joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452870
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x45e7a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push edi
push ecx
push 0x20019
push 0
push eax
push SysReAllocStringLen
mov dword [esp + 0x24], 0x200
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4528d3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov edx, dword [esp + 0x10]
lea eax, [edx + edx]
push eax
call sub.MFC42u.DLL_operatornew
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
test edi, edi
mov dword [esp + 0x28], 0
mov esi, edi
jne 0x452925
mov ecx, dword [esp + 0x10]
lea edx, [ecx + ecx]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x452925
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov ebp, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
mov eax, dword [ebp]
push esi
push edx
push 0
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp ebx, 0xea
jne 0x4529c8
mov eax, dword [esp + 0x10]
push esi
add eax, 0x200
mov dword [esp + 0x14], eax
call sub.MFC42u.DLL_operatordelete
mov ecx, dword [esp + 0x14]
lea edx, [ecx + ecx]
push edx
call sub.MFC42u.DLL_operatornew
mov edi, eax
add esp, 8
test edi, edi
mov esi, edi
jne 0x452991
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x4529d0
mov eax, dword [ebp]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push esi
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test edi, edi
mov ebx, eax
je 0x4529bc
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
cmp ebx, 0xea
je 0x45294f
mov edi, dword [esp + 0x18]
test ebx, ebx
je 0x452a03
xor esi, esi
jmp 0x452a12
test edi, edi
je 0x4529dd
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4529ee
push eax
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x38]
push esi
call fcn.00456380
mov esi, 1
test edi, edi
je 0x452a1f
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x452a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x453160
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [esp + 0x14]
push 0
mov ecx, esi
call sub.MFC42u.DLL_CString::GetBuffer
mov ecx, dword [esi]
pop esi
mov edx, dword [ecx - 8]
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4531bc
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 4]
push eax
mov ecx, dword [ecx]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
test eax, eax
sete dl
mov eax, edx
pop ecx
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp]
mov eax, dword [eax]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edx, edx
test eax, eax
sete dl
mov eax, edx
pop ecx
ret

Function at 0x453460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45e898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_3
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0xa]
lea edx, [esp + 0xc]
mov eax, dword [esi]
push ecx
push edx
lea ecx, [esp + 0x18]
push edi
push ecx
push eax
mov dword [esp + 0x30], 0
call sub.MFC42u.DLL_AfxParseURL
test eax, eax
je 0x453541
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x45351a
push 0x472cec
mov ecx, esi
call sub.MFC42u.DLL_CString::Find_3
cmp eax, 0xffffffff
je 0x45351a
add eax, 2
lea edx, [esp + 0x24]
push eax
push edx
mov ecx, esi
call sub.MFC42u.DLL_CString::Left
lea eax, [esp + 0x24]
push edi
lea ecx, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x28], 1
call sub.MFC42u.DLL_operator_2
push eax
mov ecx, edi
mov byte [esp + 0x20], 2
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x453570
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e8d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], esi
call sub.MFC42u.DLL_CString::CString_3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push esi
push eax
push ecx
mov byte [ebp - 4], 1
call fcn.00453460
mov ebx, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
add esp, 0xc
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push edx
push esi
push str.cookie:
call ebx
mov edi, eax
cmp edi, esi
jne 0x453622
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
shl eax, 4
push eax
call sub.MFC42u.DLL_operatornew
add esp, 4
lea ecx, [ebp - 0x14]
mov esi, eax
push ecx
push esi
push str.cookie:
call ebx
test esi, esi
mov edi, eax
je 0x4535fd
