joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c20
Capabilities:
Check http status code

Disassembly:
push 0xffffffffffffffff
push 0x50c880
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov edi, ecx
xor ebx, ebx
cmp ebp, ebx
je 0x425cc5
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], vtable.t_mutex::t_locker.0
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x38], 1
call fcn.00440620
test al, al
je 0x425c97
mov esi, dword [edi + 0x224]
mov dword [esp + 0x24], edi
cmp esi, ebx
jne 0x425cc9
mov byte [esp + 0x34], bl
call fcn.00440760
jmp 0x425cb4
lea ecx, [esp + 0x18]
call fcn.00439450
push str.m_ProcOpenFilemapmutex
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.004393f0
xor al, al
jmp 0x425d32
mov edx, dword [esi + 0x24]
cmp edx, ebx
jne 0x425cdf
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], bl
call fcn.00440310
jmp 0x425cb4
xor eax, eax
cmp edx, ebx
jle 0x425d16
lea ecx, [esi + 0x38]
cmp eax, 0xc8
jge 0x425d16
cmp dword [ecx - 4], ebp
jne 0x425cf8
cmp byte [ecx], bl
je 0x425d02
inc eax
add ecx, 0x10
cmp eax, edx
jl 0x425ce8
jmp 0x425d16
add eax, 4
shl eax, 4
push 0x13
mov byte [eax + esi], 1
call fcn.00444910
add esp, 4
mov byte [esp + 0x34], bl
call fcn.00440760
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.004393f0
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4

Function at 0x426850
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
push 0
push 4
mov esi, ecx
push esi
push 0x426820
push 0
push 0
call fcn.004d0cd7
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4268b7
cmp dword [esi + 0x14], 0
je 0x4268b0
mov eax, dword [esi + 0x14]
mov edx, dword [esi]
push ebx
mov ebx, dword [eax]
mov eax, dword [edx + 0xc]
push edi
mov ecx, esi
call eax
mov ecx, dword [esi + 0x14]
mov edx, dword [ebx + 0x14]
push eax
call edx
pop ebx
test al, al
je 0x4268b0
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
ret
Function at 0x428ab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x1fe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004d3fc0
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SoftWareSogouInput
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x428b21
xor al, al
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004ccee1
add esp, 0x210
ret
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x428b09
lea eax, [esp + 0x10]
mov edx, edi
call fcn.0043a2e0
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov al, 1
call fcn.004ccee1
add esp, 0x210
ret

Function at 0x429a90
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x50b92e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], vtable.ITaskCallback.0
mov dword [esi], vtable.CQQCycloneWrap.0
mov dword [esi + 0x24], vtable.CQQCycloneWrap.1.0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov edx, fcn.004ccfcd
mov ecx, fcn.004cf168
mov eax, fcn.004ccef0
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], eax
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ecx
lea ecx, [esi + 0x64]
push ecx
mov dword [esi + 0x58], edx
mov dword [esi + 0x60], eax
call edi
lea edx, [esi + 0x7c]
push edx
call edi
lea edi, [esi + 0x94]
mov byte [edi + 4], bl
mov dword [edi + 8], ebx
call fcn.004299b0
mov dword [esi + 0xa0], ebx
mov byte [esi + 0xa4], bl
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb0], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x429d30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x50b8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 1
lea eax, [esi + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor ecx, ecx
push ebx
mov word [esp + 0x18], cx
mov edi, 7
push 0x5213e4
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0xfffff830
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
call fcn.0042ae00
mov dword [esp + 0x9c], ebx
push ebx
xor edx, edx
push 0x5213e4
lea ecx, [esp + 0x34]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], dx
call fcn.0042ae00
mov byte [esp + 0x9c], 1
push ebx
mov edi, 0xf
push 0x5240cc
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00408ed0
mov byte [esp + 0x9c], 2
push ebx
push 0x5240cc
lea ecx, [esp + 0x6c]
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
call fcn.00408ed0
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ebx
lea edi, [esi + 0x64]
push edi
mov dword [esp + 0xa0], 3
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0xc]
push eax
lea eax, [esi + 0x2c]
call fcn.0042ab60
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [esi + 0x98], bl
je 0x429e7c
mov ecx, dword [esi + 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0xa0], 0xffffffff
call fcn.00429ec0
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.004ccee1
add esp, 0x94
ret
Function at 0x42e870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x50e76d
mov eax, dword fs:[0]
push eax
sub esp, 0xec
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0xfc]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x10c]
lea eax, [esp + 0x14]
push eax
call fcn.0042e1d0
mov dword [esp + 0x104], 0
cmp dword [esi + 4], 0
je 0x42e954
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x42e8d3
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42e954
shr eax, 4
not al
and al, 1
je 0x42e954
cmp byte [esi + 0x11c], 0
je 0x42e8f9
add esi, 0xc
jmp 0x42e8fc
mov esi, dword [esi + 8]
add esi, 4
push esi
lea edi, [esp + 0x18]
call fcn.0043d2b0
test al, al
jne 0x42e91b
mov ecx, ebp
call fcn.00439450
push 0x528170
jmp 0x42e960
lea ecx, [esp + 0x14]
call fcn.0042e260
test al, al
jne 0x42e93b
push 0x52818c
mov ecx, ebp
call fcn.00402960
lea edx, [esp + 0x14]
push edx
jmp 0x42e974
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x108], 0xffffffff
call fcn.0042e9b0
mov al, 1
jmp 0x42e986
mov ecx, ebp
call fcn.00439450
push 0x528154
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x108], 0xffffffff
call fcn.0042e9b0
xor al, al
mov ecx, dword [esp + 0xfc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xf8
ret 4

