joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4065de
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ebx, ebx
push edi
push ebx
push ebx
push 1
push ebx
call esi
push 0x44
mov dword [0x460c9c], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x406620
mov ecx, edi
call fcn.00404d91
push ebx
push ebx
push 1
push ebx
mov dword [edi], 0x44fad4
mov byte [edi + 0x40], bl
call esi
mov dword [edi + 0x3c], eax
jmp 0x406622
mov edi, ebx
push ebx
push ebx
push edi
push 0x4065b9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [0x460c9c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x460c9c]
call esi
mov eax, edi
mov dword [0x460c9c], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40665f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp dword [0x45f350], 0
jne 0x4066b8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x45f350
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4066b8
push esi
mov esi, dword [0x45f34c]
mov dword [0x45f348], eax
mov dword [0x45f354], eax
mov dword [0x45f33c], eax
jmp 0x4066ae
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x406698
xor eax, eax
inc eax
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x4066bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
lea ecx, [ebp - 0xc]
mov eax, edx
push ecx
push edi
push eax
push esi
mov dword [ebp - 8], eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x406727
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x406729
push edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x406716
push edi
push dword [ebp - 8]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc bl
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x406729
mov bl, 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406f4c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [0x45f17c]
xor eax, eax
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], ebx
setne al
cmp edi, eax
je 0x406fad
cmp byte [esi + 9], bl
jne 0x406f8d
lea eax, [ebp + 8]
mov byte [esi + 9], 1
push eax
push ebx
push esi
push 0x4071ee
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xb0], eax
push 4
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
test eax, eax
je 0x406fad
mov dword [eax], edi
mov ecx, esi
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
call fcn.00406fb9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407bac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov edi, edx
push eax
push 0x40
push 4
mov ebx, ecx
xor esi, esi
push edi
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x407c11
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x407c00
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp + 8]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407e5a
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov ecx, str.Winmm.dll
call fcn.00404e59
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x407f0c
call fcn.0040665f
push str.midiStreamOut
push edi
call esi
test eax, eax
je 0x407e9e
sub esp, 0xc
mov dword [0x45f1a0], eax
mov edx, 0x407c1a
mov ecx, 0x45f1a0
call fcn.00417b98
push str.waveOutWrite
push edi
call esi
test eax, eax
je 0x407ec1
sub esp, 0xc
mov dword [0x45f188], eax
mov edx, 0x407c40
mov ecx, 0x45f188
call fcn.00417b98
push str.PlaySoundA
push edi
call esi
test eax, eax
je 0x407ee4
sub esp, 0xc
mov dword [0x45f194], eax
mov edx, 0x407e32
mov ecx, 0x45f194
call fcn.00417b98
push str.PlaySoundW
push edi
call esi
test eax, eax
je 0x407f07
sub esp, 0xc
mov dword [0x45f190], eax
mov edx, 0x407e46
mov ecx, 0x45f190
call fcn.00417b98
call fcn.00417a66
mov ecx, str.Dsound.dll
call fcn.00404e59
mov edi, eax
test edi, edi
je 0x407f6e
call fcn.0040665f
push str.DirectSoundCreate
push edi
call esi
test eax, eax
je 0x407f44
sub esp, 0xc
mov dword [0x45f1a4], eax
mov edx, 0x407d74
mov ecx, 0x45f1a4
call fcn.00417b98
push str.DirectSoundCreate8
push edi
call esi
test eax, eax
je 0x407f67
sub esp, 0xc
mov dword [0x45f18c], eax
