joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420b20
Capabilities:
Inspect load icon resource

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b11fb
push eax
mov dword fs:[0], esp
sub esp, 0x3ac
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x5c8]
test eax, eax
je 0x420b4e
xor ebx, ebx
jmp 0x420b55
mov ebx, dword [esp + 0x3c8]
mov eax, dword [0x4d74d8]
push 0xca
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, eax
mov ecx, 0xe9
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x3d0]
mov ecx, dword [esi + 4]
neg eax
sbb eax, eax
mov dword [esp + 0x10], 0x3a8
and eax, 0xc
mov dword [esp + 0x18], 0x81
add eax, 7
mov dword [esp + 0x3b4], 0
test ebx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 0x7e9
mov dword [esp + 0x330], 0x1388
je 0x420d38
mov esi, dword [esp + 0x3cc]
test esi, esi
je 0x420d45
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_wcsncpy]
push 0x100
lea edx, [esp + 0x138]
push esi
push edx
call ebp
push 0x80
lea eax, [esp + 0x3c]
push esi
push eax
call ebp
mov ecx, dword [0x4c8080]
add esp, 0x18
mov dword [esp + 0x10], ecx
mov ecx, 0x4d7450
mov dword [esp + 0x3c4], 0
call fcn.00401320
mov ecx, eax
call fcn.00436dc0
mov edi, eax
mov eax, dword [esp + 0x10]
add edi, 4
mov esi, dword [edi]
cmp eax, esi
je 0x420cdb
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
mov edx, dword [0x4c8084]
jge 0x420c51
lea ebx, [eax - 0xc]
cmp ebx, edx
jne 0x420c58
mov ebx, dword [esi - 0xc]
test ebx, ebx
jge 0x420c9b
mov ebx, dword [esi - 8]
lea ecx, [esp + 0x10]
push ebx
call fcn.00405d70
test eax, eax
je 0x420cd7
lea eax, [ebx + ebx]
lea edx, [ebx + ebx + 2]
cmp edx, eax
jb 0x420c88
mov edi, dword [esp + 0x10]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [ecx - 8], ebx
mov edx, dword [esp + 0x10]
mov word [eax + edx], 0
jmp 0x420cd7
add eax, 0xfffffff4
cmp eax, edx
je 0x420cc7
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x420cbd
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.0043b3d0
add esp, 4
mov ecx, dword [0x4c8080]
mov dword [esp + 0x10], ecx
mov edi, dword [edi]
mov dword [esp + 0x10], edi
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
push 0x40
lea edx, [esp + 0x33c]
push eax
push edx
call ebp
mov esi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 1
call esi
test eax, eax
pop ebp
jne 0x420d07
lea ecx, [esp + 0x10]
push ecx
push eax
call esi
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4c8084]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x420d45
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x420d45
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.0043b3d0
add esp, 4
jmp 0x420d45
lea ecx, [esp + 0x10]
push ecx
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [esp + 0x3b8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3b8
ret 0xc
Function at 0x421560
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 0x5c0], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x4d7450
mov dword [esi + 0x5e0], eax
call fcn.00401340
mov ecx, eax
call fcn.00419cc0
test eax, eax
jne 0x4215a4
push 1
push eax
push eax
mov ecx, esi
call fcn.00420b20
push 2
mov ecx, esi
call fcn.004201f0
pop esi
ret
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x4d7450
call fcn.00401320
mov ecx, eax
call fcn.00436dc0
mov ecx, dword [eax + 4]
add eax, 4
push 0
push ecx
push 1
mov ecx, esi
call fcn.00420b20
mov ecx, esi
call fcn.00421290
pop esi
ret
Function at 0x421b80
Capabilities:
Hide graphical window

Disassembly:
push esi
push 5
mov esi, ecx
push 0
push 0
push 0xffffd8f0
mov eax, dword [esi + 4]
push 0xffffd8f0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4

Function at 0x422870
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b128e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov dword [esi + 4], eax
mov dword [esi + 0x18], eax
mov ecx, dword [0x4c8080]
mov dword [esp + 0x10], eax
mov dword [esi + 0x20], ecx
mov edx, dword [0x4c8080]
mov dword [esi + 0x24], edx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x28], 0x3a98
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], eax
mov edx, dword [esi + 0x28]
mov ecx, esi
push edx
push 0x64
mov byte [esp + 0x18], 2
mov dword [esi], vtable.CProgressDialog.0
call fcn.00422ed0
mov ecx, dword [esp + 8]
mov eax, esi
fstp dword [esi + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4254c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x42569a
