joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410e90
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x484
mov eax, dword [0x44c040]
xor eax, esp
mov dword [esp + 0x480], eax
mov eax, dword [ebp + 8]
push esi
push 0x4447e0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call fcn.00429114
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
je 0x410f9c
push eax
push 0x400
lea eax, [esp + 0x88]
mov dword [esp + 0x14], 0
push 1
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.0042941d
add esp, 0x10
test eax, eax
je 0x410f51
push eax
lea edx, [esp + 0x84]
lea ecx, [esp + 0xc]
call fcn.0040ac20
push dword [esp + 8]
lea eax, [esp + 0x88]
push 0x400
push 1
push eax
call fcn.0042941d
add esp, 0x14
test eax, eax
jne 0x410f21
lea edx, [esp + 0x70]
lea ecx, [esp + 8]
call fcn.0040ace0
push dword [esp + 4]
call fcn.004291d1
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x74]
add esp, 4
mov esi, 0xc
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x410f9c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x410f76
mov al, 1
pop esi
mov ecx, dword [esp + 0x480]
xor ecx, esp
call fcn.00421b57
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x484]
xor al, al
pop esi
xor ecx, esp
call fcn.00421b57
mov esp, ebp
pop ebp
ret

Function at 0x410fc0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x474
mov eax, dword [0x44c040]
xor eax, esp
mov dword [esp + 0x470], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x4447e0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call fcn.00429114
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x411019
xor al, al
pop esi
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00421b57
mov esp, ebp
pop ebp
ret
push eax
push 0x400
lea eax, [esp + 0x78]
mov dword [esp + 0x14], 0
push 1
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.0042941d
add esp, 0x10
test eax, eax
je 0x41108c
push eax
lea edx, [esp + 0x74]
lea ecx, [esp + 0xc]
call fcn.0040ac20
push dword [esp + 8]
lea eax, [esp + 0x78]
push 0x400
push 1
push eax
call fcn.0042941d
add esp, 0x14
test eax, eax
jne 0x411062
mov edx, esi
lea ecx, [esp + 8]
call fcn.0040ace0
push dword [esp + 4]
call fcn.004291d1
mov ecx, dword [esp + 0x478]
add esp, 4
mov al, 1
pop esi
xor ecx, esp
call fcn.00421b57
mov esp, ebp
pop ebp
ret
Function at 0x411250
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x44c040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x44fb6b], 0
jne 0x4113d2
cmp byte [0x454d58], 0
mov byte [0x44fb6b], 1
jne 0x4113ba
push ebx
push edi
push 0x110
lea eax, [ebp - 0x328]
mov byte [0x454d58], 1
push 0
push eax
call fcn.004238c0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004238c0
add esp, 0x18
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x411394
push str.kernel32.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00427bcd
add esp, 0xc
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], 0
xor bl, bl
mov dword [ebp - 0x218], 0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x411394
push esi
push eax
call fcn.00427b01
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20c]
push esi
push dword [ebp - 0x210]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x411379
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x4444a0
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x411379
mov eax, dword [ebp - 0x214]
mov bl, 1
movzx edi, word [eax + 0xa]
jmp 0x41137f
mov edi, dword [ebp - 0x218]
test esi, esi
je 0x41138c
push esi
call fcn.00427afc
add esp, 4
movzx eax, di
pop esi
test bl, bl
jne 0x41139a
mov eax, dword [ebp - 0x328]
cmp eax, 6
pop edi
setae al
mov byte [0x454d59], al
pop ebx
mov byte [0x44fb6a], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421b57
mov esp, ebp
pop ebp
ret
mov al, byte [0x454d59]
mov byte [0x44fb6a], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421b57
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x44fb6a]
xor ecx, ebp
call fcn.00421b57
mov esp, ebp
pop ebp
ret
Function at 0x4116c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], 0
push esi
push edi
lea eax, [ebx + 4]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp + 0xc]
xor esi, esi
xor edi, edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
mov eax, 0x44cfa0
mov dword [ebp - 4], esi
xor ecx, ecx
mov dword [ebx + 0x20], edx
nop dword [eax]
cmp dword [eax], edx
je 0x411713
add ecx, 0x10
add eax, 0x10
cmp ecx, 0x40
jb 0x411700
xor ecx, ecx
jmp 0x411725
mov esi, dword [eax + 0xc]
mov ecx, dword [eax + 4]
