joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458574
Capabilities:
Get disk information

Disassembly:
push 0x4c
mov eax, 0x4a0762
call fcn.00459b85
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x58], eax
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ebx
call fcn.004146b4
test al, al
jne 0x4585cc
push ebx
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.0041440b
mov dword [ebp - 4], ebx
add eax, 4
inc ebx
mov dword [ebp - 0x4c], ebx
cmp dword [eax + 0x14], 8
jb 0x4585bc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov byte [ebp - 0x41], 1
cmp eax, 4
je 0x4585d0
mov byte [ebp - 0x41], 0
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x4585eb
and ebx, 0xfffffffe
mov dword [ebp - 0x4c], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404cc0
cmp byte [ebp - 0x41], 0
je 0x4586ae
mov eax, 0x208
push eax
mov dword [ebp - 0x48], eax
call fcn.00459c53
mov ebx, eax
mov esi, ebx
pop ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 4], 2
add edi, 4
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x45861f
mov eax, dword [edi]
lea ecx, [ebp - 0x48]
push ecx
push ebx
push 1
push eax
call sub.MPR.dll_WNetGetUniversalNameW
cmp eax, 0xea
jne 0x45866b
mov eax, dword [ebp - 0x48]
add eax, 2
push eax
mov dword [ebp - 0x48], eax
call fcn.00459c53
mov esi, eax
mov dword [ebp - 0x54], esi
pop ecx
test ebx, ebx
je 0x458656
push 4
push ebx
call fcn.004598ae
pop ecx
pop ecx
cmp dword [edi + 0x14], 8
jb 0x45865e
mov edi, dword [edi]
lea eax, [ebp - 0x48]
push eax
push esi
push 1
push edi
call sub.MPR.dll_WNetGetUniversalNameW
test eax, eax
jne 0x45869c
cmp dword [esi], 0
mov edi, 0x4b65d4
mov eax, edi
cmovne eax, dword [esi]
test eax, eax
cmovne edi, eax
push edi
call fcn.00473ca3
pop ecx
mov ecx, dword [ebp - 0x58]
push eax
push edi
add ecx, 4
call fcn.00408130
mov dword [ebp - 0x50], 1
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4586ae
push 4
push esi
call fcn.004598ae
pop ecx
pop ecx
mov eax, dword [ebp - 0x50]
call fcn.00459b34
ret 8

Function at 0x45885c
Capabilities:
Delete directory

Disassembly:
push 8
mov eax, 0x490548
call fcn.00459b52
push 8
sub esp, 0x30
lea eax, [ebp - 0xd]
mov ecx, esp
mov dword [ebp - 0x14], esp
xor edi, edi
xor esi, esi
inc edi
push edi
push eax
push dword [ebp + 8]
call fcn.0041099e
and dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
call fcn.0045c4a5
add esp, 0x34
test al, al
je 0x4588b8
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
push 0
cmovne esi, edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, esi
call fcn.00459b20
ret 4
Function at 0x4588c2
Capabilities:
Delete file
Set file attributes

Disassembly:
push 8
mov eax, 0x490548
call fcn.00459b52
push 4
sub esp, 0x30
lea eax, [ebp - 0xd]
mov ecx, esp
mov dword [ebp - 0x14], esp
xor ebx, ebx
inc ebx
push ebx
push eax
push dword [ebp + 8]
call fcn.0041099e
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call fcn.0045c4a5
add esp, 0x34
test al, al
jne 0x458900
mov eax, ebx
jmp 0x45893f
push dword [ebp + 8]
xor esi, esi
call fcn.004576bc
test eax, eax
jne 0x45893d
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
push 0
cmovne esi, ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, esi
call fcn.00459b20
ret 4

Function at 0x45a973
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45a9b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45a9b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45a9b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45a9b2
cmp dword [ecx + 0x74], 0xe
jbe 0x45a9b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x45b518
Capabilities:
Write file on windows

Disassembly:
push 0x88
mov eax, 0x4a092d
call fcn.00459b85
mov esi, ecx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x94]
push 0
push eax
xor eax, eax
inc eax
cmp dword [ebp + 0xc], 0xffffffff
cmovne eax, dword [ebp + 0xc]
push eax
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x45b55d
mov eax, dword [ebp - 0x94]
call fcn.00459b34
ret 8
push 1
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.0043d1d8
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push 1
push eax
lea ecx, [ebp - 0x90]
call fcn.0043cfc7
push 0x4cd838
lea eax, [ebp - 0x90]
push eax
call fcn.00471ff8
int3