Function at 0x42ec00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509968
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.item
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004ccfcd
mov dword [eax + 0x24], fcn.004cf168
mov dword [eax + 0x28], fcn.004ccef0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_PicFaceConfigFile::t_item_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x430090
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x50e73d
mov eax, dword fs:[0]
push eax
sub esp, 0xec
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0xfc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x14]
push eax
call fcn.0042fbd0
mov dword [esp + 0x104], 0
or ebp, 0xffffffff
cmp dword [esi + 4], 0
je 0x430189
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4300ef
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebp
je 0x430189
shr eax, 4
not al
and al, 1
je 0x430189
cmp byte [esi + 0x11c], 0
je 0x430118
add esi, 0xc
jmp 0x43011b
mov esi, dword [esi + 8]
add esi, 4
push esi
lea edi, [esp + 0x18]
call fcn.0043d2b0
test al, al
jne 0x43014c
mov ecx, ebx
call fcn.00439450
push 0x5284b0
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
mov ecx, edi
push ecx
jmp 0x4301a9
mov ecx, dword [esp + 0x10c]
lea edx, [esp + 0x14]
push edx
call fcn.0042fcd0
test al, al
jne 0x430174
push 0x5284d0
mov ecx, ebx
call fcn.00402960
lea eax, [esp + 0x14]
push eax
jmp 0x4301a9
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x108], ebp
call fcn.004301e0
mov al, 1
jmp 0x4301b7
mov ecx, ebx
call fcn.00439450
push 0x528490
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x108], ebp
call fcn.004301e0
xor al, al
mov ecx, dword [esp + 0xfc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xf8
ret 4

