joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e1c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0xc], 1
mov ecx, 0x48dbf0
call fcn.00408860
mov dword [ebp - 8], eax
push 0xf0
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40e375
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40e375
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40e375
cmp dword [ebp - 0xc], 0
je 0x40e375
mov edx, dword [ebp - 0x14]
movzx eax, word [edx]
test eax, eax
je 0x40e375
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x1c], dx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x20], dx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x403
jne 0x40e2e9
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x130]
call fcn.0040e8d0
lea ecx, [ebp - 0x130]
call fcn.00419850
push eax
push 0
push 0x143
movzx eax, word [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x25c]
add ecx, 4
call fcn.0040f190
cmp eax, 0xffffffff
jne 0x40e2dc
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x130]
call fcn.0040e900
jmp 0x40e367
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x1234
jne 0x40e367
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x150], 0xffffffff
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x258]
call fcn.0040e8d0
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x260]
call fcn.00419850
mov dword [ebp - 0x14c], eax
lea ecx, [ebp - 0x258]
call fcn.0040e900
lea eax, [ebp - 0x154]
push eax
push 0
push 0x40b
movzx ecx, word [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x25c]
add ecx, 4
call fcn.0040f190
cmp eax, 0xffffffff
jne 0x40e367
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
jmp 0x40e240
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0045670b
mov esp, ebp
pop ebp
ret 4
Function at 0x40f8f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0040fa80
mov ecx, eax
call fcn.00419850
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40f963
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004079e0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040ff80
mov eax, dword [ebp - 0xc]
jmp 0x40f96d
mov ecx, dword [ebp + 0xc]
call fcn.00407600
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41aa30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.0041a590
call fcn.00414790
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041a7b0
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41ab74
push 0xf0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041a7b0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x1c], 0
je 0x41aab4
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
xor eax, eax
jne 0x41aa9f
xor ecx, ecx
jne 0x41aa9f
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41ab5b
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41ab50
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0041a7d0
add esp, 8
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0041aa20
add esp, 4
movzx edx, al
test edx, edx
jne 0x41ab35
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x41ab4e
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x41ab59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x41ab64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41ab74
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x42b080
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x20
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42b0a7
xor eax, eax
jmp 0x42b10e
lea edx, [ebp - 0x10]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x42b0c0
xor eax, eax
jmp 0x42b10e
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x42b0f8
xor eax, eax
jmp 0x42b10e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x42b109
xor eax, eax
jmp 0x42b10e
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x42b4b0
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f0d8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x14]
push eax
push 0x474ae8
push 1
push 0
push 0x474b08
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x42b53c
push 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x42b54a
mov eax, dword [ebp - 0x20]
jmp 0x42b65c
cmp dword [ebp - 0x24], 0
je 0x42b659
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [edx + 0x14]
call ecx
xor edx, edx
mov word [ebp - 0x34], dx
xor eax, eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov word [ebp - 0x26], ax
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 1
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jne 0x42b659
cmp dword [ebp - 0x1c], 0
je 0x42b654
lea eax, [ebp - 0x38]
push eax
push 0x474b48
push 0
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [edx + 0x24]
call ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x42b5d3
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [eax + 8]
call edx
jmp 0x42b577
cmp dword [ebp - 0x38], 0
je 0x42b654
mov eax, 8
mov word [ebp - 0x34], ax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0
lea edx, [ebp - 0x34]
push edx
push 0x47a4c4
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ecx + 0xc]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.004052f0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
jl 0x42b63b
lea ecx, [ebp - 0x3c]
call fcn.00419850
push eax
call fcn.0042b120
add esp, 4
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00443840
jmp 0x42b577
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42dc30
Capabilities:
Enumerate process modules
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46dffb
mov eax, dword fs:[0]
push eax
mov eax, 0x2224
call fcn.0045a1f0
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0x2020], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2010], eax
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea ecx, [ebp - 0x200c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
mov dword [ebp - 0x2018], 0
jmp 0x42dca1
mov edx, dword [ebp - 0x2018]
add edx, 1
mov dword [ebp - 0x2018], edx
mov eax, dword [ebp - 0x2014]
shr eax, 2
cmp dword [ebp - 0x2018], eax
jae 0x42dd8d
mov ecx, dword [ebp - 0x2018]
mov edx, dword [ebp - 0x2010]
cmp edx, dword [ebp + ecx*4 - 0x200c]
jne 0x42dccd
jmp 0x42dc92
mov eax, dword [ebp - 0x2018]
mov ecx, dword [ebp + eax*4 - 0x200c]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x201c], eax
cmp dword [ebp - 0x201c], 0
je 0x42dd88
push 0x104
lea edx, [ebp - 0x222c]
push edx
mov eax, dword [ebp - 0x201c]
push eax
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x42dd7b
lea ecx, [ebp - 0x222c]
push ecx
lea ecx, [ebp - 0x2230]
call fcn.004052f0
mov dword [ebp - 4], 0
push 0
push str.getkey.exe
lea ecx, [ebp - 0x2230]
call fcn.004054a0
mov ecx, eax
call fcn.00405420
test eax, eax
jl 0x42dd69
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2230]
call fcn.00443840
mov edx, dword [ebp - 0x201c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42dc92
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2020]
xor ecx, ebp
call fcn.0045670b
mov esp, ebp
pop ebp
ret
Function at 0x430e70
Capabilities:
Check os version
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
add ecx, 2
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x130]
mov ax, word [edx]
mov word [ebp - 0x136], ax
add dword [ebp - 0x130], 2
cmp word [ebp - 0x136], 0
