joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4252df
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x42e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
cmp dword [ebp + 0xc], 0x19f
mov dword [ebp - 0x408], eax
jne 0x42530f
push edi
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
xor ebx, ebx
cmp dword [ebp + 0xc], edi
jle 0x425381
push esi
lea esi, [ebp - 0x40c]
mov dword [ebp - 0x40c], edi
call fcn.004252d4
mov eax, dword [ebp - 0x408]
mov cl, byte [ebp - 0x40c]
add eax, ebx
xor byte [eax], cl
cmp dword [ebp + 0xc], 0xf
jne 0x42537a
push edi
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.Cogi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push str.Rodohuvoboco_jalajo_sezafowebazobe_dolarocuviveg
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x425317
pop esi
cmp dword [ebp + 0xc], 0x2d
pop edi
pop ebx
jne 0x42539a
or dword [0x43e844], 0xffffffff
mov dword [0x43e840], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
leave
ret
Function at 0x401b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x401b39
xor ecx, ecx
jne 0x401b39
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401b80
mov eax, dword [ebp - 0xc]
jmp 0x401bdd
cmp dword [ebp - 4], 1
je 0x401b93
cmp dword [ebp - 4], 2
je 0x401b93
mov eax, 0xd
jmp 0x401bdd
cmp dword [ebp + 0xc], 0
je 0x401bd1
cmp dword [ebp - 8], 0
je 0x401bc9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x401bc0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x401bc7
mov eax, 0xd
jmp 0x401bdd
jmp 0x401bd1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41ac96
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x4666da
call fcn.0045ea44
push ecx
push ecx
push ebx
push edi
push 0xb4
call fcn.0043c5aa
pop ecx
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x41acc3
push eax
call fcn.0041b950
jmp 0x41acc5
xor eax, eax
or dword [ebp - 4], 0xffffffff
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push dword [ebp + 8]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x41ad4d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
inc eax
push eax
call fcn.0043b860
pop ecx
push ebx
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov byte [edi + eax], bl
mov ecx, dword [esi]
push edi
call fcn.0041ba26
push edi
test al, al
je 0x41ad39
call fcn.0043bc7d
pop ecx
mov al, 1
jmp 0x41ad4f
call fcn.0043bc7d
mov eax, dword [esi]
pop ecx
cmp eax, ebx
je 0x41ad4b
push eax
call fcn.0041ad5d
mov dword [esi], ebx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41adc0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
mov eax, dword [0x48ae9c]
sub esp, 0x114
cmp eax, 0xffffffff
jne 0x41af2b
push 0x110
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [0x48ae9c], 0xfffffc18
mov dword [ebp - 0x9c], 0x114
call fcn.0043c260
add esp, 0xc
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41af26
cmp dword [ebp - 0x8c], 2
jne 0x41af26
cmp dword [ebp - 0x98], 5
jne 0x41aeb8
cmp dword [ebp - 0x94], 0
jne 0x41ae43
xor eax, eax
inc eax
jmp 0x41af18
cmp dword [ebp - 0x94], 1
jne 0x41aeaa
push 0x7f
lea eax, [ebp - 0x88]
push eax
push str.Service_Pack_1
call fcn.0043f436
add esp, 0xc
test eax, eax
jne 0x41ae6a
push 3
jmp 0x41aeb5
push 0x7f
lea eax, [ebp - 0x88]
push eax
push str.Service_Pack_2
call fcn.0043f436
add esp, 0xc
test eax, eax
jne 0x41ae88
push 4
jmp 0x41aeb5
push 0x7f
lea eax, [ebp - 0x88]
push eax
push str.Service_Pack_3
call fcn.0043f436
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
jmp 0x41af18
cmp dword [ebp - 0x94], 2
jne 0x41af26
push 6
pop eax
jmp 0x41af18
cmp dword [ebp - 0x98], 6
jne 0x41af1f
mov eax, dword [ebp - 0x94]
sub eax, 0
je 0x41aeda
dec eax
je 0x41aed6
dec eax
jne 0x41af26
push 0xb
jmp 0x41aeb5
push 0xa
jmp 0x41aeb5
push 0x7f
lea eax, [ebp - 0x88]
push eax
push str.Service_Pack_1
call fcn.0043f436
add esp, 0xc
test eax, eax
