joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10125455
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
je 0x10125509
mov ecx, dword [esi + 0x6c]
mov edi, dword [ebp + 0xc]
sub ecx, 0xffffff80
mov dword [edi], ecx
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x1012548e
push 0x1024c714
push ecx
call fcn.1012b9b2
mov dword [esi + 0x64], eax
pop ecx
pop ecx
test eax, eax
je 0x10125509
push dword [edi]
xor edi, edi
push edi
push eax
call fcn.1012db70
mov ecx, dword [esi + 0x64]
mov eax, dword [ebp + 0xc]
push 0x10
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x6c]
mov dword [ecx + 0x58], eax
lea eax, [esi + 0x14]
push eax
mov eax, dword [esi + 0x64]
add eax, 0x10
push eax
call fcn.1012d5f0
push 0x10
lea eax, [esi + 0x24]
push eax
mov eax, dword [esi + 0x64]
add eax, 0x20
push eax
call fcn.1012d5f0
mov ecx, dword [esi + 0x64]
add esp, 0x24
mov eax, dword [esi + 0x44]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x4c]
lea edx, [eax + 0x7c]
cmp dword [esi + 0x6c], edi
jbe 0x10125502
mov eax, dword [ecx]
add edi, 4
xor eax, dword [esi + 0x68]
lea ecx, [ecx + 4]
mov dword [edx], eax
lea edx, [edx + 4]
cmp edi, dword [esi + 0x6c]
jb 0x101254ea
mov eax, dword [esi + 0x64]
mov dword [ebx], eax
xor eax, eax
inc eax
jmp 0x1012550b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x101261f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
je 0x101262bb
cmp dword [ebp + 0xc], 0
je 0x101262bb
mov ecx, dword [ebx + 0x58]
cmp ecx, 0x2000
ja 0x101262bb
mov eax, ecx
and eax, 0xfffffe00
cmp eax, ecx
jne 0x101262bb
mov dword [esi + 0x70], ecx
xor edi, edi
mov ecx, esi
call fcn.10125e56
test eax, eax
je 0x101262bb
mov eax, dword [esi + 0x5c]
test eax, eax
jne 0x10126262
push 0x1024c714
push dword [ebx + 0x58]
call fcn.1012b9b2
pop ecx
pop ecx
push eax
lea ecx, [esi + 0x5c]
call fcn.1004976c
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x101262b7
push dword [ebx + 0x58]
push edi
push eax
call fcn.1012db70
mov ecx, dword [esi + 0x5c]
add ebx, 0x7c
mov dword [ebp + 8], ebx
add esp, 0xc
mov ebx, dword [esi + 0x70]
test ebx, ebx
je 0x1012629c
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x68]
add edi, 4
xor eax, dword [edx]
lea edx, [edx + 4]
mov dword [ecx], eax
lea ecx, [ecx + 4]
mov ebx, dword [esi + 0x70]
cmp edi, ebx
jb 0x10126282
mov ecx, dword [esi + 0x5c]
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x10
push eax
lea eax, [esi + 0x24]
push eax
push ebx
push ecx
call fcn.1004a18a
add esp, 0x10
mov edi, eax
mov eax, edi
jmp 0x101262bd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x101276a8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102406a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call fcn.1012db70
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.1012b632
leave
ret

Function at 0x10128e99
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0
mov eax, 0x10150b77
call fcn.1012b67a
mov esi, ecx
call fcn.10128267
xor ebx, ebx
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x10128ece
cmp eax, 0x80010119
je 0x10128ece
xor al, al
jmp 0x10128f36
lea edi, [esi + 4]
push edi
push 0x101b3e6c
push 1
push ebx
push 0x101b3f3c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10128eca
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.1001de59
mov dword [ebp - 4], ebx
mov edx, dword [edi]
lea edi, [esi + 8]
mov ecx, dword [eax]
push edi
push ebx
mov eax, dword [edx]
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push edx
call dword [eax + 0xc]
mov esi, eax
or dword [ebp - 4], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
js 0x10128eca
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
setns al
call fcn.1012b643
ret 4
Function at 0x401dd2
Capabilities:
Open clipboard

Disassembly:
push ebp
sub esp, 0x84
lea ebp, [esp - 4]
mov eax, dword [0x49e0b0]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x38
mov eax, 0x481d89
call fcn.00466321
mov esi, dword [ebp + 0x90]
mov ebx, ecx
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
