joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e161
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
mov esi, ecx
inc edi
mov eax, dword [ebp + 8]
sub eax, ebx
jne 0x41e17a
mov dword [ebp + 8], edi
jmp 0x41e16e
dec eax
je 0x41e23f
dec eax
je 0x41e191
dec eax
je 0x41e1e6
dec eax
je 0x41e1ab
dec eax
jne 0x41e26d
push edi
cmp byte [ebp + 0xc], bl
jne 0x41e238
push dword [esi + 0x2f4]
call fcn.0041dcc4
jmp 0x41e294
push dword [esi + 0x7c]
mov eax, dword [esi + 0x2f4]
push eax
call fcn.0042930e
pop ecx
pop ecx
test eax, eax
je 0x41e1c7
mov ecx, esi
call fcn.0041cf7d
push 2
push 0x44b696
mov ecx, esi
call fcn.0041cebd
or dword [esi + 0x54], 8
push 4
push 0x15
mov ecx, esi
call fcn.0041cfcc
jmp 0x41e233
cmp byte [ebp + 0xc], bl
jne 0x41e207
push dword [esi + 0x7c]
mov eax, dword [esi + 0x2f4]
push eax
call fcn.0042930e
pop ecx
pop ecx
test eax, eax
je 0x41e207
mov ecx, esi
call fcn.0041cf7d
push ebx
push edi
mov ecx, esi
call fcn.0041e051
test eax, eax
je 0x41e26d
push ebx
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x44b696
mov ecx, esi
mov dword [esi + 0x38], eax
call fcn.0041cebd
or dword [esi + 0x54], 0x40
or eax, 0xffffffff
jmp 0x41e296
call fcn.0041d9fc
jmp 0x41e294
cmp byte [ebp + 0xc], bl
jne 0x41e260
push dword [esi + 0x7c]
mov eax, dword [esi + 0x2f4]
push eax
call fcn.0042930e
pop ecx
pop ecx
test eax, eax
je 0x41e260
mov ecx, esi
call fcn.0041cf7d
push ebx
push edi
mov ecx, esi
call fcn.0041e051
test eax, eax
jne 0x41e271
xor eax, eax
jmp 0x41e296
push 4
push 0x44b696
mov ecx, esi
call fcn.0041cebd
push ebx
push ebx
push ebx
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x41e29d
Capabilities:
Clear file content
Create thread
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x80], 0
push edi
je 0x41e394
lea ecx, [esi + 0xb8]
call fcn.004202f0
and eax, edx
cmp eax, 0xffffffff
je 0x41e394
and dword [ebp - 0x10], 0
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
or eax, dword [ebp - 0xc]
jne 0x41e341
push 1
lea ecx, [esi + 0xb8]
call fcn.004203aa
xor edi, edi
push edi
lea ecx, [esi + 0xb8]
call fcn.004202f0
push edx
push eax
push dword [esi + 0x4c]
call fcn.0041c9ed
add esp, 0x10
test al, al
je 0x41e327
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov byte [ebp - 1], 1
test eax, eax
jne 0x41e32b
mov byte [ebp - 1], 0
push edi
lea ecx, [esi + 0xb8]
call fcn.004203aa
cmp byte [ebp - 1], 0
jne 0x41e343
xor eax, eax
jmp 0x41e397
xor edi, edi
lea ecx, [esi + 0xb8]
call fcn.00420961
cmp eax, 1
jne 0x41e394
lea ecx, [esi + 0xb8]
call fcn.004202f0
cmp edx, edi
ja 0x41e369
cmp eax, 0x6400000
jbe 0x41e394
lea eax, [esi + 0x30]
push eax
mov dword [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x41d3e5
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e39c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov edi, 0x44b696
cmp dword [ebp + 0xc], ebx
je 0x41e3ef
push ebx
push 1
call fcn.0041e051
mov ecx, esi
test eax, eax
jne 0x41e3e7
call fcn.00426858
push 2
push edi
mov dword [ebp + 8], eax
call fcn.0041cebd
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0041d13e
or dword [esi + 0x54], 8
push 3
pop eax
jmp 0x41e475
push 4
push edi
call fcn.0041cebd
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x41e453
dec eax
je 0x41e453
dec eax
je 0x41e410
dec eax
jne 0x41e472
or dword [esi + 0x54], 8
push 4
push 0x15
mov ecx, esi
call fcn.0041cfcc
jmp 0x41e472
push 4
push edi
mov ecx, esi
call fcn.0041cebd
lea ecx, [esi + 0xb8]
call fcn.0042004f
push ebx
push dword [esi + 0x4c]
mov dword [ebp - 8], eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp ecx, edi
jb 0x41e472
ja 0x41e441
cmp eax, dword [ebp - 8]
jbe 0x41e472
push ebx
push edi
push dword [ebp - 8]
push dword [esi + 0x4c]
call fcn.0041c9ed
add esp, 0x10
jmp 0x41e469
push 4
push edi
mov ecx, esi
call fcn.0041cebd
push ebx
push ebx
push ebx
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41e4f7
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41e57e
mov eax, dword [edi + 0x90]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x41e51b