Function at 0x4302f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509968
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.qpng
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004ccfcd
mov dword [eax + 0x24], fcn.004cf168
mov dword [eax + 0x28], fcn.004ccef0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configQQMapItemListFile::t_recommend_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x4311f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509968
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], 0x528580
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004ccfcd
mov dword [eax + 0x24], fcn.004cf168
mov dword [eax + 0x28], fcn.004ccef0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configTipListFile::t_recommend_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x431c50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5095a9
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push fcn.004091e0
push 0x431c10
push 0xc8
push 0x10
lea eax, [esi + 0x34]
push eax
call fcn.004d1448
push fcn.004091e0
push 0x431c30
push 0x7d0
push 0xc
lea ecx, [esi + 0xcb8]
xor edi, edi
push ecx
mov dword [esp + 0x28], edi
call fcn.004d1448
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0xcb4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x6a78], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x431fb0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x431fc8
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi + 4], 0
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x43201b
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov edi, eax
call fcn.00439450
mov esi, eax
call fcn.00439ca0
mov ecx, ebx
call fcn.00439450
push 0x5287c4
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
pop edi
xor al, al
pop esi
ret 4
mov al, 1
pop esi
ret 4
Function at 0x432030
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
mov edi, eax
mov dword [esi], 0x4e20
jne 0x43206c
mov ecx, dword [esp + 0x10]
call fcn.00439450
push 0x5223e8
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
pop edi
pop esi
xor al, al
pop ebp
ret 0x1c
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x43208a
push eax
call ebx
mov ecx, dword [esp + 0x18]
mov dword [ecx], 0
mov eax, dword [edi]
test eax, eax
je 0x432099
push eax
call ebx
mov dword [edi], 0
movzx ecx, word [esi + 0x208]
or ebp, 0x84480100
cmp byte [esp + 0x28], 0
movzx eax, cx
je 0x4320b9
movzx eax, cx
or ebp, 0x803000
mov edx, dword [esp + 0x1c]
push 0
push 0
push 3
push 0x5213e4
push 0x5213e4
push eax
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
test eax, eax
jne 0x43210a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x14]
mov ecx, ebx
mov edi, eax
call fcn.00439450
mov esi, eax
call fcn.00439ca0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
call fcn.00439450
jmp 0x432154
mov ebx, dword [esp + 0x14]
mov eax, edi
mov ecx, ebx
call fcn.004321a0
test al, al
jne 0x432129
mov ecx, ebx
call fcn.00439450
push 0x5287d8
jmp 0x432159
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [edi]
push 0
push ebp
push 0
push 0
push 0
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
jne 0x432171
call fcn.00439c70
push 0x5287c4
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret 0x1c
mov eax, ecx
mov ecx, ebx
call fcn.004321a0
test al, al
jne 0x432193
push 0x5287d8
mov ecx, ebx
call fcn.00402960
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret 0x1c
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
ret 0x1c
Function at 0x432720
Capabilities:
Send data

