joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402cac
Capabilities:
Resolve dns

Disassembly:
push 0x40
mov eax, 0x43e38c
call fcn.0042b376
xor ebx, ebx
cmp dword [edi + 0x4c], ebx
jne 0x402ccc
mov eax, 0x80004005
call fcn.0042b3f9
ret 4
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x38
cdq
pop ecx
idiv ecx
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
cmp ecx, eax
jae 0x402cbf
lea eax, [ebp - 0x2c]
push eax
call fcn.00417a22
call fcn.004011be
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x402d06
dec eax
dec eax
je 0x402d06
sub eax, 4
jne 0x402d11
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
push esi
mov eax, edi
mov dword [ebp - 4], ebx
call fcn.00402fef
cmp dword [eax + 0x18], 0x10
jb 0x402d27
mov eax, dword [eax + 4]
jmp 0x402d2a
add eax, 4
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push ebx
push 0xf
push eax
call sub.DNSAPI.dll_DnsQuery_A
cmp eax, ebx
je 0x402d51
mov ebx, 0x80004005
lea esi, [ebp - 0x2c]
call fcn.004030cb
mov eax, ebx
jmp 0x402cc4
mov esi, dword [ebp - 0x14]
call fcn.00428e21
call fcn.00428e21
mov dword [ebp - 4], ebx
jmp 0x402dc4
cmp word [esi + 8], 0xf
jne 0x402dc2
push dword [ebp + 8]
mov eax, edi
call fcn.00402fef
cmp dword [eax + 0x18], 0x10
jb 0x402d7f
mov eax, dword [eax + 4]
jmp 0x402d82
add eax, 4
push dword [esi + 4]
push eax
call fcn.00428726
pop ecx
pop ecx
test eax, eax
jne 0x402dc2
movzx ecx, word [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x4c], ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00402e72
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 7
call fcn.00403168
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.0040329c
mov esi, dword [esi]
cmp esi, ebx
jne 0x402d63
cmp dword [ebp - 0x14], ebx
je 0x402de7
push 1
push dword [ebp - 0x14]
call sub.DNSAPI.dll_DnsFree
call fcn.00428e21
call fcn.00428e21
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
xor esi, esi
sar eax, 5
test eax, eax
jbe 0x402d3d
push esi
lea eax, [ebp - 0x2c]
call fcn.004030f8
cmp dword [eax], 0xd
jne 0x402e19
push esi
lea eax, [ebp - 0x2c]
call fcn.004030f8
add eax, 4
cmp dword [eax + 0x14], ebx
jne 0x402e2c
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
inc esi
sar eax, 5
cmp esi, eax
jb 0x402dfa
jmp 0x402d3d
push esi
lea eax, [ebp - 0x2c]
call fcn.004030f8
push dword [ebp + 8]
mov esi, eax
mov eax, edi
add esi, 4
call fcn.00402fef
push 0xffffffffffffffff
add eax, 0x1c
push ebx
push esi
mov ecx, eax
call fcn.004031c2
jmp 0x402d42
Function at 0x404476
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431170
add esp, 0xc
xor esi, esi
call fcn.00428e21
push 0x2a
cdq
pop ecx
idiv ecx
sub dl, 0x4a
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x4044aa
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40452f
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40452f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428582
leave
ret

Function at 0x4046b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.5e21426fb4c18277
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.672b55b902c34769f48de0
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x404723
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.ceab16cbb5d3b469e00537f32d
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x4046f8
test eax, eax
jne 0x404733
push esi
push str.193b54efecc5dacfacf7ab15_d
jmp 0x404739
push eax
push str.d6b709ada25dec71572f2be71f4__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40478d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.e79f2f8bab65545b3d
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x4047d6
push str.87c57a4fbb977beb
call fcn.00428d27
jmp 0x40480e
test esi, esi
jbe 0x4047e6
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.38df635b956591af70f134b3ab
jne 0x404802
mov eax, str.4bc3ff010d5f7157021d5c21e1edea
push eax
push str.511b6399b87d41130c6d0a6bc
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x404898
Capabilities:
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 4
pop ecx
push 5
pop edx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x10], 7
mov dword [ebp - 0xc], 8
mov dword [ebp - 8], 9
mov dword [ebp - 4], 0xa
xor eax, eax
push edi
add eax, ecx
cmp eax, 0x14
jl 0x4048e5
mov edi, edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
dec edi
jne 0x4048ee
pop edi
leave
ret