mov edi, dword [eax + 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edi
push 0
push 0x80
push ecx
push 0
push edi
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004054c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x1c], eax
mov edi, 1
cmp eax, 0xffffffff
jne 0x4117b0
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x41176a
cmp edi, 3
jge 0x4117ca
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x411787
cmp eax, 5
jne 0x4117df
cmp edi, 3
jge 0x4117ca
push 0x80
mov ecx, esi
call fcn.004054c0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80
push dword [ebp - 4]
mov ecx, esi
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004054c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc edi
mov dword [ebx + 0x1c], eax
cmp eax, 0xffffffff
je 0x411750
lea ecx, [ebx + 0x24]
cmp ecx, esi
je 0x4117ca
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4117c1
mov eax, dword [esi]
push dword [esi + 0x10]
push eax
call fcn.00402e40
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test eax, eax
jne 0x4117ca
mov dword [ebp - 0x10], 0xfffffffe
jmp 0x4117ca

Function at 0x411840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x411870
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x411866
mov dword [eax], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41189b
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
test ecx, ecx
je 0x4118aa
mov dword [ecx], eax
add dword [esi + 0x3c], eax
test eax, eax
jne 0x4118bb
pop edi
mov eax, 0xfffffffd
pop esi
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412f50
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x44c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x410
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.004238c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x418]
add esp, 0xc
push 0x444410
push eax
call esi
push 0x44e288
lea eax, [ebp - 0x418]
push eax
call esi
push 0x44e288
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x413156
push 0x44e288
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp word [edi*2 + 0x44e286], 0x5c
je 0x412fe9
push 0x4444a0
lea eax, [ebp - 0x418]
push eax
call esi
push dword [0x44c02c]
lea eax, [ebp - 0x418]
push eax
call esi
push 0x439ab8
lea eax, [ebp - 0x418]
push eax
call esi
push 0x44e490
lea eax, [ebp - 0x418]
push eax
call esi
push 0x439ab8
lea eax, [ebp - 0x418]
push eax
call esi
push dword [0x44c030]
lea eax, [ebp - 0x418]
push eax
call esi
push 0x439ab8
lea eax, [ebp - 0x418]
push eax
call esi
cmp byte [0x44c028], 0
mov ecx, 0x446044
mov eax, 0x446040
cmove eax, ecx
push eax
lea eax, [ebp - 0x418]
push eax
call esi
push 0x444410
lea eax, [ebp - 0x418]
push eax
call esi
push 0x5c
push 0x44e8a0
call fcn.00423614
mov edi, eax
add esp, 8
test edi, edi
je 0x4130a9
push 0x439ac0
lea eax, [ebp - 0x418]
push eax
call esi
lea eax, [edi + 2]
push eax
lea eax, [ebp - 0x418]
push eax
call esi
push 0x444410
lea eax, [ebp - 0x418]
push eax
call esi
push 0x5c
push 0x44e698
call fcn.00423614
mov edi, eax
add esp, 8
test edi, edi
je 0x4130e7
push 0x439ac0
lea eax, [ebp - 0x418]
push eax
call esi
lea eax, [edi + 2]
push eax
lea eax, [ebp - 0x418]
push eax
call esi
push 0x444410
lea eax, [ebp - 0x418]
push eax
call esi
push 0x44
lea eax, [ebp - 0x478]
push 0
push eax
call fcn.004238c0
add esp, 0xc
mov dword [ebp - 0x478], 0x44
cmp byte [0x44c028], 0
je 0x413123
mov eax, 5
mov dword [ebp - 0x44c], 1
mov word [ebp - 0x448], ax
lea eax, [ebp - 0x430]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x478]
movaps xmmword [ebp - 0x430], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00421b57
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x413720
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
push 0
push 0
push 0x2000
mov esi, dword [edi]
mov ecx, 0x40000003
push 0x2000
push 0xff
cmp esi, 0xffffffff
mov eax, 0x400c0003
push 6
cmovne eax, ecx
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x413798
cmp esi, eax
jne 0x41378f
push 0
push 0
push 0x2000
push 0x2000
push 0xff
push 0
push 0x40000003
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x413798
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x10000000
push 6
push dword [edi]
call fcn.004113f0
push 6
push dword [edi]
call fcn.00411470
mov ebx, dword [ebp + 8]
add esp, 0x14
xor esi, esi
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x413803
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, 0x12
je 0x4137fa
cmp eax, 0x217
je 0x4137f1
cmp eax, 0x3e5
jne 0x413803
