joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cd15
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x238
mov eax, 0x5a4b34
call fcn.00587224
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x228], esi
cmp word [eax], di
jne 0x45cd3d
xor eax, eax
jmp 0x45ce51
lea ecx, [ebp - 0x21c]
push ecx
push 0xf003f
push edi
push eax
push 0x80000001
mov dword [ebp - 0x21c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45ce3f
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x220], edi
call fcn.005847c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push dword [ebp - 0x21c]
mov dword [ebp - 0x224], 0x103
call ebx
test eax, eax
jne 0x45ce33
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x244]
call fcn.0040805d
mov eax, esi
push eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 4], edi
call fcn.00408148
or dword [ebp - 4], 0xffffffff
push edi
push 1
call fcn.004048c7
inc dword [ebp - 0x220]
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.005847c0
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
mov dword [ebp - 0x224], 0x103
push dword [ebp - 0x21c]
call ebx
test eax, eax
je 0x45cdb5
mov esi, dword [ebp - 0x228]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
neg eax
sbb eax, eax
neg eax
call fcn.005872a7
ret 4

Function at 0x45cee8
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, 0xa000
push edi
mov dword [ebp - 4], edi
call fcn.0057c3f0
mov esi, eax
pop ecx
test esi, esi
je 0x45cfb2
push edi
push 0
push esi
call fcn.005847c0
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push str.visited:
call dword [0x61e854]
mov dword [ebp - 8], eax
test eax, eax
je 0x45cfab
mov ecx, dword [ebp + 8]
call fcn.0045ce59
mov ebx, dword [0x61e850]
mov dword [ebp - 0xc], eax
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [ebp - 0xc]
call fcn.0045ce83
add esp, 0xc
test eax, eax
je 0x45cf7c
push dword [esi + 4]
call ebx
test eax, eax
jne 0x45cf7c
call dword [0x5b13dc]
cmp eax, 5
jne 0x45cf7c
push 0
push dword [esi + 4]
call dword [0x61e84c]
push dword [esi + 4]
call ebx
push edi
push 0
push esi
mov dword [ebp - 4], edi
call fcn.005847c0
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call dword [0x61e848]
test eax, eax
jne 0x45cf43
push dword [ebp - 8]
call dword [0x61e844]
push esi
call fcn.0057d6c3
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45d086
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push 0x840
push 0x5fa928
call fcn.0059e670
mov edi, 0xa000
mov dword [ebp - 0x848], edi
call fcn.0045ce59
mov dword [ebp - 0x850], eax
push edi
call fcn.0057c3f0
pop ecx
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x45d2c6
push edi
push ebx
push esi
call fcn.005847c0
add esp, 0xc
mov eax, dword [ebp - 0x848]
mov dword [esi], eax
lea eax, [ebp - 0x848]
push eax
push esi
push str.cookie:
call dword [0x61e854]
mov dword [ebp - 0x84c], eax
cmp eax, ebx
je 0x45d172
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [ebp - 0x850]
call fcn.0045ce83
add esp, 0xc
test eax, eax
je 0x45d135
push dword [esi + 4]
call dword [0x61e850]
test eax, eax
jne 0x45d135
call dword [0x5b13dc]
cmp eax, 5
jne 0x45d135
push ebx
push dword [esi + 4]
call dword [0x61e84c]
push dword [esi + 4]
call dword [0x61e850]
mov dword [ebp - 0x848], edi
push edi
push ebx
push esi
call fcn.005847c0
add esp, 0xc
mov eax, dword [ebp - 0x848]
mov dword [esi], eax
lea eax, [ebp - 0x848]
push eax
push esi
push dword [ebp - 0x84c]
call dword [0x61e848]
test eax, eax
jne 0x45d0f2
push dword [ebp - 0x84c]
call dword [0x61e844]
push esi
call fcn.0057d6c3
pop ecx
cmp dword [ebp - 0x850], ebx
jne 0x45d2c6
xor eax, eax
