joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403bd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x403be3
push 0x80004005
call fcn.004043b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x403bf0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x403d80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x224
mov eax, dword [0x40a01c]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x234]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
mov esi, eax
test esi, esi
jne 0x403dee
test ecx, ecx
je 0x403de0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x18]
mov esi, eax
mov dword [esp + 0x10], ecx
je 0x403dfc
test ecx, ecx
je 0x403ea1
push ecx
jmp 0x403e9b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x3c]
push edx
push 0
push ecx
mov dword [esp + 0x34], pe_nt_image_headers32
call esi
test eax, eax
jne 0x403e6e
jmp 0x403e30
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.00403d80
mov edi, eax
test edi, edi
jne 0x403ebd
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
mov dword [esp + 0x34], pe_nt_image_headers32
call esi
test eax, eax
je 0x403e30
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403e85
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403ea1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00405b20
add esp, 0x224
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403ecc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x403ea3
Function at 0x4056b1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405709
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x4072a4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4056fc
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40570b
xor eax, eax
pop esi
leave
ret 4

Function at 0x40599b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x40a01c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00405930
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4059ea
cmp dword [ebp - 0x1c], 5
jb 0x405a02
jmp 0x4059fe
cmp dword [ebp - 0x10], 1
jne 0x405a02
cmp dword [ebp - 0x1c], 4
ja 0x4059fe
jne 0x405a02
cmp dword [ebp - 0x18], 0
jbe 0x405a02
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4072c8
call fcn.004043f0
test eax, eax
jge 0x405a23
mov byte [0x40ac68], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00405b20
add ebp, 0x78
leave
ret

Function at 0x405b20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a01c]
jne 0x405b2a
repz ret
jmp fcn.00406104
Function at 0x40da63
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404ac0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406a9c
mov edi, eax
cmp edi, 0x104
jbe 0x40da86
mov eax, edi
add eax, eax
call fcn.00402e24
mov esi, eax
jmp 0x40da88
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406a9c
push edi
push esi
call fcn.00406b34
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40dac1
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40daab
mov eax, esp
cmp esi, eax
je 0x40dace
mov eax, esi
call fcn.00402e40
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40db08
cmp bl, 0
je 0x40db04
cmp bl, 0x41
jl 0x40daff
cmp bl, 0x5a
jg 0x40daff
or bl, 0x20
xor al, bl
inc esi
jmp 0x40dae3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40da48

Function at 0x40f834
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd9c
mov eax, esi
mov edx, 8
test al, 1
je 0x40f850
shr eax, 1
xor eax, 0xedb88320
jmp 0x40f852
shr eax, 1
dec edx
jne 0x40f843
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40f83c
pop esi
ret

Function at 0x40f87f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd98], 0
jne 0x40f88b
call fcn.0040f834
push 1
push 0x41cd98
call fcn.00406948
mov eax, edi
test esi, esi
je 0x40f8b6
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd9c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40f891
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6479c1
Capabilities:
Resolve function by hash

Disassembly:
mov eax, dword fs:[0x30]
test eax, eax
js 0x6479d7
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov ebx, dword [eax + 8]
jmp 0x6479e0
mov eax, dword [eax + 0x34]
mov ebx, dword [eax + 0xb8]
pop esi
add esi, 3
push ebx
mov edx, 0xec0e4e8e
call esi
push eax
mov edx, 0x7c0dfcaa
call esi
push eax
push edi
mov edx, 0x4ee4a045
call esi
xor edx, edx
push edx
push 0x6d756369
push 0x6c656167
push esp
push edx
push edx
call eax
push eax
mov edx, 0x75da1966
call esi
call eax
xchg edi, eax
mov edx, 0xffd97fb
call esi
call eax
cmp edi, 0xb7
jne 0x647a2f
mov esp, ebp
popal
ret
call fcn.00647a50
sti
xchg edi, eax
std
pcmpeqd mm5, qword [ebp - 0x50]
inc ebp
jb 0x647a3c
mov bl, 0x16
mov eax, dword [0xd2d83d6a]
invalid