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
push dword [ebx + 0x10]
call edi
test eax, eax
jne 0x413805
push dword [ebx + 0x10]
call edi
test eax, eax
jne 0x413805
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x414f10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437a7e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x44c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x94]
mov dword [ebp - 0x10], 0
cmp eax, dword [esi + 0x90]
jl 0x414f63
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x5c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0x58]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x414f4f
mov eax, dword [esi + 0x94]
cmp eax, dword [esi + 0x90]
jge 0x4150d5
nop dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0x58]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x4150d5
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x48]
call fcn.00415290
cmp eax, 0xffffffff
je 0x4150ec
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x4150ec
inc dword [esi + 0x94]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x415049
dec dword [esi + 0x94]
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41502a
push 0x14
call fcn.0042187c
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x415014
push dword [esi + 4]
mov ecx, eax
call fcn.0041b6b0
jmp 0x415016
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41502a
mov ecx, dword [esi + 4]
push eax
call fcn.004179c0
cmp byte [esi + 0x85], 0
je 0x41503b
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x8c], eax
jmp 0x4150c3
cmp byte [esi + 0x84], 0
je 0x41509f
dec dword [esi + 0x94]
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x41509f
push 0x14
call fcn.0042187c
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x415089
push dword [esi + 4]
mov ecx, eax
call fcn.0041b6b0
jmp 0x41508b
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x41509f
mov ecx, dword [esi + 4]
push eax
call fcn.004179c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [esi + 0x85], 0
mov dword [esi + 0x8c], eax
je 0x4150bc
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov dword [ebp - 0x10], 0
mov eax, dword [esi + 0x94]
cmp eax, dword [esi + 0x90]
jl 0x414f90
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4170f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea edi, [esi + 0xa4]
push edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 0x98]
mov ebx, eax
lea eax, [esi + 0x98]
mov esi, dword [edx]
mov dword [ebp - 4], esi
cmp esi, edx
je 0x417186
mov edi, eax
nop dword [eax]
mov eax, ebx
sub eax, dword [esi + 0x14]
test eax, eax
jle 0x417174
cmp dword [esi + 0x28], 0
je 0x417160
mov edx, dword [esi + 0x2c]
lea eax, [esi + 0x18]
mov ecx, eax
cmp edx, 8
jb 0x41714e
mov ecx, dword [eax]
test ecx, ecx
je 0x417160
cmp edx, 8
jb 0x417159
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.00417370
mov esi, dword [ebp - 8]
mov dword [ebp - 4], esi
jmp 0x41717f
lea ecx, [ebp - 4]
call fcn.0041fbe0
mov esi, dword [ebp - 4]
cmp esi, dword [edi]
jne 0x417130
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push edi
mov eax, dword [eax + 0xa0]
sub ebx, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
shr ebx, 0x1f
pop edi
xor bl, 1
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437eb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 3
push dword [ebp + 0x20]
lea ecx, [esi + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0x1c]
mov dword [esi], vtable.t_ipcServerTaskConditionDownloading.0
push dword [ebp + 0x18]
push edx
call fcn.0040e990
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x30], eax
mov al, byte [ebp + 0x10]
mov byte [esi + 0x34], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4181e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437eb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 3
push dword [ebp + 0x20]
lea ecx, [esi + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0x1c]
mov dword [esi], vtable.t_ipcServerTaskConditionStart.0
push dword [ebp + 0x18]
push edx
call fcn.0040e770
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x30], eax
mov al, byte [ebp + 0x10]
mov byte [esi + 0x34], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x418260
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437eb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 3
push dword [ebp + 0x18]
lea ecx, [esi + 0x10]
mov dword [ebp - 4], 0
push edx
mov dword [esi], vtable.t_ipcServerTaskConditionWait.0
call fcn.0040e5e0
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x2c], eax
