joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416e1b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x454], ecx
call fcn.00404af6
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.004168cf
push dword [ebp - 0x454]
lea ecx, [ebp - 0x18]
call fcn.0041701c
lea ecx, [ebp - 0x438]
call fcn.00417039
push 0x400
push dword [ebp + 8]
call fcn.00416ab4
pop ecx
pop ecx
mov dword [ebp - 8], eax
push 2
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x416e95
call fcn.00416920
mov dword [ebp - 0x444], eax
jmp 0x416fda
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jne 0x416ec3
call fcn.00416920
mov dword [ebp - 0x444], eax
jmp 0x416fda
push dword [ebp - 0x440]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x416ef1
call fcn.00416920
mov dword [ebp - 0x444], eax
jmp 0x416fda
push dword [ebp - 0x440]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
inc eax
cmp eax, dword [ebp - 0x1c]
jae 0x416f3d
mov dword [ebp - 0x44c], 0x8007000e
lea ecx, [ebp - 0x438]
call fcn.0041704b
lea ecx, [ebp - 0x2c]
call fcn.004168e1
mov eax, dword [ebp - 0x44c]
jmp 0x41700e
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea ecx, [ebp - 0x438]
call fcn.0041707d
lea ecx, [ebp - 0x438]
call fcn.00418e2a
test eax, eax
jne 0x416f68
mov dword [ebp - 0x444], 0x8007000e
jmp 0x416fda
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x438]
call fcn.00418e2a
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
push 0
call fcn.00404af6
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x416fa7
call fcn.00416920
mov dword [ebp - 0x444], eax
jmp 0x416fda
lea ecx, [ebp - 0x438]
call fcn.00418e2a
mov ecx, dword [ebp - 0x43c]
and word [eax + ecx*2], 0
push dword [ebp + 0x14]
lea ecx, [ebp - 0x438]
call fcn.00418e2a
push eax
lea ecx, [ebp - 0x18]
call fcn.0041716b
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x10], 0
je 0x416fe9
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x438]
call fcn.0041704b
lea ecx, [ebp - 0x2c]
call fcn.004168e1
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00467392
leave
ret 0x10
Function at 0x418c4a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x10]
call fcn.0040bbd6
push 0x2001f
push dword [ebp + 8]
mov eax, dword [ebp - 0x228]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.0040bb53
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x418ca8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x10]
call fcn.0040bbc5
mov eax, dword [ebp - 0x21c]
jmp 0x418d37
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x418d0d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
call fcn.00418c4a
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x418d04
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x10]
call fcn.0040bbc5
mov eax, dword [ebp - 0x220]
jmp 0x418d37
mov dword [ebp - 4], 0x100
jmp 0x418caf
lea ecx, [ebp - 0x10]
call fcn.0040bb98
push dword [ebp + 8]
mov ecx, dword [ebp - 0x228]
call fcn.00418db0
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x10]
call fcn.0040bbc5
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00467392
leave
ret 4
Function at 0x421130
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a368c
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov eax, dword [ebp - 0x230]
mov dword [eax], 0
lea ecx, [ebp - 0x220]
call fcn.00405558
mov dword [ebp - 4], 0
push 0
push 0x28
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4a9890
push 0x4a98ac
lea ecx, [ebp - 0x224]
call fcn.00414bad
mov dword [ebp - 0x234], eax
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x238], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x228]
push edx
call fcn.00414be6
add esp, 0xc
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x240]
push ecx
lea edx, [ebp - 0x22c]
push edx
call fcn.0041421d
add esp, 0xc
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00407557
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
call fcn.0040558b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x228]
call fcn.0040558b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.0040558b
lea ecx, [ebp - 0x220]
call fcn.00405490
push eax
push 0
push 0x4a98b0
push 0x4a98c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4212a5
mov byte [0x4c9070], 1
