joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ad90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d3d8c], 6
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x224], edi
jb 0x45aef8
mov dword [ebp - 0x220], 0x24
mov ebx, 0x24
mov dword [ebp - 0x21c], 0x26
mov dword [ebp - 0x218], 0x2a
mov dword [ebp - 0x214], 0x23
mov dword [ebp - 0x210], 0xffffffff
mov dword [ebp - 0x228], 0
nop dword [eax]
push 0
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45aedb
nop word [eax + eax]
lea esi, [ebp - 0x20c]
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x45ae30
sub esi, ecx
lea eax, [ebp - 0x20c]
sar esi, 1
push esi
push edi
push eax
call fcn.0048b2ca
add esp, 0xc
test eax, eax
jne 0x45ae73
movzx eax, word [edi + esi*2]
test ax, ax
je 0x45af0b
cmp eax, 0x5c
je 0x45af0b
cmp eax, 0x2f
je 0x45af0b
cmp ebx, 0x26
jne 0x45aedb
lea esi, [esi*2 - 0xc]
mov ecx, str.__x86_
lea edi, [ebp - 0x20c]
add edi, esi
mov eax, edi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45aeb6
test dx, dx
je 0x45aeb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45aeb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x45ae90
xor eax, eax
jmp 0x45aebb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45aed5
cmp esi, 0x208
jae 0x45af21
mov word [edi], ax
mov edi, dword [ebp - 0x224]
jmp 0x45ae20
mov edi, dword [ebp - 0x224]
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
mov ebx, dword [ebp + eax*4 - 0x220]
cmp ebx, 0xffffffff
jne 0x45ae00
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d39f
mov esp, ebp
pop ebp
ret
call fcn.0047d64c
int3

Function at 0x45af30
Capabilities:
Get common file path

Disassembly:
cmp dword [0x4d3d8c], 6
push esi
push edi
mov edi, edx
mov esi, ecx
jb 0x45afb0
call fcn.0045ad90
test eax, eax
je 0x45af99
push 0
push 0x1c
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45af99
cmp word [esi + 2], 0x3a
jne 0x45af99
cmp word [esi + 4], 0x5c
lea edx, [esi + 4]
jne 0x45af99
mov ecx, edi
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45af70
sub ecx, esi
sar ecx, 1
push edx
push str.VirtualStore_s
lea eax, [edi + ecx*2]
push eax
call fcn.0040e1d0
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret
sub edi, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [edi + esi - 2], ax
test ax, ax
jne 0x45afa0
pop edi
xor eax, eax
pop esi
ret
Function at 0x45b890
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ecx
push str._n__e___s_
lea eax, [ebp - 0x234]
push 0x118
push eax
call fcn.0045ca50
add esp, 0x10
lea eax, [ebp - 0x234]
push 5
push 0
push eax
push str.explorer
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret

Function at 0x45bcf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49de7c
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4d59b4]
cmp eax, dword [ecx + 4]
jg 0x45bd4e
mov eax, dword [0x4d5984]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret
push 0x4d59b4
call fcn.0047d957
add esp, 4
cmp dword [0x4d59b4], 0xffffffff
jne 0x45bd30
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00481280
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or edx, 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.00412220
push 0x4d59b4
mov dword [0x4d5984], eax
call fcn.0047d90d
add esp, 4
jmp 0x45bd30

Function at 0x45c740
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
lea eax, [esi*2 + 5]
push eax
mov dword [ebp - 4], eax
call fcn.0047d522
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push 1
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x45c77a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.0045c710
push ebx
mov dword [ebp - 4], eax
call fcn.0047d4ed
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45c9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
sub ecx, edx
push edi
mov edi, dword [ebp + 8]
sub edi, edx
nop
mov al, byte [ecx + edx]
lea edx, [edx + 1]
xor al, byte [edx - 1]
mov byte [edi + edx - 1], al
sub esi, 1
jne 0x45c9b0
pop edi
pop esi
pop ebp
ret
Function at 0x45d820
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x18]
test eax, eax
jne 0x45d8d1
push 0x5c
push dword [edi + 0xc]
call fcn.0047edd8
mov esi, eax
add esp, 8
test esi, esi
je 0x45d85e
mov ebx, dword [edi + 0xc]
add esi, 2
jmp 0x45d863
mov esi, dword [edi + 0xc]
mov ebx, esi
mov eax, ebx
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45d870
sub eax, edx
sar eax, 1
push ecx
mov ecx, ebx
lea edx, [eax + eax]
call fcn.0045f6e0
add esp, 4
