joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406273
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406298
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x40628f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40630b
cmp dword [0x440a40], ebx
je 0x40630b
cmp byte [0x440640], bl
je 0x4062d7
cmp dword [0x40a8a0], 0xffffffff
jne 0x4062e0
push 4
push 0x40000000
push 0x440640
call fcn.00405c27
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40630b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40630b
push esi
mov esi, 0x444a60
push 0x40aae8
push esi
call fcn.00405f75
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f68
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4064bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44023c], esi
push edi
jne 0x4064f7
mov ecx, 0x440238
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4064d3
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440638
jl 0x4064ce
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40652c
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440238]
xor eax, esi
inc ecx
dec edx
jne 0x40650f
pop edi
pop esi
not eax
ret 0xc

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x431001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7f216118
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0xf6b13a5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4014b0
Capabilities:
Create thread
Get system information on windows

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x4014c8
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 0x10
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
lea ebx, [esi + 4]
push ebx
push 4
push esi
push 0x401640
push 0
push 0
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
call fcn.00420ae9
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
jne 0x401504
pop esi
pop ebx
add esp, 0x24
ret 0x10
push edi
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x55ac98
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor edx, edx
div dword [esp + 0x20]
mov eax, 1
mov ecx, edx
shl eax, cl
mov ecx, dword [esi + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x401626
push ebp
push 0x55ac80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x55ac68]
mov ebp, dword [esi + 8]
mov ebx, dword [ebx]
mov edi, dword [0x55ac60]
test ecx, ecx
jne 0x4015b8
mov edx, dword [0x55ac70]
push 0x18
push edx
push 0x55ac6c
call fcn.004fd3dd
mov ecx, dword [0x55ac70]
add eax, 4
lea edx, [ecx + ecx*2]
dec ecx
test ecx, ecx
lea eax, [eax + edx*8 - 0x18]
jl 0x4015f3
lea edx, [ecx + 1]
mov ecx, dword [0x55ac68]
mov dword [eax], ecx
mov ecx, eax
sub eax, 0x18
dec edx
jne 0x4015a8
mov dword [0x55ac68], ecx
mov eax, dword [ecx]
xor edx, edx
mov dword [0x55ac68], eax
mov dword [ecx + 4], edi
mov dword [ecx], 0
mov eax, dword [0x55ac64]
inc eax
mov dword [0x55ac64], eax
lea eax, [ecx + 8]
mov edi, eax
mov dword [edi], edx
mov dword [edi + 4], edx
mov dword [edi + 8], edx
mov dword [edi + 0xc], edx
mov edx, dword [0x55ac60]
test edx, edx
je 0x4015fb
mov dword [edx], ecx
jmp 0x401601
mov ecx, dword [0x55ac68]
jmp 0x4015b8
mov dword [0x55ac5c], ecx
mov edx, dword [esp + 0x3c]
mov dword [0x55ac60], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax], ebp
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
push 0x55ac80
mov dword [eax + 0xc], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
mov ecx, esi
mov dword [esi + 0xc], 1
call fcn.00455270
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
Function at 0x402380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x511868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [esp + 0x40]
push esi
push edi
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0xc], 0x5451d0
mov dword [esp + 0x10], 0x5451cc
mov dword [esp + 0x14], 0x5451c8
mov dword [esp + 0x18], 0x5451c4
mov dword [esp + 0x1c], 0x5451c0
mov dword [esp + 0x20], 0x5451bc
mov dword [esp + 0x24], 0x5451b8
mov dword [esp + 0x28], 0x5451b4
mov dword [esp + 0x2c], 0x5451b0
mov dword [esp + 0x30], 0x5451ac
mov dword [esp + 0x34], 0x5451a8
mov dword [esp + 0x38], 0x5451a4
call fcn.00433c10
xor edi, edi
lea esi, [esp + 8]
mov eax, dword [esi]
mov ecx, dword [esp + 0x48]
push eax
push ecx
call fcn.00420d30
add esp, 8