mov word [ebp - 0x844], ax
mov esi, 0x206
push esi
push ebx
lea eax, [ebp - 0x842]
push eax
call fcn.005847c0
add esp, 0xc
mov edi, 0x5bda44
push ebx
push 0x21
lea eax, [ebp - 0x844]
push eax
push ebx
call dword [0x5b1424]
test eax, eax
je 0x45d1c4
lea edi, [ebp - 0x844]
cmp edi, ebx
je 0x45d237
cmp word [edi], bx
je 0x45d237
xor eax, eax
mov word [ebp - 0x63c], ax
push esi
push ebx
lea eax, [ebp - 0x63a]
push eax
call fcn.005847c0
add esp, 0xc
push str._.txt
push edi
push 0x5cca54
push 0x103
lea eax, [ebp - 0x63c]
push eax
call fcn.0057d72e
add esp, 0x14
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x63c]
call fcn.00473691
mov dword [ebp - 4], 0xfffffffe
jmp 0x45d237
xor eax, eax
mov word [ebp - 0x434], ax
push esi
push ebx
lea eax, [ebp - 0x432]
push eax
call fcn.005847c0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x22c], ax
push esi
push ebx
lea eax, [ebp - 0x22a]
push eax
call fcn.005847c0
add esp, 0xc
push ebx
lea eax, [ebp - 0x434]
call fcn.00403b27
push str.Cookies
lea eax, [ebp - 0x434]
push eax
push 0x5d6c58
push 0x103
lea eax, [ebp - 0x22c]
push eax
call fcn.0057d72e
add esp, 0x14
xor eax, eax
cmp ax, word [ebp - 0x22c]
je 0x45d2c6
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
call fcn.0047c479
add esp, 0x10
lea eax, [ebp - 0x434]
push eax
call dword [0x5b11f8]
call fcn.0059e6b8
ret
Function at 0x45ffe7
Capabilities:
Write file on windows

Disassembly:
push 0xa90
mov eax, 0x5a2974
call fcn.00587224
mov eax, dword [ebp + 8]
mov edi, ecx
mov esi, edx
xor ebx, ebx
push edi
mov dword [ebp - 0xa94], esi
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xa9c], ebx
call dword [0x5b14d8]
test eax, eax
je 0x460169
cmp esi, ebx
je 0x460169
cmp dword [ebp - 0xa98], ebx
je 0x460169
lea esi, [ebp - 0xa90]
call fcn.00508634
push edi
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0050873e
test eax, eax
je 0x460152
mov eax, esi
push eax
call fcn.0050879f
mov edi, eax
xor esi, esi
cmp edi, ebx
jle 0x460147
push 0x22c
lea eax, [ebp - 0x23c]
push ebx
push eax
mov dword [ebp - 0x240], ebx
call fcn.005847c0
add esp, 0xc
push esi
lea edx, [ebp - 0x240]
lea ecx, [ebp - 0xa90]
call fcn.005087f3
test eax, eax
je 0x460147
test byte [ebp - 0x34], 0x10
jne 0x4600b9
push dword [ebp - 0xa94]
lea eax, [ebp - 0x23c]
push eax
call fcn.0057d999
pop ecx
pop ecx
test eax, eax
je 0x4600c3
inc esi
cmp esi, edi
jl 0x460066
jmp 0x460147
push dword [ebp - 0x240]
lea esi, [ebp - 0xa90]
call fcn.005088e0
mov esi, eax
cmp esi, ebx
je 0x460147
mov ecx, dword [ebp - 0xa98]
call fcn.00472d66
push 5
push dword [ebp - 0xa98]
push ebx
push ebx
call dword [0x5b1428]
push 0x5cba40
push dword [ebp - 0xa98]
lea eax, [ebp - 0xa94]
push eax
mov dword [ebp - 0xa94], ebx
call fcn.0058138c
add esp, 0xc
test eax, eax
jne 0x460140
push dword [ebp - 0xa94]
xor edi, edi
push dword [ebp - 0x14]
inc edi
push edi
push esi
call fcn.00581b18
push dword [ebp - 0xa94]
call fcn.00581c11
add esp, 0x14
mov dword [ebp - 0xa9c], edi
push esi
call fcn.0057db06
pop ecx
lea ecx, [ebp - 0xa90]
call fcn.0050877f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa90]
call fcn.005086b3
mov eax, dword [ebp - 0xa9c]
jmp 0x46016b
xor eax, eax
call fcn.005872a7
ret 4
Function at 0x460173
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x606c40]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push esi
mov esi, ecx
push str.flashxpwin7
push esi
call fcn.00581d9b
pop ecx
pop ecx
test eax, eax
jne 0x4601aa
cmp dword [0x622cc4], eax
je 0x4601cb
push str.flashwin8
push esi
call fcn.00581d9b
pop ecx
pop ecx
test eax, eax
jne 0x460339
cmp dword [0x622cc4], eax
