joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c830
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41c858
call fcn.0041c620
mov eax, dword [esi + 0x18]
test eax, eax
je case.default.0x41c919
mov ebx, dword [ebp + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], 0
rep stosd dword es:[edi], eax
test ebx, ebx
stosw word es:[edi], ax
jne 0x41c87d
xor edi, edi
jmp 0x41c8ad
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call sub.ntdll.dll__alloca_probe
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 8]
push edi
push 0x46bdac
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snwprintf]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
push 0x46bd80
call edi
push ebx
mov ecx, esi
call fcn.0041cc50
test eax, eax
je case.default.0x41c919
push ebx
mov ecx, esi
call fcn.0041cae0
test eax, eax
je case.default.0x41c919
push ebx
call fcn.0041e770
mov ecx, eax
call fcn.0041eb60
test eax, eax
jne case.default.0x41c919
mov ecx, dword [ebp + 0xc]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x41c919
jmp dword [eax*4 + 0x41ca3c]
lea edx, [ebp - 4]
push 0
push edx
push 0
lea eax, [ebp - 0x210]
push 0
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x210]
push ecx
push edx
push 0x222000
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41ca20
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 4]
push 0
push ecx
push 0
lea edx, [ebp - 0x210]
push 0
push edx
call dword [sym.imp.ntdll.dll_wcslen]
mov edx, dword [esi + 0x1c]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x210]
push eax
push ecx
push 0x222004
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41ca20
xor eax, eax
lea esp, [ebp - 0x21c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
push 0
push eax
push 0
lea ecx, [ebp - 0x210]
push 0
push ecx
call dword [sym.imp.ntdll.dll_wcslen]
mov ecx, dword [esi + 0x1c]
add esp, 4
lea edx, [eax + eax + 2]
lea eax, [ebp - 0x210]
push edx
push eax
push 0x222008
push ecx
jmp 0x41c99b
lea edx, [ebp - 4]
push 0
push edx
push 0
lea eax, [ebp - 0x210]
push 0
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x210]
push ecx
push edx
push 0x22200c
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je case.default.0x41c919
push 0x46bd58
call edi
lea esp, [ebp - 0x21c]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41cae0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov esi, ecx
je 0x41cbae
mov dx, word [eax + 1]
xor ecx, ecx
mov word [esp + 0x35], cx
mov word [esp + 0x34], dx
lea edx, [esp + 0x34]
mov byte [esp + 0x37], cl
mov ecx, 0x46be6c
mov dx, word [edx]
cmp dx, word [ecx]
jne 0x41cbae
mov ax, word [eax]
mov ecx, dword [0x44a330]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebp, dword [sym.imp.ntdll.dll__stricmp]
xor edx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], edx
mov word [esp + 0x34], ax
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], edx
mov al, bl
lea ecx, [esp + 0x20]
add al, 0x41
push ecx
mov ecx, esi
mov byte [esp + 0x24], al
call fcn.0041cbd0
test eax, eax
je 0x41cba8
xor edx, edx
mov ax, word [esp + 0x20]
mov dword [esp + 0x11], edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x15], edx
push ecx
mov dword [esp + 0x1d], edx
mov word [esp + 0x14], ax
mov word [esp + 0x21], dx
mov byte [esp + 0x23], dl
call edi
cmp eax, 3
jne 0x41cba8
lea edx, [esp + 0x34]
lea eax, [esp + 0x10]
push edx
push eax
call ebp
add esp, 8
test eax, eax
je 0x41cbba
inc ebx
cmp ebx, 0x1a
jl 0x41cb50
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret 4

Function at 0x41cbd0
Capabilities:
Get disk information
Print debug messages

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x41cc1b
push 0x46be70
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret 4
mov edx, dword [esp + 0x114]
lea eax, [esp + 0xc]
cmp byte [eax], 0
je 0x41cc0d
mov ecx, 3
mov edi, eax
mov esi, edx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x41cc3f
add eax, 4
jmp 0x41cc26
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret 4

Function at 0x41cc50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x140
push esi
mov esi, dword [esp + 0x148]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x41cc73
pop esi
add esp, 0x140
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41cca7
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x41cc9c
xor eax, eax
pop esi
add esp, 0x140
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 4]
not al
and eax, 0xff
pop esi
shr eax, 4
and eax, 1
add esp, 0x140
ret 4
Function at 0x41ce60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41ce95
call fcn.0041c620
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41ce95
xor eax, eax