Function at 0x64808b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x6480a4
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x6480b2
dec eax
jmp 0x6480b2
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x6480bc
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x648143
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x6480fa
cmp byte [ebx], 0x2e
je 0x64812a
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.0064808b
pop esi
jmp 0x64812a
push ebx
call dword [edi + 0x30]
push eax
call 0x648109
js 0x64816d
invalid
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x64812a
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.00648145
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x6480d9
push esi
call dword [edi + 0x40]
leave
ret
jae 0x6481da
jb 0x6481df
insb byte es:[edi], dx
js 0x6481db
invalid
Function at 0x6480bc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x6480a4
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x6480b2
dec eax
jmp 0x6480b2
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x6480bc
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x648143
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x6480fa
cmp byte [ebx], 0x2e
je 0x64812a
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.0064808b
pop esi
jmp 0x64812a
push ebx
call dword [edi + 0x30]
push eax
call 0x648109
js 0x64816d
invalid
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x64812a
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.00648145
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x6480d9
push esi
call dword [edi + 0x40]
leave
ret
jae 0x6481da
jb 0x6481df
insb byte es:[edi], dx
js 0x6481db
invalid

Function at 0x648145
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
push edx
push edx
push 3
push edx
push 1
push 0xc0000000
push eax
mov esi, eax
push esi
call dword [edi + 0x30]
lea esi, [esi + eax - 0xc]
push esi
call fcn.00648177
outsb dx, byte [esi]
je 0x6481dc

Function at 0x648177
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
call dword [edi + 0x34]
or eax, eax
jne 0x648180
leave
call dword [edi + 0x44]
mov ebx, eax
inc ebx
jne 0x648192
dec ebx
push 0x40
pop esi
sub esp, esi
mov edx, esp
push 0
push esp
push esi
push edx
push ebx
call dword [edi + 0x48]
cmp dword [esp - 4], esi
jne 0x648188
cmp word [esp], 0x5a4d
jne 0x648188
cmp byte [esp + 0x32], 0x56
je 0x648188
push eax
add esp, esi
pop esi
mov dword [ebp - 0x1c], esi
push 0
push 0
push esi
push ebx
call dword [edi + 0x50]
inc eax
je 0x648188
sub esp, 0x58
mov edx, esp
push 0
push esp
push 0x58
push edx
push ebx
call dword [edi + 0x48]
Function at 0x5024300
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0502438f
jae 0x502430e
xor ecx, ecx
call fcn.0502438f
jae 0x502433d
xor eax, eax
call fcn.0502438f
jae 0x502434d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0502438f
adc al, al
jae 0x502432f
jne 0x5024379
stosb byte es:[edi], al
jmp 0x5024311
call fcn.0502439b
sub ecx, ebx
jne 0x5024356
call fcn.05024399
jmp 0x5024375
lodsb al, byte [esi]
shr eax, 1
je 0x5024383
adc ecx, ecx
jmp 0x5024372
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.05024399
cmp eax, 0x7d00
jae 0x5024372
cmp ah, 5
jae 0x5024373
cmp eax, 0x7f
ja 0x5024374
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5024311
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x554450
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section._5058560
lea edi, [esi - 0xd2000]
push edi
or ebp, 0xffffffff
jmp 0x554472
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x554479
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x554468
mov eax, 1
add ebx, ebx
jne 0x55448b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55449c
jne 0x5544ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5544ac
dec eax
add ebx, ebx
jne 0x5544a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x554480
xor ecx, ecx
sub eax, 3
jb 0x5544c4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x554536
sar eax, 1
mov ebp, eax
jmp 0x5544cf
add ebx, ebx
jne 0x5544cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x5544dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x554500
inc ecx
add ebx, ebx
jne 0x5544ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5544e1
jne 0x5544fd
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5544e1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x554520
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x554511
jmp 0x55446e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x554520
add edi, ecx
jmp 0x55446e
pop esi
mov edi, esi
mov ecx, 0x28b7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55453e
cmp byte [edi], 0x13
jne 0x55453e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x554543
lea edi, [esi + 0x151000]
mov eax, dword [edi]
or eax, eax
je 0x5545bb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x156280]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x156384]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x554570
mov ecx, edi
jns 0x55459f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x156388]
or eax, eax
je 0x5545b5
mov dword [ebx], eax
add ebx, 4
jmp 0x55458d
call dword [esi + 0x15638c]
popal
jmp 0x44badd
Function at 0x411305
Capabilities:
Check http status code
Download url
Get disk information
Hide graphical window
Inspect section memory permissions
Log keystrokes via polling
Persist via default file association registry key
Receive data
Set registry value