Function at 0x404902
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.39b3172d14450e53b6
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40494b
push str.4f4b659b0cf14387d7e3b8d1e8d959b
call fcn.00428d27
jmp 0x404983
test esi, esi
jbe 0x40495b
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.b33db8fbb3b111273bdbeee1c74149
jne 0x404977
mov eax, str.dd29bdbbf431e0aba27da2
push eax
push str.eb2dde898eb581c336c722959e89cc
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x404a54
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00431170
add esp, 0xc
xor esi, esi
call fcn.00428e21
cdq
mov ecx, 0x84
idiv ecx
sub dl, 0x73
mov byte [ebp + esi - 0x110], dl
inc esi
cmp esi, 0x19
jl 0x404a88
xor eax, eax
lea edi, [ebp - 0x268]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x404b0f
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x404b0f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00428582
leave
ret
Function at 0x404c11
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.b3bb8d256acb339555d9138
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.65cd043f5e9549e546dd899731
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x404c82
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.7e3fabfb4c8927713367425be253eb
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x404c57
test eax, eax
jne 0x404c92
push esi
push str.68a38d27f9359d251a6b8337d355_d
jmp 0x404c98
push eax
push str.2cc3716fbda5f2395__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x404ca5
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.cbdb441582ad05f1a069401100479cf
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x404d15
push str.78a7677b1e6797495c0f
call fcn.00428d27
pop ecx
pop ecx
jmp 0x404d85
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404d30
push str.c1c3276199f34bddbda3649b42355bc
jmp 0x404d78
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x404d61
push eax
push ebx
push str.340b87d300007bd71ea129290f453
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.f921bf05a65f0719daeb4
call fcn.00428d27
add esp, 0x14
jmp 0x404d7e
cmp eax, ebx
jne 0x404d73
push ebx
push str.2713e90709c5419fe
call fcn.00428d27
pop ecx
jmp 0x404d7d
push str.8ae77ce775add66b2ce731a
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret
Function at 0x404e0e
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.e5893c9131c573af9839ff131
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.9709b307f2edf277c585293bf1db9
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x404e7f
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.5dd94aed6d73a6877fb7b3b9
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x404e54
test eax, eax
jne 0x404e8f
push esi
push str.464789d94ef112a1c_d
jmp 0x404e95
push eax
push str.ca8fef1b1bfbbbaf07f345ddb561b__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x404f98
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 0x2000
push esi
call fcn.00428a41
mov edi, eax
mov dword [esp + 0x14], esi
mov dword [esp], str.7c65e0912cd16b251ecbb0538d3
call fcn.00428d27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.193d7827b601908fd8f93a619d95b7
push 0x80000004
call ebx
mov ebp, 0xea
jmp 0x405009
add esi, 0x1000
push esi
push edi
call fcn.00428f21
pop ecx
pop ecx
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push str.359f5b15324344ef77a
push 0x80000004
mov dword [esp + 0x28], esi
call ebx
cmp eax, ebp
je 0x404fde
test eax, eax
jne 0x405019
push esi
push str.96c54de77fa73151e27_d
jmp 0x40501f
push eax
push str.48652383f0877637874fb47db6__d_
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405151
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x20]
push str.51735e634e657f4b9
call fcn.00428d27
mov esi, dword [ebp - 0x20]
pop ecx
imul esi, esi, 0x50
pop ecx
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x40519a
push str.7d777295052dcc77fac35
call fcn.00428d27
jmp 0x4051d2
test esi, esi
jbe 0x4051aa
push esi
push 0x61
push edi
call fcn.00431170
add esp, 0xc
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
mov eax, str.4651f341c1c16a29f99de41541979c
jne 0x4051c6
mov eax, str.2afd5077f5b3a3e1a3115e2d01371f
push eax
push str.2629cd4b3ba1864f2297a0ab5605a
call fcn.00428d27
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x4052ec
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.240f5ed9ef9b9159e9f
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x40535c
push str.02b966915f73d6795fbd3ecb
call fcn.00428d27
pop ecx
pop ecx
jmp 0x4053cc
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405377
push str.402f169bc5f5af73d
jmp 0x4053bf
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x4053a8
push eax
push ebx
push str.beff561fadbbf6d1b72d811de89d2f
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.3f43eeb966e9d4874b855fdf0c33c
call fcn.00428d27
add esp, 0x14
jmp 0x4053c5
cmp eax, ebx
jne 0x4053ba
push ebx
push str.3ce9faaf859fbcdfa04
call fcn.00428d27
pop ecx
jmp 0x4053c4
push str.c0eb3ab7abf136d10
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret

Function at 0x405474
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x370]
sub esp, 0x3f0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp + 0x36c], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x7c], bl
call fcn.00431170
push str.f6536b93f60552fb96954
call fcn.00428d27
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
cmp edi, 0xffffffff
jne 0x4054e4
push str.7a9338035a1f4b69bc173a
call fcn.00428d27
pop ecx
pop ecx
jmp 0x405554
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4054ff
push str.97a19013394518f9af5d759189
jmp 0x405547
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 1]
cmp ecx, 0x3e6
ja 0x405530
push eax
push ebx
push str.c5c3f67187bf2d2b66cd1a99c1f
mov byte [ebp + eax - 0x7c], bl
call fcn.00428d27
lea eax, [ebp - 0x7c]
push eax
push str.efa592b5058b5ad7
call fcn.00428d27
add esp, 0x14
jmp 0x40554d
cmp eax, ebx
jne 0x405542
push ebx
push str.eb552aeb5cc330d345b76a33
call fcn.00428d27
pop ecx
jmp 0x40554c
push str.2351c9b3049b2399c9d1
call fcn.00428d27
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x36c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428582
add ebp, 0x370
leave
ret
Function at 0x405747
Capabilities:
Parse url