je 0x460339
push ebx
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.005847c0
lea eax, [esi + 0x44]
push eax
push 0x5c86e0
mov dword [ebp - 0x7c], eax
mov ebx, 0x103
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.0057d72e
mov esi, dword [0x5b14bc]
add esp, 0x1c
lea eax, [ebp - 0x74]
push eax
call esi
mov edi, dword [0x5b14cc]
push str.flash.ocx
lea eax, [ebp - 0x74]
push eax
call edi
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x194], ax
lea eax, [ebp + 0x196]
push eax
call fcn.005847c0
push dword [ebp - 0x7c]
lea eax, [ebp + 0x194]
push 0x5c86e0
push ebx
push eax
call fcn.0057d72e
add esp, 0x1c
lea eax, [ebp + 0x194]
push eax
call esi
push str.flash.ocx.tmp
lea eax, [ebp + 0x194]
push eax
call edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x9c
push dword [ebp - 0x7c]
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call fcn.0041804e
mov edi, dword [0x5b1370]
add esp, 0x10
test eax, eax
je 0x460330
cmp dword [ebp - 0x78], ebx
je 0x460330
lea ecx, [ebp + 0x194]
call fcn.00472d66
lea eax, [ebp + 0x194]
push 0x5cba40
push eax
call fcn.00581375
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x4602d9
push esi
push dword [ebp - 0x80]
push 1
push dword [ebp - 0x78]
call fcn.00581b18
push esi
call fcn.00581c11
add esp, 0x14
push dword [ebp - 0x78]
call fcn.0057db06
pop ecx
lea eax, [ebp + 0x194]
push eax
call dword [0x5b14d8]
test eax, eax
je 0x460330
push 0x80
lea eax, [ebp - 0x74]
push eax
call edi
push 1
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x194]
push eax
call dword [0x5b1190]
test eax, eax
jne 0x460330
lea eax, [ebp + 0x194]
push eax
lea ecx, [ebp - 0x74]
call fcn.00472e4c
pop ecx
lea ecx, [ebp + 0x194]
call fcn.00472d66
push 2
push dword [ebp - 0x7c]
call edi
pop edi
pop ebx
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
pop esi
call fcn.0057d6ce
add ebp, 0x3a0
leave
ret
Function at 0x46964a
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a9a2d
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x606c40]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push esi
push edi
mov eax, dword [0x606c40]
xor eax, esp
push eax
lea eax, [esp + 0x270]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp esi, edi
je 0x46979e
cmp word [esi], di
je 0x46979e
xor eax, eax
push 0x1fe
mov word [esp + 0x68], ax
lea eax, [esp + 0x6a]
push edi
push eax
call fcn.005847c0
add esp, 0xc
push 0x38
lea eax, [esp + 0x30]
push edi
push eax
call fcn.005847c0
add esp, 0xc
lea eax, [esp + 0x64]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
push eax
push edi
push edi
push esi
mov dword [esp + 0x38], 0x3c
mov dword [esp + 0x4c], 0xff
call dword [0x61e868]
test eax, eax
je 0x46979e
xor esi, esi
push dword [esi + 0x6086cc]
lea eax, [esp + 0x68]
call fcn.00425af1
pop ecx
test eax, eax
jne 0x469758
add esi, 4
cmp esi, 0x24
jb 0x4696f9
lea eax, [esp + 0x10]
push eax
call fcn.004fae32
lea ebx, [esp + 0x10]
mov dword [esp + 0x278], edi
call fcn.004699c0
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x1c]
push 0x1c
cdq
pop ecx
idiv ecx
xor ebx, ebx
test eax, eax
jbe 0x469787
push ebx
lea esi, [esp + 0x14]
call fcn.004048a3
cmp dword [eax + 0x18], 8
jb 0x46975d
mov eax, dword [eax + 4]
jmp 0x469760
xor edi, edi
inc edi
jmp 0x46979a
add eax, 4
push eax
lea eax, [esp + 0x68]
call fcn.00425af1
pop ecx
test eax, eax
jne 0x469784
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x1c]
push 0x1c
cdq
pop ecx
idiv ecx
inc ebx
cmp ebx, eax
jb 0x469743
jmp 0x469787
xor edi, edi
inc edi
lea esi, [esp + 0x10]
call fcn.0040490e
push dword [esp + 0x10]
call fcn.0057d6c3
pop ecx
mov eax, edi