push 0x4a98e4
push str.log.txt
call fcn.0046d0fb
add esp, 8
mov edx, dword [ebp - 0x230]
mov dword [edx], eax
jmp 0x4212ac
mov byte [0x4c9070], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.0040558b
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00467392
mov esp, ebp
pop ebp
ret
Function at 0x4218b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x54], eax
mov ecx, dword [ebp - 8]
add ecx, 0x38
call fcn.00422210
mov edx, dword [ebp - 8]
add edx, 0x38
push edx
push 0x2711
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.0042b710
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call fcn.0042b740
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x58], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x58], 0
je 0x421923
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x34]
add eax, 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x34], eax
cmp ecx, 2
jl 0x4218c5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx + 0x54]
mov edx, dword [ebp - 8]
mov dword [edx + 0x54], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x58], 0
je 0x4219b8
movzx ecx, byte [0x4c9070]
test ecx, ecx
je 0x42199e
call fcn.00421450
mov ecx, eax
call fcn.004214e0
test eax, eax
je 0x42199e
push 0x4a99a0
push 0x56
push 0x4a99a8
push 0x4a99c4
push 0x4a99dc
call fcn.00421450
mov ecx, eax
call fcn.004214e0
push eax
call fcn.0046c963
add esp, 0x18
push str.notify_check_network_error_n
call fcn.00421450
push eax
call fcn.00421420
add esp, 8
xor edx, edx
jne 0x421945
push 8
mov ecx, dword [ebp - 8]
call fcn.0042b490
mov dword [ebp - 4], 0xffffffff
jmp 0x421a42
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.0042c4c0
add esp, 4
test eax, eax
je 0x421a3b
movzx edx, byte [0x4c9070]
test edx, edx
je 0x421a24
call fcn.00421450
mov ecx, eax
call fcn.004214e0
test eax, eax
je 0x421a24
push 0x4a9a08
push 0x5c
push str.update_checker::download
push 0x4a9a2c
push 0x4a9a44
call fcn.00421450
mov ecx, eax
call fcn.004214e0
push eax
call fcn.0046c963
add esp, 0x18
push str.notify_check_server_response_error_n
call fcn.00421450
push eax
call fcn.00421420
add esp, 8
xor eax, eax
jne 0x4219cb
push 9
mov ecx, dword [ebp - 8]
call fcn.0042b490
mov dword [ebp - 4], 0xffffffff
jmp 0x421a42
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x426700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4aafe8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x426782
mov dword [ebp - 0x10], 0x104
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.Install_Path
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x426776
lea edx, [ebp - 0x120]
push edx
mov ecx, dword [ebp + 8]
call fcn.004010dd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4267e8
movzx ecx, byte [0x4c9070]
test ecx, ecx
je 0x4267df
call fcn.00421450
mov ecx, eax
call fcn.004214e0
test eax, eax
je 0x4267df
push 0x4ab03c
push 0x1d
push str.get_install_dir
push 0x4ab054
push 0x4ab07c
call fcn.00421450
mov ecx, eax
call fcn.004214e0
push eax
call fcn.0046c963
add esp, 0x18
mov edx, dword [ebp - 0xc]
push edx
push str.error_ret_d_n
call fcn.00421450
push eax
call fcn.00421420
add esp, 0xc
xor eax, eax
jne 0x426782
or eax, 0xffffffff
jmp 0x4267ea
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00467392
mov esp, ebp
pop ebp
ret
Function at 0x426ba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
call fcn.0042c460
movzx eax, al
test eax, eax
je 0x426ca1
push 1
push 0
push 0x4ab204
mov ecx, dword [ebp + 8]
call fcn.004010f3
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jne 0x426bfd
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.004010f3
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
call fcn.0041a390
mov ecx, eax
call fcn.0041ab80
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0x10]
call edx
cmp dword [ebp - 4], 0x20
jg 0x426c9c
movzx eax, byte [0x4c9070]
test eax, eax
je 0x426c90
call fcn.00421450
mov ecx, eax
call fcn.004214e0
test eax, eax
je 0x426c90
push 0x4ab220
push 0x61
push 0x4ab228
push 0x4ab248
push 0x4ab270
call fcn.00421450
mov ecx, eax
call fcn.004214e0
push eax
call fcn.0046c963
add esp, 0x18
mov ecx, dword [ebp + 8]
call fcn.004010f3
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ShellExecute_runas__failed__d__result_d_file_S_n