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
test edi, edi
jne 0x453620
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
mov dword [ebp - 0x1c], esi
jmp 0x453629
xor esi, esi
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push edx
push esi
push edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
mov ebx, eax
mov eax, dword [ebp - 0x14]
test eax, eax
jbe 0x4536fa
lea eax, [eax + eax*4]
shl eax, 4
push eax
call sub.MFC42u.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
push esi
push edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
mov ebx, eax
mov eax, dword [esi + 0xc]
test eax, 0x100000
je 0x4536e9
mov edx, dword [esi + 4]
lea ecx, [ebp + 8]
push edx
call sub.MFC42u.DLL_CString::CString_4
mov eax, dword [ebp - 0x18]
lea ecx, [ebp + 8]
push eax
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::Find_3
cmp eax, 0xffffffff
je 0x4536dd
mov ecx, dword [esi + 8]
push ecx
lea ecx, [ebp - 0x20]
call sub.MFC42u.DLL_CString::CString_4
mov edx, dword [ebp + 0xc]
mov byte [ebp - 4], 4
push edx
push eax
call fcn.00453730
add esp, 8
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
test esi, esi
je 0x453702
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
jmp 0x453702
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
test esi, esi
mov byte [ebp - 4], 1
je 0x4536fa
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
test ebx, ebx
jne 0x453627
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4541f0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x45ea67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call sub.MFC42u.DLL_CString::CString_3
mov ecx, dword [esp + 0x38]
push 0
push 0
mov dword [esp + 0x34], 1
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test ebp, ebp
jbe 0x4542f3
mov al, byte [esp + 0x38]
push edi
lea edi, [ebp + 1]
mov byte [esp + 0x18], al
test edi, edi
mov eax, edi
jge 0x454254
xor eax, eax
push eax
call sub.MFC42u.DLL_operatornew
add esp, 4
mov esi, eax
test edi, edi
mov dword [esp + 0x1c], esi
jbe 0x454274
mov ecx, edi
test eax, eax
je 0x454270
mov byte [eax], 0
inc eax
dec ecx
jne 0x454269
lea eax, [esi + edi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x3c]
push esi
push ebp
push 0
push 0
mov byte [esp + 0x40], 2
call sub.MFC42u.DLL_CString::GetBuffer
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
pop edi
je 0x4542e5
lea ecx, [esp + 0x10]
lea edx, [esp + 0x38]
push ecx
push edx
push 0x471b48
push esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0x38]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
lea eax, [esp + 0x10]
shr edx, 0x10
push ecx
push edx
push str._d._d._d._d
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0x18
push esi
mov byte [esp + 0x30], 1
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov esi, dword [esp + 0x34]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_5
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x454330
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x10]
push ebx
push esi
push edi
push 0
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
sub esi, ebx
mov ebx, dword [esp + 0x28]
push 0
sub ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call edi
push 1
call edi
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edx, eax
test edx, edx
je case.default.0x4543dd
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.SHELL32.dll_SHAppBarMessage]
lea ecx, [esp + 0x2c]
push ecx
push 4
mov dword [esp + 0x38], edx
call edi
cmp eax, 1
je 0x4543ae
cmp eax, 3
jne case.default.0x4543dd
lea edx, [esp + 0x2c]
push edx
push 5
call edi
cmp eax, 1
jne case.default.0x4543dd
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov edx, dword [esp + 0x38]
cmp edx, 3
ja case.default.0x4543dd
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
jmp dword [edx*4 + 0x454428]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub edx, ecx
add ebx, edx
jmp case.default.0x4543dd
mov edx, eax
sub edx, ecx
add esi, edx
sub eax, ecx
add esi, eax
jmp case.default.0x4543dd
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
sub eax, edx
add ebx, eax
mov eax, dword [esp + 0x54]
pop edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ebx
pop esi
mov dword [eax], 0
mov dword [eax + 4], 0