lea esp, [ebp - 0x430]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x46c0d0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.ntdll.dll__strupr]
push eax
call edi
mov ebx, dword [ebp + 0x10]
push ebx
call edi
add esp, 8
test ebx, ebx
jne 0x41cebd
xor edi, edi
jmp 0x41ceed
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call sub.ntdll.dll__alloca_probe
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 8]
push edi
push 0x46bf58
lea ecx, [ebp - 0x424]
push 0x104
push ecx
call dword [sym.imp.ntdll.dll__snwprintf]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add esp, 0x10
lea edx, [ebp - 0x21c]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0041ccc0
test eax, eax
jne 0x41cf31
lea esp, [ebp - 0x430]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x424]
push 0
push ecx
mov ecx, dword [esi + 0x1c]
lea edx, [ebp - 4]
mov dword [ebp - 0xc], eax
push 4
push edx
lea eax, [ebp - 0x10]
push 8
push eax
push 0x222020
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41cf77
lea esp, [ebp - 0x430]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x46c098
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
lea esp, [ebp - 0x430]
xor eax, eax
test ecx, ecx
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41cfa0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x210
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41cfca
call fcn.0041c620
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41cfca
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push 0x46be44
call ebx
mov edi, dword [esp + 0x224]
push edi
call dword [sym.imp.ntdll.dll__strupr]
mov ecx, dword [esp + 0x224]
add esp, 4
lea eax, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.0041ccc0
test eax, eax
pop edi
jne 0x41d00e
pop esi
pop ebx
add esp, 0x210
ret 8
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
lea eax, [eax + eax + 2]
push 0
push ecx
mov ecx, dword [esi + 0x1c]
push 4
push edx
push eax
lea eax, [esp + 0x24]
push eax
push 0x22201c
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41d052
pop esi
pop ebx
add esp, 0x210
ret 8
push 0x46be1c
call ebx
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
pop esi
pop ebx
sete al
add esp, 0x210
ret 8
Function at 0x41d070
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x20c
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41d09a
call fcn.0041c620
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41d09a
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret 8
mov edi, dword [esp + 0x21c]
push edi
call dword [sym.imp.ntdll.dll__strupr]
mov ecx, dword [esp + 0x21c]
add esp, 4
lea eax, [esp + 0xc]
push eax
push edi
push ecx
mov ecx, esi
call fcn.0041ccc0
test eax, eax
jne 0x41d0cf
pop edi
pop esi
add esp, 0x20c
ret 8
mov ecx, dword [esi + 0x24]
inc ecx
mov eax, ecx
mov dword [esi + 0x24], ecx
cmp eax, 0x64
jl 0x41d0ea
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x46c140
call edi
lea edx, [esp + 8]
push 0
push edx
push 0
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x222010
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x41d138
pop edi
pop esi
add esp, 0x20c
ret 8
push 0x46c108
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret 8

Function at 0x41d150
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
lea eax, [esp + 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x46bf0c
push connect
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41d242
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push ebx
mov ebx, dword [sym.imp.ntdll.dll__snprintf]
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push edi
xor edi, edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x41d228
call fcn.00415c00
test eax, eax
je 0x41d1dd
lea eax, [esp + 0x18]
push 0x46c188
push eax
call esi
test eax, eax
jne 0x41d1da
lea ecx, [esp + 0x18]
push 0x46c178
push ecx
call esi
test eax, eax
je 0x41d1f0
inc edi
jmp 0x41d197
lea edx, [esp + 0x18]
push 0x46bee0
push edx
call esi
test eax, eax
je 0x41d1f0
inc edi
jmp 0x41d197
lea eax, [esp + 0x18]
lea ecx, [esp + 0x11c]
push eax
push 0x46be90
push 0x104
push ecx
call ebx
add esp, 0x10
lea edx, [esp + 0x11c]
push edx
push connect
call ebp
test eax, eax
jne 0x41d1da
inc dword [esp + 0x10]
jmp 0x41d197
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x210
ret
mov eax, esi
pop esi
add esp, 0x210
ret
Function at 0x41d460
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x4406ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x442014
xor ebp, ebp
mov dword [esp + 0x1c], ebp
call fcn.0041d690
mov eax, dword [esi + 0x14]
mov edi, dword [eax]
cmp edi, eax
je 0x41d4ea
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [edi + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x41d4df