mov al, byte [ebp + 0x10]
mov byte [esi + 0x30], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x419e80
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
push 0
push 4
mov esi, ecx
push esi
push 0x419ee0
push 0
push 0
call fcn.00425727
mov edi, eax
add esp, 0x18
test edi, edi
je 0x419ec3
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x419ec3
push edi
push dword [esi + 4]
call fcn.00417010
test al, al
je 0x419ec3
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, 1
pop esi
ret
push 0x444414
push 0
push 0
push 0
push 0xc
mov ecx, esi
call fcn.0041ab00
pop edi
mov eax, 1
pop esi
ret

Function at 0x41a820
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4380ab
mov eax, dword fs:[0]
push eax
mov eax, 0x1030
call fcn.00421da0
mov eax, dword [0x44c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x1038], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1030], eax
mov eax, dword [ebp + 0x14]
push 0x1000
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1010]
push 0
push eax
mov dword [esi], 0
call fcn.004238c0
add esp, 0xc
mov dword [ebp - 0x102c], 0x1000
lea eax, [ebp - 0x102c]
push 0
push eax
lea eax, [ebp - 0x1010]
push eax
push 0x21
push dword [ebp - 0x1030]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x41a8c9
mov dword [esi], 9
jmp 0x41a949
mov eax, dword [ebp - 0x102c]
and eax, 0xfffffffe
cmp eax, 0x1000
jae 0x41aa2c
push dword [ebp - 0x1030]
xor ecx, ecx
mov word [ebp + eax - 0x1010], cx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 7
mov word [ebp - 0x1028], ax
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], eax
mov eax, edi
jb 0x41a91d
mov eax, dword [edi]
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1028]
push eax
call fcn.00419f10
add esp, 0xc
test al, al
jne 0x41a967
mov dword [esi], 0xa
lea ecx, [ebp - 0x1028]
call fcn.00402d90
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421b57
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1028]
cmp edi, eax
je 0x41a98d
cmp dword [ebp - 0x1014], 8
mov ecx, edi
push dword [ebp - 0x1018]
cmovae eax, dword [ebp - 0x1028]
push eax
call fcn.00402e40
cmp dword [ebp - 0x1014], 8
lea eax, [ebp - 0x1028]
mov ecx, dword [ebp - 0x1034]
cmovae eax, dword [ebp - 0x1028]
or ecx, 0x200000
push 0
push ecx
push 0
push 0
push eax
push dword [ebp - 0x1038]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
jne 0x41a9d0
mov dword [esi], 5
jmp 0x41a93e
push 0
lea ecx, [ebp - 0x103c]
mov dword [ebp - 0x103c], 4
push ecx
push ebx
push 0x20000013
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x41a9ff
mov dword [esi], 6
jmp 0x41a93e
mov eax, dword [ebx]
cmp eax, 0xc8
je 0x41a93e
add eax, 0xfffffed4
lea ecx, [ebp - 0x1028]
cmp eax, 0x63
ja 0x41a944
call fcn.00402d90
mov al, 1
jmp 0x41a94b
call fcn.00421cbc
int3
Function at 0x41b200
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push esi
push 0x41b240
push 0
push 0
call fcn.00425727
add esp, 0x18
test eax, eax
jne 0x41b231
push 0x444414
push eax
push 0xc
mov ecx, esi
call fcn.0041b280
or eax, 0xffffffff
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
Function at 0x41b8a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438283
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], edi
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 3
lea esi, [ebx + 0x10]
mov dword [ebp - 4], 0
push 3
mov ecx, esi
mov dword [ebx], vtable.t_ipcServerTaskReplySGT.0
mov dword [ebp + 8], esi
call fcn.0040d6e0
mov dword [esi], vtable.t_taskMsgReplySGT.0
xor eax, eax
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 7
mov word [esi + 0x1c], ax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 7
mov word [esi + 0x34], ax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], 7
mov word [esi + 0x4c], ax
mov eax, dword [ebp + 0x18]
lea ecx, [ebx + 0x2c]
mov dword [ebx + 0x74], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov byte [ebp - 4], 1
mov dword [ebx + 0x20], edi
cmp ecx, eax
je 0x41b97b
cmp dword [eax + 0x14], 8
mov edx, eax
jb 0x41b972
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00402e40
mov eax, dword [ebp + 0x20]
lea ecx, [ebx + 0x44]
cmp ecx, eax
je 0x41b998
cmp dword [eax + 0x14], 8
mov edx, eax
jb 0x41b98f
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00402e40
mov eax, dword [ebp + 0x24]
lea ecx, [ebx + 0x5c]
cmp ecx, eax
je 0x41b9b5
cmp dword [eax + 0x14], 8
mov edx, eax
jb 0x41b9ac
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00402e40
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20