jne 0x430ea1
mov ecx, dword [ebp - 0x130]
sub ecx, dword [ebp - 0x134]
sar ecx, 1
mov dword [ebp - 0x13c], ecx
jne 0x430edd
jmp 0x431081
push 0x114
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.00459420
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x430f1c
cmp dword [ebp - 0x118], 2
jae 0x430f25
cmp dword [ebp - 0x11c], 6
jbe 0x430f2a
jmp 0x43106c
mov ecx, dword [ebp - 0x12c]
cmp dword [ecx + 0x2fc], 0
jne 0x43106c
push 0x4776d8
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x12c]
mov dword [edx + 0x300], eax
mov eax, dword [ebp - 0x12c]
cmp dword [eax + 0x300], 0
je 0x43106c
push 0x400
push 0
push 0
push 6
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx + 0x300]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + 0x304], eax
mov edx, dword [ebp - 0x12c]
cmp dword [edx + 0x304], 0
je 0x431048
push 0x400
push 0
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x304]
push ecx
call fcn.00459420
add esp, 0xc
mov edx, dword [ebp - 0x12c]
mov eax, dword [edx + 0x304]
mov dword [ebp - 0x128], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x140]
mov dx, word [ecx]
mov word [ebp - 0x14a], dx
mov eax, dword [ebp - 0x144]
mov cx, word [ebp - 0x14a]
mov word [eax], cx
mov edx, dword [ebp - 0x140]
add edx, 2
mov dword [ebp - 0x140], edx
mov eax, dword [ebp - 0x144]
add eax, 2
mov dword [ebp - 0x144], eax
cmp word [ebp - 0x14a], 0
jne 0x431000
push 1
mov ecx, dword [ebp - 0x12c]
call fcn.004310a0
push 0x477760
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x37c
call fcn.00405370
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045670b
mov esp, ebp
pop ebp
ret 4
Function at 0x4310a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46dfc8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftMediaPlayerMediaPluginsDSPConfig8EAABC66_3F85_4b85_84A1_424AB8DDA041_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4310f0
jmp 0x431169
lea ecx, [ebp - 0x14]
call fcn.004052d0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x431114
push str.true
lea ecx, [ebp - 0x14]
call fcn.00405370
jmp 0x431121
push str.false
lea ecx, [ebp - 0x14]
call fcn.00405370
lea ecx, [ebp - 0x14]
call fcn.00405880
lea ecx, [eax + eax + 2]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00431490
push eax
push 1
push 0
push str.Enabled
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x10], 0
je 0x43115a
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00443840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4313b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
push 0x2001f
push 0
push 0x477910
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x431407
lea ecx, [ebp - 0xc]
push ecx
push str.SoftwareMicrosoftMediaPlayerPreferencesVideoSettings_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x431407
jmp 0x431449
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push str.IgnoreAVSync
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.DontUseFrameInterpolation
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0xc], 0
je 0x431449
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x431860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.0041a590
call fcn.00431820
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041a7b0
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4319a4
push 0xf0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041a7b0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x1c], 0
je 0x4318e4
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
xor eax, eax
jne 0x4318cf
xor ecx, ecx
jne 0x4318cf
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43198b
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x431980
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0041a7d0
add esp, 8
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00431830
add esp, 4
movzx edx, al
test edx, edx
jne 0x431965
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x43197e
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x431989
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x431994
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4319a4
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x432930
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x202
mov word [ebp - 0x19c], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x19c]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x432977
xor al, al
jmp 0x432979
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045670b
mov esp, ebp
pop ebp
ret
Function at 0x4332d0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46df70
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0x477160
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov edx, dword [ebp - 0x38]
cmp dword [edx], 0
jne 0x43332d
xor eax, eax
jmp 0x4334ad
lea ecx, [ebp - 0x18]
call fcn.004052d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004052d0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
mov edx, dword [ebp + 8]
push edx
call fcn.004052f0
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x38]
call fcn.004337f0
push 0
push 0
push 3
push 0
push 0
push 0x50
lea ecx, [ebp - 0x18]
call fcn.00419850
push eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov edx, dword [ebp - 0x38]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 4], 0
jne 0x4333be
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00443840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00443840
mov eax, dword [ebp - 0x28]
jmp 0x4334ad
mov dword [ebp - 0x20], 0x477220
mov dword [ebp - 0x1c], 0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00419850
push eax
push 0x477228
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x38]
cmp dword [edx + 8], 0
jne 0x433429
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00443840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00443840
mov eax, dword [ebp - 0x2c]
jmp 0x4334ad
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x433466
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00443840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00443840
mov eax, dword [ebp - 0x30]
jmp 0x4334ad
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00443840
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00443840
jmp 0x43349a
mov dword [ebp - 4], 0xffffffff
jmp 0x4334a8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4334d0
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d2a0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 4
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 8], 0
je 0x433541
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x18
push edx
push 0x20000005
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x433541
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x18]
jmp 0x43356d
jmp 0x43355d
mov dword [ebp - 4], 0xffffffff
jmp 0x43356b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433580
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d280
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 8], 0
je 0x4335e8
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4335e8
mov eax, dword [ebp - 0x14]
jmp 0x433614
jmp 0x433604
mov dword [ebp - 4], 0xffffffff
jmp 0x433612
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8