Disassembly:
call fcn.004bf818
mov dword [0x540f14], eax
Function at 0x448d70
Capabilities:
Hide graphical window

Disassembly:
push 0x1c4
call fcn.004bf820
and eax, eax
je 0x448d88
push 0x1c4
call fcn.004bed94
push 0x313
call fcn.004bf820
and eax, eax
je 0x448da0
push 0x313
call fcn.004bed94
push 0xa5
call fcn.004bf820
and eax, eax
je 0x448e35
push 0xa3
call fcn.004bf8ce
mov dword [0x54112c], eax
mov ebx, dword [0x54112c]
fld qword [0x540ddc]
fmul qword [0x51e790]
mov dword [esp - 4], ebx
fild dword [esp - 4]
fxch st(1)
fsubp st(1)
fadd qword [0x51e530]
fistp dword [0x541158]
jmp 0x448ded
mov eax, dword [0x54112c]
cmp eax, dword [0x541158]
jl 0x448e2b
push 0xffff0001
push 0xffff0001
push 0xffff0001
push dword [0x541158]
push 0xa5
call fcn.004bf9e6
push 1
call fcn.004bed73
inc dword [0x541158]
jno 0x448ded
push 0xa5
call fcn.004bed94
cmp dword [0x541480], 0
je 0x448e5a
mov ebx, dword [0x54159c]
cmp ebx, 1
jne 0x448e5a
mov ebx, dword [0x5416b8]
and ebx, ebx
jne 0x448e5a
mov eax, 1
jmp 0x448e5c
xor eax, eax
and eax, eax
je 0x449039
mov ebx, dword [0x54175c]
cmp ebx, 1
jne 0x448e8e
mov dword [0x54175c], 2
push 1
push 0xa3
call fcn.004bf237
push eax
call sub.USER32.DLL_KillTimer
push 0x313
call fcn.004bf820
and eax, eax
je 0x448ea6
push 0x313
call fcn.004bed94
push 0xaf
call fcn.00471ef0
push dword [0x540ee4]
push 0xfffffff0
push 0xa3
call fcn.004bf237
push eax
call sub.USER32.DLL_SetWindowLongW
push 0
push 0xab
call fcn.004b12ef
push 5
push 0
call fcn.0048bd30
push eax
call sub.USER32.DLL_ShowWindow
push 5
push dword [0x5417a4]
call fcn.0048cba7
push eax
call sub.USER32.DLL_ShowWindow
push 1
push 0xab
call fcn.004b9e1b
push eax
push 0xaf
call fcn.004ae7c3
push eax
call sub.USER32.DLL_SetParent
call fcn.004ae7df
push 0
push 0xa3
call fcn.004bfbce
push dword [0x541170]
push dword [0x54108c]
push dword [0x540fb4]
push dword [0x540fb0]
push 0xa3
call fcn.004bf9e6
mov dword [0x54140c], 0
call fcn.004bf818
and eax, eax
je 0x448f70
jmp 0x448f65
push 0xa3
call fcn.004bf693
mov ebx, eax
mov edi, dword [0x541714]
add edi, edi
sub ebx, edi
add ebx, 0xb
mov dword [0x541058], ebx
push 0xa3
call fcn.004bf8ce
mov ebx, eax
add ebx, 0xfffffffd
mov dword [0x540fa4], ebx
call fcn.004bf818
and eax, eax
je 0x448faf
jmp 0x448fa4
cmp dword [0x541480], 0
je 0x448fd4
mov ebx, dword [0x54159c]
cmp ebx, 1
jne 0x448fd4
mov ebx, dword [0x5416b8]
and ebx, ebx
jne 0x448fd4
mov eax, 1
jmp 0x448fd6
xor eax, eax
and eax, eax
je 0x448fef
call fcn.004bf818
and eax, eax
je 0x448fe5
jmp 0x448fda
push 0xaf
call fcn.0047a070
mov ebx, dword [0x54175c]
cmp ebx, 2
jne 0x449039
lea eax, [0x488876]
push eax
fld qword [0x540dec]
fistp dword [esp - 4]
mov eax, dword [esp - 4]
push eax
push 1
push 0xa3
call fcn.004bf237
push eax
call sub.USER32.DLL_SetTimer
push 0x80000003
call fcn.00478863
mov dword [0x54175c], 1
mov dword [0x541380], 1
push 1
call fcn.004abb6e
and eax, eax
je 0x44905b
push 1
call fcn.004abae2
ret
Function at 0x464ac6
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x464acc
call fcn.004d5aa0
push dword [esp + 0x28]
call fcn.0048a280
