joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5226aa
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x597f54]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00438fb0
mov eax, SysReAllocString
xor ebx, ebx
mov dword [esi], vtable.CPnxRegistry.0
mov byte [esi + 0x138], bl
mov byte [esi + 0x139], bl
mov dword [esi + 0x13c], eax
mov dword [esi + 0x140], eax
call fcn.004b4151
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x454ffe
push 0x80004005
call fcn.004010bd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x144], eax
lea edi, [esi + 0x148]
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.004cf1ba
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esi + 0x15c]
mov byte [esp + 0x20], 1
call fcn.00401534
mov eax, dword [esp + 0x2c]
mov dl, byte [esp + 0x30]
push eax
mov ecx, edi
mov byte [esp + 0x20], 2
mov dword [esi + 0x160], 0xffffffff
mov byte [esi + 0x164], dl
mov dword [esi + 0x178], ebx
mov dword [esi + 0x17c], ebx
call fcn.004cf4a5
push 0x1000
call fcn.004b1a5e
push 0x1000
mov dword [esi + 0x174], eax
call fcn.004b1a5e
push 0x1000
mov dword [esi + 0x168], eax
call fcn.004b1a5e
push 0x1000
mov dword [esi + 0x16c], eax
call fcn.004b1a5e
mov ecx, dword [esp + 0x34]
add esp, 0x10
push ecx
mov ecx, esi
mov dword [esi + 0x170], eax
call fcn.00454e70
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
Function at 0x458950
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jle 0x458984
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
movzx edx, byte [ecx]
mov eax, dword [esi]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x593110]
add ecx, 1
sub edi, 1
mov dword [esi], eax
jne 0x458962
pop esi
pop edi
ret

Function at 0x459650
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x597f54]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.004e3e60
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x4596a5
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
je 0x4596d0
mov eax, dword [esp + 0x14]
sub eax, 2
jne 0x4596d0
cmp dword [esp + 8], 5
jb 0x4596d0
mov eax, 1
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004e2867
add esp, 0xa0
ret
mov ecx, dword [esp + 0xa0]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004e2867
add esp, 0xa0
ret

Function at 0x459900
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
mov ecx, dword [eax]
push 0x461
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
mov edi, eax
push 0x1004
push edi
call ebp
mov ebx, eax
xor esi, esi
test ebx, ebx
jle 0x45999c
lea esp, [esp]
push 2
push esi
push 0x102c
push edi
call ebp
and eax, 2
cmp al, 2
je 0x459963
add esi, 1
cmp esi, ebx
jl 0x459940
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
mov ebx, dword [esp + 0x10]
push 0x104
add ebx, 0x714
push ebx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 0x14]
push edx
push esi
push 0x102d
push edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x38], ebx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4

Function at 0x45a260
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push 0x52db7c
push eax
mov dword [esi], vtable.CResFile.0
call fcn.004e2f3f
add esp, 8
test eax, eax
je 0x45a288
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop esi
jg 0x45a2a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
ret
Function at 0x45a550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
push edi
mov edi, ecx
mov ecx, esi
call fcn.00439770
mov ecx, esi
call fcn.00439780
mov ecx, dword [edi + 8]
lea eax, [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [edi + 8]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
mov eax, dword [edi + 0x68]
push eax
push ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x40]
push ecx
push ebp
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
movzx ebx, word [edi + 0x38]
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov esi, dword [edi + 0x44]
mov edx, dword [edx + 0x14]
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x28]
push eax
neg esi
mov dword [esp + 0x28], ebx
call edx
test eax, eax
je 0x45a6df
cmp esi, dword [esp + 0x3c]
jge 0x45a6b5
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x45a680
cmp dword [ebp + 0x10], 0
mov dword [esp + 0x24], 0
je 0x45a60b
mov eax, dword [edi + 0x60]
cmp dword [eax + 0x158], 0
je 0x45a60b
add esi, dword [esp + 0x40]
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x17]
push edx
push eax
mov ecx, ebp
call fcn.00439910
mov ecx, dword [esp + 0x7c]
push ecx
movzx ecx, byte [esp + 0x1c]
lea edx, [esp + 0x44]
push edx
mov edx, dword [esp + 0x30]
push ebx
mov bl, byte [esp + 0x1f]
movzx eax, bl
push eax
push ecx
push ebp
push esi
push edx
mov ecx, edi
call fcn.00471b50
add esi, dword [esp + 0x40]
cmp dword [esp + 0x24], 0
je 0x45a669
mov ebp, dword [esp + 0x14]
add bl, 1
mov byte [esp + 0x18], bl
mov ebx, dword [esp + 0x1c]
jmp 0x45a610
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov ebx, dword [esp + 0x1c]
mov ebp, eax
mov dword [esp + 0x14], ebp
jmp 0x45a6a7
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
lea edx, [esp + 0x14]
push edx
add ebx, 1
push ebx
lea edx, [esp + 0x28]
push edx
add esi, 8
mov dword [esp + 0x28], ebx
call eax
test eax, eax
je 0x45a6b1
mov ebp, dword [esp + 0x14]
cmp esi, dword [esp + 0x3c]
jl 0x45a5e5
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x45a6c8
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esp + 0x2c]
push ecx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [edi + 8]
push ebp
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 4
Function at 0x45b9f4
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x60]
push eax
call fcn.004675a0
mov ecx, dword [esi + 8]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 8]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x465350
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5232d0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x597f54]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov ebp, dword [esp + 0x28]
xor ebx, ebx
push ebx
push ebp
push 0x5350d0
call fcn.004d1ddf
lea edi, [esi + 0xac]
mov ecx, edi
mov dword [esp + 0x20], ebx
call fcn.00438fb0
mov cl, byte [esp + 0x34]
mov edx, dword [esp + 0x2c]
mov dword [edi], vtable.CTxPageSetupSheet.0
mov edi, dword [esp + 0x30]
mov eax, 1
mov byte [esi + 0x1e6], cl
cmp edi, eax
mov dword [esi], vtable.CTxPageSetupSheet.1.0
mov byte [esi + 0x1e4], bl
mov byte [esi + 0x1e5], al
mov dword [esi + 0x1ec], edx
mov dword [esi + 0x1f0], ebp
mov dword [esi + 0x1f8], edi
mov dword [esi + 0x200], ebx
mov dword [esi + 0x204], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x20c], ebx
mov dword [esi + 0x210], ebx
mov dword [esi + 0x214], ebx
mov dword [esi + 0x218], ebx
mov dword [esi + 0x21c], ebx
mov byte [esi + 0x220], bl
mov byte [esi + 0x221], bl
mov byte [esi + 0x222], bl
sete cl
mov byte [esi + 0x1fc], cl
mov dword [esi + 0x224], ebx
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x230], ebx
mov dword [esi + 0x234], ebx
lea ebp, [esi + 0x23c]
mov ecx, ebp
mov byte [esp + 0x20], al
mov byte [esi + 0x238], bl
call fcn.004bc2bf
mov dword [ebp], vtable.CButton.0
lea ebp, [esi + 0x290]
mov ecx, ebp
mov byte [esp + 0x20], 2
call fcn.004bc2bf
mov dword [ebp], vtable.CButton.0
lea ebp, [esi + 0x2e4]
mov ecx, ebp
mov byte [esp + 0x20], 3
call fcn.004bc2bf
mov dword [ebp], vtable.CButton.0
mov ecx, dword [esp + 0x2c]
push edi
mov byte [esp + 0x24], 4
mov byte [esi + 0x338], bl
mov byte [esi + 0x340], bl
mov dword [esi + 0x1f4], ebx
call fcn.0043a700
mov dword [esi + 0x33c], eax
call fcn.004b9ccd
mov edi, dword [eax + 8]
call fcn.004b9ccd
mov dword [eax + 0xc], edi
call fcn.00463a70
mov dword [esi + 0x1e8], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10

Function at 0x466c30
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x59b258]
add ecx, 0x64
cmp ecx, eax
jae 0x466c9a
call esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
mov dword [0x59b258], eax
call esi
test eax, eax
je 0x466c9a
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
call ebx
push 1
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call esi
test eax, eax
jne 0x466c77
pop edi
pop ebx
pop esi
add esp, 0x1c
ret
Function at 0x467070
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
push ebp
push esi
push edi
push 0
push 0x466f10
jne 0x467099
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x599ed0]
push eax
push 0x61b
push ecx
jmp 0x4670a9
mov edx, dword [esp + 0x2c]
mov eax, dword [0x599ed0]
push edx
push 0x2a4
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [esp + 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, esi
call fcn.00466f90
push 8
mov edi, eax
call fcn.004b1a2e
add esp, 4
push eax
push 8
push esi
mov dword [eax], edi
mov dword [eax + 4], ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
call fcn.00466fc0
push eax
mov eax, dword [esp + 0x20]
add eax, 0xffffffe6
push eax
push 0xd
push 0xd
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
test ebx, ebx
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x46715c
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
lea edx, [esp + 0x10]
push edx
push esi
call ebx
lea eax, [esp + 0x18]
push eax
push esi
call ebx
push 0
push 2
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 6
add ecx, 0xfffffffe
push ecx
push edx
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push edi
call ebp
mov eax, dword [esp + 0x24]
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4749c0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x13c
mov eax, dword [0x597f54]
xor eax, esp
mov dword [esp + 0x138], eax
mov eax, dword [esp + 0x148]
test eax, eax
mov ecx, dword [esp + 0x150]
push ebx
mov ebx, dword [esp + 0x144]
push esi
mov esi, dword [esp + 0x14c]
push edi
mov edi, dword [esp + 0x158]
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 0
je 0x474b82
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x474b81
push ebp
call fcn.004747c0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x474a44
push 1
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [esp + 0x18], eax
push 3
push ebx
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov edx, dword [esp + 0x168]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push edx
mov edx, dword [esp + 0x18]
push 0
push ebp
push edx
mov edx, dword [edi + 0xc]
sub edx, eax
push edx
mov edx, dword [edi + 8]
sub edx, ecx
push edx
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi + 0xc]
sub ecx, eax
push ecx
mov ecx, dword [esi]
sub edx, ecx
push edx
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_StretchDIBits]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
test eax, eax
mov dword [esp + 0x20], ecx
jne 0x474b60
mov dx, 8
cmp dx, word [ebp + 0xe]
sbb eax, eax
add eax, 1
push eax
push ebp
push ebp
call fcn.004747c0
push eax
push 4
push ebp
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 3
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x10]
mov ebp, eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x168]
mov ecx, dword [edi]
push edx
mov edx, dword [edi + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 4]
sub edx, eax
push edx
mov edx, dword [edi + 8]
sub edx, ecx
push edx
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi + 0xc]
push ebp
sub ecx, eax
push ecx
mov ecx, dword [esi]
sub edx, ecx
push edx
push eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
test eax, eax
jne 0x474b42
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x34]
push ecx
push 0
lea edx, [esp + 0x50]
push str.cant_paint__page__d___d_bytes_left_n
push edx
call fcn.004e8739
add esp, 0x10
mov eax, dword [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x474b7d
push 1
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
mov eax, dword [esp + 0x20]
pop ebp
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e2867
add esp, 0x13c
ret 0x1c
Function at 0x477990
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
shr eax, 0x10
push esi
mov esi, ecx
movsx ecx, ax
add dword [esi + 4], ecx
test ecx, ecx
mov eax, dword [esi + 4]
push edi
jl 0x4779b2
mov edi, 0x78
xor ebx, ebx
jmp 0x4779ba
mov edi, 0xffffff88
lea ebx, [edi + 0x79]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl 0x4779ef
push ebp
mov ebp, dword [esp + 0x14]
lea esp, [esp]
mov edx, dword [esi]
mov eax, dword [edx]
push 0
push ebx
push 0
push ebp
mov ecx, esi
call eax
sub dword [esi + 4], edi
mov eax, dword [esi + 4]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jge 0x4779d0
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x482dd0
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x482ddf
xor eax, eax
pop esi
ret 8
call fcn.00482740
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
jne 0x482dd9
push 0x10000000
push eax
push eax
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 4], eax
je 0x482dd9
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], ecx
mov eax, 1
pop esi
ret 8
Function at 0x483850
Capabilities:
Connect to http server

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x48385f
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esi + 0xc]
test eax, eax
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetSetStatusCallback]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x483886
push 0
push eax
call ebp
mov eax, dword [esi + 0xc]
push eax
call edi
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x48389f
push 0
push eax
call ebp
mov ecx, dword [esi + 8]
push ecx
call edi
mov dword [esi + 8], 0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push esi
push 0
push 3
mov edx, edi
neg edx
push 0
sbb edx, edx
push str.anonymous
and edx, 0x16b
add edx, 0x50
push edx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 8], eax
je 0x483903
test edi, edi
mov ecx, 0x84400000
je 0x4838e3
mov ecx, 0x84c00000
mov edx, dword [esp + 0x14]
push esi
push ecx
mov ecx, dword [esp + 0x24]
push 0
push 0
push 0
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x48390b
pop edi
pop ebp
xor eax, eax
pop esi
ret 0x10
push 0x483490
push eax
call ebp
neg eax
pop edi
sbb eax, eax
pop ebp
add eax, 1
pop esi
ret 0x10

Function at 0x4856e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x524b91
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x597f54]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
lea esi, [edi + 0xc]
push esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebp
call fcn.00485200
mov ebx, dword [esp + 0x30]
add esp, 4
push esi
mov ecx, ebx
call fcn.00410688
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x24], ebp
lea ebp, [edi + 0x10]
push 0x52db7c
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], ecx
call fcn.004e2f3f
add esp, 8
test eax, eax
setne al
test al, al
je 0x4857ce
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x485781
add eax, 0xffffffff
js 0x4857e6
mov esi, dword [esi]
cmp eax, dword [esi - 0xc]
jg 0x4857e6
mov al, byte [esi + eax]
cmp al, 0x5c
je 0x485781
push 0x5c
mov ecx, ebx
call fcn.0043aff0
add edi, 0x14
push edi
lea edx, [esp + 0x1c]
push ebp
push edx
call fcn.0040acb6
add esp, 0xc
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 1
call fcn.00402c69
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4857ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
push 0x80070057
call fcn.004010bd
int3
Function at 0x486770
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x524d56
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x597f54]
xor eax, esp
mov dword [esp + 0x114], eax
push ebp
push esi
push edi
mov eax, dword [0x597f54]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
mov esi, dword [esp + 0x138]
mov eax, dword [esp + 0x140]
mov edi, dword [esp + 0x13c]
mov ebp, ecx
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.00401534
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x134], 0
call fcn.00401534
test esi, esi
mov byte [esp + 0x130], 1
jne 0x486800
push 4
push str.sfx
lea ecx, [esp + 0x18]
call fcn.00401452
test edi, edi
jne 0x48683a
lea ecx, [esp + 0x1c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
jmp 0x486820
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x486820
sub eax, edx
push eax
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x1c]
call fcn.00401452
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4868d4
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x486860
mov ecx, dword [esp + 0x18]
sub eax, edx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00401452
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x130], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4868a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x130], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4868cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x48693e
mov eax, dword [ebp + 4]
push 0
lea ecx, [ebp + 4]
push 0
push eax
push str.XERR_DEVICETEMPLIMIT
call fcn.00489e50
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x130], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486911
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x130], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48693c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004e2867
add esp, 0x124
ret 0xc
Function at 0x486f50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x524e48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x597f54]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea ecx, [esp + 0x10]
call fcn.00405829
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xf]
mov dword [esp + 0x28], 0
call fcn.004873a0
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [eax]
push ecx
push edx
push eax
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 1
call fcn.00486970
mov esi, eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486fda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x10], vtable.XFileSys.0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x24], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48700a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x487032
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret

Function at 0x487050
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0xc]
push eax
mov esi, ecx
mov ecx, dword [esp + 0x14]
push ecx
push 0
push edi
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jae 0x487085
push edi
push eax
mov ecx, esi
call fcn.004894e0
xor eax, eax
pop edi
pop esi
ret 0x10