joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498a20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6476
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4fa7e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
cmp dword [ebx + 8], 0
jle 0x498bd1
movdqu xmm0, xmmword [str.SoftwareMicrosoftInternet_ExplorerTabbedBrowsing]
mov eax, dword [0x4db878]
xor esi, esi
mov dword [ebp - 0x20], eax
mov eax, dword [0x4db884]
movdqu xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x54]
movdqu xmm0, xmmword [0x4db858]
push eax
push 0x2001b
movdqu xmmword [ebp - 0x40], xmm0
push esi
movdqu xmm0, xmmword [0x4db868]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x58], esi
push eax
movdqu xmmword [ebp - 0x30], xmm0
push SysReAllocString
movq xmm0, qword [str.WarnOnClose]
mov dword [ebp - 0x5c], 4
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
js 0x498b1f
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x60], 4
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
js 0x498b1a
cmp dword [ebp - 0x58], 1
jne 0x498b1a
push dword [ebp - 0x5c]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], esi
push eax
push 4
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov ecx, 1
cmovns esi, ecx
push dword [ebp - 0x54]
call edi
push 0
push ebx
call fcn.00498eb0
add esp, 8
test esi, esi
je 0x498b66
lea eax, [ebp - 0x54]
push eax
push 2
push 0
lea eax, [ebp - 0x50]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
js 0x498b66
push dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
push eax
push 4
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x54]
call edi
mov eax, dword [ebx + 8]
xor esi, esi
test eax, eax
jle 0x498bd1
nop
test esi, esi
js 0x498bed
cmp esi, eax
jge 0x498bed
mov eax, dword [ebx + 4]
mov edi, dword [eax + esi*4]
mov dword [ebp - 0x68], edi
test edi, edi
je 0x498bc9
mov edx, dword [edi + 0x30]
or ecx, 0xffffffff
sub edx, 0x10
mov dword [ebp - 4], 1
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x498ba9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [edi + 0x1c]
call fcn.004988c0
lea ecx, [edi + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.004988a0
push edi
call fcn.0049d324
add esp, 4
mov eax, dword [ebx + 8]
inc esi
cmp esi, eax
jl 0x498b70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3861
mov esp, ebp
pop ebp
ret
call fcn.0049d3c8
int3
Function at 0x498eb0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6520
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4fa7e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x24]
call fcn.00498870
mov dword [ebp - 0x24], vtable.CArrayProcessData.0
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.00498950
mov edi, dword [ebp - 0x1c]
xor esi, esi
mov ebx, dword [ebp - 0x20]
test edi, edi
jle 0x498f28
test esi, esi
js 0x498f9f
cmp esi, edi
jge 0x498f9f
push dword [ebx + esi*4]
push 0x499070
call dword [sym.imp.USER32.dll_EnumWindows]
inc esi
cmp esi, edi
jl 0x498f05
xor esi, esi
test edi, edi
jle 0x498f45
mov edi, edi
test esi, esi
js 0x498f9f
cmp esi, edi
jge 0x498f9f
mov ecx, dword [ebx + esi*4]
call fcn.004989c0
inc esi
cmp esi, edi
jl 0x498f30
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea ecx, [ebp - 0x24]
call fcn.004990c0
test eax, eax
jne 0x499018
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 3
jl 0x498f52
lea ecx, [ebp - 0x24]
call fcn.004990c0
test eax, eax
jne 0x499018
call fcn.0049dc5a
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x498fa4
push 0x80004005
call fcn.00486f80
call fcn.0049d3c8
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [0x500edc]
lea eax, [ebp - 0x10]
push 0x1fb8
push eax
mov byte [ebp - 4], 1
call fcn.00499ec0
push 0
push str.install
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor esi, esi
test edi, edi
jle 0x498ff7
test esi, esi
js 0x498f9f
cmp esi, edi
jge 0x498f9f
mov ecx, dword [ebx + esi*4]
call fcn.004993a0
inc esi
cmp esi, edi
jl 0x498fe2
mov edx, dword [ebp - 0x10]
or ecx, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x499018
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x24]
call fcn.004988c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4993a0
Capabilities:
Terminate process

Disassembly:
push esi
push dword [ecx]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4993c3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x499780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6662
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4fa7e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], 0
call fcn.0049dc5a
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4997e2
push 0x80004005
call fcn.00486f80
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 1
push 0x1a
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x118], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x499838
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x499820
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
mov ecx, esi
call fcn.00487e40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3861
mov esp, ebp
pop ebp
ret 4
Function at 0x499860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d65d1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4fa7e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0049dc5a
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4998b1
push 0x80004005
call fcn.00486f80
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov edi, dword [ebp + 0xc]
push str.system
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push dword [edi]
call fcn.004b514f
add esp, 8
test eax, eax
jne 0x4998fb
push 0x29
lea eax, [ebp - 0x14]
push eax
call fcn.0049a090
mov dword [ebp - 4], 1
jmp 0x4999ab
push str.windows
push dword [edi]
call fcn.004b514f
add esp, 8
test eax, eax
jne 0x499986
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x499930
push 0x104
mov ecx, esi
call fcn.00487c50
push 0x104
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esi]
test eax, eax
jne 0x499947
xor ecx, ecx
jmp 0x499959
push dword [eax - 8]
push eax
call fcn.004b46eb
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x49997c
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x49997c
mov dword [eax - 0xc], ecx
mov eax, dword [esi]
mov byte [ecx + eax], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00486f80
push str.program_files
push dword [edi]
call fcn.004b514f
add esp, 8
test eax, eax
jne 0x4999e7
push 0x2a
lea eax, [ebp - 0x14]
push eax
call fcn.0049a090
mov dword [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00486ab0
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x499a34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.appdata
push dword [edi]
call fcn.004b514f
add esp, 8
test eax, eax
jne 0x499a34
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00499cd0
push eax
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.00486ab0
mov edi, dword [ebp - 0x14]
or ecx, 0xffffffff
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x499a34
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x499bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6662
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4fa7e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], 0
call fcn.0049dc5a
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x499c52
push 0x80004005
call fcn.00486f80
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 1
push 0x1c
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x118], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x499ca8
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x499c90
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
mov ecx, esi
call fcn.00487e40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3861
mov esp, ebp
pop ebp
ret 4

Function at 0x499cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d66c8
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x4fa7e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], 0
call fcn.0049dc5a
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x499d32
push 0x80004005
call fcn.00486f80
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x11c], 1
call fcn.00499e50
test eax, eax
je 0x499dd3
sub esp, 0x10
cmp dword [ebp + 0xc], 0
mov eax, esp
je 0x499d85
movdqu xmm0, xmmword [0x4e3768]
movdqu xmmword [eax], xmm0
lea eax, [ebp - 0x118]
push eax
call fcn.00499f30
add esp, 0x14
mov dword [ebp - 4], 1
jmp 0x499da7
movdqu xmm0, xmmword [0x4e3758]
movdqu xmmword [eax], xmm0
lea eax, [ebp - 0x118]
push eax
call fcn.00499f30
add esp, 0x14
mov dword [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00486ab0
mov edx, dword [ebp - 0x118]
or ecx, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x499dd3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x499e18
push 1
push 0x1a
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x499e18
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
jmp 0x499e00
mov al, byte [ecx]
inc ecx
test al, al
jne 0x499e00
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
mov ecx, esi
call fcn.00487e40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3861
mov esp, ebp
pop ebp
ret 8
Function at 0x499e50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4fa7e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x90
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], 0x94
push 0
push eax
call fcn.004b4310
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x499eb0
cmp dword [ebp - 0x94], 6
jb 0x499eb0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3861
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004b3861
mov esp, ebp
pop ebp
ret

Function at 0x49a090
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6759
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4fa7e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0049dc5a
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x49a0de
push 0x80004005
call fcn.00486f80
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov ecx, 1
mov dword [ebp - 4], 0
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
mov dword [ebp - 0x10], 1
or ecx, eax
jge 0x49a11b
push 0x104
mov ecx, esi
call fcn.00487c50
push 1
push dword [ebp + 0xc]
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, dword [esi]
test eax, eax
je 0x49a140
push dword [eax - 8]
push eax
call fcn.004b46eb
add esp, 8
test eax, eax
js 0x49a164
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x49a164
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.00486f80
int3

Function at 0x49ca90
Capabilities:
Check if file exists
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x49cb30
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x49cb30
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x49cb30
cmp dword [ebp + 0x10], 0
je 0x49cb30
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x49caf5
push dword [ebp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x49caf5
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49caf5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
jne 0x49cafc
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
add eax, 0xa
push eax
call fcn.0049d329
push dword [esi]
mov edi, eax
push dword [ebp + 8]
push edi
call fcn.004b3cc0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4a159b
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6ef5
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.004b6260
mov eax, dword [0x4fa7e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edx
mov dword [ebp - 0x1028], ebx
cmp dword [ecx + 0x58], ebx
je 0x4a16cf
push ebx
push eax
call fcn.004a171e
mov ebx, eax
test ebx, ebx
jne 0x4a1603
push esi
jmp 0x4a16f7
call fcn.0049dc5a
push eax
lea ecx, [ebp - 0x1014]
call fcn.0049d5b0
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x101c]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1024], eax
test eax, eax
jne 0x4a168e
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.00487cc0
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x101c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x1024], eax
call fcn.00487d60
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1024], 0
jne 0x4a16bc
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.00486fe0
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00487d40
jmp 0x4a16fe
push esi
mov ecx, edi
call fcn.004861f0
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x4a16b5
test esi, esi
jne 0x4a16d8
mov esi, 0x4ee565
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.004861f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b3861
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4a244c
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x4d7008
call fcn.004b6e51
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004a2615
and dword [ebp - 4], 0
mov dword [ebx], vtable.CHttpConnection.0
call fcn.0049dc5a
push eax
lea ecx, [ebx + 0x18]
call fcn.0049d5b0
push dword [ebp + 0xc]
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
call fcn.00487e00
push dword [ebx + 8]
push 0
push 3
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebx + 4], eax
test eax, eax
jne 0x4a24c2
push eax
push dword [ebx + 8]
call fcn.004a2c0d
push dword [ebx + 0xc]
mov ecx, 0x500f30
push eax
call fcn.004a37f3
mov eax, ebx
call fcn.004b6e1f
ret 0x18
Function at 0x4a24da
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x4d7008
call fcn.004b6e51
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.004a2615
and dword [ebp - 4], 0
mov dword [ebx], vtable.CHttpConnection.0
call fcn.0049dc5a
push eax
lea ecx, [ebx + 0x18]
call fcn.0049d5b0
push dword [ebp + 0xc]
lea ecx, [ebx + 0x18]
mov byte [ebp - 4], 1
call fcn.00487e00
push dword [ebx + 8]
push dword [ebp + 0x10]
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebx + 4], eax
test eax, eax
jne 0x4a2551
push eax
push dword [ebx + 8]
call fcn.004a2c0d
push dword [ebx + 0xc]
mov ecx, 0x500f30
push eax
call fcn.004a37f3
mov eax, ebx
call fcn.004b6e1f
ret 0x1c

Function at 0x4a2795
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x4a27be
call fcn.004a4af7
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 8], eax
test eax, eax
je 0x4a27eb
push esi
push eax
mov ecx, 0x500f30
call fcn.004a37f3
mov eax, esi
pop esi
pop ebp
ret 0x18
push 0
push dword [esi + 4]
call fcn.004a2c0d
int3
Function at 0x4a39da
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x4fa7e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x840], eax
test edi, edi
je 0x4a3ad8
test ecx, ecx
je 0x4a3ad8
mov edx, dword [ebp + 0x18]
xor eax, eax
and edx, 0x2e000000
mov dword [ebp - 0x830], 0x824
test dword [ebp + 0x18], 0x90000000
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x844], edx
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x838], eax
je 0x4a3a72
cmp dword [edi + 0x30], eax
je 0x4a3a72
test dword [ebp + 0x18], 0x2000000
je 0x4a3a68
mov dword [ebp - 0x838], 1
jmp 0x4a3a72
mov dword [ebp - 0x83c], SysReAllocString
push edx
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x828]
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
jne 0x4a3aed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4a3ad8
push dword [ebp - 0x830]
call fcn.0049d2f7
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4a3ad8
push dword [ebp - 0x844]
lea eax, [ebp - 0x830]
mov dword [ebp - 0x82c], 1
push eax
push ebx
push dword [ebp - 0x834]
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
jne 0x4a3af3
push ebx
call fcn.0049d324
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3861
mov esp, ebp
pop ebp
ret 0x14
lea ebx, [ebp - 0x828]
push edi
push dword [ebp - 0x83c]
push 0
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp dword [ebp - 0x838], 0
mov dword [ebp - 0x834], eax
je 0x4a3b54
cmp dword [edi + 0x2c], 0
je 0x4a3b28
push dword [edi + 0x2c]
call fcn.004b6a50
pop ecx
cmp eax, 0x824
jae 0x4a3b76
push 0x2100000
xor eax, eax
push eax
push eax
push dword [edi + 0x2c]
call dword [sym.imp.SHLWAPI.dll_UrlUnescapeA]
test eax, eax
js 0x4a3b76
cmp dword [edi + 0x2c], 0
jne 0x4a3b48
xor eax, eax
jmp 0x4a3b51
push dword [edi + 0x2c]
call fcn.004b6a50
pop ecx
mov dword [edi + 0x30], eax
cmp dword [ebp - 0x82c], 0
je 0x4a3b64
push ebx
call fcn.0049d324
pop ecx
mov ecx, dword [ebp - 0x834]
test ecx, ecx
jne 0x4a3b88
mov dword [esi], 0x1000
jmp 0x4a3be3
cmp dword [ebp - 0x82c], 0
je 0x4a3ad8
jmp 0x4a3ad1
mov edx, dword [ebp - 0x840]
mov ax, word [edi + 0x18]
mov word [edx], ax
mov eax, dword [edi + 0xc]
dec eax
je 0x4a3bdd
dec eax
je 0x4a3bd5
dec eax
je 0x4a3bcd
dec eax
je 0x4a3bc5
dec eax
je 0x4a3bbd
dec eax
je 0x4a3bb5
dec eax
jne 0x4a3b6e
mov dword [esi], 0x1002
jmp 0x4a3be3
mov dword [esi], 0x1006
jmp 0x4a3be3
mov dword [esi], 0x1001
jmp 0x4a3be3
mov dword [esi], 0x100b
jmp 0x4a3be3
mov dword [esi], 3
jmp 0x4a3be3
mov dword [esi], 2
jmp 0x4a3be3
mov dword [esi], 1
mov eax, ecx
jmp 0x4a3ada