lea edx, [ebp]
push edx
call dword [eax + 8]
and dword [ebp - 4], 0
mov ecx, str.click
mov eax, esi
call fcn.0042ccd2
test eax, eax
jne 0x402005
mov ecx, str.btnClose
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401e45
push 2
lea esi, [ebx - 0x10]
call fcn.0042aecb
jmp 0x402005
mov ecx, str.btnImportRule
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401e63
lea ecx, [ebx - 0x10]
call fcn.00403cc6
jmp 0x402005
mov ecx, str.btnViewRule
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401e82
add ebx, 0xfffffff0
push ebx
call fcn.00403d78
jmp 0x402005
mov ecx, str.btnUninst
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401ea0
lea ecx, [ebx - 0x10]
call fcn.0040308f
jmp 0x402005
mov ecx, str.btnClearRules
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401ebe
lea ecx, [ebx - 0x10]
call fcn.00403204
jmp 0x402005
mov ecx, str.btnOk
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401edd
add ebx, 0xfffffff0
push ebx
call fcn.00402da7
jmp 0x402005
mov ecx, str.btnUpdateOfflineLic
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401efc
add ebx, 0xfffffff0
push ebx
call fcn.00404107
jmp 0x402005
mov ecx, str.btnLeaveOfflineMode
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401f1b
add ebx, 0xfffffff0
push ebx
call fcn.00404346
jmp 0x402005
mov ecx, str.btnOfflineReqCode
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401f39
lea ecx, [ebx - 0x10]
call fcn.00403dfb
jmp 0x402005
mov ecx, str.btnModifyDepAndName
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401f57
lea edi, [ebx - 0x10]
call fcn.00403f58
jmp 0x402005
mov ecx, str.btnHardwareCustomWnd
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x401f75
lea ecx, [ebx - 0x10]
call fcn.00404025
jmp 0x402005
mov ecx, str.btnCopyCid
lea eax, [ebp]
call fcn.0042ccd2
test eax, eax
jne 0x402005
lea eax, [ebp - 0x28]
push eax
call fcn.004137e3
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.0040126f
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x401fab
mov edi, dword [eax + 4]
jmp 0x401fae
lea edi, [eax + 4]
push dword [ebx - 0xc]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x401fbf
xor edi, edi
jmp 0x401fc6
call fcn.0041093c
mov edi, eax
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.00404960
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00404863
test edi, edi
je 0x401ff0
push 0x40
push 0x48627c
push 0x486284
jmp 0x401ffc
push 0x10
push 0x486298
push 0x4862a0
push dword [ebx - 0xc]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp]
call fcn.0042ca3a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.00464d54
add ebp, 0x88
leave
ret 4
Function at 0x40308f
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x49e0b0]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x481ad2
call fcn.00466321
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4bc], ebx
jne 0x4030c7
cmp dword [esi + 0x4b4], ebx
je 0x4030d6
mov eax, esi
call fcn.004031eb
test al, al
je 0x4031c8
push str.CryptEnabled
push str.Softwareprojonepodlp_smprule_
mov edi, 0x486660
call fcn.004114af
test eax, eax
je 0x4030f3
mov edi, 0x486698
push 0x24
push 0x4866f0
push edi
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
call edi
cmp eax, 6
jne 0x4031c8
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
call fcn.00404b61
lea eax, [ebp]
push eax
push 0x7d0
push str.http:__127.0.0.1:13004_ppmessage_messageuninstActionmodemanally
mov dword [ebp - 4], ebx
call fcn.0040b617
xor eax, eax
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
call fcn.004667e0
add esp, 0x18
push 0x104
lea eax, [ebp + 0x1c]
push eax
push str.poda32.exe
call fcn.004103aa
mov dword [ebp - 0x10], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x1c]
push eax
call ebx
test eax, eax
je 0x403187
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
jl 0x403169
lea eax, [ebp + 0x1c]
push eax
call ebx
test eax, eax
je 0x4031a4
push 0
push 0x486754
push 0x486760
push dword [esi + 4]
call edi
jmp 0x4031bc
push 0x40