Function at 0x45c41c
Capabilities:
Get file attributes

Disassembly:
push 0
mov eax, 0x4a0a9d
call fcn.00459b52
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [ebp + 0x38], bl
je 0x45c448
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
jne 0x45c495
push 0x80
sub esp, 0x30
lea eax, [ebp + 8]
mov ecx, esp
mov edi, 0x4b6748
mov esi, 0x4b6750
mov dword [ebp + 0x38], ecx
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x28], esi
call fcn.00410617
call fcn.0045fb02
pop ecx
mov ecx, esp
lea eax, [ebp + 8]
push ebx
push eax
mov dword [ebp + 0x38], ecx
mov dword [ecx], edi
mov dword [ecx + 0x28], esi
call fcn.00410617
call fcn.0045c39b
add esp, 0x30
test eax, eax
setne bl
lea ecx, [ebp + 8]
call fcn.00404cc0
mov al, bl
call fcn.00459b20
ret
Function at 0x45c4a5
Capabilities:
Check if file exists

Disassembly:
push 0xcc
mov eax, 0x4a0b1e
call fcn.00459b85
xor ebx, ebx
test byte [ebp + 0x38], 0x10
mov dword [ebp - 4], ebx
je 0x45c4ff
lea ecx, [ebp + 8]
call fcn.00444f77
test al, al
je 0x45c4ff
push dword [ebp + 0x38]
lea eax, [ebp + 8]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd4], ecx
push ebx
push eax
mov dword [ecx], 0x4b6748
mov dword [ecx + 0x28], 0x4b6750
call fcn.00410617
call fcn.0045c690
add esp, 0x34
mov bl, al
jmp 0x45c614
sub esp, 0x30
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0xd4], ecx
push ebx
push eax
mov dword [ecx], 0x4b6748
mov dword [ecx + 0x28], 0x4b6750
call fcn.00410617
call fcn.0045ce4e
add esp, 0x30
cmp eax, 0xffffffff
je 0x45c554
and eax, 0x10
test byte [ebp + 0x38], 4
je 0x45c53b
test eax, eax
je 0x45c54d
test byte [ebp + 0x38], 8
je 0x45c614
test eax, eax
je 0x45c614
mov bl, 1
jmp 0x45c614
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x45c641
cmp esi, 3
je 0x45c641
cmp esi, 5
jne 0x45c63b
lea ecx, [ebp - 0x9c]
call fcn.0045b689
or dword [ebp - 0xd4], 0xffffffff
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 2
push eax
sub esp, 0x30
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0xd8], ecx
push ebx
push eax
mov dword [ecx], 0x4b6748
mov dword [ecx + 0x28], 0x4b6750
call fcn.00410617
call fcn.0045cbe6
mov ecx, eax
add esp, 0x34
cmp ecx, 0xffffffff
je 0x45c620
test byte [ebp + 0x38], 4
je 0x45c5d4
test byte [ebp - 0x9c], 0x10
je 0x45c5e3
test byte [ebp + 0x38], 8
je 0x45c5ec
test byte [ebp - 0x9c], 0x10
je 0x45c5ec
mov byte [ebp - 0xcd], 1
jmp 0x45c5f2
mov byte [ebp - 0xcd], bl
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
cmp eax, ebx
je 0x45c5fe
push ecx
call eax
lea ecx, [ebp - 0x40]
call fcn.00404cc0
lea ecx, [ebp - 0x70]
call fcn.00404cc0
mov bl, byte [ebp - 0xcd]
lea ecx, [ebp + 8]
call fcn.00404cc0
mov al, bl
jmp 0x45c64b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
mov esi, eax
call fcn.00404cc0
lea ecx, [ebp - 0x70]
call fcn.00404cc0
test byte [ebp + 0x38], 0x20
jne 0x45c651
lea ecx, [ebp + 8]
call fcn.00404cc0
xor al, al
call fcn.00459b34
ret
push 1
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0043d1d8
push 1
push esi
lea eax, [ebp - 0xcc]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x60]
call fcn.0043d022
push 0x4cd838
lea eax, [ebp - 0x60]
push eax
call fcn.00471ff8
int3
Function at 0x45dcfb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d9754]
xor eax, ebp
mov dword [ebp - 4], eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45dd31
push 0x4b00cc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45dd31
call eax
jmp 0x45ddff
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0xf003f
push 0
push str..DefaultControl_PaneldesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], 0xa
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45dd83
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x4b65d4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45ddd8
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push str..DEFAULTControl_PanelInternational
push SysReAllocStringLen
call edi
mov edi, eax
test edi, edi
jne 0x45ddbe
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push str.Locale
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 0x14], 0
je 0x45ddcd
test esi, esi
je 0x45ddcd
push dword [ebp - 0x14]
call esi
test edi, edi
je 0x45ddd8
mov edi, 0x409
jmp 0x45ddeb
push 0x10
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00476639
add esp, 0xc
movzx edi, ax
cmp dword [ebp - 0x18], 0
je 0x45ddfa
test esi, esi
je 0x45ddfa
push dword [ebp - 0x18]
call esi
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045978b
leave
ret
Function at 0x45e97c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x38
mov eax, 0x4a127d
call fcn.00459b85
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
and esi, 0xf
push dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
test ecx, ecx
jne 0x45e9aa
mov al, 1
jmp 0x45e9c6
xor eax, eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x45e9be
cmp eax, esi
je 0x45e9cc
lea ecx, [ecx + edx*2]
inc eax
cmp eax, 0x10
jl 0x45e9ac
xor al, al
call fcn.00459b34
ret
push 0
lea eax, [ebp - 0x41]
mov dword [ebp - 0x40], 0x4b6748
push eax
test ecx, ecx
mov dword [ebp - 0x18], 0x4b6750
mov eax, 0x4b65d4
cmovne eax, ecx
lea ecx, [ebp - 0x40]
push edx
push eax
call fcn.00410788
and dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [edi + 4]
call fcn.00407b80
lea ecx, [ebp - 0x40]
call fcn.00404cc0
jmp 0x45e9a6