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp ebx, 1
jne 0x425513
push 1
call fcn.00425470
push ebp
mov ecx, esi
call fcn.004256b0
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.00425460
test eax, eax
je 0x4255bc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x18
jne 0x42554b
push 1
mov ecx, esi
call fcn.00425470
push ebp
push edi
mov ecx, esi
call fcn.00425800
mov edx, dword [esp + 0x24]
mov ecx, esi
mov dword [edx], 0
call fcn.00425460
test eax, eax
je 0x4255bc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x111
jne 0x4255bc
cmp di, 0x6a
jne 0x42556c
mov ecx, esi
call fcn.00428070
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp di, 0x27d8
jb 0x425594
cmp di, 0x283b
ja 0x425594
and edi, 0xffff
mov ecx, esi
push edi
call fcn.00427cf0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp di, 0x2710
jb 0x4255bc
cmp di, 0x27d7
ja 0x4255bc
and edi, 0xffff
mov ecx, esi
push edi
call fcn.00427890
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 5
lea eax, [esi + 0x9c]
jne 0x42563d
test eax, eax
je 0x4255d3
lea esi, [eax - 0x9c]
jmp 0x4255d5
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x42560a
mov eax, dword [esi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x4255fb
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42560f
test edi, edi
jne 0x42560a
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42560f
cmp edi, 1
je 0x42565d
mov ecx, ebp
shr ecx, 0x10
movsx edx, cx
movsx eax, bp
push edx
push eax
lea ecx, [esi + 0x9c]
call fcn.0042a170
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x24
jne 0x425673
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x42565d
cmp dword [eax + 0x18], ecx
je 0x42565d
mov edx, dword [eax + 0x14]
mov dword [ebp + 0x18], edx
mov eax, dword [eax + 0x18]
mov dword [ebp + 0x1c], eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
mov eax, 1
pop ebx
ret 0x18
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
push 0
push edx
push ebp
push edi
push ebx
push eax
lea ecx, [esi + 0x20]
call fcn.00438fd0
test eax, eax
je 0x42569a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x4296c0
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x410
mov edx, dword [eax]
mov eax, dword [edx - 8]
test eax, eax
jne 0x4296dc
add esp, 0x410
ret 4
cmp eax, 0x104
jle 0x4296ee
xor eax, eax
add esp, 0x410
ret 4
push edi
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
push ecx
push 0x2710
push 0x4ca5a0
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [esp + 4], 0
pop edi
jne 0x429726
xor eax, eax
add esp, 0x410
ret 4
lea edx, [esp]
push 0x4ca59c
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
add esp, 8
test eax, eax
jne 0x429746
add esp, 0x410
ret 4
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
add esp, 0x410
ret 4
Function at 0x42bed0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x42c01e
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp edi, 1
jne 0x42bf1f
push 1
call fcn.0042be80
push ebp
mov ecx, esi
call fcn.0042c030
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.0042be70
test eax, eax
je 0x42bf40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x111
jne 0x42bf40
cmp bx, 0x6a
jne 0x42bf40
mov ecx, esi
call fcn.0042c630
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 5
lea eax, [esi + 0x9c]
jne 0x42bfc1
test eax, eax
je 0x42bf57
lea esi, [eax - 0x9c]
jmp 0x42bf59
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x42bf8e
mov edx, dword [esi + 4]
push 0xe801
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp ebx, 2
jne 0x42bf7f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42bf93
test ebx, ebx
jne 0x42bf8e
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42bf93
cmp ebx, 1
je 0x42bfe1
mov eax, ebp
shr eax, 0x10
movsx ecx, ax
movsx edx, bp
push ecx
push edx
lea ecx, [esi + 0x9c]
call fcn.0042cb30
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x24
jne 0x42bff7
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x42bfe1
cmp dword [eax + 0x18], ecx
je 0x42bfe1
mov ecx, dword [eax + 0x14]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp + 0x1c], edx
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push 0
push ecx
push ebp
push ebx
push edi
push edx
lea ecx, [esi + 0x20]
call fcn.00438fd0
test eax, eax
je 0x42c01e
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x42d890
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x42d9f7
