joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40812c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40822f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x437b84
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x437b9c]
jne 0x408178
mov eax, esi
mov edx, 0x437b9e
mov ecx, 0x55
call fcn.00406b50
push 0x437b84
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408219
push 0x437b84
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406200
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4081e7
cmp byte [0x437b80], 0
je 0x4081ac
mov edx, esi
mov eax, ebx
call fcn.00408010
jmp 0x4081e7
mov edx, esi
mov eax, ebx
call fcn.00407e14
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4081e7
cmp dword [esi], 0
je 0x4081d0
mov eax, esi
mov edx, 0x408248
call fcn.00406c3c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00407e14
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406c3c
push 0x437b84
call sub.kernel32.dll_EnterCriticalSection
mov word [0x437b9c], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406abc
push eax
push 0x437b9e
call sub.kernel32.dll_lstrcpynW
push 0x437b84
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408236
lea eax, [ebp - 4]
call fcn.00406200
ret
Function at 0x408464
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004062e4
xor eax, eax
push ebp
push 0x408689
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4084a4
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x4084be
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406abc
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x408673
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408698
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40858d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408698
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40858d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4086d4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40858d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4086d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40858d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408708
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40858d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40873c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x408673
xor eax, eax
push ebp
push 0x40866c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.00408270
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4085fc
mov eax, dword [ebp - 0x10]
call fcn.004041a8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406b14
jmp 0x408647
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40877c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408647
mov eax, dword [ebp - 0x10]
call fcn.004041a8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40877c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406b14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408673
cmp dword [ebp - 8], 0
je 0x408662
mov eax, dword [ebp - 8]
call fcn.004041c4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408690
lea eax, [ebp - 4]
call fcn.00406200
ret
Function at 0x40896c
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004062e4
xor eax, eax
push ebp
push 0x408a2c
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00406b50
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00406c94
mov eax, dword [ebx]
call fcn.00408834
test al, al
jne 0x408a09
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00406b50
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00406c94
mov eax, dword [ebx]
call fcn.00408834
test al, al
jne 0x408a09
mov eax, ebx
call fcn.00406200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408a33
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406260
lea eax, [ebp - 4]
call fcn.00406200
ret

Function at 0x416df4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00406abc
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x416e5e
test ah, 4
je 0x416e57
test bl, bl
jne 0x416e1c
mov al, 1
jmp 0x416e85
test al, 0x10
je 0x416e24
xor eax, eax
jmp 0x416e85
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x416e48
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x416e85
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x416e85
test al, 0x10
sete al
jmp 0x416e85
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x416e7f
cmp ebx, 3
je 0x416e7f
cmp ebx, 0x7b
je 0x416e7f
mov eax, esi
call fcn.00416db4
test al, al
jne 0x416e83
xor eax, eax
jmp 0x416e85
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x416e8c
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.00406abc
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x416ee1
call sub.kernel32.dll_GetLastError_2
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x416edb
test ah, 4
je 0x416edb
test al, 0x10
je 0x416edb
mov eax, esi
call fcn.00406abc
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x416ee1
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41a8f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41a92d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00406358
jmp 0x41a936
mov eax, ebx
mov edx, esi
call fcn.004065b0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41a940
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41a962
movzx eax, word [esp]
jmp 0x41a964
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41b638
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41b75d
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041b440
mov esi, eax
mov eax, dword [0x434a10]
cmp byte [eax], 0
je 0x41b705
mov eax, dword [0x4348ac]
call fcn.0040466c
call fcn.004042fc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41b608]
call fcn.004078a0
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41b778
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41b741
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x434878]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x437c4c]
call fcn.00407958
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b764
lea eax, [ebp - 4]
mov edx, dword [0x41b608]
call fcn.004078ac
ret

Function at 0x41d38c
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00406b50
add esp, 0x800
pop ebx
ret
Function at 0x41dcbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41de41
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x41de2b
xor edx, edx
push ebp
push 0x41de24
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
push 1
push 2
push 0
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
jne 0x41dd2f
call fcn.00405a28
jmp 0x41de2b
xor edx, edx
push ebp
push 0x41de06
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.004046d0
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406ba0
push esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.004069ac
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x41ddef
call sub.kernel32.dll_GetLastError_2
cmp eax, 0x522
jne 0x41dde3
push esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, ebx
call fcn.00406abc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x41ddef
call fcn.00405a28
call fcn.00405a28
jmp 0x41de2b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41de0d
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41de48
lea eax, [ebp - 4]
call fcn.00406248
ret
Function at 0x41f6e8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x41f83f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.004065b0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.00406abc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x41f829
xor eax, eax
push ebp
push 0x41f822
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp + 0x10]
call fcn.00406abc
mov esi, eax
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x41f80b
cmp dword [ebp - 0x10], 0
jle 0x41f80b
cmp dword [ebp - 8], 1
jne 0x41f80b
mov eax, dword [ebp - 0x10]
push eax
call fcn.00408e60
pop ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41f804
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.004046d0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x41f7ec
mov ecx, dword [ebp - 0x10]
sar ecx, 1
jns 0x41f7ce
adc ecx, 0
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00406358
lea edx, [ebp - 0x14]
mov eax, dword [ebx]
call fcn.00415f78
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.004065b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f80b
mov eax, dword [ebp - 0xc]
push eax
call fcn.00408e70
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f829
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f846
lea eax, [ebp - 0x14]
call fcn.00406200
ret