call fcn.00421450
push eax
call fcn.00421420
add esp, 0x14
xor edx, edx
jne 0x426c23
or eax, 0xffffffff
jmp 0x426d51
jmp 0x426d4f
push 1
push 0
push str.no_args
mov ecx, dword [ebp + 8]
call fcn.004010f3
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
call fcn.0041a390
mov ecx, eax
call fcn.0041ab80
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebp - 4], 0x20
jg 0x426d4f
movzx ecx, byte [0x4c9070]
test ecx, ecx
je 0x426d46
call fcn.00421450
mov ecx, eax
call fcn.004214e0
test eax, eax
je 0x426d46
push 0x4ab2c4
push 0x6a
push str.win_update_installer::do_exe
push 0x4ab2ec
push 0x4ab314
call fcn.00421450
mov ecx, eax
call fcn.004214e0
push eax
call fcn.0046c963
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ShellExecuteW_NULL_NULL_file_NULL_NULL_SW_NORMAL__ERROR_d_n
call fcn.00421450
push eax
call fcn.00421420
add esp, 0xc
xor edx, edx
jne 0x426ce6
or eax, 0xffffffff
jmp 0x426d51
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x428b20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x4c91c4]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
je 0x428b37
push eax
call edi
test eax, eax
jne 0x428b6d
push esi
call fcn.00428420
push 0x427ee0
push 0x4c91c0
mov esi, eax
call fcn.00428840
mov eax, dword [0x4c91c4]
add esp, 8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x4c91c4]
test eax, eax
pop esi
jne 0x428b6a
pop edi
ret
push eax
call edi
pop edi
ret
Function at 0x428fb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4a4358
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c6644]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4c91c4]
test eax, eax
jne 0x428fe2
xor esi, esi
jmp 0x428feb
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
je 0x42902d
cmp dword [esi + 0x14], 0
jne 0x42906f
cmp dword [esi + 0x10], 0
jne 0x429075
push 0x427ee0
push 0x4c91c0
call fcn.00428840
mov eax, dword [0x4c91c4]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
mov dword [esp + 0x20], 0xffffffff
je 0x42905b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x42905b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x4290b5
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x4290a3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x429075
cmp dword [esi + 0x14], 0
je 0x429007
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4290da
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x42910b
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x42910b
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x42910b
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x4290bf
jmp 0x429001
Function at 0x4291c0
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x429130
push 0
push 0
call fcn.0046b15b
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x429200
lea ecx, [esp + 8]
call fcn.0042a490
push 0x4bda24
lea edx, [esp + 0xc]
push edx
call fcn.0046cc14
mov eax, dword [edi + 8]
push esi
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi + 8]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x429229
cmp eax, 0xffffffff
je 0x429229
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x42b530
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4c6644]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x42b580
mov ax, word [esp]
cmp al, 2
jne 0x42b57a
cmp ah, al
jne 0x42b57a
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00467392
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.00467392
add esp, 0x194
ret

Function at 0x42c460
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.00467660
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
mov esp, ebp
pop ebp
ret

Function at 0x42c4c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x200002
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042b860
add esp, 0xc
movzx edx, byte [0x4c9070]
test edx, edx
je 0x42c53d
call fcn.00421450
mov ecx, eax
call fcn.004214e0
test eax, eax
je 0x42c53d
push 0x4ac65c
push 0x6b
push str.check_response_code
push 0x4ac678
push 0x4ac684
call fcn.00421450
mov ecx, eax
call fcn.004214e0
push eax
call fcn.0046c963
add esp, 0x18
mov eax, dword [ebp - 4]
push eax
push str.http_code_d_n
call fcn.00421450
push eax
call fcn.00421420
add esp, 0xc
xor ecx, ecx