jmp 0x4697a0
xor eax, eax
mov ecx, dword [esp + 0x270]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.0057d6ce
mov esp, ebp
pop ebp
ret

Function at 0x46a2dc
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x1c4]
sub esp, 0x244
mov eax, dword [0x606c40]
xor eax, ebp
mov dword [ebp + 0x1c0], eax
push edi
xor edi, edi
mov dword [ebp - 0x44], edi
cmp word [esi], di
je 0x46a374
cmp ebx, edi
je 0x46a374
xor eax, eax
push 0x1fe
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push edi
push eax
call fcn.005847c0
push 0x38
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.005847c0
add esp, 0x18
lea eax, [ebp - 0x40]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push esi
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x6c], 0xff
call dword [0x61e868]
test eax, eax
je 0x46a36f
lea eax, [ebp - 0x40]
push eax
push 0x5c86e0
push 0xffffffffffffffff
push 0x100
push ebx
call fcn.0057fccc
add esp, 0x14
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x44]
jmp 0x46a376
xor eax, eax
mov ecx, dword [ebp + 0x1c0]
xor ecx, ebp
pop edi
call fcn.0057d6ce
add ebp, 0x1c4
leave
ret
Function at 0x46c2d8
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x40
push dword [esp + 0x20]
mov ebx, 0x62dae0
push ebx
mov esi, eax
call fcn.0046c579
push 0x40
push ebx
push ebx
mov eax, 0x5c16a0
call fcn.0046c502
add esp, 0x18
cmp byte [esp + 0x20], 0
mov ebp, 0x62e278
jne 0x46c361
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], 0x10
push 8
pop ecx
push dword [esp + 0x20]
mov esi, 0x62db00
mov edi, ebp
push 0x62db00
rep movsd dword es:[edi], dword [esi]
call fcn.0046c45d
pop ecx
pop ecx
xor esi, esi
lea eax, [esi + 0x62db00]
mov cl, byte [eax - 0x20]
xor byte [eax], cl
inc esi
cmp esi, 0x20
jl 0x46c337
add dword [esp + 0x20], 0x30
dec dword [esp + 0x10]
push 8
pop ecx
mov esi, ebp
mov edi, 0x62dae0
rep movsd dword es:[edi], dword [esi]
jne 0x46c319
jmp 0x46c3ba
add esi, 0x2d0
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x20], esi
push 8
pop ecx
push dword [esp + 0x20]
mov esi, 0x62dae0
mov edi, ebp
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0046c45d
pop ecx
pop ecx
xor esi, esi
lea eax, [esi + 0x62dae0]
mov cl, byte [eax + 0x20]
xor byte [eax], cl
inc esi
cmp esi, 0x20
jl 0x46c38d
dec dword [esp + 0x10]
sub dword [esp + 0x20], 0x30
cmp dword [esp + 0x10], 0
push 8
pop ecx
mov esi, ebp
mov edi, 0x62db00
rep movsd dword es:[edi], dword [esi]
jge 0x46c373
push 0x40
push ebx
push ebx
mov eax, 0x5c16e0
call fcn.0046c502
mov ebp, dword [esp + 0x24]
xor eax, eax
mov edi, ebp
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
xor eax, eax
mov dl, byte [eax + 0x62dae0]
mov ecx, eax
sar ecx, 3
lea esi, [ecx + ebp]
mov ecx, eax
and ecx, 7
shl dl, cl
or byte [esi], dl
inc eax
cmp eax, 0x40
jl 0x46c3d7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x46c3fa
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x40
push dword [esp + 0x1c]
mov esi, 0x62daa0
push esi
call fcn.0046c579
push 0x38
push esi
push esi
mov eax, str.91__
call fcn.0046c502
mov ebp, dword [esp + 0x2c]
add esp, 0x18
xor edi, edi
movsx ebx, byte [edi + 0x5c17d8]
mov eax, esi
call fcn.0046c545
mov eax, 0x62dabc
call fcn.0046c545
push 0x30
push esi
push ebp
mov eax, 0x5c17a8
call fcn.0046c502
add esp, 0xc
inc edi
add ebp, 0x30
cmp edi, 0x10
jl 0x46c426
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x46c45d
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x30
push ebx
mov esi, 0x62e248
push esi
mov eax, 0x5c1720
call fcn.0046c502
mov edi, dword [ebp + 0xc]
add esp, 0xc
xor ecx, ecx
sub edi, esi