pop ebx
add esp, 0x44
ret
Function at 0x4010e1
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
jmp 0x401210
push 0xffffffffffffffff
push 0x54cc92
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 0x58c7e8
lea ecx, [esi + 0xc]
mov dword [esp + 0xc], esi
call fcn.004842d8
xor edi, edi
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], edi
call fcn.004ddcf7
push 0x58c7e8
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 1
call fcn.004842d8
push 0x58c7e8
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 2
call fcn.004842d8
push 0x58c7e8
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 3
call fcn.004842d8
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 4
call fcn.004ddcf7
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 5
call fcn.004ddcf7
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi], 0x55401c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x401226
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
jmp 0x401210
push 0xffffffffffffffff
push 0x54cc92
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 0x58c7e8
lea ecx, [esi + 0xc]
mov dword [esp + 0xc], esi
call fcn.004842d8
xor edi, edi
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], edi
call fcn.004ddcf7
push 0x58c7e8
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 1
call fcn.004842d8
push 0x58c7e8
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 2
call fcn.004842d8
push 0x58c7e8
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 3
call fcn.004842d8
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 4
call fcn.004ddcf7
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 5
call fcn.004ddcf7
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi], 0x55401c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4865e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x28], 0
je 0x48660d
push 0x18b
push str.thrdcore.cpp
call fcn.004e1770
test eax, eax
je 0x48660d
int3
xor ecx, ecx
test ecx, ecx
jne 0x4865f0
push 0x1c
push 0
lea edx, [ebp - 0x1c]
push edx
call fcn.00425ab0
add esp, 0xc
call fcn.00504505
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
push 0
push 0
push 1
push 0
call dword [0x593848]
mov dword [ebp - 0xc], eax
push 0
push 0
push 1
push 0
call dword [0x593848]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0xc], 0
je 0x486665
cmp dword [ebp - 8], 0
jne 0x48669e
push str.Warning:_CreateEvent_failed_in_CWinThread::CreateThread._n
push 0x578a68
call fcn.0045a065
add esp, 8
cmp dword [ebp - 0xc], 0
je 0x486687
mov edx, dword [ebp - 0xc]
push edx
call dword [0x593838]
cmp dword [ebp - 8], 0
je 0x486697
mov eax, dword [ebp - 8]
push eax
call dword [0x593838]
xor eax, eax
jmp 0x4867d3
mov ecx, dword [ebp - 0x20]
add ecx, 0x2c
push ecx
mov edx, dword [ebp + 8]
or edx, 4
push edx
lea eax, [ebp - 0x1c]
push eax
push 0x485da0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00425b60
add esp, 0x18
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x28], 0
jne 0x4866db
xor eax, eax
jmp 0x4867d3
mov ecx, dword [ebp - 0x20]
call fcn.004ea64c
cmp eax, 0xffffffff
jne 0x4866fc
push 0x1a5
push str.thrdcore.cpp
call fcn.004e1770
test eax, eax
je 0x4866fc
int3
xor eax, eax
test eax, eax
jne 0x4866db
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x59383c]
test eax, eax
je 0x486726
push 0x1a6
push str.thrdcore.cpp
call fcn.004e1770
test eax, eax
je 0x486726
int3
xor edx, edx
test edx, edx
jne 0x486702
mov eax, dword [ebp - 0xc]
push eax
call dword [0x593838]
mov ecx, dword [ebp + 8]
and ecx, 4
test ecx, ecx
je 0x48676c
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x28]
push eax
call dword [0x593844]
cmp eax, 0xffffffff
jne 0x486766
push 0x1ab
push str.thrdcore.cpp
call fcn.004e1770
test eax, eax
je 0x486766
int3
xor ecx, ecx
test ecx, ecx
jne 0x486740
cmp dword [ebp - 4], 0
je 0x4867c4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x28]
push eax
call dword [0x59383c]
test eax, eax
je 0x486799
push 0x1b0
push str.thrdcore.cpp
call fcn.004e1770
test eax, eax
je 0x486799
int3
xor ecx, ecx
test ecx, ecx
jne 0x486772
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x28]
push eax
call dword [0x593838]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 8]