test eax, eax
je 0x402450
inc edi
add esi, 4
cmp edi, 0xc
jl 0x40240e
lea ecx, [esp + 0x48]
mov dword [esp + 0x40], 0xffffffff
call fcn.004345c0
pop edi
xor ax, ax
pop esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
lea ecx, [esp + 0x48]
lea esi, [edi + 1]
mov dword [esp + 0x40], 0xffffffff
call fcn.004345c0
mov ecx, dword [esp + 0x38]
mov ax, si
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret

Function at 0x4033b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x511a73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x51f068]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebx, [esi + 0xc]
mov dword [ebx], eax
mov ecx, dword [0x51f068]
lea ebp, [esi + 0x10]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebp], ecx
mov edx, dword [0x51f068]
mov dword [esi + 0x14], edx
mov eax, dword [0x51f068]
mov dword [esi + 0x18], eax
mov eax, 0x51bb04
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
lea ecx, [esi + 0x44]
mov byte [esp + 0x1c], 5
call fcn.004fd7c3
mov ecx, dword [0x51f068]
mov dword [esi + 0x5c], ecx
lea ecx, [esi + 0x64]
mov byte [esp + 0x1c], 7
call fcn.004fd7c3
push 0x55ac9c
mov ecx, ebx
mov byte [esp + 0x20], 8
mov dword [esi], 0x51bb00
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.00434880
push 0x55ac9c
mov ecx, ebp
call fcn.00434880
push 0x55ac9c
lea ecx, [esi + 0x14]
call fcn.00434880
push 0x55ac9c
lea ecx, [esi + 0x18]
call fcn.00434880
or edi, 0xffffffff
push 0x55ac9c
lea ecx, [esi + 0x5c]
mov dword [esi + 0x58], edi
call fcn.00434880
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x60], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4034e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x511ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x51bb00
lea ecx, [esi + 0x64]
mov dword [esp + 0x20], 7
call fcn.004fd7f6
lea ecx, [esi + 0x5c]
mov byte [esp + 0x20], 6
call fcn.004345c0
lea ecx, [esi + 0x44]
mov byte [esp + 0x20], 5
call fcn.004fd7f6
lea edi, [esi + 0x30]
mov dword [esp + 0x14], edi
mov dword [edi], method.CCommandLineInfo.virtual_0
mov eax, dword [edi + 4]
mov byte [esp + 0x20], 8
test eax, eax
je 0x403573
mov ecx, dword [edi + 8]
mov ebx, eax
mov eax, ecx
dec ecx
test eax, eax
je 0x403567
lea ebp, [ecx + 1]
mov ecx, ebx
call fcn.004345c0
add ebx, 4
dec ebp
jne 0x40355a
mov edi, dword [edi + 4]
push edi
call fcn.004fed6b
add esp, 4
lea edi, [esi + 0x1c]
mov dword [esp + 0x14], edi
mov dword [edi], method.CCommandLineInfo.virtual_0
mov ebx, dword [edi + 4]
mov byte [esp + 0x20], 9
test ebx, ebx
je 0x4035b2
mov eax, dword [edi + 8]
mov ecx, eax
dec eax
test ecx, ecx
je 0x4035a6
lea ebp, [eax + 1]
mov ecx, ebx
call fcn.004345c0
add ebx, 4
dec ebp
jne 0x403599
mov edi, dword [edi + 4]
push edi
call fcn.004fed6b
add esp, 4
lea ecx, [esi + 0x18]
mov byte [esp + 0x20], 2
call fcn.004345c0
lea ecx, [esi + 0x14]
mov byte [esp + 0x20], 1
call fcn.004345c0
lea ecx, [esi + 0x10]
mov byte [esp + 0x20], 0
call fcn.004345c0
lea ecx, [esi + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.004345c0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x404070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x511c50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, ecx
push edi
push 0x55ac9c
lea ecx, [esp + 0x28]
mov dword [ebx], 0
call fcn.00433c10
lea edi, [esi + 0xc]
push 0x2f
mov ecx, edi
mov dword [esp + 0x20], 0
call fcn.004357a0
test eax, eax
jge 0x4040c9
push edi
lea ecx, [esp + 0x28]
call fcn.00434760
jmp 0x4040f4
inc eax
mov ecx, edi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004368d0
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 1
call fcn.00434760
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call fcn.004345c0
push 0x2e
lea ecx, [esp + 0x28]
call fcn.004356f0
test eax, eax
jge 0x404140
lea ecx, [esp + 0x24]
mov dword [ebx], 1
push ecx
lea ecx, [esi + 0x10]
call fcn.00434760
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004345c0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004345c0
mov ecx, dword [esi + 4]
mov edi, dword [edi]
lea edx, [esp + 0x10]
push edx
call fcn.00405d90
mov eax, dword [eax]
push edi
push eax
lea eax, [esp + 0x14]
mov ebx, 2
push eax
mov dword [esp + 0x28], ebx
call fcn.00401c90
add esp, 0xc
lea edi, [esi + 0x5c]