mov edx, 0x407dd3
mov ecx, 0x45f18c
call fcn.00417b98
pop edi
pop esi
jmp fcn.00417a66
pop edi
pop esi
ret
Function at 0x407f71
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, edx
push ebx
push 2
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x407f95
xor al, al
jmp 0x407fd9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x22c
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x407fbd
cmp dword [esp + 0x18], esi
je 0x407fc3
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x407fab
jmp 0x407fd0
mov ecx, 0x8b
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov bl, 1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret

Function at 0x4081cd
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
cmp dword [0x45f1ac], esi
jne 0x408208
push 0x18
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
test eax, eax
je 0x408202
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 0xa
mov dword [0x45f1ac], eax
jmp 0x408208
mov dword [0x45f1ac], esi
cmp dword [0x45f1a8], esi
jne 0x408241
push 1
push esi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x45f1b4], eax
test eax, eax
jne 0x408228
int3
lea eax, [esp + 4]
push eax
push esi
push esi
push 0x408059
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x45f1a8], eax
pop esi
pop ecx
ret
Function at 0x4083e2
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, ecx
push 0xa
pop eax
mov dword [edi], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], eax
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], esi
mov dword [edi + 0x40], esi
mov dword [edi + 0x44], esi
mov dword [edi + 0x48], esi
mov dword [edi + 0x4c], eax
mov dword [edi + 0x68], esi
mov dword [edi + 0x6c], esi
mov dword [edi + 0x70], esi
mov dword [edi + 0x74], esi
mov dword [edi + 0x78], esi
mov dword [edi + 0x7c], eax
mov dword [edi + 0xe8], esi
mov dword [edi + 0xec], esi
mov dword [edi + 0xfc], esi
mov dword [edi + 0x104], 0x1000
mov dword [edi + 0x110], ebx
call fcn.00408781
push 0xf0000040
push 1
push esi
push esi
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x408472
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 4]
push eax
mov dword [edi + 4], eax
lea eax, [ebp + 0xc]
push eax
call fcn.00408d0c
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0x400
push 0x1388
push eax
push eax
push 1
push 6
push 0x40080003
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi + 0xf8], eax
cmp eax, 0xffffffff
jne 0x4084ca
int3
push 5
push eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp eax, ebx
je 0x4084da
int3
mov ecx, edi
call fcn.00408896
lea ecx, [esi - 0x10]
call fcn.0040169b
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408b61
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
xor esi, esi
cmp dword [ebx + 0xfc], esi
je 0x408cfb
cmp dword [ebx + 0xec], esi
jne 0x408cfb
cmp dword [ebx + 0x10], esi
je 0x408cfb
push ebp
push edi
lea ebp, [ebx + 8]
lea edi, [ebx + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp]
test eax, eax
je 0x408d01
mov esi, dword [eax + 8]
mov ecx, eax
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x408d01
mov eax, dword [ecx]
mov dword [ebp], eax
test eax, eax
je 0x408bc5
and dword [eax + 4], 0
jmp 0x408bc9
and dword [ebp + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
dec dword [ebp + 8]
mov dword [ebp + 0x10], ecx
jne 0x408bdd
mov ecx, ebp
call fcn.00404e09
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebx + 0x108]
test ecx, ecx
jne 0x408bef
int3
mov eax, dword [esi + 0x18]
add eax, 0x18
cmp eax, dword [ebx + 0x10c]
jbe 0x408c22
push eax
push ecx
mov dword [ebx + 0x10c], eax
call dword [sym.imp.msvcrt.dll_realloc]
push dword [ebx + 0x10c]
mov dword [ebx + 0x108], eax
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x14
mov eax, dword [esi + 0x18]
mov edx, dword [ebx + 0x108]
add eax, 0x18
cmp dword [ebx + 0x10c], eax
jb 0x408c63
push 6
pop ecx
add esi, 4
lea eax, [edx + 0x18]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
push dword [esi + 0x18]
push dword [esi + 0x1c]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x18]
lea edi, [ebx + 0x20]
add esp, 0xc
add eax, 0x18
mov ecx, eax
jmp 0x408c65
xor ecx, ecx
cmp ecx, eax
je 0x408c6a
int3
and dword [esp + 0x14], 0
lea eax, [ebx + 0x98]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push dword [ebx + 0x108]
push dword [ebx + 0xf8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x408cde
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
cmp eax, 0x6d
je 0x408cd7
cmp eax, 0xe7
jbe 0x408cc9
cmp eax, 0xe9
jbe 0x408cd7
cmp eax, 0x3e3
je 0x408cd7
cmp eax, 0x3e5
jne 0x408cc9
mov dword [ebx + 0xec], 1
jmp 0x408cde
lea eax, [esp + 0x18]
push eax
call fcn.00408054
pop ecx
int3
mov ecx, ebx
call fcn.004089cf
push ecx
mov ecx, esi
call fcn.00408766
xor esi, esi
cmp dword [ebx + 0xec], esi
jne 0x408cf9
cmp dword [ebx + 0x10], esi
jne 0x408b93
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, 0x80004005
call fcn.0040167c
int3
Function at 0x409ec6
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp + 0x18], 0
jne 0x40a01f
mov ecx, dword [esp + 0x38]
sub ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x34]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
test ecx, ecx
jle 0x40a01f
test eax, eax
jle 0x40a01f
push dword [esp + 0x2c]
lea esi, [esp + 0x34]
lea edi, [ebp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp + 0x2c]
sub ecx, dword [ebp + 0x24]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x30]
sub eax, dword [ebp + 0x28]
cmp byte [ebp + 0x68], 0
push eax
je 0x409f39
push ecx
push dword [esp + 0x34]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
jmp 0x409f3e
call fcn.0040a094
push eax
push dword [ebp + 0x1c]
mov dword [ebp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
cmp byte [ebp + 0x68], 0
je 0x409f95
lea eax, [esp + 0x18]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_GetWindowRect]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0xcc0020
push dword [esp + 0x20]
mov esi, eax
push dword [esp + 0x20]
push esi
push dword [esp + 0x20]
push dword [esp + 0x28]
push ebx
push ebx
push dword [ebp + 0x1c]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x409fb6
xor ebx, ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, eax
lea eax, [esp + 0x30]
push esi
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 8
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x409fe1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ebx
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
jmp 0x409fe3
mov esi, ebx
push 2
mov dword [ebp + 0x18], esi
push dword [esi]
call dword [sym.imp.gdiplus.dll_GdipSetSmoothingMode]
test eax, eax
je 0x409ff7
mov dword [esi + 4], eax
mov esi, dword [ebp + 0x18]
push 2
push dword [esi]
call dword [sym.imp.gdiplus.dll_GdipSetInterpolationMode]
test eax, eax
je 0x40a00b
mov dword [esi + 4], eax
mov esi, dword [ebp + 0x18]
push 4
push dword [esi]
call dword [sym.imp.gdiplus.dll_GdipSetTextRenderingHint]
test eax, eax
je 0x40a01f
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x14
Function at 0x40a7bc
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov eax, dword [ebx + 4]
sub eax, 0x200
je 0x40a970
sub eax, 4
je 0x40a8ff
dec eax
je 0x40a8bc
sub eax, 0x41
je 0x40a86c
dec eax
je 0x40a836
sub eax, 0x231
jne 0x40a82b
push 7
pop ecx
lea eax, [esp + 0x14]
mov esi, ebx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [esp + 0x1c], 0x204
call dword [0x460cb0]
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0x205
push eax
call dword [0x460cb0]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x45f21c]
test ecx, ecx
je 0x40a82b
lea eax, [esp + 0x30]
push eax
movzx eax, word [ebx + 8]
push eax
call ecx
test eax, eax
je 0x40a82b
cmp dword [esp + 0x80], 4
jne 0x40a82b
cmp byte [0x45f187], 0
je 0x40a82b
mov byte [0x45f187], 0
jmp 0x40a82b
mov ecx, dword [0x45f21c]
test ecx, ecx
je 0x40a82b
lea eax, [esp + 0x30]