push eax
push esi
push str._s__x
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.0045ca50
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x18], eax
test eax, eax
jne 0x45d8d1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d39f
mov esp, ebp
pop ebp
ret
Function at 0x45dea0
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e030
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x4cf06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
call fcn.0045d820
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x2c]
call fcn.00418a50
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov dword [ebp - 4], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
jne 0x45df17
xor edi, edi
jmp 0x45e083
push 0xa00000
push 0x10000
lea ecx, [ebp - 0x40]
call fcn.004593a0
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov ebx, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
cmp ebx, edi
je 0x45e04a
test ebx, ebx
je 0x45e04a
test ecx, ecx
je 0x45e06e
mov edi, dword [ebx + 0xc]
lea eax, [ebx + 8]
mov dword [ebp - 0x18], eax
cmp edi, eax
je 0x45e034
test edi, edi
je 0x45e034
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x45df8e
push eax
push str.__s__r_n
push ecx
call fcn.0040e230
add esp, 4
lea ecx, [ebp - 0x40]
mov edx, eax
call fcn.0045de60
add esp, 8
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x45e028
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x45dfb0
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45dfa5
sub eax, edx
jmp 0x45dfb2
xor eax, eax
mov edx, dword [edi + 0xc]
lea ecx, [edx + 1]
mov dword [ebp - 0x10], ecx
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x45dfc0
sub edx, dword [ebp - 0x10]
add eax, edx
cmp eax, 0xfff6
jl 0x45dfe2
push str.Too_long_entry_in_TInifile::WriteIni_n
call fcn.00459e20
add esp, 4
jmp 0x45e020
mov eax, dword [edi + 0xc]
push eax
test ebx, ebx
je 0x45dffb
push ebx
push str._s__s__r_n
push esi
call fcn.0040e230
add esp, 8
jmp 0x45e009
push str._s_r_n
push esi
call fcn.0040e230
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.0045de60
mov edi, dword [edi + 4]
add esp, 8
mov esi, eax
cmp edi, dword [ebp - 0x18]
je 0x45e028
test edi, edi
jne 0x45df91
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0x14], ebx
cmp ebx, dword [ebp - 0x20]
je 0x45e047
test ebx, ebx
jne 0x45df47
mov eax, dword [ebp - 0x40]
test ecx, ecx
je 0x45e06e
push 0
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x45e06e
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edi, eax
jmp 0x45e070
xor edi, edi
lea ecx, [ebp - 0x40]
call fcn.004593f0
test esi, esi
je 0x45e083
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x28], 0
je 0x45e091
mov ecx, dword [ebp - 0x2c]
call fcn.0045d8f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e550
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e066
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
push 0x49f3cc
push 1
push 0
push 0x49f40c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x45e5b8
xor esi, esi
jmp 0x45e67e
mov eax, dword [ebp - 0x220]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
push 0x104
lea edx, [ebp - 0x21c]
mov ecx, edi
call fcn.0045e6c0
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
add esp, 4
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x220]
push edx
push 0x49f44c
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x45e65e
mov eax, dword [ebp - 0x224]
push 1
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
js 0x45e65e
push 0x104
lea edx, [ebp - 0x21c]
mov ecx, esi
call fcn.0045e6c0
add esp, 4
lea eax, [ebp - 0x21c]
push 0
push eax
push 0x1005
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, 1
jmp 0x45e660
xor esi, esi
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x45e67e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x45e695
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret

Function at 0x45e780
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e796
mov eax, 1
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
ret
Function at 0x45f4b0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x4d3d8c], 6
push esi
push edi
mov esi, edx
mov edi, ecx
jb 0x45f4e4
push 2
push esi
push edi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jns 0x45f50f
mov edx, esi
mov ecx, edi
call fcn.0045f580
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4d5c40]
cmp eax, dword [ecx + 4]
jg 0x45f51a
mov eax, dword [0x4d7034]