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp edi, 1
jne 0x42d8df
push 1
call fcn.0042d840
push ebp
mov ecx, esi
call fcn.0042da00
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.0042d830
test eax, eax
je 0x42d919
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x111
jne 0x42d919
cmp bx, 0x71
jne 0x42d900
mov ecx, esi
call fcn.0042df70
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp bx, 0x6a
jne 0x42d919
mov ecx, esi
call fcn.0042df80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 5
lea eax, [esi + 0x9c]
jne 0x42d99a
test eax, eax
je 0x42d930
lea esi, [eax - 0x9c]
jmp 0x42d932
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x42d967
mov edx, dword [esi + 4]
push 0xe801
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp ebx, 2
jne 0x42d958
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42d96c
test ebx, ebx
jne 0x42d967
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42d96c
cmp ebx, 1
je 0x42d9ba
mov eax, ebp
shr eax, 0x10
movsx ecx, ax
movsx edx, bp
push ecx
push edx
lea ecx, [esi + 0x9c]
call fcn.0042e410
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x24
jne 0x42d9d0
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x42d9ba
cmp dword [eax + 0x18], ecx
je 0x42d9ba
mov ecx, dword [eax + 0x14]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp + 0x1c], edx
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push 0
push ecx
push ebp
push ebx
push edi
push edx
lea ecx, [esi + 0x20]
call fcn.00438fd0
test eax, eax
je 0x42d9f7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x42dda0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b1dcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
mov eax, dword [0x4c8080]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [0x4d7448]
lea edx, [esp + 0x30]
push 0x100
push edx
mov eax, dword [ecx + 8]
xor ebx, ebx
push 0x93
push eax
mov dword [esp + 0x248], ebx
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x42ddfa
mov word [esp + 0x30], bx
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x42de2e
lea edx, [esp + 0x30]
test edx, edx
jne 0x42de12
xor eax, eax
jmp 0x42de1d
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x30]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00405ad0
jmp 0x42de7c
push 0x1ff
lea ecx, [esp + 0x10]
mov esi, 0x200
call fcn.004058b0
cmp eax, ebx
je 0x42de71
push esi
push eax
push 0x93
call fcn.00405e80
mov edx, esi
sub edx, eax
cmp edx, 1
jg 0x42de71
add esi, 0x100
lea ecx, [esp + 0xc]
lea eax, [esi - 1]
push eax
call fcn.004058b0
cmp eax, ebx
jne 0x42de45
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call fcn.00405970
mov edx, dword [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [edi + 0x20]
lea esi, [edi + 0x20]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call dword [eax + 0x38]
push 0xffffffffffffffd8
lea eax, [esp + 0x14]
push 0xffffffffffffffd8
push eax
call dword [sym.imp.USER32.dll_InflateRect]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add eax, 0xffffffd8
add ecx, 0xffffffec
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
add eax, 0xffffffb0
add ecx, 0xffffffe8
mov dword [esp + 0x24], edx
mov edx, dword [edi + 4]
mov dword [esp + 0x20], eax
push ebx
mov dword [esp + 0x28], ecx
push 0x50000000
lea eax, [esp + 0x28]
push 0x71
lea ecx, [esp + 0x18]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00439aa0
mov edx, dword [0x4c8084]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
lea ecx, [eax - 0xc]
neg esi
cmp ecx, edx
je 0x42df4f
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42df4f
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.0043b3d0
add esp, 4
mov ecx, dword [esp + 0x230]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret
Function at 0x42f200
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x42f3e4
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp ebx, 1
jne 0x42f253
push 1
call fcn.0042f1b0
push ebp
mov ecx, esi
call fcn.0042f3f0
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.0042f1a0
test eax, eax
je 0x42f306
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x111
jne 0x42f2ce
cmp di, 0x6f
jne 0x42f274
mov ecx, esi
call fcn.004314a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp di, 0x6d
jne 0x42f28d
mov ecx, esi
call fcn.00431540
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp di, 0x71
jne 0x42f2a6
