joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a584
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416e54]
call fcn.00404f20
xor eax, eax
push ebp
push 0x46a6c8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a0fbc], 0
jne 0x46a5d7
mov ecx, dword [0x4a4ee4]
mov dl, 1
mov eax, dword [0x407bc0]
call fcn.0040c764
call fcn.00403edc
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403008
mov eax, ebx
call fcn.00404d6c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46a6d8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004060d0
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404d7c
test eax, eax
jle 0x46a66f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46a668
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404770
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404758
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408aac
test eax, eax
jne 0x46a668
mov ebx, 0x15
jmp 0x46a674
mov ebx, 0x10
jmp 0x46a674
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4a0fbc]
call fcn.0046a480
mov eax, dword [ebp - 8]
call fcn.0046a480
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004060e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a6cf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040450c
lea eax, [ebp - 0x10]
mov edx, dword [0x416e54]
call fcn.00404ff0
ret

Function at 0x46e028
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0046dac8
test byte [ebx + 0x23d], 4
jne 0x46e0bd
mov edx, esp
mov eax, ebx
call fcn.00448ae0
push esp
mov eax, ebx
call fcn.0044f75c
push eax
push 0
mov eax, ebx
test eax, eax
je 0x46e05d
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x46e08e
mov ecx, dword [0x4a5160]
mov dl, 1
mov eax, dword [0x46a140]
call fcn.0040c764
call fcn.00403edc
mov eax, ebx
call fcn.0046e5fc
cmp byte [ebx + 0x57], 0
jne 0x46e0c4
mov eax, ebx
call fcn.0044f960
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46e0c4
push 0
mov eax, ebx
call fcn.0044f960
push eax
call sub.user32.dll_ShowWindow
jmp 0x46e0c4
mov eax, ebx
call fcn.0044c8e0
add esp, 0x10
pop ebx
ret
Function at 0x472e80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x472ee7
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.00404b34
push edi
mov eax, dword [ebp - 8]
call fcn.004049a8
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040453c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472eee
lea eax, [ebp - 8]
call fcn.004044e8
ret

Function at 0x477650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4776da
xor edx, edx
push ebp
push 0x4776bb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4776da
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x47b564
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47b592
mov eax, ebx
call fcn.0047c018
cmp dword [ebx + 0x40], 0
je 0x47b58b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47b603
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47b5f5
cmp dword [ebx + 8], 0
je 0x47b5b4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47b5c6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47b5f5
cmp dword [ebx + 8], 0
je 0x47b5a7
cmp eax, 3
je 0x47b5d9
dec eax
jne 0x47b5a7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47b5a7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47b5a7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47b621
cmp dword [ebx + 0x14], 0xcc
je 0x47b621
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047b62c
pop ebx
ret
Function at 0x48c05c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404998
mov eax, dword [ebp - 8]
call fcn.00404998
xor eax, eax
push ebp
push 0x48c179
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.004049a8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x48c188
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004049a8
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x48c15e
xor eax, eax
push ebp
push 0x48c157
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x48c137
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x48c13b
xor eax, eax
jmp 0x48c13d
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c15e
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c180
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040450c
ret
Function at 0x48c190
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404998
mov eax, dword [ebp - 8]
call fcn.00404998
mov eax, dword [ebp - 0xc]
call fcn.00404998
mov eax, dword [ebp + 0xc]
call fcn.00404998
xor eax, eax
push ebp
push 0x48c304
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x2c], 0x14
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x44], 2
mov eax, dword [ebp - 8]
call fcn.004049a8
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 3
mov eax, 0x48c318
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004049a8
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48c2e1
xor eax, eax
push ebp
push 0x48c2da
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004049a8
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049a8
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004049a8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x48c2c3