Disassembly:
push 0x3c
mov eax, 0x43dafb
call fcn.0042b30d
mov esi, ecx
xor ebx, ebx
push 0x3c
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00431170
mov eax, 0x2800
add esp, 0xc
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], 0x3c
jae 0x405790
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x48]
push ecx
push ebx
push dword [ebp + 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x4057c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0040329c
mov eax, 0x80004005
call fcn.0042b3e5
ret 0x1c
cmp dword [ebp - 0x34], ebx
je 0x4057a9
cmp dword [ebp - 0x40], ebx
je 0x4057a9
mov dx, word [ebp - 0x30]
cmp dx, bx
je 0x4057a9
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x4057a9
mov ecx, eax
dec ecx
je 0x405807
dec ecx
dec ecx
je 0x4057fb
dec ecx
je 0x4057fb
mov esi, 0x80004005
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0040329c
mov eax, esi
jmp 0x4057b9
mov dword [esi + 0x94], 3
jmp 0x405811
mov dword [esi + 0x94], 1
push dword [ebp - 0x40]
mov ecx, esi
push dword [ebp - 0x44]
mov word [esi + 0x3c], dx
mov dword [esi + 0x1c], eax
call fcn.004034d0
push dword [ebp - 0x34]
lea ecx, [esi + 0x20]
push dword [ebp - 0x38]
call fcn.004034d0
push dword [ebp - 0x28]
lea ecx, [esi + 0x40]
push dword [ebp - 0x2c]
call fcn.004034d0
push dword [ebp - 0x20]
lea ecx, [esi + 0x5c]
push dword [ebp - 0x24]
call fcn.004034d0
push dword [ebp - 0x18]
lea ecx, [esi + 0x78]
push dword [ebp - 0x1c]
call fcn.004034d0
xor esi, esi
jmp 0x4057ec
Function at 0x4067f4
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440215
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.00438600
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x406841
dec eax
dec eax
je 0x406841
sub eax, 4
je 0x406841
xor ebx, ebx
xor eax, eax
jmp 0x406851
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor eax, eax
inc eax
dec eax
jne 0x40685e
call fcn.004049cf
call fcn.00404a54
mov dword [ebp - 0x101c], ebx
jmp 0x406980
lea eax, [ebp - 0x101c]
push eax
push 0xff6
lea eax, [ebp - 0x1018]
push eax
push dword [edi + 0xb0]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [ebp - 0x101c], ebx
ja 0x40694d
cmp dword [edi + 0xb4], ebx
je 0x4069bf
call fcn.004062e8
lea eax, [edi + 0xbc]
inc dword [eax]
cmp dword [eax], 2
ja 0x406991
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0x8c]
lea eax, [edi + 0x1c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1020], esp
push eax
call fcn.00402e94
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1024], esp
push edi
mov dword [ebp - 4], ebx
call fcn.00402e94
or dword [ebp - 4], 0xffffffff
push edi
call fcn.004060ee
mov dword [ebp - 0x1020], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x406923
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1020], ebx
jl 0x406980
call fcn.0040121a
test eax, eax
je 0x40693d
call fcn.004017c3
lea eax, [edi + 0x70]
mov dword [edi + 0xb8], ebx
call fcn.00402ec4
jmp 0x406980
push dword [ebp - 0x101c]
lea eax, [ebp - 0x1018]
push eax
lea eax, [edi + 0x70]
call fcn.00408041
mov ecx, dword [ebp - 0x101c]
lea eax, [edi + 0xb8]
add dword [eax], ecx
mov ecx, dword [edi + 0xb4]
mov eax, dword [eax]
cmp ecx, ebx
je 0x406980
cmp eax, ecx
jae 0x4069bf
cmp dword [edi + 0xc0], ebx
jne 0x406869
call fcn.004062e8
mov eax, dword [edi + 0xc4]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428582
leave
ret
mov dword [edi + 0xc4], 1
jmp 0x406991
Function at 0x4069cb
Capabilities:
Write file on windows

Disassembly:
push 8
mov eax, 0x43d430
call fcn.0042b30d
mov esi, ecx
xor edi, edi
cmp dword [esi + 0xc4], edi
jne 0x4069fb
push edi
push 1
lea ecx, [ebp + 8]
call fcn.0040329c
mov eax, 0x80004005
call fcn.0042b3e5
ret 0x1c
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x406a07
lea eax, [ebp + 0xc]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x4069e3
cmp dword [esi + 0x88], 0x10
mov ecx, dword [esi + 0x84]
mov dword [ebp - 0x10], edi
jb 0x406a3c
mov eax, dword [esi + 0x74]
jmp 0x406a3f
lea eax, [esi + 0x74]
push edi
lea edx, [ebp - 0x10]
push edx
push ecx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x406a64
dec eax
dec eax
je 0x406a64
sub eax, 4
jne 0x406a6f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.00401d8f
cmp ebx, edi
je 0x4069e3
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0x84]
je 0x406a99
mov esi, 0x80004005
push edi
push 1
lea ecx, [ebp + 8]
call fcn.0040329c
mov eax, esi
jmp 0x4069f3
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x406a87