test eax, eax
je 0x45f4d5
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x45f4d5
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0x4d5c40
call fcn.0047d957
add esp, 4
cmp dword [0x4d5c40], 0xffffffff
jne 0x45f4f9
push 0xf0000020
push 0x18
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x45f565
push 0xf0000020
push 3
push eax
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
jmp 0x45f565
mov eax, dword [ebp - 4]
push 0x4d5c40
mov dword [0x4d7034], eax
call fcn.0047d90d
add esp, 4
jmp 0x45f4f9

Function at 0x45f6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
mov ecx, edx
mov dword [ebp - 8], 0
mov eax, 0xad7d8b19
mov dword [ebp - 0xc], 0x5e7
mul ecx
mov esi, ecx
shr edx, 0xa
imul eax, edx, 0x5e7
mov edx, ecx
and ecx, 0xfffffffc
and edx, 3
mov dword [ebp - 0x10], edx
sub esi, eax
lea eax, [ecx + edi]
shr ecx, 2
mov esi, dword [esi*4 + 0x4d0858]
xor esi, 0xe31a021d
mov ebx, esi
xor ebx, 0x8f8e053a
cmp edi, eax
cmova ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
test ecx, ecx
je switch.0x0045f787
nop dword [eax]
mov eax, dword [edi]
xor edx, edx
xor eax, 0x3c0f9791
ror esi, 7
imul ecx, eax, 0x7b2fcbc3
add edi, 4
mov eax, ecx
xor eax, ebx
add ebx, 0xb
div dword [ebp - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
xor esi, dword [edx*4 + 0x4d0858]
xor esi, ecx
cmp eax, dword [ebp - 4]
jb case.default.0x45f787
mov edx, dword [ebp - 0x10]
jmp dword [edx*4 + 0x45f800]
mov eax, 0x44444444
jmp 0x45f7d2
mov al, byte [edi]
mov dword [ebp - 4], 0x11111111
mov byte [ebp - 4], al
mov eax, dword [ebp - 4]
jmp 0x45f7d2
mov ax, word [edi]
mov dword [ebp - 4], 0x22222222
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
jmp 0x45f7d2
mov ax, word [edi]
mov dword [ebp - 4], 0x33333333
mov word [ebp - 4], ax
mov al, byte [edi + 2]
mov byte [ebp - 2], al
mov eax, dword [ebp - 4]
jmp 0x45f7d2
xor eax, 0x3c0f9791
ror esi, 7
imul ecx, eax, 0x7b2fcbc3
lea eax, [edx + ebx]
xor edx, edx
mov ebx, 0x5e7
pop edi
xor eax, ecx
div ebx
xor esi, dword [edx*4 + 0x4d0858]
xor esi, ecx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0
push 0x2f5
mov eax, edx
mov dword [esp + 0x2c], ecx
push 0
push eax
mov dword [esp + 0x28], eax
mov ebx, ecx
call fcn.0049ae30
mov ecx, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x28], 0
mov edi, dword [eax*8 + 0x4d0858]
mov esi, dword [eax*8 + 0x4d085c]
xor edi, 0x4190944b
xor esi, 0x313b88a3
mov dword [esp + 0x1c], edi
mov eax, edi
mov dword [esp + 0x20], esi
xor eax, 0xcf82b318
mov dword [esp + 0x10], eax
mov eax, esi
xor eax, 0xa0f643cc
mov dword [esp + 0x14], eax
mov eax, ecx
and ecx, 0xfffffff8
and eax, 7
mov dword [esp + 0x34], eax
lea eax, [ecx + ebx]
shr ecx, 3
cmp ebx, eax
cmova ecx, edx
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x45f9c7
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
xor eax, 0x57ff7a3a
push 0xda5174b5
push 0xa1d8414f
xor ecx, 0xd28cb573
push eax
push ecx
call fcn.0047dfd0
mov ecx, dword [esp + 0x20]
mov edi, eax
mov ebx, edx
xor esi, esi
mov edx, dword [esp + 0x1c]
mov eax, edx
shrd edx, ecx, 0x11
shl eax, 0xf
shr ecx, 0x11
or esi, edx
or eax, ecx
mov ecx, edi
xor ecx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, ebx
xor eax, dword [esp + 0x14]
push 0
push 0x2f5
push eax
push ecx
call fcn.0049ae30
mov ecx, dword [esp + 0x20]
xor esi, dword [eax*8 + 0x4d0858]
xor ecx, dword [eax*8 + 0x4d085c]
xor esi, edi
mov eax, dword [esp + 0x28]
xor ecx, ebx
add dword [esp + 0x10], 0x17
mov edi, esi
mov ebx, dword [esp + 0x24]
adc dword [esp + 0x14], 0
add ebx, 8
inc eax
mov dword [esp + 0x1c], esi
mov esi, ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], eax
cmp eax, dword [esp + 0x18]
jb case.default.0x45f9cb
mov eax, dword [esp + 0x34]
jmp dword [eax*4 + 0x45fad0]
mov eax, 0x88888888
mov edx, eax
jmp 0x45faab
mov al, byte [ebx]
mov edx, 0x11111111
mov dword [esp + 0x28], 0x11111111
mov byte [esp + 0x28], al
jmp 0x45faa7
mov ax, word [ebx]
mov edx, 0x22222222
mov dword [esp + 0x28], 0x22222222
mov word [esp + 0x28], ax
jmp 0x45faa7
mov ax, word [ebx]
mov edx, 0x33333333
mov dword [esp + 0x28], 0x33333333
mov word [esp + 0x28], ax
mov al, byte [ebx + 2]
mov byte [esp + 0x2a], al
jmp 0x45faa7
mov eax, dword [ebx]
mov edx, 0x44444444
mov dword [esp + 0x28], 0x44444444
jmp 0x45faab
mov cl, byte [ebx + 4]
mov eax, dword [ebx]
mov dword [esp + 0x2c], 0x55555555
mov byte [esp + 0x2c], cl
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x28], 0x55555555