push ebx
lea eax, [ebp - 0x2c]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x48c2ba
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x48c2be
xor eax, eax
jmp 0x48c2c0
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c2e1
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c30b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040450c
lea eax, [ebp + 0xc]
call fcn.004044e8
ret
Function at 0x48c320
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x48c3e8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x48c3ec
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x48c3e8
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48c3df
xor eax, eax
push ebp
push 0x48c3d8
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c3df
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48c5e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48c7fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402b54
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48c65d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x48c647
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.004046e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c664
mov eax, dword [ebp - 8]
call fcn.00402b84
ret

Function at 0x48db10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00403008
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x48db4a
cmp byte [ebp - 0xa], 0x31
jne 0x48db48
mov bl, 1
jmp 0x48db4a
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f058
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0044fc64
test al, al
je 0x48f111
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x48f0ef
cmp word [esi + 0x5da], 0
je 0x48f0a9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [ebp - 9], 0
jne 0x48f0c6
cmp dword [ebp - 4], 0
jbe 0x48f0c2
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x48f0c6
xor ebx, ebx
jmp 0x48f0c8
mov bl, 1
test bl, bl
jne 0x48f111
mov eax, dword [0x4a52b8]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x48f111
mov eax, dword [0x4a52b8]
mov eax, dword [eax]
call fcn.00468948
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x48f111
cmp byte [esi + 0x584], 0
jne 0x48f111
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0046e434
cmp eax, 4
jne 0x48f086
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48f11c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x48f1a2
cmp word [esi + 0x5da], 0
je 0x48f15c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [ebp - 9], 0
jne 0x48f179
cmp dword [ebp - 4], 0
jbe 0x48f175
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x48f179
xor ebx, ebx
jmp 0x48f17b
mov bl, 1
test bl, bl
jne 0x48f1c0
mov eax, dword [0x4a52b8]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x48f1c0
mov eax, dword [0x4a52b8]
mov eax, dword [eax]
call fcn.00468948
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [esi + 0x584], 0
jne 0x48f1c0
mov edx, 0xd4
mov eax, esi
call fcn.0046e420
test ax, ax
jne 0x48f139
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494558
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff94
mov ebp, edx
mov esi, eax
mov eax, ebp
call fcn.004044e8
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov eax, esi
call fcn.004049a8
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [esp], eax
cmp dword [esp], 0
je 0x494664
mov eax, dword [esp]
call fcn.00402b54
mov ebx, eax
push ebx
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x49465d
mov eax, 0x34
call fcn.00402b54
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
push esp
lea eax, [esp + 0xc]
push eax
push 0x49466c
push ebx
call sub.version.dll_VerQueryValueA
lea eax, [esp + 0x18]
mov ecx, 0x34
mov edx, dword [esp + 8]
call fcn.004075dc
mov eax, dword [esp + 0xc]
call fcn.00402b84
mov eax, dword [esp + 0x20]
mov esi, eax
shr esi, 0x10
mov edi, eax
and edi, 0xff
mov eax, dword [esp + 0x24]
mov edx, eax
shr edx, 0x10
mov dword [esp + 0x10], edx
and eax, 0xff
mov dword [esp + 0x14], eax
push ebp
mov dword [esp + 0x50], esi
mov byte [esp + 0x54], 0
mov dword [esp + 0x58], edi
mov byte [esp + 0x5c], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x60], eax
mov byte [esp + 0x64], 0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x68], eax
mov byte [esp + 0x6c], 0
lea edx, [esp + 0x50]
mov ecx, 3
mov eax, 0x494678
call fcn.00409c88
mov eax, ebx
call fcn.00402b84
add esp, 0x6c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x494c78
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
mov edx, 0x94
call fcn.004075e4
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
xor eax, eax
cmp dword [esp + 0x10], 2
jne 0x494ce5
mov edx, dword [esp + 4]
sub edx, 3
je 0x494cb4
dec edx
je 0x494cb8
dec edx
je 0x494cbc
dec edx
je 0x494cd8
jmp 0x494d19
mov al, 4
jmp 0x494d19
mov al, 5
jmp 0x494d19
mov edx, dword [esp + 8]
sub edx, 1
jb 0x494ccc
je 0x494cd0
dec edx
je 0x494cd4
jmp 0x494d19
mov al, 6
jmp 0x494d19
mov al, 7
jmp 0x494d19
mov al, 8
jmp 0x494d19
mov edx, dword [esp + 8]
sub edx, 2
jae 0x494d19
mov al, 9
jmp 0x494d19