jne 0x41aef8
push 8
jmp 0x41aeb5
push 0x7f
lea eax, [ebp - 0x88]
push eax
push str.Service_Pack_2
call fcn.0043f436
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 9
mov dword [0x48ae9c], eax
jmp 0x41af2b
mov eax, 0x3e8
jmp 0x41af18
mov eax, dword [0x48ae9c]
add ebp, 0x78
leave
ret

Function at 0x41af30
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x41af8e
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x41af85
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp dword [ebp - 4], ebx
pop ebx
setne al
leave
ret

Function at 0x41feb0
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x422024
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0041adc0
cmp eax, 7
mov ebx, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
jge 0x42203f
mov ebx, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
and dword [ebp - 4], 0
push 0
push 0x18
push ebx
mov edi, str.SEContainer
push edi
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
jne 0x42206a
push 8
push 0x18
push ebx
push edi
lea eax, [ebp - 4]
push eax
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x422072
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x422088
mov esi, str.vc8v7vghw7v278vn2v8239vh29vh890m
push 8
pop ecx
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
mov byte [ebp - 0x34], cl
mov byte [ebp - 0x33], 2
mov dword [ebp - 0x30], 0x6610
mov dword [ebp - 0x2c], 0x20
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
cmp dword [ebp - 4], ebx
je 0x4220e9
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
xor edi, edi
inc edi
mov dword [ebp - 8], edi
call esi
push ebx
push str.aqkeezgxijvlm2op
push edi
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4220f1
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
push ebx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4221c6
cmp eax, 0xffffffff
je 0x4221c6
mov dword [ebp - 0xc], eax
call fcn.00422024
mov dword [ebp - 8], eax
cmp eax, edi
je 0x422192
push eax
mov eax, dword [ebp + 0x10]
call fcn.00422072
pop ecx
mov dword [ebp - 4], eax
cmp eax, edi
je 0x422187
mov ebx, dword [ebp + 0xc]
test bl, 0xf
je 0x422141
shr ebx, 4
inc ebx
shl ebx, 4
jmp 0x422144
add ebx, 0x10
push ebx
call fcn.0043b860
push ebx
mov edi, eax
push 0
push edi
call fcn.0043c260
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.0043bef0
add esp, 0x1c
push ebx
lea eax, [ebp + 0xc]
push eax
push edi
push 0
push 1
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp + 0xc]
push dword [ebp - 4]
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test byte [ebp - 0xc], 0xf
jne 0x4221c2
mov eax, dword [esi]
cmp eax, 0x10
jbe 0x4221c2
add eax, 0xfffffff0
push eax
mov dword [esi], eax
call fcn.0043b860
push dword [esi]
mov ebx, eax
push edi
push ebx
call fcn.0043bef0
push edi
call fcn.0043bc7d
add esp, 0x14
mov eax, ebx
jmp 0x4221c8
mov eax, edi
jmp 0x4221c8
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x4221cc
Capabilities:
Encrypt or decrypt via wincrypt
Reference public rsa key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor edi, edi
mov dword [ebp - 4], 0x20
cmp dword [ebp + 8], edi
je 0x4222bd
push esi
xor esi, esi
call fcn.00422024
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x4222b8
lea ecx, [ebp - 8]
push ecx
push edi
push edi
push 0x94
push 0x46ef40
push eax
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4222ae
push ebx
push dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 1
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
call ebx
test eax, eax
je 0x4222a4
push dword [ebp - 0xc]
call fcn.0043b860
push dword [ebp - 4]
mov esi, eax
push dword [ebp + 8]
push esi
call fcn.0043bef0
add esp, 0x10
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push esi
push edi
push 1
push edi
push dword [ebp - 8]
call ebx
test eax, eax
je 0x42229b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