push eax
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.00434760
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call fcn.004345c0
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004345c0
mov edi, dword [edi]
mov eax, dword [edi - 8]
test eax, eax
jne 0x4041d3
push str.400_Bad_Request
mov ecx, esi
call fcn.00404420
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404127
push str.404_Not_Found
mov ecx, esi
call fcn.00404420
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x4042c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x511c68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.004fd7c3
mov esi, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.004fd823
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x10]
not ecx
dec ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [ebx + 0x64]
call fcn.004fd91a
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004fd7f6
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x404500
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x511cd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
push 0x2e
lea edi, [esi + 0x5c]
mov ecx, edi
call fcn.004357a0
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.004368d0
mov ecx, dword [esp + 0xc]
xor ebx, ebx
push 0x5453d0
push ecx
mov dword [esp + 0x2c], ebx
call fcn.00420d30
add esp, 8
cmp eax, ebx
jne 0x404568
push str.text_javascript
push str.Content_type
mov ecx, esi
call fcn.004044c0
jmp 0x404655
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
push eax
push SysReAllocStringLen
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404655
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
push ecx
push ebx
push ebx
push ebx
push str.Content_Type
push edx
call edi
test eax, eax
je 0x4045c1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404655
mov ecx, dword [0x51f068]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call fcn.00435260
mov ecx, dword [esp + 0x14]
push eax
push ebx
push ebx
push str.Content_Type
push ecx
call edi
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.00435340
cmp edi, ebx
je 0x40460a
mov edx, dword [esp + 0x10]
push edx
jmp 0x404642
mov eax, dword [esp + 0x14]
mov ecx, esi
push eax
push str.Content_type
call fcn.004044c0
push str.no_cache__must_revalidate
push str.Cache_control
mov ecx, esi
call fcn.004044c0
push str.no_cache
push str.Pramga
mov ecx, esi
call fcn.004044c0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], bl
call fcn.004345c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004345c0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x404680
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x511cf0
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
push 0
mov esi, ecx
push 0x8000080
push 3
mov eax, dword [esi + 0x5c]
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x60], eax
jne 0x4046df
push str.503_Service_Unavailable
mov ecx, esi
call fcn.00404420
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
lea eax, [esp + 8]
push str.If_Modified_Since
push eax
mov ecx, esi
call fcn.00403a70
mov ecx, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [esp + 0x28], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x404784
mov eax, dword [esi + 0x60]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push eax
call edi
test eax, eax
je 0x404784
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
call fcn.00402480
add esp, 0xc
test eax, eax
jne 0x404784
push str.304_Not_Modified
mov ecx, esi
call fcn.00404360
push 0x545268
mov ecx, esi
call fcn.004042c0
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 8]
mov dword [esi + 0x60], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
call fcn.004345c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
push str.200_OK
mov ecx, esi
call fcn.00404360
mov ecx, esi
call fcn.00404500
mov edx, dword [esi + 0x60]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push str.Content_length
mov ecx, esi
call fcn.00404440
mov ecx, dword [esi + 0x60]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push ecx
call edi
test eax, eax
je 0x4047f7
lea edx, [esp + 0x18]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.00401d60
add esp, 8
mov eax, dword [eax]
mov ecx, esi
push eax
push str.Last_Modified