push eax
movzx eax, word [ebx + 8]
push eax
call ecx
test eax, eax
je 0x40a82b
cmp dword [esp + 0x80], 3
jne 0x40a82b
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0xc]
mov dword [0x45f228], eax
mov eax, dword [esp + 0x10]
mov dword [0x45f220], eax
xor eax, eax
mov byte [0x45f187], 1
inc eax
jmp 0x40a82d
cmp byte [0x45f187], 0
je 0x40a82b
push 7
pop ecx
lea eax, [esp + 0x14]
mov esi, ebx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [esp + 0x1c], 0x204
call dword [0x460cb0]
push ebx
mov dword [esp + 0x1c], 0x205
call dword [0x460cb0]
mov byte [0x45f187], 0
jmp 0x40a95f
test byte [ebx + 8], 1
jne 0x40a95f
movsx eax, word [ebx + 0xc]
mov dword [esp + 0xc], eax
movsx eax, word [ebx + 0xe]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp byte [esi], 0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [0x45f228], eax
mov dword [0x45f220], edx
je 0x40a967
push 7
pop ecx
mov esi, ebx
movzx eax, ax
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movzx ecx, dx
shl ecx, 0x10
or ecx, eax
lea eax, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x28], ecx
call fcn.0040a9f8
push 2
pop eax
jmp 0x40a82d
mov byte [0x45f187], 1
jmp 0x40a95f
cmp byte [0x45f187], 0
je 0x40a82b
test byte [ebx + 8], 2
je 0x40a82b
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
mov edx, dword [0x45f220]
push dword [esp + 0x10]
mov ecx, dword [0x45f228]
call fcn.0040a66b
pop ecx
pop ecx
cmp eax, 2
jle 0x40a82b
movzx eax, word [0x45f228]
lea edi, [esp + 0x14]
push 7
pop ecx
mov esi, ebx
mov byte [0x45f187], 0
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [0x45f220]
shl ecx, 0x10
or ecx, eax
lea eax, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x28], ecx
call fcn.0040a9f8
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
jmp 0x40a82d
Function at 0x40aced
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edi
mov edi, ecx
mov dword [ebp - 8], edi
test esi, esi
je 0x40ad4f
mov edx, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40ad0f
sub edx, ecx
je 0x40ad4f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ad1f
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jle 0x40ad37
xor eax, eax
jmp 0x40ad4b
lea eax, [ebx + ebx]
call fcn.0044c2f1
mov ecx, esp
mov edx, esi
push 3
push ebx
call fcn.00409179
mov ebx, eax
jmp 0x40adc6
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x110]
push eax
push ebx
push 0x44fda0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp + 8]
call fcn.004022cb
mov esi, dword [ebp + 8]
test esi, esi
je 0x40adbe
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ad90
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jle 0x40ada8
xor eax, eax
jmp 0x40adbc
lea eax, [ebx + ebx]
call fcn.0044c2f1
mov ecx, esp
mov edx, esi
push 3
push ebx
call fcn.00409179
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.0040169b
push ebx
lea ecx, [ebp + 8]
call fcn.004025b6
push 0x5c
lea ecx, [ebp + 8]
call fcn.00402779
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp + 8]
call fcn.0040af65
push eax
lea ecx, [ebp + 8]
call fcn.00405f8f
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0040169b
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004021ca
mov ecx, ebx
call fcn.004020f3
test al, al
je 0x40ae3b
test byte [ebp + 0xc], 1
je 0x40ae2d
xor eax, eax
push eax
push eax
push 2
push eax
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x10], eax
test byte [ebp + 0xc], 2
je 0x40ae53
xor eax, eax
push eax
push eax
push 4
jmp 0x40ae41
xor eax, eax
push eax
push eax
push 2
push eax
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x10], eax
xor eax, eax
cmp dword [edi + 0x10], eax
je 0x40aec6
push 2
push eax
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
mov dword [ebp + 0xc], eax
test ebx, ebx
je 0x40ae94
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x40ae7b
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jle 0x40ae98
xor eax, eax
jmp 0x40aeb1
lea edi, [ecx + ecx]