test ecx, 0xfffffffe
jbe 0x4222a4
mov eax, esi
mov cl, byte [eax + ecx - 1]
mov dl, byte [edi + esi]
mov byte [edi + esi], cl
mov ecx, dword [ebp - 4]
mov byte [eax + ecx - 1], dl
mov ecx, dword [ebp - 4]
mov edx, ecx
inc edi
shr edx, 1
dec eax
cmp edi, edx
jb 0x422279
xor edi, edi
jmp 0x4222a4
push esi
call fcn.0043bc7d
pop ecx
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
jmp 0x4222bf
xor eax, eax
pop edi
leave
ret
Function at 0x424250
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, eax
test esi, esi
je 0x424392
test ebp, ebp
je 0x424392
cmp dword [esp + 0x14], 0
je 0x424392
lea ecx, [edi + 2]
test ecx, ecx
jl 0x424392
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x40000000
jge 0x424392
cmp edi, 2
mov ecx, ebp
jle 0x42431f
lea edx, [edi - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
push ebx
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x46d790]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
movzx eax, byte [eax + ebx + 0x46d790]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
shr ebx, 6
movzx eax, byte [ebx + eax*4 + 0x46d790]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x46d790]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x4242c0
pop ebx
test edi, edi
je 0x42437f
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + 0x46d790]
mov byte [ecx], al
inc ecx
cmp edi, 1
jle 0x424365
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shl edx, 4
shr eax, 4
movzx edx, byte [edx + eax + 0x46d790]
mov byte [ecx], dl
movzx eax, byte [esi + 1]
inc ecx
and eax, 0xf
movzx edx, byte [eax*4 + 0x46d790]
mov byte [ecx], dl
jmp 0x42437a
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov dl, byte [eax + 0x46d790]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov edx, dword [esp + 0x14]
mov eax, ecx
sub eax, ebp
pop edi
pop esi
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret

Function at 0x4243eb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, eax
test edx, edx
jne 0x4243f6
xor eax, eax
pop edi
ret
or eax, 0xffffffff
push esi
mov ecx, 0xff
cmp edi, 8
jb 0x4244a9
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x46d390]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x46d390]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x46d390]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x46d390]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x46d390]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x46d390]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x46d390]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x46d390]
inc edx
sub edi, 8
dec esi
jne 0x42440e
pop ebx
test edi, edi
je 0x4244c2
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x46d390]
inc edx
dec edi
jne 0x4244ad
pop esi
not eax
pop edi
ret
Function at 0x424d44
Capabilities:
Create http request

Disassembly:
mov eax, 0x465242
call fcn.0045ea44
sub esp, 0x84
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x14], ebx
push str.Browser1.0
mov dword [ebp - 0x1c], vtable.CWebWorld.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.http:__tb.sogou.com_
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], ebx
call fcn.00405b00
push dword [ebp + 8]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 1
call fcn.0041e0c0
add esp, 0xc
push 0x47c73c
push eax
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 2
call fcn.00409750
add esp, 0xc
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 3
call fcn.00409280
lea ecx, [ebp - 0x70]
call fcn.00407d30
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 1
call fcn.00407d30
mov esi, 0x48e3f4
mov ecx, esi
call fcn.004015b0
test al, al
je 0x424e0b
push str.Unknown
lea ecx, [ebp - 0x8c]
call fcn.00405b00
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], 1
jmp 0x424e0d
mov eax, esi
push eax
lea ecx, [ebp - 0x54]