Function at 0x41f850
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call fcn.00406abc
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x41f8de
xor eax, eax
push ebp
push 0x41f8d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, esi
test ebx, ebx
je 0x41f89c
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00406abc
push eax
push 1
push 0
mov eax, dword [ebp + 0xc]
call fcn.00406abc
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f8de
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x41f8e8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov eax, esi
call fcn.00406abc
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x41f94d
xor eax, eax
push ebp
push 0x41f946
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00406abc
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f94d
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x421868
Capabilities:
Check http status code
Create http request
Get http content length

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x4219fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
mov edx, dword [0x434838]
mov edx, dword [edx]
call fcn.004065f8
mov eax, dword [ebp - 4]
call fcn.00406abc
push eax
call sub.wininet.dll_DeleteUrlCacheEntryW
push 0
push 0
push 0
push 0
push 0
call sub.wininet.dll_InternetOpenW
mov dword [0x43a08c], eax
cmp dword [0x43a08c], 0
je 0x4219e3
cmp dword [0x43a09c], 0
jbe 0x4218fc
lea eax, [ebp - 8]
push eax
mov eax, dword [0x43a09c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x421a1c
call fcn.00417350
mov eax, dword [ebp - 8]
call fcn.00406abc
mov edi, eax
jmp 0x42190e
lea eax, [ebp - 8]
mov edx, dword [0x434a1c]
mov edx, dword [edx]
call fcn.004065f8
xor edi, edi
mov esi, dword [ebp - 8]
test esi, esi
je 0x42191a
sub esi, 4
mov esi, dword [esi]
push 0
push 0x4000200
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00406abc
push eax
mov eax, dword [0x43a08c]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [0x43a090], eax
cmp dword [0x43a090], 0
je 0x4219e3
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
mov eax, dword [0x43a090]
push eax
call sub.wininet.dll_HttpQueryInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4219e3
cmp dword [ebp - 0x14], 0xc8
je 0x42199f
cmp dword [ebp - 0x14], 0xcb
je 0x42199f
cmp dword [ebp - 0x14], 0xce
je 0x42199f
xor ebx, ebx
jmp 0x4219a1
mov bl, 1
test bl, bl
je 0x4219e3
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x43a094
push 0x20000005
mov eax, dword [0x43a090]
push eax
call sub.wininet.dll_HttpQueryInfoW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4219e3
mov eax, dword [0x43a09c]
add dword [0x43a094], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421a05
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406260
ret
Function at 0x421a7c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x43a098
xor ebx, ebx
cmp dword [0x43a098], 0
je 0x421a9a
cmp dword [0x43a098], 0xffffffff
jne 0x421afe
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
mov eax, dword [0x434968]
mov eax, dword [eax]
call fcn.00406abc
push eax
call sub.kernel32.dll_CreateFileW
mov dword [0x43a098], eax
cmp dword [0x43a098], 0
je 0x421afe
cmp dword [0x43a098], 0xffffffff
je 0x421afe
push 2
push 0
push 0
mov eax, dword [0x43a098]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
setne bl
push 0
mov eax, dword [0x43a098]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x43a09c], eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x421b38
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
lea eax, [ebp - 4]
push eax
push 0x200
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x43a090]
push eax
call sub.wininet.dll_InternetReadFile
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x421b9b
cmp dword [ebp - 4], 0
jbe 0x421b9b
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x43a098]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x421b9b
mov edx, dword [ebp - 8]
add dword [0x43a09c], edx
mov esp, ebp
pop ebp
ret

Function at 0x4220f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4221cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20a]
xor ecx, ecx
mov edx, 0x20a
call fcn.004046d0
push 0
push 0x10
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
test eax, eax
je 0x42215c
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406b50
jmp 0x422176
lea edx, [ebp - 0x210]
xor eax, eax
call fcn.00404568
mov eax, dword [ebp - 0x210]
mov edx, ebx
call fcn.00416f30
lea edx, [ebp - 0x214]
mov eax, dword [ebx]
call fcn.0041cb44
push dword [ebp - 0x214]
mov eax, dword [0x434a28]
push dword [eax]
push 0x4221e4
mov eax, dword [0x4348e4]
push dword [eax]
push 0x4221f4
mov eax, ebx
mov edx, 5
call fcn.00406d1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4221d2
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00406260
ret

Function at 0x42a898
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, edx
mov eax, ebx
mov edx, dword [0x434a1c]
mov edx, dword [edx]
call fcn.004065b0
lea eax, [ebp - 0x20c]
xor ecx, ecx
mov edx, 0x208
call fcn.004046d0
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x42a8f2
mov eax, ebx
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00406b50
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42bddc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x42beb5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x42bbb0]
call fcn.0042bc70
mov eax, dword [ebp - 0x20]
call fcn.00406abc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x42be9f
xor eax, eax
push ebp
push 0x42be98
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x1c], 8
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x42bec4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42be81
cmp dword [ebp - 0x1c], 8
jne 0x42be81
cmp dword [ebp - 0x10], 0xb
jne 0x42be81
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42be9f
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bebc
lea eax, [ebp - 0x20]
call fcn.00406200
ret

Function at 0x42bedc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42bf86
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 8]
mov eax, dword [0x42bbb0]
call fcn.0042bc70
mov eax, dword [ebp - 8]
call fcn.00406abc
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x42bf70
xor eax, eax
push ebp
push 0x42bf69
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp + 8]
push eax
push 0xb
push 0
push 0x42bf94
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bf70
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bf8d
lea eax, [ebp - 8]
call fcn.00406200
ret