cmp dword [esp + 0x10], 0x103
jne 0x41d4df
mov edx, dword [esi + 0x1c]
mov eax, dword [edi + 8]
push edx
push eax
call ebx
cmp eax, 0x102
jne 0x41d4df
mov ecx, dword [edi + 8]
push 0xdb
push ecx
call ebp
mov edi, dword [edi]
mov eax, dword [esi + 0x14]
cmp edi, eax
jne 0x41d4a6
xor ebp, ebp
mov ebx, dword [esi + 0x14]
mov edi, dword [ebx]
cmp edi, ebx
je 0x41d51a
mov eax, edi
mov edi, dword [edi]
push eax
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
call fcn.0043fa08
mov ecx, dword [esi + 0x18]
add esp, 4
dec ecx
cmp edi, ebx
mov dword [esi + 0x18], ecx
jne 0x41d4f3
mov edx, dword [esi + 0x14]
push edx
call fcn.0043fa08
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x41d540
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
call fcn.0041d690
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esp + 4], eax
je 0x41d5be
push esi
mov esi, dword [ebx + 0x14]
push edi
push 0x10
mov edi, dword [esi + 4]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ecx, esi
test esi, esi
jne 0x41d588
mov ecx, eax
mov dword [eax], ecx
mov ecx, edi
test edi, edi
jne 0x41d592
mov ecx, eax
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
pop edi
pop esi
mov dword [ecx], eax
add eax, 8
test eax, eax
je 0x41d5b3
mov edx, dword [esp + 4]
mov dword [eax], edx
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov eax, dword [ebx + 0x18]
inc eax
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 4]
pop ebx
add esp, 8
ret 8
Function at 0x41d5d0
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
call fcn.0041d690
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
add esp, 4
mov dword [eax], ecx
lea ecx, [esp + 8]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x14]
push ecx
push 0
push eax
push 0x41d670
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esp + 4], eax
je 0x41d664
push esi
mov esi, dword [ebx + 0x14]
push edi
push 0x10
mov edi, dword [esi + 4]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ecx, esi
test esi, esi
jne 0x41d62e
mov ecx, eax
mov dword [eax], ecx
mov ecx, edi
test edi, edi
jne 0x41d638
mov ecx, eax
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
pop edi
pop esi
mov dword [ecx], eax
add eax, 8
test eax, eax
je 0x41d659
mov edx, dword [esp + 4]
mov dword [eax], edx
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov eax, dword [ebx + 0x18]
inc eax
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 4]
pop ebx
add esp, 8
ret 0xc

Function at 0x41d6f0
Capabilities:
Delete file
Download url
Get common file path
Receive data

Disassembly:
mov al, byte [0x47f4cc]
sub esp, 0x104
test al, al
jne 0x41d734
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x47f4cc
push 0x6b696c6c
lea ecx, [esp + 8]
push 0x46c24c
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x47f5d0]
test eax, eax
jne 0x41d762
push eax
push eax
push 0x47f4cc
push 0x46c220
push eax
call sub.urlmon.dll_URLDownloadToFileA
xor ecx, ecx
test eax, eax
setl cl
dec ecx
and ecx, 2
dec ecx
mov eax, ecx
mov dword [0x47f5d0], eax
dec eax
neg eax
sbb eax, eax
not eax
and eax, 0x47f4cc
add esp, 0x104
ret
Function at 0x41da30
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
push esi
xor esi, esi
push edi
push esi
push esi
push 3
push esi
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x41db1c
lea ecx, [esp + 8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [esp + 0x68], eax
je 0x41db15
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x41db15
cmp eax, 0x40000000
jae 0x41db15
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x41db15
mov eax, dword [esp + 0x68]
lea edx, [esp + 0x68]
push 0
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41db0a
mov eax, dword [esp + 0x68]
test eax, eax
je 0x41db0a
lea ecx, [esp + 0xc]
mov byte [eax + esi], 0
push ecx
call fcn.0043f9e0
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x10]
push edx
push esi
push eax
call fcn.0043f0d0
mov edx, dword [esp + 0x80]
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.0043f1cf
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
add esp, 0x18
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x5c
ret
push esi
call fcn.0043fa08
add esp, 4
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x5c
ret
Function at 0x41db30
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4406eb
push eax
mov dword fs:[0], esp
mov eax, dword [ecx + 0x2c]
sub esp, 0x31c
test eax, eax
push ebp
push esi
push edi
je 0x41dcb0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x118]
stosb byte es:[edi], al
call fcn.004162e0
mov ebp, dword [esp + 0x33c]
lea eax, [esp + 0x14]
push 0x104
push eax
push 0
mov dword [esp + 0x33c], 0
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x11c]
call fcn.00416350
test eax, eax
je 0x41dc99
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x120]
call fcn.00416460
test eax, eax
je 0x41dc99
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41dc99
call fcn.0041d6f0
mov edi, eax
test edi, edi
je 0x41dc99
mov edx, dword [esp + 0xc]
xor ecx, ecx
cmp byte [edx], 0
je 0x41dc20
mov al, byte [edx]
cmp al, 0x20
je 0x41dc18
cmp al, 0x2c
je 0x41dc12
mov byte [esp + ecx + 0x14], al
jmp 0x41dc17
mov byte [esp + ecx + 0x14], 0x2e
inc ecx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x41dc02
mov esi, dword [esp + 0x338]
mov byte [esp + ecx + 0x14], 0
push edi
lea ecx, [esp + 0x228]
push 0x104
push ecx
push 0x46c2a0
push 0x44ab20
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x41dc99
push edi
push 0
push 0x46c298
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp], eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x224]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jle 0x41dc99
lea ecx, [esp + 0x118]
mov dword [esp + 0x330], 0xffffffff
call fcn.00416320
mov eax, 1
jmp 0x41dcb2
lea ecx, [esp + 0x118]
mov dword [esp + 0x330], 0xffffffff
call fcn.00416320
xor eax, eax
mov ecx, dword [esp + 0x328]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x328
ret 0x10
Function at 0x41dfa0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
mov dword [esp + 4], 0
jne 0x41dfbd
xor eax, eax
pop ebp
add esp, 0x18
ret 4
push ebx
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x46c2fc]
mov ecx, dword [0x46c300]
mov dword [esp + 0x14], eax
mov eax, dword [0x46c308]
mov dword [esp + 0x18], ecx
mov cl, byte [0x46c30c]
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], cl
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x46c304]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], edx
lea esi, [ecx*4 + 0x1000]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41e0d3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esp + 0x2c], eax
je 0x41e0ca
push 0
push 0
push 3
push 0
push 0
lea edx, [esp + 0x28]
push 0x50
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
test edi, edi
je 0x41e0bf
push 0x46c2a0
call fcn.004190e0
push eax
push ebp
push 0x46c2e0
push esi
push ebx
call fcn.00407080
add esp, 0x18
push 0
push 0x4000000
push 0
push 0
push 0x45fac0
push ebx
push 0x46c2dc
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x41e0b8
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x41e0b1
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call fcn.0043fa08
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 4
Function at 0x41e1c0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
mov dword [esp + 4], 0
jne 0x41e1dd
xor eax, eax
pop ebx
add esp, 0x14
ret 4
push ebp
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x46c310]
mov ecx, dword [0x46c314]
mov dword [esp + 0x14], eax
mov ax, word [0x46c31c]
mov dword [esp + 0x18], ecx
mov word [esp + 0x20], ax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x46c318]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], edx
mov esi, ecx
shl esi, 2
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push esi
dec ecx
push ebp
push ecx
push ebx
call fcn.0041de40
add esi, 0x1000
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0x18
test edi, edi
je 0x41e30c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esp + 0x28], eax
je 0x41e303
push 0
push 0
push 3
push 0
push 0
lea ecx, [esp + 0x28]
push 0x50
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
je 0x41e2f8
push 0x46c2a0
call fcn.004190e0
push eax
push ebp
push 0x46c2e0
push esi
push edi
call fcn.00407080
add esp, 0x18
push 0
push 0x4000000
push 0
push 0
push 0x45fac0
push edi
push 0x46c2dc
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x41e2f1
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x41e2ea
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call fcn.0043fa08
add esp, 4
push ebp
call fcn.0043fa08
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x41e3f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20
push esi
mov edx, ecx
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov ecx, edx
stosb byte es:[edi], al
call fcn.0041e5a0
mov eax, dword [0x47f5d4]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jne 0x41e436
call esi
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [0x47f5d4], 1
call dword [sym.imp.MSVCRT.dll_rand]
push eax
call esi
push eax
push 0x46c33c
lea eax, [esp + 0x14]
push 0x1e
push eax
call fcn.00407080
mov eax, dword [esp + 0x40]
add esp, 0x14
lea edx, [esp + 8]
mov ecx, dword [eax + 8]
add eax, 0x10
push ecx
push eax
push 3
push edx
push 0x46c320
push connect
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x20
ret 4