mov ecx, esi
call fcn.00431550
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp di, 0x27d8
jb 0x42f306
cmp di, 0x283b
ja 0x42f306
and edi, 0xffff
mov ecx, esi
push edi
call fcn.00431570
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x18
jne 0x42f306
push 1
mov ecx, esi
call fcn.0042f1b0
mov edx, dword [esi]
push ebp
push edi
mov ecx, esi
call dword [edx + 0xc]
mov eax, dword [esp + 0x24]
mov ecx, esi
mov dword [eax], 0
call fcn.0042f1a0
test eax, eax
je 0x42f306
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 5
lea eax, [esi + 0x9c]
jne 0x42f387
test eax, eax
je 0x42f31d
lea esi, [eax - 0x9c]
jmp 0x42f31f
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x42f354
mov ecx, dword [esi + 4]
push 0xe801
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x42f345
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42f359
test edi, edi
jne 0x42f354
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x42f359
cmp edi, 1
je 0x42f371
mov edx, ebp
shr edx, 0x10
movsx eax, dx
movsx ecx, bp
push eax
push ecx
lea ecx, [esi + 0x9c]
call fcn.004330b0
mov edx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [edx], 0
mov eax, 1
pop ebx
ret 0x18
cmp ebx, 0x24
jne 0x42f3bd
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x42f3a7
cmp dword [eax + 0x18], ecx
je 0x42f3a7
mov ecx, dword [eax + 0x14]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp + 0x1c], edx
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push 0
push ecx
push ebp
push edi
push ebx
push edx
lea ecx, [esi + 0x20]
call fcn.00438fd0
test eax, eax
je 0x42f3e4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x432500
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x410
mov edx, dword [eax]
mov eax, dword [edx - 8]
test eax, eax
jne 0x43251c
add esp, 0x410
ret 4
cmp eax, 0x104
jle 0x43252e
xor eax, eax
add esp, 0x410
ret 4
push edi
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
push ecx
push 0x2710
push 0x4ca5a0
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [esp + 4], 0
pop edi
jne 0x432566
xor eax, eax
add esp, 0x410
ret 4
lea edx, [esp]
push 0x4ca59c
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
add esp, 8
test eax, eax
jne 0x432586
add esp, 0x410
ret 4
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
add esp, 0x410
ret 4
Function at 0x433cc0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x433cd0
mov eax, 1
ret
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret
Function at 0x434940
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
mov esi, ecx
push 0
push 1
push 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 4], eax
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x434ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
mov dword [esi + 0x30], 1
pop esi
pop ecx
ret

Function at 0x434d20
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebp, eax
test ebp, ebp
jne 0x434d5a
mov eax, dword [esp + 0x5c]
mov edx, dword [0x4c8084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x434e5e
lea esi, [eax - 0xc]
jmp 0x434df1
mov esi, dword [esp + 0x5c]
push 0
push 0
push 3
push 0
push 0
push 0x50
push esi
push ebp
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
jne 0x434d81
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x434de2
mov eax, dword [esp + 0x58]
push 0
push 0x8440c100
push 0
push 0
push str.HTTP_1.1
push eax
push 0x4ca854
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
test edi, edi
jne 0x434dc0
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call edi
push ebx
call edi
mov eax, dword [0x4c8084]
lea ecx, [esi - 0xc]
cmp ecx, eax
jmp 0x434dec
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x434e0f
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
call ebp
push ebx
call ebp
push edi
call ebp
mov eax, dword [0x4c8084]
lea edx, [esi - 0xc]
cmp edx, eax
je 0x434e5e
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x434e5e
push esi
call fcn.0043b3d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8
lea eax, [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x13
push edi
mov dword [esp + 0x24], 0x40
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push ebx
call edi
push ebp
call edi
mov eax, dword [0x4c8084]
lea edx, [esi - 0xc]
cmp edx, eax
je 0x434e5e
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x434e5e
push esi
call fcn.0043b3d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8