mov byte [esp + 0x30], 1
call fcn.004044c0
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.004345c0
push str.no_cache__must_revalidate
push str.Cache_control
mov ecx, esi
call fcn.004044c0
push str.no_cache
push str.Pramga
mov ecx, esi
call fcn.004044c0
push 0x545268
mov ecx, esi
call fcn.004042c0
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.004345c0
mov ecx, dword [esp + 0x20]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x404850
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x511d08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [esp + 8]
call fcn.004fd7c3
push 0xffffffffffffffff
push 0x400
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.004fd823
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push 0
push eax
mov eax, dword [esi + 0x60]
push ecx
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
test eax, eax
ja 0x4048ca
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], 0xffffffff
jmp 0x4048e3
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x10]
call fcn.004fd823
lea edx, [esp + 8]
lea ecx, [esi + 0x64]
push edx
call fcn.004fd91a
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.004fd7f6
mov ecx, dword [esp + 0x1c]
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x405880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x511e87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x51f068]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebp, [esi + 8]
mov dword [ebp], eax
mov ecx, dword [0x51f068]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
mov byte [esp + 0x1c], 1
call fcn.00402510
mov dword [esi + 0x1c], 0x51bb60
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0xa
lea edi, [esi + 0x38]
push ebx
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.0041c100
mov dword [edi], 0x51ba9c
add edi, 8
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x55ac9c
mov ecx, ebp
mov byte [esp + 0x20], 4
mov dword [esi], 0x51bb5c
mov dword [esi + 4], 0x50
call fcn.00434880
push str.index.html
lea ecx, [esi + 0xc]
call fcn.00434880
push esi
lea ecx, [esi + 0x10]
call fcn.00402560
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x405a40
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call sub.WSOCK32.dll_WSAStartup
neg eax
sbb eax, eax
inc eax
add esp, 0x190
ret
Function at 0x40c5e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x512a4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x51f06c]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
xor edx, edx
xor eax, eax
mov dl, byte [ecx + 0xf]
mov al, byte [ecx + 0xe]
push edx
push eax
xor edx, edx
xor eax, eax
mov dl, byte [ecx + 0xd]
mov al, byte [ecx + 0xc]
push edx
push eax
xor edx, edx
xor eax, eax
mov dl, byte [ecx + 0xb]
mov al, byte [ecx + 0xa]
push edx
push eax
xor edx, edx
xor eax, eax
mov dl, byte [ecx + 9]
mov al, byte [ecx + 8]
push edx
push eax
xor edx, edx
xor eax, eax
mov dx, word [ecx + 6]
mov ax, word [ecx + 4]
mov ecx, dword [ecx]
push edx
mov edx, dword [esp + 0x44]
push eax
push ecx
lea eax, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x48], 1
call fcn.0043cd60
mov esi, dword [esp + 0x50]
add esp, 0x34
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.004392d0
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.00439d50
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x40c6a0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
push 0x546420
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
call fcn.004210fe
lea ecx, [esp + 0xc]
push 0x5463dc
push ecx
call fcn.004210d4
add esp, 0x10
lea edx, [esp + 4]
push edx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
pop edi
jne 0x40c70c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 5
sete cl
mov eax, ecx
add esp, 0x208
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x208
ret

Function at 0x40cdd0
Capabilities:
Access the windows event log

Disassembly:
push esi
call fcn.0040c8d0
test eax, eax
je 0x40ce29
call fcn.0040c8d0
mov eax, dword [eax + 4]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x40ce29
lea eax, [esp + 0xc]
push 0
push eax
push 0
push 1
call fcn.0040c8c0
mov ecx, eax
add ecx, 0xc8
call fcn.004491d0
mov ecx, dword [esp + 0x18]
push eax
push 0xc0000000
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
ret