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.0048a000
mov dword [esp + 4], 0x10000
push 0
push 0
push 0
push 0
push dword [esp + 0x10]
call sub.WININET.DLL_InternetOpenW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x464c05
push 0
push 0x80000000
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x1c]
call sub.WININET.DLL_InternetOpenUrlW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x464bfc
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004d2c50
lea eax, [esp + 0x14]
push eax
call fcn.004d57f0
mov dword [esp + 0x14], 1
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call fcn.004d3290
push eax
mov eax, dword [esp + 0x18]
push eax
push dword [esp + 0x18]
call sub.WININET.DLL_InternetReadFile
mov ebx, eax
and ebx, ebx
je 0x464bb4
mov ebx, dword [esp + 0x14]
and ebx, ebx
jle 0x464bb4
mov eax, 1
jmp 0x464bb6
xor eax, eax
and eax, eax
je 0x464bfc
mov edx, dword [esp + 0x18]
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d58b0
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push 2
push dword [esp + 0x24]
mov eax, dword [esp + 0x24]
push eax
call fcn.004d4540
pop eax
lea eax, [esp + 0x1c]
push eax
call fcn.004d57f0
jmp 0x464b82
push dword [esp + 8]
call sub.WININET.DLL_InternetCloseHandle
mov edx, dword [esp + 0x18]
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d58b0
pop eax
push eax
call fcn.0048a250
pop edx
add eax, edx
jmp 0x464c2d
push dword [esp + 0x18]
call fcn.004d5b30
push dword [esp + 0x10]
call fcn.004d5b30
push dword [esp]
call fcn.004d5b30
add esp, 0x1c
pop ebx
ret 4
Function at 0x46a2d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call fcn.004d5aa0
push dword [esp + 0x30]
call fcn.0048a280
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.0048a000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.0048a000
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 8]
call fcn.0048a000
mov dword [esp + 0xc], 0
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push 0xff
call fcn.004d2c50
lea eax, [esp + 0x14]
push eax
call fcn.004d57f0
mov dword [esp + 0x14], 0xff
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_RegOpenKeyExW
and eax, eax
je 0x46a383
mov edx, dword [esp + 8]
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d58b0
lea eax, [esp + 0x14]
push eax
call fcn.004d57f0
jmp 0x46a3f8
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegQueryValueExW
and eax, eax
je 0x46a3c6
mov edx, dword [esp + 8]
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d58b0
lea eax, [esp + 0x14]
push eax
call fcn.004d57f0
jmp 0x46a3ef
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
mov ebx, dword [esp + 0x1c]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004d30d0
lea eax, [esp + 0x14]
push eax
call fcn.004d57f0
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [esp + 0x10]
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d58b0
pop eax
push eax
call fcn.0048a250
pop edx
add eax, edx
jmp 0x46a420
push dword [esp + 0x10]
call fcn.004d5b30
push dword [esp]
call fcn.004d5b30
push dword [esp + 8]
call fcn.004d5b30
push dword [esp + 4]
call fcn.004d5b30
add esp, 0x18
pop ebx
ret 0x10