push edx
call dword [0x593838]
xor eax, eax
jmp 0x4867d3
mov eax, dword [ebp - 8]
push eax
call dword [0x593840]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f6926
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54df8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004970a0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x1c], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004ddcf7
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov dword [edx], vtable.CInternetFile.0
push 0xffffffffffffffff
mov eax, dword [ebp + 0x14]
push eax
call fcn.0045a172
test eax, eax
jne 0x4f6998
push 0x2e0
push str.inet.cpp
call fcn.004e1770
test eax, eax
je 0x4f6998
int3
xor ecx, ecx
test ecx, ecx
jne 0x4f6975
push 0xffffffffffffffff
mov edx, dword [ebp + 0x10]
push edx
call fcn.0045a172
test eax, eax
jne 0x4f69c1
push 0x2e1
push str.inet.cpp
call fcn.004e1770
test eax, eax
je 0x4f69c1
int3
xor eax, eax
test eax, eax
jne 0x4f699e
cmp dword [ebp + 8], 0
jne 0x4f69e1
push 0x2e2
push str.inet.cpp
call fcn.004e1770
test eax, eax
je 0x4f69e1
int3
xor ecx, ecx
test ecx, ecx
jne 0x4f69c7
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004844fd
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004844fd
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x1c]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4f6a7a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54dfb7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004970a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.004ddcf7
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CInternetFile.0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0045a172
test eax, eax
jne 0x4f6ae5
push 0x2f7
push str.inet.cpp
call fcn.004e1770
test eax, eax
je 0x4f6ae5
int3
xor edx, edx
test edx, edx
jne 0x4f6ac2
cmp dword [ebp + 0x10], 0
jne 0x4f6b05
push 0x2f8
push str.inet.cpp
call fcn.004e1770
test eax, eax
je 0x4f6b05
int3
xor eax, eax
test eax, eax
jne 0x4f6aeb
push 0x2f9
push str.inet.cpp
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00493810
cmp dword [ebp + 8], 0
jne 0x4f6b38
push 0x2fa
push str.inet.cpp
call fcn.004e1770
test eax, eax
je 0x4f6b38
int3
xor edx, edx
test edx, edx
jne 0x4f6b1e
mov ecx, dword [ebp + 0x10]
call fcn.004fc249
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x58e378
call fcn.004fc490
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.004844fd
mov ecx, dword [ebp + 0x10]
call fcn.004fc37c
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x1c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004fc218
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.00484446
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0048424c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40c9d2
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], esp
push 0
mov eax, 0
call fcn.0040f980
cmp dword [ebp - 4], esp
je 0x40c9ff
push 6
call fcn.0040f97a
add esp, 4
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 4], ebx
push 0
push 0
push 0
push getpeername
push 0
push str.WinHttp.WinhttpRequest.5.1
push 0x10030
push 0
mov ebx, dword [ebp - 4]
push dword [ebx]
push 3
mov ebx, 0x412d50
call fcn.0040f986
add esp, 0x28
and eax, 1
xor eax, 1
test eax, eax
je 0x40ca7e
push getpeername
push 0
push 0x4d926a
push 0x80000301
push 0
push 0
push getpeername
push 0
push str.Http
push 3
mov ebx, 0x4116b0
call fcn.0040f986
add esp, 0x28
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 4], ebx
push 0x80000301
push 0
push 0x4e20
push 0x80000301
push 0
push 0x4e20
push 0x80000301
push 0
push 0x4e20
push 0x80000301
push 0
push 0x4e20
push getpeername
push 0
push str.SetTimeouts
push 0x10030
push 0
mov ebx, dword [ebp - 4]
push dword [ebx]
push 6
mov ebx, 0x411d10
call fcn.0040f986
add esp, 0x4c
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 4], ebx
push getpeername
push 0
push str.Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.1__WOW64__Trident_5.0_
push getpeername
push 0
push str.User_Agent
push getpeername
push 0
push str.SetRequestHeader
push 0x10030
push 0
mov ebx, dword [ebp - 4]
push dword [ebx]
push 4
mov ebx, 0x411d10
call fcn.0040f986
add esp, 0x34
mov esp, ebp
pop ebp
ret 4