ecx, ecx
cmp edx, ecx
push esi
mov dword [ebp - 4], eax
push edi
je 0x46edf1
cmp dword [ebp + 8], ecx
je 0x46edf1
mov eax, dword [ebp + 0x18]
mov esi, eax
mov edi, eax
and esi, 0x2e000000
and edi, 0x40000000
test eax, 0x90000000
mov dword [ebp - 0x830], 0x824
mov dword [ebp - 0x82c], ecx
mov dword [ebp + 0x18], ecx
je 0x46ed42
cmp dword [edx + 0x30], ecx
je 0x46ed42
test eax, 0x2000000
je 0x46ed3c
mov dword [ebp + 0x18], 1
jmp 0x46ed42
or edi, 0x80000000
mov ebx, dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
push esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x828]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x46eda9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x46edf1
push dword [ebp - 0x830]
call fcn.004563d8
test eax, eax
pop ecx
mov dword [ebp - 0x834], eax
je 0x46edf1
push esi
lea ecx, [ebp - 0x830]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x82c], 1
call ebx
test eax, eax
jne 0x46edb1
push dword [ebp - 0x834]
jmp 0x46edeb
lea ebx, [ebp - 0x828]
jmp 0x46edb7
mov ebx, dword [ebp - 0x834]
mov esi, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp dword [ebp + 0x18], edi
mov dword [ebp + 8], eax
je 0x46ee0e
push 0x2100000
push edi
push edi
push dword [esi + 0x2c]
call dword [sym.imp.SHLWAPI.dll_UrlUnescapeA]
test eax, eax
jge 0x46ee02
cmp dword [ebp - 0x82c], edi
je 0x46edf1
push ebx
call fcn.00456403
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004368a4
leave
ret 0x14
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esi + 0x30], eax
cmp dword [ebp - 0x82c], edi
je 0x46ee1d
push ebx
call fcn.00456403
pop ecx
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x46ee2f
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0x1000
jmp 0x46edf3
mov cx, word [esi + 0x18]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov esi, dword [esi + 0xc]
dec esi
mov ecx, dword [ebp + 0x10]
je 0x46ee8d
dec esi
je 0x46ee82
dec esi
je 0x46ee77
dec esi
je 0x46ee6c
dec esi
je 0x46ee64
dec esi
je 0x46ee5c
dec esi
jne 0x46ee27
mov dword [ecx], 0x1002
jmp 0x46edf3
mov dword [ecx], 0x1006
jmp 0x46edf3
mov dword [ecx], 0x1001
jmp 0x46edf3
mov dword [ecx], 0x100b
jmp 0x46edf3
mov dword [ecx], 3
jmp 0x46edf3
mov dword [ecx], 2
jmp 0x46edf3
mov dword [ecx], 1
jmp 0x46edf3
Function at 0x46fa0d
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x46fa36
call fcn.00472506
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x46fa59
push eax
push dword [esi + 4]
call fcn.0046f99a
push esi
push eax
mov ecx, 0x4acd0c
call fcn.0046f694
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x46fbee
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
je 0x46fd17
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46fd17
mov ecx, dword [esi + 0x3c]
test ecx, ecx
jne 0x46fc35
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x46fc2d
push 0
jmp 0x46fd19
mov eax, dword [ebp - 4]
jmp 0x46fcf8
mov eax, dword [esi + 0x38]
push ebx
push edi
mov edi, dword [ebp + 0xc]
cmp edi, dword [esi + 0x34]
jb 0x46fc89
mov ebx, dword [esi + 0x40]
sub ebx, eax
jns 0x46fc4d
xor ebx, ebx
jmp 0x46fc55
cmp ebx, edi
ja 0x46fcfd
push ebx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00439a90
mov eax, dword [esi + 0x34]
add esp, 0xc
mov dword [esi + 0x38], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
sub edi, ebx
push edi
add eax, ebx
push eax
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x46fc26
mov eax, dword [ebp - 4]
jmp 0x46fcf4
mov edx, dword [esi + 0x40]
lea ebx, [eax + edi]
cmp ebx, edx
jb 0x46fd01
sub edx, eax
jns 0x46fc9b
xor ebx, ebx
jmp 0x46fca1
mov ebx, edx
cmp ebx, edi
ja 0x46fcfd
push ebx
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00439a90
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x46fc26
mov eax, dword [ebp + 0xc]
sub edi, ebx
cmp edi, eax
mov dword [esi + 0x40], eax
jae 0x46fcda
mov dword [ebp + 0xc], edi
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [esi + 0x3c]
add eax, ebx
push eax
call fcn.00439a90
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [esi + 0x38], eax
add eax, ebx
pop edi
pop ebx
pop esi
leave
ret 8
xor eax, eax
jmp 0x46fcf6
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00439a90
add esp, 0xc
add dword [esi + 0x38], edi
mov eax, edi
jmp 0x46fcf6
push 6
push dword [esi + 0x1c]
call fcn.0046f99a
int3
Function at 0x46fd22
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x18], 1
push edi
je 0x46fdcb
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46fdcb
mov ecx, dword [esi + 0x30]
test ecx, ecx
mov edi, dword [ebp + 0xc]
jne 0x46fd66
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x46fd5f
push 0
jmp 0x46fdcd
cmp dword [ebp + 0xc], edi
je 0x46fda4
jmp 0x46fd5b
mov eax, dword [esi + 0x2c]
lea edx, [eax + edi]
cmp edx, dword [esi + 0x28]
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetWriteFile]
jb 0x46fd8b
lea edx, [ebp + 0xc]
push edx
push eax
push ecx
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x46fd5b
and dword [esi + 0x2c], 0
mov ecx, dword [esi + 0x28]
cmp edi, ecx
jb 0x46fdaa
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x46fd5b
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x2c]
lea edx, [eax + edi]
cmp edx, ecx
ja 0x46fda3
mov ecx, dword [esi + 0x30]
push edi
push dword [ebp + 8]
add ecx, eax
push ecx
call fcn.00439a90
add esp, 0xc
add dword [esi + 0x2c], edi
jmp 0x46fda3
push 6
push dword [esi + 0x1c]
call fcn.0046f99a
int3

Function at 0x46fe05
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
jne 0x46fe42
push 0x1000
call fcn.0046efe4
test eax, eax
je 0x46fe9d
lea eax, [ebp - 4]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x46fea3
mov eax, dword [ebp - 4]
mov dword [esi + 0x40], eax
mov dword [esi + 0x38], ebx
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x3c]
push edi
mov edi, dword [ebp + 8]
jmp 0x46fe92
mov ecx, dword [esi + 0x38]
cmp ecx, dword [esi + 0x40]
jb 0x46fe7d
lea eax, [ebp - 4]
push eax
push dword [esi + 0x34]
push dword [esi + 0x3c]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x46fea3
mov eax, dword [ebp - 4]
cmp eax, ebx
mov dword [esi + 0x40], eax
je 0x46feac
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x38], ebx
mov cl, byte [eax]
cmp cl, 0xd
je 0x46fe87
mov byte [edi], cl
inc edi
inc dword [esi + 0x38]
mov cl, byte [eax]
inc eax
cmp cl, 0xa
je 0x46fe97
dec dword [ebp + 0xc]
jne 0x46fe4e
mov eax, dword [ebp + 8]
mov byte [edi], bl
pop edi
pop esi
pop ebx
leave
ret 8
push ebx
push dword [esi + 0x1c]
call fcn.0046f99a
mov eax, edi
sub eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, dword [ebp + 8]
jmp 0x46fe9a
Function at 0x4705e6
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x48041c
call fcn.00439a10
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004579d8
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [esi], vtable.CInternetFile.0
mov dword [esi + 0x1c], eax
call fcn.004046c0
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call fcn.00406db0
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.00406db0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x470666
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x480441
call fcn.00439a10
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004579d8
xor edi, edi
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
mov dword [esi], vtable.CInternetFile.0
call fcn.004046c0
mov ebx, dword [ebp + 0x10]
push dword [ebx + 0xc]
mov ecx, 0x4acd0c
push dword [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0046f694
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.00406db0
mov eax, dword [ebx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
mov ecx, ebx
call fcn.0042ac47
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00406d40
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401830
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x18], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x471195
Capabilities:
Connect to http server

Disassembly:
mov eax, 0x4805ca
call fcn.00439a10
push ecx
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push edi
call fcn.00470e32
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.004046c0
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 4], eax
jne 0x4711fc
push eax
push dword [esi + 8]
call fcn.0046f99a
push dword [esi + 0xc]
mov ecx, 0x4acd0c
push eax
call fcn.0046f694
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x473615
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00472506
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x473655
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x473655
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x473659
xor eax, eax
jmp 0x4736d6
movzx eax, word [esi + 6]
push ebx
shl eax, 2
push edi
push eax
call fcn.004563d8
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x473687
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x473676
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.004731ab
push edi
mov ebx, eax
call fcn.00456403
test ebx, ebx
pop ecx
je 0x4736c9
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00473425
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.0047350f
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x47383e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x4a9e6c]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x47389c
push 0x48e7c8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0043b64c
add esp, 0x10
cmp eax, 0xffffffff
je 0x4738b0
cmp eax, esi
jae 0x4738b0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x4738b2
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x473867
jmp 0x4738b3
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.004368a4
leave
ret