mov eax, edi
call fcn.0044c2f1
mov ecx, esp
mov edx, ebx
push 3
push edi
call fcn.0040aa41
mov edi, dword [ebp - 8]
push eax
lea ecx, [edi + 0xc]
call fcn.00402892
push ecx
push ecx
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
jmp 0x40aecd
push ecx
push ecx
push eax
push eax
push eax
push 0xffffffffffffffff
push 0xb
pop edx
mov ecx, edi
call fcn.00401562
add esp, 0x18
mov edx, eax
xor ecx, ecx
call fcn.004054e9
lea ecx, [esi - 0x10]
call fcn.0040169b
lea esp, [ebp - 0x11c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b5f7
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
cmp dword [ebp + 0x38], ebx
je 0x40b60c
xor al, al
jmp 0x40b770
push esi
push edi
call fcn.0040129e
push eax
lea ecx, [esp + 0x1c]
call fcn.004028e5
call fcn.0040129e
push eax
lea ecx, [esp + 0x18]
call fcn.004028e5
call fcn.0040129e
push eax
lea ecx, [esp + 0x14]
call fcn.004028e5
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0040b2e3
mov edi, dword [esp + 0x18]
test al, al
jne 0x40b662
mov esi, dword [esp + 0x10]
jmp 0x40b750
mov eax, dword [0x45f22c]
test eax, eax
jne 0x40b683
push 0x10000000
push ebx
push ebx
push ebx
push 0x44fda8
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [0x45f22c], eax
push ebx
push dword [esp + 0x20]
push edi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [ebp], eax
test eax, eax
je 0x40b745
push 8
lea eax, [esp + 0x20]
push eax
lea ecx, [ebp + 0x28]
call fcn.0040bf88
push str.https:__
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [esp + 0x1c]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.0040169b
cmp byte [ebp + 0x30], bl
mov eax, 0x44fe04
mov ecx, 0x44fdf8
mov edx, 0x800000
cmovne ecx, eax
xor eax, eax
test esi, esi
cmove eax, edx
push eax
push ebx
push ebx
push ebx
push dword [esp + 0x24]
push ecx
push dword [ebp]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebp + 4], eax
test eax, eax
je 0x40b745
push ebx
push 0x17e4800
push 0x40b5a4
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
cmp eax, 0xffffffff
je 0x40b745
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.0040b7b5
mov eax, dword [ebp + 0x2c]
mov esi, dword [esp + 0x10]
push ebp
push dword [eax - 0xc]
push dword [eax - 0xc]
push eax
push dword [esi - 0xc]
push esi
push dword [ebp + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x40b749
xor ebx, ebx
inc ebx
mov dword [ebp + 0x38], ebx
jmp 0x40b750
mov esi, dword [esp + 0x10]
mov ecx, ebp
call fcn.0040b776
lea ecx, [esi - 0x10]
call fcn.0040169b
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.0040169b
lea ecx, [edi - 0x10]
call fcn.0040169b
pop edi
mov al, bl
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x40b9fb
Capabilities:
Receive http response

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x38], 6
je 0x40ba56
cmp dword [esp + 0xc], 0
mov ecx, dword [esi + 0x34]
jne 0x40ba1a
test ecx, ecx
je 0x40ba4f
mov eax, dword [ecx]
push esi
call dword [eax + 0x10]
jmp 0x40ba4f
test ecx, ecx
je 0x40ba2c
push dword [esp + 0xc]
mov eax, dword [ecx]
push dword [esp + 0xc]
push esi
call dword [eax + 0xc]
cmp dword [esi + 0x38], 6
je 0x40ba56
cmp dword [esi + 0x3c], 0
jne 0x40ba56
push 0
push 0x1000
push dword [esi + 0x40]
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x40ba56
mov ecx, esi
call fcn.0040b776
pop esi
ret 8
Function at 0x40ba5a
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
cmp dword [ecx + 4], 0
push esi
je 0x40bada
xor esi, esi
mov dword [ebp - 4], 0x400
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x40bada
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x40ba99
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jg 0x40bacd
lea esi, [ecx + ecx]
mov eax, esi
call fcn.0044c2f1
mov ecx, esp
lea edx, [ebp - 0x804]
push 3
push esi
call fcn.0040aa41
mov esi, eax
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00402892
mov al, 1
jmp 0x40badc
xor al, al
lea esp, [ebp - 0x808]
pop esi
mov esp, ebp
pop ebp
ret 8