push 0x48678c
push 0x486798
push dword [esi + 4]
call edi
push 1
call fcn.0042aecb
push 0
push 1
lea ecx, [ebp]
call fcn.00404863
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00464d54
add ebp, 0x228
leave
ret
Function at 0x403cc6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x481cec
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49e0b0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x49e0b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 4]
lea ecx, [esp + 0xc]
call fcn.0041195f
xor edi, edi
mov dword [esp + 0x38], edi
cmp dword [esp + 0x20], edi
je 0x403d4f
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x403d25
lea eax, [esp + 0x10]
mov ecx, dword [esi + 4]
push eax
call fcn.0040397b
pop ecx
test eax, eax
je 0x403d4f
push 0x40
push 0x48627c
push 0x486acc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push esi
call fcn.00402032
push edi
push 1
lea esi, [esp + 0x14]
call fcn.00404960
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00464d54
mov esp, ebp
pop ebp
ret

Function at 0x403dfb
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x480809
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x49e0b0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x49e0b0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov esi, ecx
call fcn.004144d8
push eax
lea eax, [esp + 0x38]
xor ebx, ebx
push eax
mov dword [esp + 0x84], ebx
call fcn.0040126f
add esp, 0xc
push ebx
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x80], 2
call fcn.00404863
cmp dword [esp + 0x44], ebx
jne 0x403e89
push 0x10
push 0x486298
push 0x486aec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403f2e
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
jae 0x403e98
lea eax, [esp + 0x34]
push eax
push 0x486b08
lea ecx, [esp + 0x54]
call fcn.004113d1
pop ecx
pop ecx
mov byte [esp + 0x78], 3
cmp dword [esp + 0x64], 8
mov eax, dword [esp + 0x50]
jae 0x403ebd
lea eax, [esp + 0x50]
push eax
push 0x486b64
push dword [esi + 4]
xor edi, edi
mov ecx, str._rY6R_
call fcn.004165f4
add esp, 0xc
cmp eax, 6
jne 0x403f22
cmp dword [esp + 0x48], 8
mov edi, dword [esp + 0x34]
jae 0x403ee9
lea edi, [esp + 0x34]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x403f0d
call fcn.0041093c
cmp eax, ebx
je 0x403f0d
push 0x40
push 0x486b90
push 0x486b74
jmp 0x403f19
push 0x10
push 0x486bb4
push 0x486b98
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
push 1
lea esi, [esp + 0x54]
call fcn.00404960
push ebx
push 1
lea esi, [esp + 0x38]
call fcn.00404960
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00464d54
mov esp, ebp
pop ebp
ret
Function at 0x404346
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
sub esp, 0x5c
lea ebp, [esp - 4]
mov eax, dword [0x49e0b0]
xor eax, ebp
mov dword [ebp + 0x5c], eax
push 0x3c
mov eax, 0x481c6f
call fcn.00466321
mov ebx, dword [ebp + 0x68]
push 0x24
push 0x4866f0
push 0x486c68
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40449e
xor eax, eax
push 0x3e
push eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push eax
call fcn.004667e0
mov eax, dword [0x4a3460]
add esp, 0xc
push 0x403def
lea ecx, [ebp + 0x1c]
push ecx
push 0x20
pop edi
push edi
push 0
push 0x486cb0
push 0x65
push eax
mov esi, eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0x486cc8
push dword [ebx + 4]
push esi
call fcn.004275a0
add esp, 0x24
test eax, eax
je 0x40449e
lea eax, [ebp + 0x1c]
push eax
lea esi, [ebp - 0x2c]
call fcn.00404522
and dword [ebp - 4], 0
mov eax, esi
push eax
lea eax, [ebp]
push eax
call fcn.004012f3
pop ecx
pop ecx
xor edi, edi
push 0
inc edi
push edi
mov byte [ebp - 4], 2
call fcn.00404960
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
jae 0x404411
lea eax, [ebp + 4]
push eax
call fcn.00411d5c
pop ecx
cmp eax, 0xffffffff
jne 0x404437
push 0x10
push 0x486298
push 0x48660c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push edi
jmp 0x404496
push eax
call sub.WS2_32.dll_closesocket
call fcn.00414d03
test eax, eax
jne 0x404454
push 0x10
push 0x486298