lea eax, [ecx + 0x62e248]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, 0x30
jl 0x46c484
mov esi, 0x62e24a
xor edi, edi
mov dword [ebp - 4], 8
mov al, byte [esi - 1]
mov cl, byte [esi - 2]
add al, al
add al, byte [esi]
add cl, cl
add cl, byte [esi + 3]
add al, al
add al, byte [esi + 1]
movsx ecx, cl
add al, al
add al, byte [esi + 2]
add ecx, edi
movsx eax, al
shl ecx, 4
push 4
lea eax, [eax + ecx + 0x5c17e8]
push eax
push ebx
call fcn.0046c579
add esp, 0xc
add edi, 4
add esi, 6
add ebx, 4
dec dword [ebp - 4]
jne 0x46c4a3
push 0x20
push dword [ebp + 8]
mov eax, 0x5c1750
push dword [ebp + 8]
call fcn.0046c502
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46c5a8
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 8
push 1
mov ebx, str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
xor ebp, ebp
push ebp
push esi
mov dword [esp + 0x20], ebp
call edi
mov eax, dword [esi]
cmp eax, ebp
jne 0x46c5de
push 0xf0000048
push 1
push ebx
push ebp
push esi
call edi
mov eax, dword [esi]
cmp eax, ebp
je 0x46c607
push dword [esp + 0x14]
push ebp
push ebp
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x46c5fe
mov dword [esp + 0xc], 1
jmp 0x46c607
push ebp
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x46c7ef
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5a0]
sub esp, 0x620
mov eax, dword [0x606c40]
xor eax, ebp
mov dword [ebp + 0x59c], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor ebx, ebx
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x78], ebx
call dword [0x5b14d8]
test eax, eax
je 0x46c865
cmp esi, ebx
je 0x46c865
push 0x5cba38
lea eax, [ebp - 0x70]
push edi
push eax
mov dword [ebp - 0x70], ebx
call fcn.0058138c
add esp, 0xc
test eax, eax
jne 0x46c93f
lea eax, [ebp - 0x74]
push eax
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], ebx
call fcn.0046c5a8
pop ecx
test eax, eax
jne 0x46c87f
push dword [ebp - 0x70]
call fcn.00581c11
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x59c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057d6ce
add ebp, 0x5a0
leave
ret
push 0x3ff
lea eax, [ebp - 0x6b]
push ebx
xor edi, edi
push eax
inc edi
mov byte [ebp - 0x6c], bl
call fcn.005847c0
push dword [ebp - 0x70]
mov esi, 0x400
push esi
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00581999
add esp, 0x1c
jmp 0x46c8d4
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call fcn.0046c610
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x46c8d8
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push esi
push 1
push eax
call fcn.00581999
add esp, 0x10
cmp eax, ebx
jne 0x46c8ac
xor eax, eax
push 0x206
mov word [ebp + 0x394], ax
lea eax, [ebp + 0x396]
push ebx
push eax
call fcn.005847c0
add esp, 0xc
cmp edi, ebx
je 0x46c929
push dword [ebp - 0x74]
lea edi, [ebp + 0x394]
call fcn.0046c635
pop ecx
test eax, eax
je 0x46c929
mov eax, edi
push eax
push 0x5c86e0
push 0x3f
push dword [ebp - 0x80]
call fcn.0057d72e
add esp, 0x10
mov dword [ebp - 0x78], 1
push dword [ebp - 0x74]
push dword [ebp - 0x7c]
call fcn.0046c6f9
push dword [ebp - 0x70]
call fcn.00581c11
add esp, 0xc
mov eax, dword [ebp - 0x78]
jmp 0x46c867
Function at 0x46d055
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005847c0
push 0x2454
push 0
push esi
call fcn.005847c0
lea eax, [esi + 8]
mov dword [ebp - 0x38], eax
lea eax, [esi + 0x2148]
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], eax
mov eax, 0x800
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x2348]
lea ecx, [esi + 0x1048]
mov dword [ebp - 0x20], eax
mov eax, 0x80
mov dword [ebp - 8], ecx
lea ecx, [esi + 0x2048]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
add esp, 0x18