Disassembly:
push 0xffffffffffffffff
push 0x50a978
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
push 8
mov dword [esp + 0x40], ebx
call fcn.004cf589
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x432773
push ebx
call fcn.004d0409
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], edx
mov ebx, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0
test edi, edi
jbe 0x4327ce
mov esi, dword [sym.imp.WININET.dll_InternetWriteFile]
lea esp, [esp]
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x3c]
push eax
push edi
push ebp
push ecx
call esi
test eax, eax
je 0x4327f7
push 0
call fcn.004d0409
sub eax, dword [ebx]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x34]
imul eax, eax, 0x3e8
add esp, 4
cmp eax, dword [edx]
ja 0x432846
mov eax, dword [esp + 0x3c]
add ebp, eax
sub edi, eax
jne 0x432790
push ebx
mov dword [esp + 0x2c], 0xffffffff
call fcn.004cf512
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x34]
mov ecx, ebp
mov edi, eax
call fcn.00439450
mov esi, eax
call fcn.00439ca0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebp
call fcn.00439450
push 0x528824
push 0x52139c
mov edx, eax
call fcn.0043a8a0
push ebx
mov dword [esp + 0x34], 0xffffffff
call fcn.004cf512
add esp, 0xc
xor al, al
jmp 0x4327e1
mov ecx, dword [esp + 0x34]
call fcn.00439450
push 0x528838
push 0x52139c
mov edx, eax
call fcn.0043a8a0
push ebx
mov dword [esp + 0x34], 0xffffffff
call fcn.004cf512
add esp, 0xc
xor al, al
jmp 0x4327e1
Function at 0x432880
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x50a978
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov esi, dword [eax]
xor ebx, ebx
push 8
mov dword [esp + 0x40], ebx
call fcn.004cf589
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4328d7
push ebx
call fcn.004d0409
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], edx
mov ebx, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0
test esi, esi
jle 0x432934
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [ecx]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
push ecx
push esi
push ebp
push edx
call edi
test eax, eax
je 0x432963
push 0
call fcn.004d0409
sub eax, dword [ebx]
mov ecx, dword [esp + 0x34]
imul eax, eax, 0x3e8
add esp, 4
mov dword [esp + 0x1c], edx
cmp eax, dword [ecx]
ja 0x4329b2
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x432934
sub esi, eax
add ebp, eax
test esi, esi
jg 0x4328f0
mov eax, dword [esp + 0x40]
sub dword [eax], esi
push ebx
mov dword [esp + 0x2c], 0xffffffff
call fcn.004cf512
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x34]
mov ecx, ebp
mov edi, eax
call fcn.00439450
mov esi, eax
call fcn.00439ca0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebp
call fcn.00439450
push 0x528850
push 0x52139c
mov edx, eax
call fcn.0043a8a0
push ebx
mov dword [esp + 0x34], 0xffffffff
call fcn.004cf512
add esp, 0xc
xor al, al
jmp 0x43294d
mov ecx, dword [esp + 0x34]
call fcn.00439450
push 0x528864
push 0x52139c
mov edx, eax
call fcn.0043a8a0
push ebx
mov dword [esp + 0x34], 0xffffffff
call fcn.004cf512
add esp, 0xc
xor al, al
jmp 0x43294d
Function at 0x433a50
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x50d5ad
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
fld dword [0x52f28c]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x804]
fld dword [0x52f288]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], fcn.004ccfcd
fld dword [0x52f284]
mov dword [esp + 0x1c], fcn.004cf168
fstp dword [esp]
mov dword [esp + 0x20], fcn.004ccef0
call fcn.004078c0
mov dword [esp + 0x20], 0
fld dword [0x52f28c]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x840]
fld dword [0x52f288]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], fcn.004ccfcd
fld dword [0x52f284]
mov dword [esp + 0x1c], fcn.004cf168
fstp dword [esp]
mov dword [esp + 0x20], fcn.004ccef0
call fcn.004078c0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push ecx
mov dword [edi + 0x890], eax
mov eax, dword [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x48]
mov ecx, edi
mov dword [edi + 0x88c], 0
call fcn.004339e0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18
Function at 0x436cc0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x50c6db
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x5405a0]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5405a0]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov edi, dword [esp + 0x158]
mov eax, dword [edi + 4]
mov ebp, dword [esp + 0x154]
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
cmp eax, esi
jbe 0x436d46
lea ebx, [ebx]
mov eax, esi
and eax, 1
mov ecx, edi
lea ebx, [esp + eax*2 + 0x14]
call fcn.00437460
movzx ecx, word [eax + esi*2]
push ecx
call fcn.004d1a02
xor word [ebx], ax
inc esi
add esp, 4
cmp esi, dword [edi + 4]
jb 0x436d20
lea ecx, [esp + 0x1c]
call fcn.0043a090
push 0x528ff4
push 0x52139c
lea edx, [esp + 0x24]
mov dword [esp + 0x154], 0
call fcn.0043a8a0
push str.mutex_file_
push 0x52139c
lea edx, [esp + 0x2c]
call fcn.0043a8a0
mov edx, dword [esp + 0x24]
push edx
push str.0x_08x
lea edx, [esp + 0x34]
call fcn.0043a8a0
add esp, 0x18
cmp byte [esp + 0x138], 0
lea eax, [esp + 0x28]
jne 0x436da8
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
add eax, 4
push eax
push ebp
call fcn.00440410
test al, al
jne 0x436e00
mov ecx, ebp
call fcn.00439450
push 0x52901c
push 0x52139c
mov edx, eax
call fcn.0043a8a0
add esp, 8
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], vtable.t_str.0
jne 0x436dfc
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x436dfc
push eax
call fcn.004ccef0
add esp, 4
xor al, al
jmp 0x436e29
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], vtable.t_str.0
jne 0x436e27
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
cmp eax, edx
je 0x436e27
push eax
call fcn.004ccef0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004ccee1
add esp, 0x13c
ret 8

Function at 0x4376d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x4376df
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4376f1
xor al, al
ret
shr eax, 4
not eax
and eax, 1
ret