call fcn.004092a0
mov dword [ebp - 4], 1
test byte [ebp - 0x14], 1
je 0x424e2e
lea ecx, [ebp - 0x8c]
call fcn.00407d30
lea ecx, [ebp - 0x54]
call fcn.00405c20
push eax
push 0x47c744
push 8
push dword [0x48d1c4]
call fcn.00454eb0
add esp, 0x10
lea ecx, [ebp - 0x38]
call fcn.00405580
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.00428ef8
cmp al, bl
jne 0x424ea0
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x38]
push eax
call fcn.00409280
lea ecx, [ebp - 0x38]
call fcn.00407d30
lea ecx, [ebp - 0x54]
call fcn.00407d30
lea ecx, [ebp - 0x1c]
call fcn.00428ee8
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
lea ecx, [ebp - 0x38]
call fcn.00405c20
push eax
push 0x47c754
push 8
push dword [0x48d1c4]
call fcn.00454eb0
add esp, 0x10
push ebx
push str.OK_r_n
lea ecx, [ebp - 0x38]
call fcn.00409310
cmp eax, ebx
je 0x424ef8
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x38]
push eax
call fcn.00409280
lea ecx, [ebp - 0x38]
call fcn.00407d30
lea ecx, [ebp - 0x54]
call fcn.00407d30
lea ecx, [ebp - 0x1c]
call fcn.00428ee8
mov al, bl
jmp 0x424e92
push 4
push 0x47c76c
lea ecx, [ebp - 0x38]
call fcn.00409310
add eax, 0xfffffffc
push eax
push 4
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x38]
call fcn.00409340
mov ecx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 6
call fcn.00409280
lea ecx, [ebp - 0x8c]
call fcn.00407d30
mov bl, 1
jmp 0x424edc
Function at 0x4256a6
Capabilities:
Create thread

Disassembly:
mov eax, 0x46709d
call fcn.0045ea44
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea esi, [edi + 0x10]
mov dword [ebp - 4], ebx
call fcn.004255f2
push 0xa
pop eax
push 5
pop esi
lea ecx, [edi + 0x1658]
mov dword [edi + 0xe0], eax
mov dword [edi + 0xe4], eax
mov dword [edi + 0xe8], eax
mov dword [edi + 0xec], esi
mov byte [edi + 0xf0], 1
mov dword [edi + 0xf4], ebx
call fcn.00405580
lea ecx, [edi + 0x1674]
call fcn.00401d20
lea ecx, [edi + 0x16a0]
mov dword [edi + 0x1690], ebx
mov dword [edi + 0x1694], ebx
call fcn.00405580
lea ecx, [edi + 0x16bc]
call fcn.00405580
lea ecx, [edi + 0x16d8]
call fcn.00405580
mov byte [ebp - 4], 6
lea eax, [edi + 0x1704]
push eax
mov dword [edi + 0x16f4], 0x1000
mov dword [edi + 0x16f8], ebx
mov dword [edi + 0x16fc], ebx
mov dword [edi + 0x1700], ebx
call fcn.0041c069
lea eax, [edi + 0x1724]
mov byte [ebp - 4], 7
push eax
mov dword [edi + 0x171c], ebx
call fcn.00431fc4
lea eax, [edi + 0x173c]
push eax
mov byte [ebp - 4], 8
call fcn.00431fc4
mov byte [ebp - 4], 9
lea eax, [edi + 0x1768]
push eax
mov dword [edi + 0x1754], ebx
mov dword [edi + 0x1758], ebx
mov dword [edi + 0x175c], ebx
mov byte [edi + 0x1760], bl
mov dword [edi + 0x1764], 0x1f
call fcn.0041c674
lea ecx, [edi + 0x17b4]
mov dword [edi + 0x1788], ebx
mov dword [edi + 0x178c], ebx
mov byte [edi + 0x1790], bl
mov dword [edi + 0x1794], ebx
mov byte [edi + 0x17b0], 1
call fcn.00405580
lea ecx, [edi + 0x17d0]
call fcn.00405580
lea ecx, [edi + 0x17ec]
call fcn.00405580
lea ecx, [edi + 0x1808]
call fcn.00405580
lea ecx, [edi + 0x1828]
mov dword [edi + 0x1824], ebx
call fcn.00405580
lea ecx, [edi + 0x1844]
call fcn.00405580
lea ecx, [edi + 0x1870]
mov dword [edi + 0x1860], ebx
mov word [edi + 0x1864], si
mov dword [edi + 0x1868], ebx
mov dword [edi + 0x186c], ebx
call fcn.00405580
mov byte [ebp - 4], 0x11
push 0x54
mov dword [edi + 0x188c], ebx
call fcn.0043c5aa
pop ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x12
cmp eax, ebx
je 0x425871
push edi
push eax
call fcn.004297b5
mov esi, eax
jmp 0x425873
xor esi, esi
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x1720], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push ebx
push esi
push 0x428b48
push ebx
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 8]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1540
lea eax, [edi + 0x100]
push ebx
push eax
call fcn.0043c260