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x28], 0x100
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x46d0d9
sub eax, ecx
lea ecx, [ebp - 0x3c]
push ecx
push dword [ebp + 0xc]
sar eax, 1
push eax
push dword [ebp + 8]
call dword [0x61e868]
test eax, eax
je 0x46d132
mov eax, dword [ebp - 0x30]
cmp eax, 3
je 0x46d10e
cmp eax, 4
je 0x46d10e
cmp eax, 1
jne 0x46d132
mov cx, word [ebp - 0x24]
and dword [esi + 0x2448], 0
and dword [esi + 0x244c], 0
or dword [esi + 0x2450], 0xffffffff
mov dword [esi + 4], eax
xor eax, eax
mov word [esi], cx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x46d136
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push edi
cmp dword [esi + 0xc], ebx
je 0x46d14b
xor eax, eax
jmp 0x46d1e3
mov edi, str.MetalinkFile
lea eax, [esi + 0x5d558]
push edi
push eax
call fcn.0057e0d8
pop ecx
pop ecx
cmp eax, ebx
je 0x46d18b
xor ecx, ecx
mov word [eax], cx
mov ecx, edi
lea edx, [ecx + 2]
mov di, word [ecx]
inc ecx
inc ecx
cmp di, bx
jne 0x46d16d
sub ecx, edx
sar ecx, 1
lea eax, [eax + ecx*2]
push eax
call fcn.00582025
pop ecx
mov dword [esi + 0x2698], eax
mov ecx, esi
call fcn.0047182b
test eax, eax
je 0x46d144
push ebx
push ebx
push 1
push ebx
call dword [0x5b1374]
mov dword [esi + 0x2464], eax
cmp eax, ebx
je 0x46d1e0
mov dword [ebp - 4], ebx
mov dword [esi + 0x5d120], 8
cmp dword [esi + 0x2480], ebx
jne 0x46d1da
lea eax, [ebp - 4]
push eax
push ebx
push esi
push fcn.0046d513
push ebx
push ebx
call fcn.0057e701
add esp, 0x18
mov dword [esi + 0xc], eax
jmp 0x46d1e0
push esi
call fcn.0046d513
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret
Function at 0x472fa3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x5cba38
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
call fcn.00581375
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 4], edi
cmp edi, ebx
je 0x47304b
push esi
push 2
push ebx
push edi
call fcn.00581469
push edi
call fcn.0058168b
push ebx
push ebx
push edi
mov esi, eax
call fcn.00581469
lea ebx, [esi + 1]
push ebx
call fcn.0057c3f0
mov edi, eax
add esp, 0x20
test edi, edi
je 0x473041
push ebx
push 0
push edi
call fcn.005847c0
push dword [ebp - 4]
push esi
push 1
push edi
call fcn.00581999
push 0x5cba40
push dword [ebp + 0xc]
call fcn.00581375
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x47303a
push ebx
push esi
xor esi, esi
inc esi
push esi
push edi
call fcn.00581b18
push ebx
call fcn.00581c11
add esp, 0x14
mov dword [ebp - 8], esi
push edi
call fcn.0057db06
pop ecx
push dword [ebp - 4]
call fcn.00581c11
pop ecx
pop esi
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret

Function at 0x4774a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x622cbc], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternationalScripts26
je 0x4774c9
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternational
lea ecx, [ebp - 4]
push ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x477502
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.AutoDetect
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret

Function at 0x477507
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x622cbc], 0
push edi
push 4
pop edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternationalScripts26
je 0x477531
mov eax, str.SoftwareMicrosoftInternet_ExplorerInternational
lea ecx, [ebp - 8]
push ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47758c
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov esi, str.AutoDetect
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 4], eax
sete al
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
leave
ret