joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464890
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
xor ebx, ebx
mov eax, dword [0x4b77f0]
cmp dword [eax], 2
je 0x4648b1
lea eax, [esi + 4]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
mov bl, 1
jmp 0x4648f5
cmp edi, 0xffffffff
jne 0x4648c3
lea eax, [esi + 4]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
mov bl, 1
jmp 0x4648f5
call sub.kernel32.dll_GetTickCount_1
mov ebp, eax
lea eax, [esi + 4]
push eax
call sub.kernel32.dll_TryEnterCriticalSection
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4648f5
push 0xa
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WaitForSingleObject
call sub.kernel32.dll_GetTickCount_1
sub eax, ebp
cmp edi, eax
jae 0x4648ca
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x464d3c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x464f83
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00406f08
mov byte [ebp - 0xd], 0
test ebx, ebx
je 0x464f5b
cmp dword [0x4b6b60], 0
jne 0x464da1
call fcn.00465de8
cmp dword [0x4b6b60], 0
je 0x464f5b
xor eax, eax
push ebp
push 0x464f51
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x464f40
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x464fa4
call fcn.00406f50
mov edx, dword [ebp - 4]
mov eax, 0x464fbc
call fcn.00407cc4
mov esi, eax
test esi, esi
jle 0x464e00
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407b18
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 1
call fcn.00407b60
cmp dword [ebp - 4], 0
jne 0x464e20
mov dl, 1
mov eax, ebx
call fcn.00456a98
xor edx, edx
push edx
push eax
lea edx, [ebp - 4]
mov eax, 8
call fcn.0041c114
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x4b6b60]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0045d4c4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00406f08
mov eax, dword [0x4b6b60]
cmp byte [eax + 0x13], 0
je 0x464e8d
push 0x464fcc
push dword [ebp - 4]
push 0x464ff0
push ebx
push 0x464ff0
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00407a30
mov eax, dword [ebp - 0x1c]
call fcn.0040774c
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x464eda
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00406f08
mov eax, dword [0x4b6b60]
cmp byte [eax + 0x11], 0
je 0x464ec4
push dword [ebp - 4]
push 0x465004
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00407a30
mov byte [ebp - 0xd], 0
call fcn.00406294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x464f5b
mov byte [ebp - 0xd], 1
mov eax, dword [0x4b6b60]
cmp byte [eax + 0x11], 0
je 0x464f03
push dword [ebp - 4]
push 0x465014
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00407a30
lea eax, [ebp - 8]
call fcn.00406b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464f47
mov eax, dword [0x4b6b60]
cmp dword [eax + 0x18], 0
je 0x464f3f
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ebx, dword [0x4b6b60]
call dword [ebx + 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00406f08
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464f8a
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406b88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret
Function at 0x465c30
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x465d30
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x465d4c
call fcn.00406f50
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
sete bl
test bl, bl
je 0x465c96
push 0xa
lea eax, [ebp - 0xe]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
cmp eax, 3
je 0x465c9a
xor eax, eax
jmp 0x465c9c
mov al, 1
mov ebx, eax
test bl, bl
je 0x465cb7
lea eax, [ebp - 4]
lea edx, [ebp - 0x18]
call fcn.004077a4
mov eax, esi
lea edx, [ebp - 0xe]
call fcn.004077a4
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0041b384
mov eax, dword [ebp - 0x1c]
mov edx, 0x465d60
call fcn.00407ae0
jne 0x465cfe
lea edx, [ebp - 0x20]
mov eax, dword [esi]
call fcn.0041b384
mov eax, dword [ebp - 0x20]
mov edx, 0x465d74
call fcn.00407ae0
jne 0x465cfe
mov eax, edi
mov edx, dword [0x4b6b64]
mov ecx, 0
call fcn.00407404
jmp 0x465d0d
mov eax, edi
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00407404
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465d37
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406b88
lea eax, [ebp - 4]
call fcn.00406b28
ret
Function at 0x46ec14
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x46edf4
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
jne 0x46ec71
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_BeginPaint
mov ebx, eax
jmp 0x46ec84
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WindowFromDC
test eax, eax
jne 0x46ec84
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46ecd4
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf5], 0
jne 0x46ecd4
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
jmp 0x46ece4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf5]
test eax, eax
je 0x46ece4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x46ede3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xf5], edx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
push eax
call fcn.00471828
cmp dword [0x4bd238], 0
je 0x46ed26
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call dword [0x4bd238]
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
push eax
call fcn.00471828
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x45b]
test eax, eax
je 0x46ed4b
xor edx, edx
call fcn.0046ac28
push 0
push ebx
call sub.gdi32.dll_SelectClipRgn
cmp ebx, dword [ebp - 0xc]
je 0x46ed77
