joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5c42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
push str.openUrlOnDefaultBrowser
mov ecx, 0x4d7098
call fcn.00405a40
mov byte [ebp - 4], 1
push 1
push 0
push 0
lea ecx, [ebp + 8]
call fcn.0043fc50
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4377f5
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043bb20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x446310
Capabilities:
Connect to http server
Create http request
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], str.User_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_37.0.2062.120_Safari_537.36
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x10], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
push 3
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 8], 0
jne 0x44638f
xor al, al
jmp 0x446391
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4519e0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8b94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x8c], 0
jne 0x451a1f
xor eax, eax
jmp 0x451b3c
mov ecx, dword [ebp - 0x20]
call fcn.004532a0
test eax, eax
je 0x451a79
lea ecx, [ebp - 0x14]
push ecx
push 4
mov edx, dword [ebp - 0x20]
push edx
push 0x4525f0
push 0
push 0
call fcn.0048930c
add esp, 0x18
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xa8], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0xa8], 0
jne 0x451a64
xor eax, eax
jmp 0x451b3c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x451b22
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0xb0], 0
je 0x451b22
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xb0]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xb0]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 0x18]
call eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0xb0]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xb0]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x1c]
call ecx
push 0
mov edx, dword [ebp - 0x1c]
neg edx
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x68]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x64]
push edx
push 0
push 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x90]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0xb0]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xb0]
mov eax, dword [eax]
push edx
mov ecx, dword [eax + 0x20]
call ecx
test eax, eax
jne 0x451b22
push 0
mov ecx, dword [ebp - 0x20]
call fcn.00454ec0
mov eax, 1
jmp 0x451b3c
xor eax, eax
jmp 0x451b3c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451db0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8bc2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00454eb0
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x451e12
mov edx, dword [ebp - 0x28]
push edx
call fcn.00454eb0
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x451e19
xor eax, eax
jmp 0x451ef0
mov eax, dword [ebp - 0x28]
push eax
call fcn.00454eb0
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x451e52
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x451ef0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x451e78
cmp dword [ebp - 0x14], 0
jne 0x451e90
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x451ef0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.004856c0
add esp, 0xc
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x30]
call fcn.004512b0
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x1c]
jmp 0x451ef0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x455450
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov dword [ebp - 0x224], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x455486
mov eax, 1
jmp 0x455620
lea edx, [ebp - 8]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x4554e4
cmp dword [ebp - 0x214], 2
jne 0x4554d0
push str.Key_not_found._n
call fcn.00485a25
add esp, 4
mov eax, 1
jmp 0x455620
push str.Error_opening_key._n
call fcn.00485a25
add esp, 4
xor eax, eax
jmp 0x455620
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x220], edx
mov eax, dword [ebp - 0x220]
movzx ecx, word [eax - 2]
cmp ecx, 0x5c
je 0x455531
mov edx, 0x5c
mov eax, dword [ebp - 0x220]
mov word [eax], dx
mov ecx, dword [ebp - 0x220]
add ecx, 2
mov dword [ebp - 0x220], ecx
xor edx, edx
mov eax, dword [ebp - 0x220]
mov word [eax], dx
mov dword [ebp - 4], 0x104
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4555d6
lea edx, [ebp - 0x210]
push edx
push 0x208
mov eax, dword [ebp - 0x220]
push eax
call fcn.00456e40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x224]
call fcn.00456470
test eax, eax
jne 0x45559c
jmp 0x4555d6
mov dword [ebp - 4], 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x45556b
mov ecx, dword [ebp - 0x220]
sub ecx, 2
mov dword [ebp - 0x220], ecx
xor edx, edx
mov eax, dword [ebp - 0x220]
mov word [eax], dx
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x45561e
mov eax, 1
jmp 0x455620
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x455900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8e1d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0045c7c0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
lea ecx, [ebp + 0x10]
call fcn.0043fc50
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4559c5
lea edx, [ebp - 0x14]
push edx
push 0x20119
push 0
lea ecx, [ebp + 0x10]
call fcn.0043fc50
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4559c5
push 0x4ade8c
mov ecx, dword [ebp + 8]
call fcn.0040fbc0
mov ecx, dword [ebp - 0x38]
or ecx, 1
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0043bb20
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.0043bb20
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x455b0b
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x18]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.0043fc50
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402df0
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp + 0x14]
call fcn.0043fc50
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], eax
jmp 0x455a6f
mov dword [ebp - 4], 3
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.00456e90
cmp dword [ebp - 0x1c], 0
je 0x455acf
push str.NULLABLE
mov ecx, dword [ebp + 8]
call fcn.004132d0
mov eax, dword [ebp - 0x38]
or eax, 1
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0043bb20
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.0043bb20
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.0043bb20
mov eax, dword [ebp + 8]
jmp 0x455b0b
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov edx, dword [ebp - 0x38]
or edx, 1
mov dword [ebp - 0x38], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0043bb20
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.0043bb20
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.0043bb20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x455d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8ea1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], 0xfffffff6
lea ecx, [ebp + 0xc]
call fcn.00442600
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea eax, [ebp + 8]
push eax
call fcn.004059f0
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
call fcn.004563f0
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.004562f0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
lea ecx, [ebp + 0xc]
call fcn.0043fc50
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp + 8]
push edx
call fcn.004059f0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
call fcn.004563f0
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x455e64
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp + 0xc]
call fcn.0043fc50
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
lea eax, [ebp + 8]
push eax
call fcn.004059f0
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x50], ecx
mov byte [ebp - 4], 5
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
call fcn.004563f0
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x455e64
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0043bb20
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0043bb20
mov eax, dword [ebp - 0x28]
jmp 0x455ebe
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
lea ecx, [ebp + 0x10]
call fcn.0043fc50
push eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0043bb20
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0043bb20
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45c490
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9903
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], 0
push str.Caption
push 0x4adb78
push str.SELECT__FROM_Win32_OperatingSystem
push str.ROOTcimv2
lea eax, [ebp - 0x28]
push eax
call fcn.0045bc60
add esp, 0x14
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401bc0
mov edx, dword [ebp - 0x2c]
or edx, 1
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00401c00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x45c510
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9937
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x21c], 0xff
xor eax, eax
mov word [ebp - 0x214], ax
push 0x1fc
push 0
lea ecx, [ebp - 0x212]
push ecx
call fcn.00482a10
add esp, 0xc
mov dword [ebp - 0x10], 0x1fe
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0x214]
push eax
push 0x59
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x220]
call fcn.0045c7c0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00405a40
lea edx, [ebp - 0x220]
push edx
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov eax, dword [ebp - 0x224]
or eax, 1
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.0043bb20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x468fc4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x46900b
call fcn.00475c77
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46900b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x469027
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00468b3c
mov esi, eax
test edi, edi
je 0x469025
test ebx, ebx
je 0x469025
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4697f6
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4aa84d
call fcn.0048979b
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x46981b
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x469861
lea ecx, [ebp - 0x10]
call fcn.0045c7c0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045d039
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004017f0
mov eax, esi
call fcn.00489873
ret 8

Function at 0x46a77d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x46a7c5
call fcn.00475c77
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46a7c5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x46a808
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x46a7f1
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x46a7f1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x46a805
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x472bde
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x472c02
cmp dword [edi + 0x54], 0
jne 0x472c02
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00475c77
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00472b9f
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x478d8c
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x478db7
call fcn.00475c77
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x478dda
push eax
push dword [esi + 4]
call fcn.00478d12
push esi
push eax
mov ecx, 0x4d8f38
call fcn.00478999
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x47985a
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x4aac02
call fcn.0048979b
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0047981a
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.0045c7c0
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
jne 0x4798c0
push eax
push dword [esi + 8]
call fcn.00478d12
push dword [esi + 0xc]
mov ecx, 0x4d8f38
push eax
call fcn.00478999
mov eax, esi
call fcn.00489873
ret 0x18

Function at 0x48964a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d57e0]
jne 0x489654
repz ret
jmp fcn.004998f6
Function at 0x49bbc0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0048ecab
and dword [ebp - 4], 0
cmp dword [0x4da134], 0
mov ebx, eax
jne 0x49bc71
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x49bd22
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x49bd22
push eax
call fcn.0048ec39
mov dword [esp], 0x4ba478
push edi
mov dword [0x4da134], eax
call esi
push eax
call fcn.0048ec39
mov dword [esp], 0x4ba464
push edi
mov dword [0x4da138], eax
call esi
push eax
call fcn.0048ec39
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4da13c], eax
call esi
push eax
call fcn.0048ec39
pop ecx
mov dword [0x4da144], eax
test eax, eax
je 0x49bc71
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048ec39
pop ecx
mov dword [0x4da140], eax
mov eax, dword [0x4da140]
cmp eax, ebx
je 0x49bcc9
cmp dword [0x4da144], ebx
je 0x49bcc9
push eax
call fcn.0048ecb4
push dword [0x4da144]
mov esi, eax
call fcn.0048ecb4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x49bcc9
test edi, edi
je 0x49bcc9
call esi
test eax, eax
je 0x49bcc0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49bcc0
test byte [ebp - 0xc], 1
jne 0x49bcc9
or dword [ebp + 0x10], 0x200000
jmp 0x49bd02
mov eax, dword [0x4da138]
cmp eax, ebx
je 0x49bd02
push eax
call fcn.0048ecb4
pop ecx
test eax, eax
je 0x49bd02
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x49bd02
mov eax, dword [0x4da13c]
cmp eax, ebx
je 0x49bd02
push eax
call fcn.0048ecb4
pop ecx
test eax, eax
je 0x49bd02
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4da134]
call fcn.0048ecb4
pop ecx
test eax, eax
je 0x49bd22
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x49bd24
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret