joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a95b
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test al, 0x10
je 0x44a995
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x44a9d2
mov dword [esi], edi
mov eax, dword [esi]
pop edi
pop esi
leave
ret 0x10
test dword [ebp + 8], eax
je 0x44a9bb
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x44a98f
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x44aa09
or eax, 0xffffffff
jmp 0x44a98f
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x44a9e0
cmp eax, 0xffffffff
je 0x44a9e0
push 1
mov edx, esi
mov ecx, eax
call fcn.0044a81b
pop ecx
jmp 0x44a98d
push edi
push 0x80
push 3
lea eax, [ebp - 0xc]
push eax
push 2
push 0x40000000
push 0x4b48fc
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x44a98b
test eax, eax
je 0x44a98b
mov ecx, dword [esi]
push 1
lea edx, [ebp + 0x10]
call fcn.0044a81b
pop ecx
mov ecx, esi
call fcn.0044a7c4
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x44a98d

Function at 0x44aa27
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test al, 0x10
je 0x44aa60
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x44aa9b
mov dword [esi], edi
mov eax, dword [esi]
pop edi
pop esi
leave
ret 0x10
test al, 1
je 0x44aa85
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x44aa5a
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x44aad2
or eax, 0xffffffff
jmp 0x44aa5a
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
test eax, eax
je 0x44aaa9
cmp eax, 0xffffffff
je 0x44aaa9
push 1
mov edx, esi
mov ecx, eax
call fcn.0044a81b
pop ecx
jmp 0x44aa58
push edi
push 0x80
push 3
lea eax, [ebp - 0xc]
push eax
push 1
push bind
push 0x4b48fc
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x44aa56
test eax, eax
je 0x44aa56
mov ecx, dword [esi]
push 1
lea edx, [ebp + 0x10]
call fcn.0044a81b
pop ecx
mov ecx, esi
call fcn.0044a7c4
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x44aa58
Function at 0x44acad
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
push 0x1f5
lea esi, [ebx + 0x34]
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0xffff
call fcn.00420bca
mov edi, eax
mov eax, 0xffff
push eax
mov dword [ebp - 8], edi
mov dword [ebx + 0x10], eax
call fcn.00420bca
pop ecx
pop ecx
push 0
mov dword [ebx + 8], eax
lea eax, [ebp - 4]
push eax
push 0xffff
push edi
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44adc1
cmp dword [ebp - 4], 0
jbe 0x44adbe
lea esi, [ebx + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 4]
add eax, ecx
cmp dword [ebx + 0x10], eax
jae 0x44ad83
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 4]
mov edi, dword [ebx + 8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4b7590]
mulsd xmm0, qword [0x4b3758]
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
call fcn.00472b06
push eax
mov dword [ebx + 0x10], eax
call fcn.00420bca
push dword [ebx + 0xc]
mov dword [ebx + 8], eax
push edi
push dword [ebx + 8]
call fcn.00420560
push edi
call fcn.00420c3e
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 8]
add esp, 0x14
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 8]
push ecx
push edi
push eax
call fcn.00420560
mov eax, dword [ebp - 4]
add dword [ebx + 0xc], eax
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
lea eax, [ebp - 4]
push eax
push 0xffff
push edi
push dword [ebx + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44ad09
mov esi, dword [ebp - 0xc]
push edi
call fcn.00420c3e
pop ecx
mov edi, 0x1f6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44ae7f
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x20], 0
jne 0x44aea3
call fcn.0044ac9f
test al, al
je 0x44aea3
mov ecx, dword [esi + 8]
call fcn.0044a6c7
mov ecx, eax
mov dword [esi + 0x20], eax
call fcn.0044adf6
cmp dword [esi + 0x24], 0
jne 0x44aed0
mov ecx, esi
call fcn.0044aba2
test al, al
je 0x44aed0
call fcn.0044ab98
test al, al
jne 0x44aed0
mov ecx, dword [esi + 0x10]
call fcn.0044a6c7
mov dword [esi + 0x24], eax
mov ecx, eax
pop esi
jmp fcn.0044adf6
pop esi
ret

Function at 0x44aed2
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x44aee1
call fcn.0044ae1d
mov ecx, dword [esi + 0x24]
pop esi
test ecx, ecx
jne fcn.0044ae1d
ret

Function at 0x44ca9a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c07e0]
jne 0x44caa7
call fcn.0044cb7a
mov eax, dword [0x4c44f0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c44f0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret
Function at 0x44cadf
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x4c07e0]
jne 0x44caec
call fcn.0044cb7a
mov eax, dword [0x4c44f0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c44f0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4b7590]
mulsd xmm0, qword [0x4b7540]
ret

Function at 0x44cb3e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
inc esi
mov dword [0x4c44f8], ecx
mov edx, esi
mov ecx, 0x4c44f8
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
add ecx, 4
imul eax, eax, 0x6c078965
add eax, edx
mov dword [ecx], eax
inc edx
cmp ecx, 0x4c4eb4
jl 0x44cb4f
mov dword [0x4c07e0], esi
mov dword [0x4c44e4], esi
pop esi
ret

Function at 0x44cb7a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c44e4], 0
push ebx
push esi
push edi
mov esi, 0x4c44f8
jne 0x44cb9a
push 0
call fcn.00424b8a
pop ecx
mov ecx, eax
call fcn.0044cb3e
mov dword [0x4c07e0], 0x270
mov dword [0x4c44f0], esi
mov edi, 0xe3
mov ebx, 0x9908b0df
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and ecx, ebx
and eax, 0x7ffffffe
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x44cbb4
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and ecx, ebx
and eax, 0x7ffffffe
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x44cbe5
mov ecx, dword [0x4c44f8]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
xor eax, dword [esi]
and edx, ebx
shr eax, 1
xor eax, dword [esi - 0x38c]
pop edi
xor eax, edx
mov dword [esi], eax
pop esi
pop ebx
ret

Function at 0x44d096
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x44d0bb
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.00420560
add esp, 0xc
jmp 0x44d0ce
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.00424f5e
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
push str.EA06
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
mov byte [ebp - 4], 0
call fcn.00425010
pop ecx
neg eax
pop ecx
sbb eax, eax
neg eax
pop esi
leave
ret 4
Function at 0x44d1a2
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10000
mov eax, dword [esi + 0x464]
test eax, eax
je 0x44d1b8
cmp eax, ecx
jne 0x44d1d3
push dword [esi + 0x1c]
push ecx
push 1
push dword [esi + 0x45c]
call fcn.00424f5e
add esp, 0x10
and dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov eax, dword [esi + 0x45c]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret

Function at 0x44d1eb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x460]
mov esi, dword [edi + 0x458]
mov byte [esi + edx], al
inc dword [edi + 0x460]
mov eax, 0x10000
cmp dword [edi + 0x460], eax
jne 0x44d232
push dword [edi + 0x20]
push eax
push 1
push dword [edi + 0x458]
call fcn.004241ee
add esp, 0x10
and dword [edi + 0x460], 0
pop edi
pop esi
pop ebp
ret 4

Function at 0x44d238
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x460]
test eax, eax
je 0x44d260
push dword [esi + 0x20]
push eax
push 1
push dword [esi + 0x458]
call fcn.004241ee
add esp, 0x10
and dword [esi + 0x460], 0
pop esi
ret

Function at 0x44d418
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.0044d262
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call fcn.0044d2ae
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x44d45c
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.0044d3ec
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x44d446
pop edi
pop esi
leave
ret 0xc
Function at 0x44e529
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa2c]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x44e682
push ebx
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push str.___s
push eax
call fcn.00422e0b
lea eax, [ebp - 0x20c]
push eax
call fcn.004223bb
mov ebx, eax
add esp, 0x10
cmp word [ebp + ebx*2 - 0x20e], 0x5c
jne 0x44e59d
cmp word [ebp + ebx*2 - 0x210], 0x3a
je 0x44e59d
xor eax, eax
mov word [ebp + ebx*2 - 0x20e], ax
push edi
xor edi, edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44e5b7
cmp byte [ebp + 0x10], al
je 0x44e673
push edi
push 0x2200000
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44e66a
push 0x618
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.00422430
lea eax, [ebx + ebx]
mov word [ebp - 0x81a], ax
mov eax, dword [ebp - 0x81a]
add eax, 2
mov word [ebp - 0x818], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x814]
push eax
mov dword [ebp - 0x824], 0xa0000003
call fcn.004236d0
mov eax, dword [ebp - 0x81a]
add esp, 0x18
add eax, 0xc
xor edx, edx
push edx
mov word [ebp - 0x820], ax
lea ecx, [ebp + 8]
push ecx
push edx
movzx eax, ax
push edx
add eax, 8
push eax
lea eax, [ebp - 0x824]
push eax
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
test eax, eax
jne 0x44e677
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
jmp 0x44e680
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 0xc
Function at 0x452c87
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452d22
lea eax, [ebp - 0x22c]
push 0x49eaa0
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x452d10
lea eax, [ebp - 0x22c]
push 0x4b4a70
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x452d10
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
or ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
not eax
and ecx, eax
push ecx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x452dd3
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x452cb1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0x14], 0
je 0x452dca
lea eax, [ebp - 0x258]
push eax
push 0x4b4a68
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452dc1
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x452daf
lea eax, [ebp - 0x22c]
push 0x49eaa0
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x452daf
lea eax, [ebp - 0x22c]
push 0x4b4a70
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x452daf
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00452c87
test al, al
je 0x452dde
push 0x4b4a70
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x452d51
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x452dcc
xor ebx, ebx
jmp 0x452dc3
Function at 0x452de2
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452e68
lea eax, [ebp - 0x22c]
push 0x49eaa0
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x452e56
lea eax, [ebp - 0x22c]
push 0x4b4a70
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x452e56
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x22c]
call fcn.00448061
pop ecx
test al, al
je 0x452f19
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x452e0c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0x14], 0
je 0x452f10
lea eax, [ebp - 0x258]
push eax
push 0x4b4a68
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452f07
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x452ef5
lea eax, [ebp - 0x22c]
push 0x49eaa0
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x452ef5
lea eax, [ebp - 0x22c]
push 0x4b4a70
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x452ef5
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00452de2
test al, al
je 0x452f24
push 0x4b4a70
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x452e97
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x452f12
xor ebx, ebx
jmp 0x452f09
Function at 0x4530ec
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call fcn.00408f82
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push 0x4b4a68
inc dword [eax]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
call fcn.00403e34
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x10]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x45324b
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.0041f65c
cmp eax, 1
je 0x453246
cmp eax, 0xb
jne 0x453171
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x453151
lea eax, [ebp - 0x24c]
push 0x49eaa0
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x45322c
lea eax, [ebp - 0x24c]
push 0x4b4a70
push eax
call fcn.00422cc3
pop ecx
pop ecx
test eax, eax
je 0x45322c
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.00408eac
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00403e34
test byte [ebp - 0x278], 0x10
je 0x453209
cmp byte [ebp + 0x18], 0
je 0x4531d8
add dword [esi], 1
adc dword [esi + 4], 0
cmp byte [ebp + 0x1c], 0
je 0x45322c
push 0x49ec84
lea ecx, [ebp - 0x10]
call fcn.00403e34
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.004530ec
mov bl, al
test bl, bl
je 0x453248
jmp 0x45322c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x25c]
xor eax, eax
or eax, dword [ebp - 0x258]
add dword [edx], eax
adc dword [edx + 4], ecx
cmp byte [ebp + 0x18], 0
je 0x45322c
add dword [edi], 1
adc dword [edi + 4], 0
lea eax, [ebp - 0x278]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x453151
jmp 0x453248
xor bl, bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x24]
call fcn.00406e3b
lea ecx, [ebp - 0x10]
call fcn.00406e3b
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x18
Function at 0x455862
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
cmp dword [ebx + 0x74], 4
push edi
mov edi, ecx
mov esi, dword [edi + 0x54]
mov dword [ebp - 4], esi
jne 0x455885
or esi, 0x800000
mov dword [ebp - 4], esi
movzx eax, word [ebx + 0x78]
push 0
push 0
push dword [ebx + 0x70]
push dword [ebx + 0x30]
push dword [ebx + 0x20]
push eax
push dword [ebx + 0x10]
push dword [edi + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
test eax, eax
jne 0x4558bd
push eax
push 0xdeadbeef
push 0xb
mov ecx, edi
call fcn.004562e9
jmp 0x4559ac
xor ecx, ecx
push ecx
push esi
push ecx
push ecx
push ecx
push dword [ebx + 0x60]
push ecx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
test esi, esi
jne 0x4558e2
push eax
push 0xdeadbeef
push 0xc
jmp 0x455996
cmp byte [ebp + 0xc], 0
je 0x4558f1
push ebx
push esi
mov ecx, edi
call fcn.00456343
test dword [ebp - 4], 0x1000
je 0x455926
push 4
pop ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1f
push esi
mov dword [ebp + 8], ebx
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [ebp + 0xc], 0x100
push ebx
lea eax, [ebp + 0xc]
push eax
push 0x1f
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x45598e
push esi
call fcn.00455824
cmp eax, 0xc8
jne 0x45598e
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
push 5
push esi
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], 0x20
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x24]
push eax
call fcn.00422d0a
pop ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov ecx, edi
cmp byte [ebp + 0x10], bl
je 0x455988
push esi
call fcn.0045614b
jmp 0x45599d
push 1
push ebx
push ebx
jmp 0x455998
push ebx
push 0xdeadbeef
push 0xd
mov ecx, edi
call fcn.004562e9
mov bl, al
test esi, esi
je 0x4559aa
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x456035
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
inc ebx
push edi
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x456050
movzx eax, word [edi + 0x8c]
jmp 0x456054
movzx eax, word [edi + 0x58]
movsx ecx, ax
lea edx, [edi + 0xb0]
cmp dword [ebp + 8], ebx
je 0x456065
lea edx, [edi + 0x7c]
mov eax, dword [edi + 0xc0]
xor esi, esi
push esi
cmp ecx, ebx
jne 0x456077
push esi
push esi
push ebx
jmp 0x45608a
cmp ecx, 2
jne 0x456087
push str._local_
push dword [edx]
push 3
jmp 0x45608a
push esi
push esi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 4], eax
cmp eax, esi
jne 0x45609c
xor al, al
jmp 0x4560bc
cmp byte [edi + 0xdc], 0
je 0x4560ba
push 8
lea ecx, [ebp - 8]
push ecx
push 0x32
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x45614b
Capabilities:
Download and write a file
Query remote server for available data
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x30], 0
je 0x45615a
pop ebp
jmp fcn.00456219
pop ebp
jmp fcn.00456160

Function at 0x456417
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x38
xor esi, esi
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.00422430
xor eax, eax
inc eax
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x4c], 0x7c
call fcn.004223bb
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x45646e
xor al, al
jmp 0x45651e
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push dword [ebp - 0x44]
mov ecx, ebx
push esi
push dword [ebp - 0x48]
call fcn.00404875
push dword [ebp - 0x38]
lea ecx, [ebx + 0x10]
push esi
push dword [ebp - 0x3c]
call fcn.00404875
push dword [ebp - 0x2c]
lea ecx, [ebx + 0x20]
push esi
push dword [ebp - 0x30]
call fcn.00404875
push dword [ebp - 0x24]
lea ecx, [ebx + 0x30]
push esi
push dword [ebp - 0x28]
call fcn.00404875
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
push esi
push dword [ebp - 0x20]
call fcn.00404875
push dword [ebp - 0x14]
lea esi, [ebx + 0x50]
push 0
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00404875
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x40]
call fcn.0043cb11
push eax
lea ecx, [ebx + 0x60]
call fcn.00408eac
lea ecx, [ebp - 0x10]
call fcn.00406e3b
mov ax, word [ebp - 0x34]
mov word [ebx + 0x78], ax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x74], eax
dec eax
je 0x456513
dec eax
je 0x45650a
mov dword [ebx + 0x70], 3
jmp 0x45651a
mov dword [ebx + 0x70], 2
jmp 0x45651a
mov dword [ebx + 0x70], 1
pop edi
mov al, 1
pop ebx
pop esi
leave
ret 8