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push 0
push 0
push ebx
call sub.gdi32.dll_BitBlt
cmp dword [ebp - 8], 0
jne 0x46ed90
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46edea
cmp dword [ebp - 0x10], 0
je 0x46edcf
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
jmp 0x46ede2
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jne 0x46ede2
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xf5], edx
ret
Function at 0x46fa30
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x423]
test eax, eax
je 0x46fa8b
cmp byte [ebx + 0x44d], 0
jne 0x46fa8b
push eax
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jne 0x46fa59
xor esi, esi
jmp 0x46fa75
inc eax
mov ebp, eax
add ebp, ebp
mov eax, ebp
call fcn.004044d8
mov esi, eax
push ebp
push esi
mov eax, dword [ebx + 0x423]
push eax
call sub.user32.dll_GetWindowTextW
mov eax, edi
mov edx, esi
call fcn.004077a4
test esi, esi
je 0x46fa98
mov eax, esi
call fcn.004044f4
jmp 0x46fa98
mov eax, edi
mov edx, dword [ebx + 0x441]
call fcn.004077a4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x474764
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x4747a1
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x47478f
mov al, 7
jmp 0x4747da
cmp edx, 5
jb 0x4747da
mov al, 5
cmp dword [esp + 8], 1
jb 0x4747da
mov al, 6
jmp 0x4747da
cmp eax, 1
jne 0x4747d8
mov al, 1
cmp dword [esp + 4], 4
ja 0x4747bd
cmp dword [esp + 4], 4
jne 0x4747bf
cmp dword [esp + 8], 0xa
jb 0x4747bf
mov al, 2
cmp dword [esp + 4], 4
ja 0x4747d4
cmp dword [esp + 4], 4
jne 0x4747da
cmp dword [esp + 8], 0x5a
jb 0x4747da
mov al, 3
jmp 0x4747da
xor eax, eax
add esp, 0x11c
ret

Function at 0x47ad90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x47adf4
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.0040774c
push eax
mov eax, esi
call fcn.0040774c
push eax
mov eax, ebx
call fcn.0040774c
push eax
push 0x47ae04
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47adfb
lea eax, [ebp + 8]
call fcn.00406b28
ret

Function at 0x47afc0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x47b05a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a4c
lea eax, [ebp - 0x44]
call fcn.0047bccc
xor eax, eax
push ebp
push 0x47b03d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x44], 0x3c
lea eax, [ebp - 0x44]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040774c
push eax
call sub.wininet.dll_InternetCrackUrlW
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b044
lea eax, [ebp - 0x44]
call fcn.0047bddc
ret

Function at 0x47d11c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00404a4c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x48a368
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48a560
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48a530
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0047da98
call fcn.0047eaf0
call fcn.004a6abc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x485cac]
call fcn.00489570
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48a51f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00471bdc
mov edi, eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], edi
cmp edi, 0x20
setne al
push eax
mov edx, dword [0x4b75bc]
mov edx, dword [edx]
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.00489890
mov edx, dword [0x4b77f4]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.004897a8
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00407834
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004896b8
mov ebx, eax
test ebx, ebx
je 0x48a509
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x30]
mov cl, 7
call fcn.00471c1c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x48a502
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.004726a0
call fcn.0046ae40
mov ecx, eax
mov edx, dword [ebx + 0x58]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.00475a78
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebx + 0x74]
mov eax, dword [ebx + 0x70]
call fcn.0043bc08
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push 0
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.00488c2c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.00407848
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 8]
mov dl, 1
mov eax, dword [0x48a2a0]
call fcn.0048a678
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48a4e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a4ec
mov eax, dword [ebp - 0xc]
call fcn.00404ebc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a526
mov eax, dword [ebp - 8]
call fcn.00404ebc
ret
Function at 0x496fd8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x620]
call fcn.004088c4
test eax, eax
jl 0x497093
cmp word [esi], 0xd
jne 0x49707a
mov edi, dword [ebx + 0x18]
cmp byte [edi + 0x4a7], 0
je 0x497062
mov eax, edi
call fcn.00471664
push eax
mov eax, dword [ebx + 0x18]
call fcn.004713a8
dec eax
pop edx
cmp edx, eax
jne 0x497033
mov eax, ebx
call fcn.0049e69c
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.0047188c
jmp 0x4970a3
mov eax, dword [ebx + 0x18]
call fcn.00471664
mov edi, eax
mov eax, dword [ebx + 0x18]
call fcn.004713a8
sub eax, 2
cmp edi, eax
jne 0x497058
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.0047188c
jmp 0x4970a3
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.0047188c
push 0
push 0xd
push 0x464
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x423]
push eax
call sub.user32.dll_SendMessageW
cmp word [esi], 0x1b
jne 0x497093
mov eax, dword [ebx + 0x18]
cmp byte [eax + 0x4a7], 0
je 0x497093
xor edx, edx
call fcn.0047188c
cmp word [esi], 0x21
jae 0x4970a3
mov eax, dword [ebx + 0x18]
mov dword [eax + 0x2e], 3
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x49b9f4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49bafe
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49bade
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0047da98
call fcn.0047eaf0
call fcn.0047d9b4
mov dword [ebx + 0x10], eax
call fcn.004a6abc
lea eax, [ebp - 0x10]
mov edx, 1
mov cl, 1
call fcn.0042d61c
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x49bb10
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [eax]
call dword [eax + 0x88]
push 0x49bb20
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4bd2bc], eax
push 0x49bb44
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4bd2c0], eax
push 0x49bb68
call sub.user32.dll_RegisterWindowMessageW
mov dword [0x4bd2c4], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 8]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x10]
cmp dword [ebx + 0x18], 0
jne 0x49bacd
cmp dword [0x4b72c0], 0xffffffff
je 0x49bacd
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49bae8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bb05
lea eax, [ebp - 0x10]
call fcn.00427f70
ret
Function at 0x4a840c
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x4a84cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a4c
push ebp
call fcn.004a8344
pop ecx
xor eax, eax
push ebp
push 0x4a84af
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x40]
call fcn.0040774c
push eax
call sub.wininet.dll_InternetCrackUrlW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call fcn.004077a4
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.004077a4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.004077a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a84b6
push ebp
call fcn.004a83cc
pop ecx
ret
Function at 0x10024b50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012fc16
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10186bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100eb7d3
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100e8780
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10025db0
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10130298
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x48], esi
mov edi, ecx
test edi, edi
jne 0x10025e05
push str.Cant_add_headers_to_this_request__in_addWinHttpHeaders
push str.HTTPConnector
call fcn.1002e950
push eax
call fcn.1002f880
add esp, 0xc
xor al, al
jmp 0x10025eee
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push 0x20000000
push 0xffffffffffffffff
push str.User_Agent:_IMSLib_Agent
push edi
call ebx
push 0x20000000
push 0xffffffffffffffff
push str.Content_Type:_text_xml__charsetutf_8
push edi
call ebx
push 0x20000000
push 0xffffffffffffffff
push str.Proxy_Connection:_keep_alive
push edi
call ebx
push 0x20000000
push 0xffffffffffffffff
push str.Connection:_close
push edi
call ebx
cmp dword [esi + 4], 0
sete al
test al, al
jne 0x10025eec
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [ebp - 0x44], ecx
cmp ecx, eax
je 0x10025eec
lea esi, [ecx + 0x10]
push 0x1014ca04
mov edx, esi
lea ecx, [ebp - 0x40]
call fcn.10028160
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
push ecx
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.10028270
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x10025eab
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10028060
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0xa0000000
cmovae eax, dword [ebp - 0x28]
push 0xffffffffffffffff
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x10025ed6
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10028060
lea ecx, [ebp - 0x44]
call fcn.10020120
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [eax]
jne 0x10025e65
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret
Function at 0x10028cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x10046280
xor bl, bl
push edi
mov edi, ecx
test eax, eax
jne 0x10028ccd
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0xc
call fcn.100eb7d3
add esp, 4
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
push 0
push 0
push esi
push 0x10028da0
push 0
push 0
mov dword [esi], 0x10046280
mov dword [esi + 4], 0x100465a0
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10028d1b
push ecx
mov ecx, esi
call fcn.10028d30
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop esi
mov dword [edi], eax
mov bl, 1
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10029650
Capabilities:
Create directory

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x1002965d
mov eax, dword [esi]
jmp 0x1002965f
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x100296a6
cmp eax, 0xb7
je 0x100296a6
cmp eax, 0x50
je 0x100296a6
cmp dword [esi + 0x14], 8
jb 0x10029682
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_create_directoryPath_...Error_Code_is:__d_._At_desired_location:_s
push str.Utilities
call fcn.1002e950
push eax
call fcn.1002f880
add esp, 0x14
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x100296b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x100296ed
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x20c], 0
jne 0x100296fb
xor ecx, ecx
jmp 0x10029713
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10029704
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.10027660
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100eb369
mov esp, ebp
pop ebp
ret