push 0x486cd4
jmp 0x404429
push edi
lea edi, [ebp - 0x48]
call fcn.004137ff
pop ecx
xor esi, esi
cmp dword [eax + 0x14], esi
push esi
push 1
mov ecx, edi
sete byte [ebp - 0xd]
call fcn.00404863
cmp byte [ebp - 0xd], 0
je 0x404482
push 1
lea eax, [ebp]
call fcn.004138f9
pop ecx
push esi
lea eax, [ebp]
call fcn.004138f9
pop ecx
push esi
push ebx
call fcn.00402032
push esi
push 1
lea ecx, [ebp]
call fcn.00404863
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x5c]
xor ecx, ebp
call fcn.00464d54
add ebp, 0x60
leave
ret 4
Function at 0x406287
Capabilities:
Accept command line arguments

Disassembly:
push 0x40
mov eax, 0x47f700
call fcn.00466321
xor edi, edi
test byte [0x4a3aec], 1
mov dword [ebp - 0x1c], edi
jne 0x4062e0
or dword [0x4a3aec], 1
mov dword [ebp - 4], edi
xor eax, eax
mov dword [0x4a3ac4], 7
mov dword [0x4a3ac0], edi
mov word [0x4a3ab0], ax
push 0x4a3acc
mov byte [ebp - 4], 1
call fcn.004045c9
push 0x481f93
call fcn.0046575c
or dword [ebp - 4], 0xffffffff
pop ecx
cmp byte [0x4a3af0], 0
jne 0x4064a4
xor esi, esi
lea eax, [ebp - 0x18]
inc esi
push eax
mov byte [0x4a3af0], 1
mov dword [0x4a3aa8], esi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4064a4
cmp dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
jle 0x40649b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
lea edi, [eax + ecx*4]
mov eax, dword [edi]
cmp word [eax], 0x2f
jne 0x4063a0
push 0x486d88
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004111a0
add esp, 0xc
push 2
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
push 0x1c
cdq
pop esi
idiv esi
cmp eax, ecx
jne 0x40638b
push 1
lea esi, [ebp - 0x34]
call fcn.0040ecd3
push 0
mov ebx, eax
call fcn.0040ecd3
push eax
push 0x4a3acc
call fcn.00408237
push 0xffffffffffffffff
push 0
push eax
mov eax, ebx
call fcn.004048ae
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x34]
call fcn.004049a7
push dword [ebp - 0x34]
call fcn.0046516c
pop ecx
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4063c7
push str._embedded
push eax
call ebx
test eax, eax
jne 0x4063c7
mov dword [0x4a3aa8], 2
jmp 0x40648c
mov eax, dword [edi]
test eax, eax
je 0x4063e8
push str._console
push eax
call ebx
test eax, eax
jne 0x4063e8
mov dword [0x4a3aa8], 3
jmp 0x40648c
mov eax, dword [edi]
test eax, eax
je 0x406409
push str._consoletool
push eax
call ebx
test eax, eax
jne 0x406409
mov dword [0x4a3aa8], 4
jmp 0x40648c
push dword [edi]
mov esi, str._class
call fcn.00411354
test eax, eax
je 0x406473
push 0x486de4
push dword [edi]
lea eax, [ebp - 0x4c]
push eax
call fcn.004111a0
add esp, 0xc
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, 1
jbe 0x40645c
push 1
lea esi, [ebp - 0x4c]
call fcn.0040ecd3
push 0xffffffffffffffff
push 0
push 0x4a3aac
call fcn.004048ae
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x4c]
call fcn.004049a7
push dword [ebp - 0x4c]
call fcn.0046516c
pop ecx
jmp 0x40648c
mov edi, dword [edi]
test edi, edi
je 0x40648c
push 0x486de8
push edi
call ebx
test eax, eax
jne 0x40648c
mov byte [0x4a3ac8], 1
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jl 0x406328
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp + 8]
mov eax, dword [0x4a3aa8]
push 0x4a3aac
lea esi, [edi + 4]
mov dword [edi], eax
call fcn.00404542
mov dword [ebp - 4], 4
mov al, byte [0x4a3ac8]
mov byte [edi + 0x20], al
push 0x4a3acc
lea eax, [edi + 0x24]
push eax
call fcn.0040839b
mov eax, edi
call fcn.004663f9
ret
Function at 0x40b12a
Capabilities:
Parse url

Disassembly:
push ebp
sub esp, 0x44
lea ebp, [esp - 4]
mov eax, dword [0x49e0b0]
xor eax, ebp
mov dword [ebp + 0x44], eax
push 0x74
mov eax, 0x47db73
call fcn.00466321
mov eax, dword [ebp + 0x50]
mov dword [ebp], eax
mov eax, dword [ebp + 0x54]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x58]
push 0x38
mov dword [ebp + 4], eax
xor edi, edi
lea eax, [ebp - 0x44]
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x48], 0x3c
call fcn.004667e0
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
xor ebx, ebx