jmp 0x45faab
mov cx, word [ebx + 4]
mov eax, dword [ebx]
mov dword [esp + 0x2c], 0x66666666
mov word [esp + 0x2c], cx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x28], 0x66666666
jmp 0x45faab
mov cx, word [ebx + 4]
mov eax, dword [ebx]
mov dword [esp + 0x2c], 0x77777777
mov word [esp + 0x2c], cx
mov cl, byte [ebx + 6]
mov byte [esp + 0x2e], cl
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x28], 0x77777777
jmp 0x45faab
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x34]
xor ecx, ecx
add ebx, dword [esp + 0x10]
adc ecx, dword [esp + 0x14]
push ecx
push ebx
push edx
push eax
push esi
push edi
call fcn.0045f810
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4606d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e277
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4cf06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push 0x30
call fcn.0047d4f2
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x46076b
cmp ebx, dword [esi]
je 0x460797
mov eax, dword [esi]
test eax, eax
je 0x460780
push eax
call fcn.0047d4ed
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
test ebx, ebx
je 0x460797
or edx, 0xffffffff
mov ecx, ebx
call fcn.0043a7d0
mov dword [esi], eax
test edi, edi
je 0x4607a0
cmp edi, dword [esi + 8]
je 0x4607cf
mov eax, dword [esi + 8]
test eax, eax
je 0x4607b7
push eax
call fcn.0047d4ed
add esp, 4
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0xffffffff
test edi, edi
je 0x4607cf
or edx, 0xffffffff
mov ecx, edi
call fcn.0043a7d0
mov dword [esi + 8], eax
push 0
lea ecx, [esi + 0x10]
call fcn.0040e260
mov eax, dword [ebp + 0x10]
push esi
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x14]
push 0
push 0x460570
mov dword [esi + 0x1c], 0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.0048732c
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460840
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e2b0
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x4cf06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0
call fcn.00486e21
xor edi, edi
push 0x400
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
call fcn.0048714e
add esp, 8
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4608a4
xor ecx, ecx
mov edi, 0x400
mov word [eax], cx
mov dword [ebp - 0x24], edi
mov word [eax + 0x3fe], cx
push 0
mov dword [ebp - 4], 0
call fcn.00486e21
xor ebx, ebx
push 0x4000
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0048714e
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4608e2
xor ecx, ecx
mov ebx, 0x4000
mov word [eax], cx
mov dword [ebp - 0x18], ebx
mov word [eax + 0x3ffe], cx
push 0x38
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 1
push 0
push eax
mov dword [ebp - 0x64], 0x3c
call fcn.00481280
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov ecx, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x38], eax
lea edi, [ecx + 1]
mov dword [ebp - 0x34], ebx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x460917
lea eax, [ebp - 0x64]
sub ecx, edi
push eax
push 0
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x46094d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetCrackUrl_err__d__n
call fcn.00459e20
add esp, 8
xor esi, esi
jmp 0x4609f1
mov eax, dword [ebp - 0x58]
cmp eax, 4
jne 0x460a18
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x460966
mov dword [eax], 1
test esi, esi
je 0x4609a1
mov edi, dword [ebp - 0x54]
test edi, edi
je 0x460975
cmp edi, dword [esi]
je 0x4609a1
mov eax, dword [esi]
test eax, eax
je 0x46098a
push eax
call fcn.0047d4ed
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
test edi, edi
je 0x4609a1
or edx, 0xffffffff
mov ecx, edi
call fcn.0043a7d0
mov dword [esi], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x4609df
mov edi, dword [ebp - 0x38]
test edi, edi
je 0x4609b3
cmp edi, dword [esi]
je 0x4609df
mov eax, dword [esi]
test eax, eax
je 0x4609c8
push eax
call fcn.0047d4ed
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
test edi, edi
je 0x4609df
or edx, 0xffffffff
mov ecx, edi
call fcn.0043a7d0
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4609ec
movzx eax, word [ebp - 0x4c]
mov dword [ecx], eax
mov esi, 1
push dword [ebp - 0x1c]
call fcn.00486e21
push dword [ebp - 0x28]
call fcn.00486e21
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 3
je 0x460966
push str.Scheme_not_http_https_n
call fcn.00459e20
add esp, 4
xor esi, esi
jmp 0x4609f1