Function at 0x45f155
Capabilities:
Enumerate process modules

Disassembly:
push 0x4a0
mov eax, 0x4a13d6
call fcn.00459b85
mov eax, dword [ebp + 8]
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x480]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
call sub.PSAPI.DLL_EnumProcesses
push str.NtQueryInformationProcess
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x45f2ba
xor edi, edi
cmp dword [ebp - 0x480], edi
jbe 0x45f2ba
push dword [ebp + edi*4 - 0x410]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x488], esi
and dword [ebp - 4], 0
test esi, esi
je 0x45f29e
push 0x18
lea eax, [ebp - 0x4a4]
push 0
push eax
call fcn.004714b0
add esp, 0xc
lea eax, [ebp - 0x48c]
push eax
push 0x18
lea eax, [ebp - 0x4a4]
push eax
push 0
push esi
call ebx
test eax, eax
js 0x45f29e
cmp dword [ebp - 0x494], 0
je 0x45f29e
lea ecx, [ebp - 0x444]
call fcn.0045b6cd
mov eax, dword [ebp - 0x490]
mov esi, 0x4b65d4
push esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x444], eax
call fcn.00473ca3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x43c]
call fcn.00408130
mov eax, dword [ebp - 0x494]
lea ecx, [ebp - 0x478]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x444]
push eax
call fcn.0045b620
mov ecx, dword [ebp - 0x484]
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x4ac]
mov byte [ebp - 4], 2
push eax
call fcn.0045b43a
lea ecx, [ebp - 0x474]
call fcn.00404cc0
lea ecx, [ebp - 0x440]
call fcn.00404cc0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x488]
call fcn.00406070
inc edi
cmp edi, dword [ebp - 0x480]
jb 0x45f1b4
call fcn.00459b34
ret
Function at 0x45f2c0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d9754]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.0045e4b5
test al, al
je 0x45f32f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x18]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45f32f
push esi
lea eax, [ebp - 0x20]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push esi
push esi
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop esi
push 0xffff
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
neg eax
sbb al, al
xor ecx, ebp
inc al
call fcn.0045978b
leave
ret

Function at 0x45f88c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x24], 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
cmovae eax, dword [ebp + 0x10]
push 0x2001f
push eax
push ecx
lea ecx, [ebp - 0xc]
call fcn.00404b50
test eax, eax
jne 0x45f8d3
cmp dword [ebp + 0x54], 8
lea eax, [ebp + 0x40]
cmovae eax, dword [ebp + 0x40]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
mov dword [0x4deec8], eax
push ebx
sete bl
cmp dword [ebp - 0xc], 0
je 0x45f8ed
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
call fcn.00404cc0
lea ecx, [ebp + 0x3c]
call fcn.00404cc0
mov al, bl
pop ebx
leave
ret

