joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d40
Capabilities:
Extract resource via kernel32 functions
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0xa
movzx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x408e30
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00405d80
add esp, 4
test eax, eax
je 0x408dd0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 1
jne 0x408dc1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 4
je 0x408dd0
push 0x80
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80
push 2
call fcn.004018a0
mov ecx, eax
call fcn.00402ba0
push eax
push 3
push 0x40000000
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x408e30
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x408e32
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x409cd0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x1c], 0x10
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x409d00
xor eax, eax
jmp 0x409db4
lea ecx, [ebp - 0x34]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x409d21
xor eax, eax
jmp 0x409db4
mov dword [ebp - 0x2c], 1
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x409d63
xor eax, eax
jmp 0x409db4
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
or ecx, 2
mov dword [ebp - 8], ecx
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x409da5
xor eax, eax
jmp 0x409db4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40ba20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x40ba29
xor ecx, ecx
jne 0x40ba29
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x40ba4a
mov eax, 0xd
jmp 0x40ba76
xor eax, eax
jne 0x40ba31
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40bae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x40bae9
xor ecx, ecx
jne 0x40bae9
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40bb2e
mov eax, dword [ebp - 0xc]
jmp 0x40bb84
cmp dword [ebp - 4], 1
je 0x40bb41
cmp dword [ebp - 4], 2
je 0x40bb41
mov eax, 0xd
jmp 0x40bb84
cmp dword [ebp + 0xc], 0
je 0x40bb7a
cmp dword [ebp - 8], 0
je 0x40bb74
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 1
div ecx
test edx, edx
jne 0x40bb6b
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movsx eax, byte [edx - 1]
test eax, eax
je 0x40bb72
mov eax, 0xd
jmp 0x40bb84
jmp 0x40bb7a
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40cf20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0040cf60
movzx eax, al
test eax, eax
jne 0x40cf4b
mov ecx, dword [ebp - 4]
push ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, dword [ebp - 4]
mov dword [edx + 0x190], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp dword [eax + 0x190], 0
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret
Function at 0x40f850
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40f882
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], 0x2749
xor al, al
jmp 0x40f988
push 0
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40f8a9
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], 0x2734
xor al, al
jmp 0x40f988
mov byte [ebp - 1], 1
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
call fcn.0040f990
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x40f918
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e5
je 0x40f918
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x48], ecx
mov byte [ebp - 1], 0
movzx edx, byte [ebp - 1]
test edx, edx
je 0x40f97a
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40f976
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x40f964
mov byte [ebp - 1], 1
jmp 0x40f974
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x48], eax
mov byte [ebp - 1], 0
jmp 0x40f97a
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x28
call fcn.0040f9b0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x441400]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x4104b0
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x410d10
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.00410440
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
cmp dword [0x44286c], 0
je 0x41027b
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x4412a4]
jmp 0x41042b
push 0x104
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x410296
jmp 0x41038b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.00426639
add esp, 0xc
push str.ws2_32
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004265c5
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x410309
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x410309
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
je 0x410311
jmp 0x41038b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.00426639
add esp, 0xc
push str.wship6
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004265c5
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x410384
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x410384
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x41038b
cmp dword [ebp - 0x20], 0
je 0x410416
mov dword [ebp - 4], 0
jmp 0x4103a7
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 3
jge 0x4103e5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*8 - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x4103e3
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x4103e5
jmp 0x41039e
cmp dword [ebp - 0x20], 0
je 0x410416
mov dword [ebp - 4], 0
jmp 0x4103fd
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 3
jge 0x410416
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*8 - 0x18]
mov dword [edx*8 + 0x4412a4], ecx
jmp 0x4103f4
mov dword [0x44286c], 1
movzx edx, word [ebp + 8]
mov eax, dword [edx*8 + 0x4412a4]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00423ff6
mov esp, ebp
pop ebp
ret 4
Function at 0x410b60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x410c28
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x410c08
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x410c08
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x410bc5
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x410c08
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
movzx eax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00410910
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x410bfb
mov eax, 8
jmp 0x410c6e
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x410bbc
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.004269b8
add esp, 0x10
xor eax, eax
jmp 0x410c6e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x410c46
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x410c74]
mov eax, 0x2af9
jmp 0x410c6e
mov eax, 0x2afa
jmp 0x410c6e
mov eax, 0x2afb
jmp 0x410c6e
mov eax, 0x2af9
jmp 0x410c6e
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x411280
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + 0x44]
test ecx, ecx
je 0x41129b
mov al, 1
jmp 0x411356
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x40], 0xffffffff
jne 0x4112af
xor al, al
jmp 0x411356
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x41134a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2733
je 0x4112f1
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x48], edx
mov byte [ebp - 1], 0
jmp 0x41134a
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x411346
push 0x2c
push 0
lea ecx, [ebp - 0x34]
push ecx
call fcn.00424040
add esp, 0xc
lea edx, [ebp - 0x34]
push edx
push 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp dword [ebp - 0x20], 0
je 0x411344
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov dword [edx + 0x48], eax
mov byte [ebp - 1], 0
jmp 0x41134a
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 0x38]
mov dl, byte [ebp - 1]
mov byte [ecx + 0x44], dl
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8
Function at 0x4121f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x412222
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], 0x2749
xor al, al
jmp 0x41234a
push 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x412249
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], 0x2734
xor al, al
jmp 0x41234a
mov byte [ebp - 9], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov dword [ebp - 0x10], 0
push 0x14
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00424040
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.0040f990
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x4122dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x3e5
je 0x4122dd
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov dword [ecx + 0x48], edx
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
test eax, eax
je 0x41233c
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x412338
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x412326
mov byte [ebp - 9], 1
jmp 0x412336
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x48], eax
mov byte [ebp - 9], 0
jmp 0x41233c
mov byte [ebp - 9], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x10
call fcn.0040f9b0
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret 8
Function at 0x415b20
Capabilities:
Query remote server for available data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435f18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x441400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x14]
call fcn.00403600
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x80008000
mov ecx, dword [ebp - 0x2c]
add ecx, 0x14
call fcn.0040c0d0
movzx eax, al
test eax, eax
je 0x415b87
mov ecx, dword [ebp + 8]
push ecx
push 0x43844c
lea edx, [ebp - 0x14]
push edx
call fcn.0040cae0
add esp, 0xc
jmp 0x415ba3
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x14]
push edx
push str.__s__s
lea eax, [ebp - 0x14]
push eax
call fcn.0040cae0
add esp, 0x10
cmp dword [ebp + 0xc], 0xffffffff
jne 0x415bbb
cmp dword [ebp + 0x14], 0
je 0x415bbb
mov ecx, dword [ebp - 0x18]
or ecx, 0x4000000
mov dword [ebp - 0x18], ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.0040c3b0
push eax
push 0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0xc], 0
jne 0x415c16
mov ecx, dword [ebp - 0x2c]
call fcn.00416690
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040de10
mov eax, dword [ebp - 0x1c]
jmp 0x415cc1
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x415c5f
mov ecx, dword [ebp - 0x2c]
call fcn.00416690
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040de10
mov eax, dword [ebp - 0x20]
jmp 0x415cc1
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x415ca8
mov ecx, dword [ebp - 0x2c]
call fcn.00416690
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040de10
mov eax, dword [ebp - 0x24]
jmp 0x415cc1
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040de10
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4162c0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x41630a
push 0
push 0
push 0
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x820
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x416303
mov ecx, dword [ebp - 4]
call fcn.00416690
xor eax, eax
jmp 0x41630f
mov eax, 1
jmp 0x41630f
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x416390
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x441400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.004036c0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004036c0
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 4], 0
jne 0x416402
mov edi, dword [ebp - 0x1c]
add edi, 0x20
mov ecx, 6
mov esi, str.Session_not_initialized_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x416577
push 0
push 0x4383c8
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0040bec0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4164b3
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.004038c0
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.004036a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040de10
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.00403d10
sub eax, dword [ebp - 0x10]
sub eax, 1
push eax
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.00416700
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004036a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040de10
jmp 0x4164be
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.00404120
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0xc24], 1
jne 0x4164d9
cmp dword [ebp + 0x18], 1
jne 0x4164d9
mov dword [ebp - 0x30], 0x8000000
jmp 0x4164e0
mov dword [ebp - 0x30], 0
cmp dword [ebp + 0xc], 0
jne 0x4164fb
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0xc24], 3
jne 0x4164fb
mov dword [ebp - 0x34], 0x43825c
jmp 0x416501
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
movzx ecx, word [ebp + 0x14]
test ecx, ecx
jne 0x416519
mov edx, dword [ebp - 0x1c]
mov ax, word [edx + 0xc20]
mov word [ebp - 0x36], ax
jmp 0x416521
mov cx, word [ebp + 0x14]
mov word [ebp - 0x36], cx
push 0
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc24]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x34]
push eax
movzx ecx, word [ebp - 0x36]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0040c3b0
push eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 8], 0
jne 0x416572
mov ecx, dword [ebp - 0x1c]
call fcn.00416690
xor eax, eax
jmp 0x416577
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14