jne 0x42c4e0
cmp dword [ebp - 4], 0xc8
je 0x42c585
cmp dword [ebp - 4], 0xc9
je 0x42c585
cmp dword [ebp - 4], 0xca
je 0x42c585
cmp dword [ebp - 4], 0xcb
je 0x42c585
cmp dword [ebp - 4], 0xcc
je 0x42c585
cmp dword [ebp - 4], 0xcd
je 0x42c585
cmp dword [ebp - 4], 0xce
je 0x42c585
or eax, 0xffffffff
jmp 0x42c587
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42e960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4a18
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x42e9a0
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x42e9ac
mov al, 1
jmp 0x42eb4f
mov dword [ebp - 0x10], 8
call fcn.0042ccc0
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0042ccc0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0042cd80
add esp, 8
movzx eax, al
test eax, eax
je 0x42e9ef
xor al, al
jmp 0x42eb4f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0042ddc0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.00422300
mov ecx, eax
call fcn.0042ec50
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00404e53
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00422300
mov ecx, eax
call fcn.0042ec50
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.0042eed0
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x42ea6a
cmp dword [ebp - 0x6c], 1
je 0x42ea71
cmp dword [ebp - 0x6c], 3
je 0x42eb0b
jmp 0x42eb23
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00422300
mov ecx, eax
call fcn.0042ec50
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x42ead4
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.00422300
mov ecx, eax
call fcn.0042ec50
push eax
call fcn.0046f5aa
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x42ead4
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004052e5
mov al, byte [ebp - 0x61]
jmp 0x42eb4f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x42eaf7
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004052e5
mov al, byte [ebp - 0x62]
jmp 0x42eb4f
cmp dword [ebp - 0x38], 0
jne 0x42eb09
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004117e5
jmp 0x42eb3b
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004052e5
mov al, byte [ebp - 0x63]
jmp 0x42eb4f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004052e5
mov al, byte [ebp - 0x64]
jmp 0x42eb4f
jmp 0x42ea02
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00467392
mov esp, ebp
pop ebp
ret
Function at 0x434010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x43401f
mov eax, dword [eax + 4]
jmp 0x434022
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4340b4
push esi
mov esi, dword [0x4c92ac]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x434099
cmp eax, 3
je 0x434099
cmp eax, 0x7b
je 0x434099
cmp eax, 0xf
je 0x434099
cmp eax, 0x57
je 0x434099
cmp eax, 0xa1
je 0x434099
cmp eax, 0x35
je 0x434099
cmp eax, 0x20
jne 0x43408e
mov eax, dword [0x4c92b0]
mov dword [ecx], eax
mov edx, dword [0x4c92b4]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4c92b0]
mov dword [ecx], eax
mov edx, dword [0x4c92b4]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4c92b0]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4c92b4]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4340e1
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x4340f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x4340ff
mov eax, dword [eax + 4]
jmp 0x434102
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x434194
push esi
mov esi, dword [0x4c92ac]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x434179
cmp eax, 3
je 0x434179
cmp eax, 0x7b
je 0x434179
cmp eax, 0xf
je 0x434179
cmp eax, 0x57
je 0x434179
cmp eax, 0xa1
je 0x434179
cmp eax, 0x35
je 0x434179
cmp eax, 0x20
jne 0x43416e
mov eax, dword [0x4c92b0]
mov dword [ecx], eax
mov edx, dword [0x4c92b4]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4c92b0]
mov dword [ecx], eax
mov edx, dword [0x4c92b4]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4c92b0]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4c92b4]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4341c1
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x4348a0
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x4348bb
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret