joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459fb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5c5c30]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00459de0
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x459ff5
push 0x66
push 0x543470
call fcn.0045b590
test eax, eax
je 0x459ff5
int3
mov dword [ebp - 0x8c], 0x40
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x45a06a
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx - 4]
mov dword [ebp - 0x94], eax
push 0x40
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x40
lea edx, [ebp - 0x88]
push edx
call fcn.004def20
add esp, 0x10
cmp eax, 1
je 0x45a068
push 0xffffffffffffffff
push 0
mov eax, dword [ebp + 0x14]
push eax
call fcn.00429f90
mov ecx, dword [ebp + 8]
call fcn.00459ef0
jmp 0x45a0dd
call fcn.004dc110
mov ecx, dword [eax]
mov dword [ebp - 0x98], ecx
call fcn.004dc110
mov dword [eax], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0x3f
push 0x40
lea ecx, [ebp - 0x88]
push ecx
call fcn.004d78d0
add esp, 0x14
call fcn.004dc110
cmp dword [eax], 0
je 0x45a0b9
call fcn.004dc110
mov edx, dword [eax]
push edx
call fcn.00429990
add esp, 4
jmp 0x45a0c6
call fcn.004dc110
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
xor edx, edx
jne 0x45a06a
lea eax, [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.00471a40
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d1610
mov esp, ebp
pop ebp
ret

Function at 0x45a8f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.00459e10
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.004502f0
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x45a979
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x45a950
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0042cf80
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x45a96d
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.0040bf20
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00426f40
jmp 0x45a9aa
mov ecx, dword [ebp + 0x10]
call fcn.0040d7e0
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x45a9aa
mov ecx, dword [ebp + 0x10]
call fcn.0040d7e0
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00471a40
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45f140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519cbe
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x5c5c30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.004a5b40
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CInternetFile.0
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.0040ac00
mov byte [ebp - 4], 1
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00467aa0
test eax, eax
jne 0x45f1b2
push 0x325
push 0x546f60
call fcn.0045b590
test eax, eax
je 0x45f1b2
int3
cmp dword [ebp + 0x10], 0
jne 0x45f1cc
push 0x326
push 0x546f94
call fcn.0045b590
test eax, eax
je 0x45f1cc
int3
push 0x327
push 0x546fc8
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0045d090
cmp dword [ebp + 8], 0
jne 0x45f1f9
push 0x328
push 0x546ffc
call fcn.0045b590
test eax, eax
je 0x45f1f9
int3
mov ecx, dword [ebp + 0x10]
call fcn.00464b30
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x5c9788
call fcn.00464f20
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.0040adb0
mov ecx, dword [ebp + 0x10]
call fcn.00464ce0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x1c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00464af0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.0040ad90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0040ad40
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45faa0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x30], 0
je 0x45fb0f
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x2c], 0
jbe 0x45fb0f
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x45faec
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.00464770
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x2c]
je 0x45fb05
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.00464770
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0
mov esp, ebp
pop ebp
ret
Function at 0x45fea0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x488
push 0x5476b0
mov eax, dword [ebp - 8]
push eax
call fcn.0045d090
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], 0
jne 0x45fed9
push 0x489
push 0x5476e4
call fcn.0045b590
test eax, eax
je 0x45fed9
int3
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00467ae0
test eax, eax
jne 0x45ff00
push 0x48a
push 0x547718
call fcn.0045b590
test eax, eax
je 0x45ff00
int3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
je 0x45ff26
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
je 0x45ff26
push 0x48b
push 0x54774c
call fcn.0045b590
test eax, eax
je 0x45ff26
int3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 1
je 0x45ff38
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], 0
jne 0x45ff46
push 6
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call fcn.00464770
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x30], 0
jne 0x45ff95
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x45ff7a
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.00464770
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x45ff90
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.00464770
jmp 0x460063
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
add ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [edx + 0x28]
jb 0x45ffe1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x45ffd7
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.00464770
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0x28]
jb 0x460019
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x460017
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call fcn.00464770
jmp 0x460063
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x2c]
add edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
cmp edx, dword [eax + 0x28]
ja 0x460063
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + 0x28]
sub edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 0x2c]
push ecx
call fcn.00415320
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
add ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x460480
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x52f
push 0x547958
mov eax, dword [ebp - 8]
push eax
call fcn.0045d090
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], 0
jne 0x4604b9
push 0x530
push 0x54798c
call fcn.0045b590
test eax, eax
je 0x4604b9
int3
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
je 0x4604e9
push 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x4604e9
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x460da0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519db4
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c5c30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x18]
push eax
mov cx, word [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004607b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CFtpConnection.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040ac00
mov byte [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x460e18
push 0x615
push 0x548094
call fcn.0045b590
test eax, eax
je 0x460e18
int3
push 0x54ab90
mov ecx, dword [ebp + 8]
call fcn.0045cf80
test eax, eax
jne 0x460e3d
push 0x616
push 0x5480c8
call fcn.0045b590
test eax, eax
je 0x460e3d
int3
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00467aa0
test eax, eax
jne 0x460e60
push 0x617
push 0x5480fc
call fcn.0045b590
test eax, eax
je 0x460e60
int3
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040adb0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x20]
neg eax
sbb eax, eax
and eax, 0x8000000
push eax
push 1
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ax, word [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00464b50
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jne 0x460ec9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call fcn.00464770
jmp 0x460ee1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
mov ecx, 0x5c9788
call fcn.00464f20
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x461aa0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519e83
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c5c30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x18]
push eax
mov cx, word [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004607b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CGopherConnection.0
cmp dword [ebp + 8], 0
jne 0x461b09
push 0x70b
push 0x548ba0
call fcn.0045b590
test eax, eax
je 0x461b09
int3
push 0x54ab90
mov ecx, dword [ebp + 8]
call fcn.0045cf80
test eax, eax
jne 0x461b2e
push 0x70c
push 0x548bd4
call fcn.0045b590
test eax, eax
je 0x461b2e
int3
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00467aa0
test eax, eax
jne 0x461b51
push 0x70d
push 0x548c08
call fcn.0045b590
test eax, eax
je 0x461b51
int3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
push 0
push 2
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov cx, word [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00464b50
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jne 0x461b9b
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call fcn.00464770
jmp 0x461bb3
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x5c9788
call fcn.00464f20
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4623d0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51a034
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c5c30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov cx, word [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004607b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CHttpConnection.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040ac00
mov byte [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x462448
push 0x7bc
push 0x548fc4
call fcn.0045b590
test eax, eax
je 0x462448
int3
push 0x54ab90
mov ecx, dword [ebp + 8]
call fcn.0045cf80
test eax, eax
jne 0x46246d
push 0x7bd
push 0x548ff8
call fcn.0045b590
test eax, eax
je 0x46246d
int3
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00467aa0
test eax, eax
jne 0x462490
push 0x7be
push 0x54902c
call fcn.0045b590
test eax, eax
je 0x462490
int3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
push 0
push 3
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov cx, word [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00464b50
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jne 0x4624da
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call fcn.00464770
jmp 0x4624f2
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x5c9788
call fcn.00464f20
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x462510
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51a062
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5c5c30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x20]
push eax
mov cx, word [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004607b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CHttpConnection.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040ac00
mov byte [ebp - 4], 1
cmp dword [ebp + 8], 0
jne 0x462588
push 0x7d2
push 0x549060
call fcn.0045b590
test eax, eax
je 0x462588
int3
push 0x54ab90
mov ecx, dword [ebp + 8]
call fcn.0045cf80
test eax, eax
jne 0x4625ad
push 0x7d3
push 0x549094
call fcn.0045b590
test eax, eax
je 0x4625ad
int3
mov ecx, dword [ebp + 0x10]
and ecx, 0x10000000
je 0x4625cc
push 0x7d4
push 0x5490c8
call fcn.0045b590
test eax, eax
je 0x4625cc
int3
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.00467aa0
test eax, eax
jne 0x4625ef
push 0x7d5
push 0x5490fc
call fcn.0045b590
test eax, eax
je 0x4625ef
int3
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 3
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov cx, word [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00464b50
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jne 0x46263b
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call fcn.00464770
jmp 0x462653
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x5c9788
call fcn.00464f20
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x469790
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x4e
push 0x54e3d4
mov eax, dword [ebp - 0x24]
push eax
call fcn.0045d090
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x3c], 0
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x4697f6
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x3c]
or eax, 1
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x3c], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x38]
or eax, 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x38], eax
jmp 0x469823
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
test edx, edx
jge 0x469823
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x3c]
or ecx, 2
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x3c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x38]
or ecx, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x38], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
call fcn.00434350
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x34], 0
jne 0x4698ff
call fcn.00434330
cmp eax, dword [ebp + 8]
je 0x469850
jmp 0x4698ff
push 1
push 0x209
push 0x200
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x469888
push 1
push 0x109
push 0x100
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4698df
cmp dword [ebp - 0x1c], 0x202
je 0x4698ac
cmp dword [ebp - 0x1c], 0x205
je 0x4698ac
cmp dword [ebp - 0x1c], 0x201
je 0x4698ac
cmp dword [ebp - 0x1c], 0x204
jne 0x4698ae
jmp 0x4698ff
cmp dword [ebp - 0x1c], 0x100
jne 0x4698bf
cmp dword [ebp - 0x18], 0x1b
jne 0x4698bf
jmp 0x4698ff
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x24
call fcn.00510560
neg eax
sbb eax, eax
add eax, 1
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [0x5c97cc]
jbe 0x4698fa
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x34], 1
jmp 0x469834
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x34]
mov esp, ebp
pop ebp
ret 4
Function at 0x46a870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x109
push 0x54fa4c
mov eax, dword [ebp - 8]
push eax
call fcn.0045d090
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x46a8a9
push 0x10a
push 0x54fa84
call fcn.0045b590
test eax, eax
je 0x46a8a9
int3
cmp dword [ebp + 0xc], 0
jne 0x46a8b3
xor eax, eax
jmp 0x46a92e
cmp dword [ebp + 8], 0
jne 0x46a8cd
push 0x10f
push 0x54fabc
call fcn.0045b590
test eax, eax
je 0x46a8cd
int3
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00467ae0
test eax, eax
jne 0x46a8f4
push 0x110
push 0x54faf4
call fcn.0045b590
test eax, eax
je 0x46a8f4
int3
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46a92b
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0040d7e0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047b960
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x46a940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x11b
push 0x54fb2c
mov eax, dword [ebp - 8]
push eax
call fcn.0045d090
mov ecx, dword [ebp - 8]
cmp dword [ecx + 4], 0xffffffff
jne 0x46a979
push 0x11c
push 0x54fb64
call fcn.0045b590
test eax, eax
je 0x46a979
int3
cmp dword [ebp + 0xc], 0
jne 0x46a984
jmp 0x46aa19
cmp dword [ebp + 8], 0
jne 0x46a99e
push 0x121
push 0x54fb9c
call fcn.0045b590
test eax, eax
je 0x46a99e
int3
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00467ae0
test eax, eax
jne 0x46a9c5
push 0x122
push 0x54fbd4
call fcn.0045b590
test eax, eax
je 0x46a9c5
int3
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46a9fc
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0040d7e0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047b960
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x46aa19
mov ecx, dword [ebp - 8]
add ecx, 0xc
call fcn.0040d7e0
push eax
push 0xffffffffffffffff
push 0xd
call fcn.0047bb80
mov esp, ebp
pop ebp
ret 8