cmp dword [esp + 4], 4
jne 0x494cf7
cmp dword [esp + 8], 0
jne 0x494cf7
mov al, 1
jmp 0x494d19
cmp dword [esp + 4], 4
jne 0x494d09
cmp dword [esp + 8], 0xa
jne 0x494d09
mov al, 2
jmp 0x494d19
cmp dword [esp + 4], 4
jne 0x494d19
cmp dword [esp + 8], 0x5a
jne 0x494d19
mov al, 3
add esp, 0x94
ret
Function at 0x49b80c
Capabilities:
Extract http body

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x49b815
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
xor eax, eax
push ebp
push 0x49b9dc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov edx, 0xcb
mov eax, esi
call fcn.0046e39c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, 0x49b9ec
call fcn.00406114
cmp dword [ebp - 8], 0
je 0x49b979
lea eax, [ebp - 0xc]
call fcn.004060d0
push eax
push 0x49ba00
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0xbc]
call fcn.004061e0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.004061e0
mov edi, dword [ebp - 0x18]
dec edi
test edi, edi
jl 0x49b979
inc edi
xor esi, esi
lea eax, [ebp - 0x1c]
call fcn.004060d0
push eax
lea eax, [ebp - 0x3c]
call fcn.004163f4
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x2c]
call fcn.00414838
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
lea eax, [ebp - 0x4c]
mov edx, esi
mov cl, 0xfc
call fcn.00414478
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
call fcn.004061e0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
mov ecx, 0x49ba04
call fcn.00406114
lea eax, [ebp - 0x54]
call fcn.00404bf4
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0xf0]
call fcn.004061e0
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00408b8c
mov eax, dword [ebp - 0x50]
mov edx, 0x49ba18
call fcn.00404de8
jne 0x49b971
mov bl, 1
push 0
lea eax, [ebp - 0x58]
mov edx, dword [ebp - 8]
mov ecx, 0x49ba24
call fcn.00406114
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [eax]
call dword [eax + 0xac]
call fcn.004061e0
cmp byte [ebp - 1], 0
je 0x49b979
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x114]
call fcn.004061e0
jmp 0x49b979
inc esi
dec edi
jne 0x49b8a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b9e3
lea eax, [ebp - 0x58]
call fcn.004060d0
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.00404c0c
lea eax, [ebp - 0x4c]
call fcn.0040ff68
lea eax, [ebp - 0x3c]
call fcn.0040ff68
lea eax, [ebp - 0x2c]
call fcn.0040ff68
lea eax, [ebp - 0x1c]
call fcn.004060d0
lea eax, [ebp - 0x14]
call fcn.004060d0
lea eax, [ebp - 0x10]
call fcn.004060d0
lea eax, [ebp - 0xc]
call fcn.004060d0
lea eax, [ebp - 8]
call fcn.004060d0
ret
Function at 0x402716
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x5c9f243
jg 0x402745
inc edi
cmp edi, 0x1e70dee2
jl 0x402725
cmp dword [0x452104], 0x400
jne 0x402797
push 0x448438
push str.secezu
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push esi
call fcn.004028b3
push esi
push esi
call fcn.004028ed
pop ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402a3a
fstp st(0)
push esi
call fcn.00402aab
add esp, 0xc
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x58bc6e
jg 0x4027b6
inc edi
cmp edi, 0xe52f
jl 0x402799
mov eax, dword [0x44a0b4]
mov dword [0x452104], eax
call fcn.00402470
mov edi, 0x3078f
cmp dword [0x452104], 0x51f
jne 0x4027e4
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x4027ca
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x405b98
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449328]
jne 0x405ba2
repz ret
jmp fcn.0040807c
Function at 0x406683
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x449328]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403c23
and dword [ebp - 0x14], 0
cmp dword [0x44bd10], 0
mov dword [ebp - 0x18], eax
jne 0x406736
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4067de
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4067de
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44bd10], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44bd14], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44bd18], eax
call edi
push eax
call esi
mov dword [0x44bd20], eax
test eax, eax
je 0x406736
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44bd1c], eax
mov eax, dword [0x44bd1c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40678f
cmp dword [0x44bd20], ecx
je 0x40678f
push eax
call esi
push dword [0x44bd20]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40678f
test ebx, ebx
je 0x40678f
call edi
test eax, eax
je 0x406786
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406786
test byte [ebp - 8], 1
jne 0x40678f
or dword [ebp + 0x10], 0x200000
jmp 0x4067c2
mov eax, dword [0x44bd14]
cmp eax, dword [ebp - 0x18]
je 0x4067c2
push eax
call esi
test eax, eax
je 0x4067c2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4067c2
mov eax, dword [0x44bd18]
cmp eax, dword [ebp - 0x18]
je 0x4067c2
push eax
call esi
test eax, eax
je 0x4067c2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44bd10]
call esi
test eax, eax
je 0x4067de
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4067e0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405b98
leave
ret