inc ebx
push edi
push esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x40b1a8
xor eax, eax
jmp 0x40b2a9
cmp dword [ebp - 0x3c], 3
jne 0x40b1a1
push dword [ebp - 0x34]
lea esi, [ebp - 0x64]
push dword [ebp - 0x38]
call fcn.0040b765
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0040475d
or dword [ebp - 4], 0xffffffff
push edi
push ebx
mov ecx, esi
call fcn.00404863
push dword [ebp + 8]
lea ecx, [ebp + 0xc]
call fcn.004044f2
mov dword [ebp - 4], ebx
cmp word [ebp - 0x30], 0x50
je 0x40b21d
movzx eax, word [ebp - 0x30]
push eax
push 0x4873dc
lea esi, [ebp - 0x64]
call fcn.0041142f
pop ecx
pop ecx
push 0xffffffffffffffff
push edi
lea esi, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.0040b873
push edi
push ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.00404863
mov cx, word [ebp - 0x30]
mov eax, dword [ebp + 4]
mov word [eax], cx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
add eax, ecx
push eax
push dword [ebp - 0x1c]
lea esi, [ebp + 0x28]
call fcn.0040b765
mov byte [ebp - 4], 3
cmp dword [ebp + 0x3c], edi
jne 0x40b250
push 0x4873e0
mov ecx, esi
call fcn.004047ef
cmp dword [ebp + 0x24], 0x10
mov ecx, dword [ebp + 0x10]
jae 0x40b25c
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x40], 0x10
mov eax, dword [ebp + 0x2c]
jae 0x40b268
lea eax, [ebp + 0x2c]
push ecx
push eax
push str.GET__s_HTTP_1.1_r_nHost:__s_r_nConnection:_close_r_nCache_Control:_no_cache_r_nAccept:___r_n_r_n
lea esi, [ebp - 0x80]
call fcn.0041142f
add esp, 0xc
mov ecx, dword [ebp]
push 0xffffffffffffffff
push edi
push eax
mov byte [ebp - 4], 4
call fcn.0040475d
push edi
push ebx
mov ecx, esi
call fcn.00404863
push edi
push ebx
lea ecx, [ebp + 0x28]
call fcn.00404863
push edi
push ebx
lea ecx, [ebp + 0xc]
call fcn.00404863
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x44]
xor ecx, ebp
call fcn.00464d54
add ebp, 0x48
leave
ret
Function at 0x40b2c6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push esi
push esi
mov dword [ebp - 0xc], 0x4000
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x40b334
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x40b334
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
leave
ret
push 0x7d0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40b362
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CancelIo]
or esi, 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x40b330
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x40b355
mov esi, dword [ebp - 4]
jmp 0x40b355
Function at 0x40d97d
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp ebx, esi
jne 0x40d9a0
push esi
call edi
mov ebx, eax
push 0x65
push ebx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp + 8], eax
mov eax, ebx
cmp dword [ebp + 8], esi
je 0x40da00
cmp ebx, esi
jne 0x40d9ba
push esi
call edi
push esi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40d8ca
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, esi
je 0x40d9f8
cmp edi, 0xffffffff
je 0x40d9f8
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp + 8]
call fcn.0040b917
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40dea4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea ecx, [ebp - 0x20]
call fcn.004139f4
cmp dword [eax + 0x18], 8
jb 0x40debf
mov eax, dword [eax + 4]
jmp 0x40dec2
add eax, 4
call fcn.00410467
push 0
push 1
lea esi, [ebp - 0x20]
call fcn.00404960
lea ecx, [ebp - 0x20]
call fcn.004139f4
cmp dword [eax + 0x18], 8
jb 0x40dee6
mov eax, dword [eax + 4]
jmp 0x40dee9
add eax, 4
push eax
call fcn.0040ffe8
cmp eax, 2
jne 0x40defc
test edx, edx
jne 0x40defc
mov bl, 1
jmp 0x40defe
xor bl, bl
push 0
push 1
lea esi, [ebp - 0x20]
call fcn.00404960
test bl, bl
je 0x40df4d
push 0x40
push 0x4865b8
push 0x487b98
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00411839
mov dword [esp], str.ruleupt
push 0x48607c
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x40df61
push 0x10
push 0x486298
push 0x4868f0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
pop ebx
leave
ret