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
lea eax, [edi + 0x1640]
push eax
call esi
lea eax, [edi + 0x1798]
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x425b44
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
lea ecx, [esi + 0x16a0]
call fcn.00405ad0
push dword [ebp + 8]
lea ecx, [esi + 0x16bc]
call fcn.00405ad0
push dword [ebp + 0xc]
lea ecx, [esi + 0x16d8]
call fcn.00405ad0
push dword [ebp + 8]
lea ecx, [esi + 0x2c]
call fcn.00405ad0
push dword [ebp + 0xc]
lea ecx, [esi + 0x48]
call fcn.00405ad0
push 0x48e3f4
lea ecx, [esi + 0x10]
call fcn.00409280
push dword [ebp + 0x10]
lea ecx, [esi + 0x1674]
call fcn.00401d00
xor edi, edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push edi
push esi
push 0x428a06
push edi
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 8]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
pop edi
pop ebp
ret 0xc

Function at 0x426c27
Capabilities:
Create thread

Disassembly:
mov eax, 0x46671a
call fcn.0045ea44
push ecx
push esi
push edi
push 0xd0
call fcn.0043c5aa
pop ecx
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
je 0x426c62
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push eax
call fcn.00429dc9
mov esi, eax
jmp 0x426c64
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0x1724]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov dword [ebp + 0x14], esi
sar ecx, 2
mov dword [esi + 0xb8], ecx
lea ecx, [ebp + 0x14]
push ecx
call fcn.0042876b
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push edi
push esi
push 0x428b87
push edi
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 8]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret 0x10
Function at 0x428ef8
Capabilities:
Read data from internet
Receive data

Disassembly:
mov eax, 0x465138
call fcn.0045ea44
sub esp, 0x458
push ebx
push esi
push edi
push 4
pop edi
push edi
lea eax, [ebp - 0x2c]
push eax
mov esi, ecx
push 6
push dword [esi + 4]
xor ebx, ebx
mov dword [ebp - 0x28], 0x20
mov byte [ebp - 0x11], 1
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov ecx, dword [ebp + 8]
push ebx
push 0x4000000
push ebx
push ebx
call fcn.00405c20
push eax
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x429058
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
push ebx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0x20000013
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], edi
call esi
test eax, eax
je 0x428f8c
mov eax, dword [ebp - 0x1c]
push 0x64
xor edx, edx
pop ecx
div ecx
cmp eax, 2
je 0x428f8c
xor al, al
jmp 0x42905e
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x64]
push eax
push 5
push dword [ebp + 8]
call esi
cmp eax, 1
jne 0x42900e
lea eax, [ebp - 0x64]
push eax
call fcn.00440088
mov edi, eax
pop ecx
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0042906f
push ebx
lea esi, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.004290d1
lea ecx, [ebp - 0x18]
push ecx
push edi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x24], eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x428fe5
cmp dword [ebp - 0x18], edi
jne 0x428fe5
mov byte [ebp - 0x11], 1
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
lea esi, [ebp - 0x44]
call fcn.004290d1
mov ecx, dword [ebp + 0xc]
push edi
push dword [ebp - 0x24]
mov byte [eax], bl
call fcn.00405a20
mov eax, esi
call fcn.004290b5
jmp 0x42905b
mov dword [ebp - 0x18], ebx
cmp ebx, ebx
jbe 0x429027
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x464]
push eax
call fcn.00409830
lea eax, [ebp - 0x18]
push eax
push 0x400
lea eax, [ebp - 0x464]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, ebx
je 0x42904d
cmp dword [ebp - 0x18], ebx
ja 0x429015
mov byte [ebp - 0x11], 1
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x42905b
mov byte [ebp - 0x11], bl
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8