Function at 0x45f902
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4d9754]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x45f946
cmp dword [ebp - 0x108], 2
jne 0x45f946
cmp dword [ebp - 0x114], 5
jb 0x45f946
mov al, 1
jmp 0x45f948
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045978b
leave
ret
Function at 0x46343d
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d9754]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 8], 0x500
push eax
xor ebx, ebx
push ebx
push 8
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4634b3
call esi
cmp eax, 0x3f0
jne 0x463496
lea eax, [ebp - 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call esi
cmp eax, 0x78
jne 0x4634ac
push 1
push dword [ebp - 0x10]
call fcn.00463599
pop ecx
pop ecx
jmp 0x46358b
test eax, eax
jne 0x4634b3
push ebx
jmp 0x46349d
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4634d9
push ebx
push dword [ebp - 0x10]
call fcn.00463599
jmp 0x463588
call esi
cmp eax, 0x7a
jne 0x4634cb
push dword [ebp - 0x14]
call fcn.00459c5c
pop ecx
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push 2
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x463501
push ebx
jmp 0x463572
cmp byte [ebp + 8], bl
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
mov eax, 0x223
push ebx
push ebx
lea ecx, [eax - 3]
cmovne eax, ecx
push eax
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4634fe
mov edi, ebx
mov byte [ebp - 0x18], bl
cmp dword [esi], ebx
jbe 0x463566
lea ebx, [esi + 4]
push dword [ebp - 0x1c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x463551
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x463538
jmp 0x463566
cmp byte [ebp + 0xc], 0
je 0x463562
test byte [esi + edi*8 + 8], 0x10
mov byte [ebp - 0x18], 0
jne 0x463566
mov byte [ebp - 0x18], 1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.00463599
pop ecx
pop ecx
push 0xc
push esi
mov bl, al
call fcn.004598ae
mov al, bl
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045978b
leave
ret
Function at 0x463600
Capabilities:
Connect to http server
Parse url
Send data
Send http request

Disassembly:
push 0x44
mov eax, 0x4a200d
call fcn.00459b52
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x50], 0x3c
inc eax
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x10], eax
call fcn.00463d97
xor esi, esi
lea ecx, [ebp - 0x50]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
call fcn.00464576
test eax, eax
je 0x463648
lea eax, [ebp - 0x50]
push eax
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov eax, dword [ebp - 0x44]
mov ecx, 0x800000
push 2
pop edx
sub eax, 1
je 0x4636ab
sub eax, 1
je 0x4636a8
sub eax, 1
je 0x46369f
sub eax, 1
je 0x463691
mov eax, 0x2ee6
mov dword [ebp - 0x14], esi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 8
lea eax, [ebp - 0x14]
push eax
push 0x64
push dword [ebp + 0x1c]
push dword [ebp + 8]
call fcn.00463840
jmp 0x4637c7
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x10], 3
or edi, ecx
jmp 0x4636ae
mov dword [ebp - 0x10], 3
jmp 0x4636ab
mov dword [ebp - 0x10], edx
mov edi, dword [ebp + 0x18]
test ecx, edi
jne 0x4636cf
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
jmp 0x4637c7
mov eax, dword [ebx + 0x94]
cmp dword [eax + 4], esi
je 0x4636f4
push dword [ebp - 0x40]
push dword [ebx + 0x98]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4636f4
mov ecx, ebx
call fcn.0041b543
mov eax, dword [ebx + 0x94]
cmp dword [eax + 4], esi
jne 0x463748
push eax
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x40]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00459c53
pop ecx
push dword [ebp - 0x40]
mov dword [ebx + 0x98], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x18]
inc ecx
add eax, ecx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00459c53
pop ecx
push dword [ebp - 0x24]
mov dword [ebp + 0x18], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp - 0x18], esi
je 0x46378a
push dword [ebp - 0x1c]
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp + 0x1c]
mov eax, dword [ebx + 0x94]
push edi
mov edi, dword [ebp + 0x18]
push esi
push esi
push esi
push edi
push 0x4b0618
push dword [eax + 4]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
push edi
mov ebx, eax
call fcn.004598bc
pop ecx
push esi
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4637c7
mov esi, ebx
lea ecx, [ebp - 0x50]
call fcn.004639d6
mov eax, esi
call fcn.00459b20
ret 0x18
Function at 0x463a22
Capabilities:
Connect to http server
Parse url

Disassembly:
push 0x2a4
mov eax, 0x4a2040
call fcn.00459b85
mov esi, ecx
mov dword [ebp - 0x270], esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2b0]
push 1
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x2b0], 0x3c
call fcn.00463d97
mov edi, dword [esi + 0x3c]
lea ecx, [ebp - 0x2b0]
push 0x10000000
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov byte [ebp - 0x261], bl
call fcn.00464576
test eax, eax
je 0x463bda
lea eax, [ebp - 0x2b0]
push eax
push 0x10000000
push ebx
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x463bda
push 0x2c
call fcn.00459c5c
mov dword [ebp - 0x268], eax
pop ecx
test eax, eax
je 0x463abf
mov ecx, eax
call fcn.0041aac9
mov ebx, eax
mov dword [ebp - 0x26c], eax
jmp 0x463ac5
mov dword [ebp - 0x26c], ebx
push 0x2c
call fcn.00459c5c
mov dword [ebp - 0x268], eax
pop ecx
test eax, eax
je 0x463ae2
mov ecx, eax
call fcn.0041aac9
mov edi, eax
jmp 0x463ae4
xor edi, edi
push ebx
push 0x8000000
push 1
push dword [ebp - 0x28c]
push dword [ebp - 0x294]
push 0x15
push dword [ebp - 0x2a0]
push dword [esi + 0x30]
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
jne 0x463b24
mov edx, dword [ebx]
mov ecx, ebx
push eax
lea eax, [ebx + 0xc]
push eax
push dword [esi + 0x28]
call dword [edx + 8]
test al, al
je 0x463bcc
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x268], eax
test eax, eax
je 0x463b43
push eax
call fcn.00473ca3
inc eax
pop ecx
cmp eax, 0x3fffffff
jle 0x463b47
xor eax, eax
jmp 0x463b68
lea esi, [eax + eax]
mov eax, esi
call fcn.00459c90
mov eax, esp
push 3
push esi
push dword [ebp - 0x268]
push eax
call fcn.004635b8
mov esi, dword [ebp - 0x270]
push edi
push 0
push dword [ebp - 0x274]
push eax
push dword [ebx + 4]
call dword [sym.imp.WININET.dll_FtpFindFirstFileA]
lea ebx, [edi + 0xc]
test eax, eax
jne 0x463b9a
mov eax, dword [edi]
mov ecx, edi
push 0
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
mov byte [ebp - 0x261], 0
test al, al
je 0x463ba1
mov byte [ebp - 0x261], 1
lea eax, [ebp - 0x260]
push eax
push dword [edi + 4]
call dword [sym.imp.WININET.dll_InternetFindNextFileW]
test eax, eax
jne 0x463ba1
mov eax, dword [edi]
mov ecx, edi
push 0
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
test al, al
jne 0x463ba1
mov ebx, dword [ebp - 0x26c]
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
lea ecx, [ebp - 0x2b0]
call fcn.004639d6
mov al, byte [ebp - 0x261]
lea esp, [ebp - 0x2c0]
call fcn.00459b34
ret 4
Function at 0x463fec
Capabilities:
Create http request
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x4d9754]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x83c], eax
call fcn.0041b723
cmp eax, 1
jne 0x4640f3
and dword [ebp - 0x82c], 0
lea eax, [ebp - 0x82c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4640d9
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x834]
mov dword [ebp - 0x830], 4
push eax
push 0
push 0
push str.ProxyEnable
push dword [ebp - 0x82c]
call esi
mov ecx, dword [ebp - 0x834]
xor edx, edx
test eax, eax
mov dword [ebp - 0x830], 0x824
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x828]
cmovne ecx, edx
push eax
push edx
push edx
push str.AutoConfigURL
push dword [ebp - 0x82c]
mov dword [ebp - 0x834], ecx
call esi
movzx ecx, byte [ebp - 0x828]
xor edx, edx
mov esi, dword [ebp - 0x838]
test eax, eax
cmovne ecx, edx
mov byte [ebp - 0x828], cl
cmp dword [ebp - 0x82c], 0
je 0x4640f3
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4640f3
push dword [ebp - 0x82c]
call eax
push dword [ebp - 0x83c]
push dword [ebp - 0x840]
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, dword [ebp - 4]
test eax, eax
mov dword [edi + 4], eax
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.0045978b
leave
ret 0x14