mov eax, ecx
cmp eax, ecx
je 0x41e530
jle 0x41e57e
cmp eax, 5
jg 0x41e57e
push ecx
mov ecx, edi
call fcn.0041d9fc
jmp 0x41e57e
push esi
push 4
mov esi, 0x44b696
push esi
mov ecx, edi
call fcn.0041cebd
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x41e57d
mov ecx, edi
call fcn.00426858
push 2
push esi
mov dword [ebp - 4], eax
call fcn.0041cebd
lea eax, [ebp - 4]
push eax
mov ecx, edi
call fcn.0041d13e
push 4
push esi
mov ecx, edi
call fcn.0041cebd
push 0
mov ecx, edi
call fcn.0041d9fc
pop esi
pop edi
leave
ret

Function at 0x41e8e8
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x443b01
call fcn.00429d10
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x24], ebx
je 0x41e960
lea ecx, [ebp - 0x18]
call fcn.00424787
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.0042475e
lea edi, [esi + 0x1c]
push edi
lea ecx, [ebp - 0x18]
call fcn.0042476c
mov ecx, dword [esi + 0x24]
imul ecx, ecx, 0xea60
cmp eax, ecx
jbe 0x41e954
mov ecx, edi
call fcn.0042475e
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
push 0x41e47c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00424757
call fcn.00429de8
ret
Function at 0x41f275
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 4
mov eax, 0x443ba0
call fcn.00429d10
mov esi, ecx
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
call fcn.0041e581
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0041edd2
test eax, eax
jne 0x41f2be
push 2
push 0x44b696
mov ecx, esi
call fcn.0041cebd
or dword [esi + 0x54], 8
mov dword [esi + 0x2c], 1
xor eax, eax
jmp 0x41f382
mov eax, dword [esi + 0x98]
test eax, eax
je 0x41f2d1
cmp byte [eax], 0
mov byte [ebp + 0xf], 1
jne 0x41f2d5
mov byte [ebp + 0xf], 0
push dword [esi + 0x7c]
lea ecx, [esi + 0x2f4]
call fcn.0041c501
mov ecx, esi
call fcn.0041cff4
push dword [esi + 0x7c]
call fcn.0041cac3
pop ecx
test eax, eax
je 0x41f347
push dword [esi + 0x7c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call edi
cmp eax, 0xffffffff
je 0x41f355
push 1
mov eax, dword [esi + 0x90]
push eax
mov ecx, esi
call fcn.0041e161
test eax, eax
je 0x41f347
cmp eax, 0xffffffff
je 0x41f2b7
xor eax, eax
cmp dword [ebp + 8], eax
je 0x41f37b
push eax
push 0x80
push 4
push eax
push 1
push accept
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41f36c
push 0
mov ecx, esi
call fcn.0041d13e
jmp 0x41f2ac
cmp byte [ebp + 0xf], 0
je 0x41f320
push dword [esi + 0x2f4]
call edi
cmp eax, 0xffffffff
je 0x41f320
push 0
jmp 0x41f309
push edi
mov ecx, esi
call fcn.0041d3a9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0xc], 0xfffffffe
xor eax, eax
inc eax
call fcn.00429de8
ret 8
Function at 0x41f73d
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2718
call fcn.0042a390
mov eax, dword [0x45a400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0041d18b
mov ecx, esi
call fcn.0041d30e
push dword [esi + 0x7c]
call fcn.0042a410
push dword [esi + 0x98]
mov edi, eax
call fcn.0042a410
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41f848
lea eax, [edi - 1]
cmp ebx, eax
jge 0x41f848
mov eax, edi
push ebx
push dword [esi + 0x98]
sub eax, ebx
add eax, dword [esi + 0x7c]
push eax
call fcn.0041c9bd
add esp, 0xc
test eax, eax
jne 0x41f848
push dword [esi + 0x7c]
lea eax, [ebp - 0x2714]
push eax
call fcn.0042a290
mov eax, dword [esi + 0x7c]
sub edi, ebx
pop ecx
mov byte [edi + eax - 1], 0
test byte [esi + 0x9c], 8
pop ecx
je 0x41f7dd
push 0
mov ecx, esi
call fcn.0041f484
mov ecx, esi
call fcn.0041e4f7
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41f7fb
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi + 0x7c]
lea eax, [ebp - 0x2714]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x41f85a
mov ecx, esi
call fcn.00426858
push 2
push 0x44b696
mov dword [ebp - 0x2718], eax
call fcn.0041cebd
lea eax, [ebp - 0x2718]
push eax
mov ecx, esi
call fcn.0041d13e
lea eax, [ebp - 0x2714]
push eax
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x41f85a
test byte [esi + 0x9c], 8
je 0x41f85a
push 1
mov ecx, esi
call fcn.0041f484
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428263
leave
ret
Function at 0x4203e2
Capabilities:
Parse credit card information

Disassembly:
push 0xc
mov eax, 0x443cd7
call fcn.00429d10
lea esi, [ecx + 0x88]
mov eax, dword [esi]
xor edi, edi
mov dword [ebp - 0x18], esi
cmp eax, edi
je 0x420408
push eax
call fcn.0042a410
pop ecx
jmp 0x42040a
xor eax, eax
cmp eax, 0xd
jl 0x42054c
mov eax, dword [esi]
push 8
push str._UTF_8_
push eax
call fcn.0042adb6
add esp, 0xc
test eax, eax
jne 0x42054c
mov eax, dword [esi]
mov cl, byte [eax + 8]
cmp cl, 0x42
je 0x420440
cmp cl, 0x62
jne 0x42054c
cmp byte [eax + 9], 0x3f
jne 0x42054c
add eax, 0xa
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
jmp 0x420476
mov dl, byte [eax]
cmp dl, 0x3f
jne 0x420461
cmp cl, 0x3d
je 0x42047f
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xf], 0
call fcn.0041c55d
mov eax, esi
lea esi, [eax + 1]
mov cl, byte [esi]
test cl, cl
jne 0x420455
cmp byte [eax], 0x3f
jne 0x42053e
cmp byte [eax + 1], 0x3d
jne 0x42053e
cmp dword [ebp - 0x14], edi
je 0x4204a2
push dword [ebp - 0x14]
call fcn.0042a410
pop ecx
jmp 0x4204a4
xor eax, eax
push eax
call fcn.0042824d
mov ebx, eax
push ebx
push dword [ebp - 0x14]
call fcn.00437780
mov edi, eax
add esp, 0xc
test edi, edi
jg 0x4204cb
push ebx
call fcn.004288f1
cmp dword [ebp - 0x14], 0
pop ecx
jmp 0x420541
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042824d
pop ecx
push edi
mov esi, eax
push esi
push edi
push ebx
xor edi, edi
push edi
xor eax, eax
push 0xfde9
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
jle 0x420506
xor ecx, ecx
mov word [esi + eax*2], cx
cmp dword [ebp - 0x14], edi
je 0x420516
push dword [ebp - 0x14]
call fcn.0042a410
pop ecx
jmp 0x420518
xor eax, eax
push edi
push edi
push eax
push ebx
push 0xffffffffffffffff
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.0041c501
push ebx
call fcn.004288f1
push esi
call fcn.004288f1
pop ecx
pop ecx
cmp dword [ebp - 0x14], edi
je 0x42054c
push dword [ebp - 0x14]
call fcn.004288f1
pop ecx
call fcn.00429de8
ret
Function at 0x4237e7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x1e0], edi
jle 0x423815
push edi
lea ecx, [esi + 0x1d0]
call fcn.00420637
cmp dword [eax + 0x20], 6
je 0x42381d
inc edi
cmp edi, dword [esi + 0x1e0]
jl 0x4237fa
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
push edi
lea ecx, [esi + 0x1d0]
call fcn.00420637
and dword [eax + 0x1c], 0
inc dword [esi + 0x140]
inc dword [esi + 0x144]
push edi
push 6
mov ecx, esi
call fcn.0041ffcc
push edi
lea ecx, [esi + 0x1d0]
call fcn.00420637
lea ecx, [ebp - 4]
push ecx
xor ecx, ecx
push ecx
push eax
push 0x422962
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x423818

Function at 0x42386f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
neg eax
push esi
sbb eax, eax
add eax, 6
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x30], esi
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x1e0]
mov dword [edi + 0x2c], eax
cmp eax, ebx
jne 0x4238ba
cmp dword [ebp + 0xc], ebx
je 0x4238ba
push ebx
push 0xc
call fcn.0041ffcc
test eax, eax
jne 0x4238ba
xor eax, eax
jmp 0x42396a
sub esp, 0x58
mov ecx, esp
push edi
call fcn.0041ff59
lea ecx, [esi + 0x1d0]
call fcn.00420a24
mov eax, dword [esi + 0x1e0]
dec eax
push eax
lea ecx, [esi + 0x1d0]
call fcn.00420637
mov dword [ebp + 8], eax
cmp dword [edi + 0x2c], ebx
jne 0x4238fe
cmp dword [ebp + 0xc], ebx
je 0x423967
push ebx
push 0xd
mov ecx, esi
call fcn.0041ffcc
test eax, eax
je 0x4238b3
cmp dword [ebp + 0xc], ebx
je 0x423967
push dword [edi + 0x2c]
mov ecx, esi
push 5
call fcn.0041ffcc
cmp dword [ebp + 0x10], ebx
je 0x423933
mov eax, dword [edi + 0x34]
cmp eax, 0xffffffff
jne 0x423924
dec dword [esi + 0x8c]
jmp 0x423933
push eax
lea ecx, [esi + 0x200]
call fcn.0042069c
dec dword [eax + 0x60]
inc dword [esi + 0x140]
inc dword [esi + 0x144]
push dword [edi + 0x2c]
mov ecx, esi
push 6
call fcn.0041ffcc
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push 0x422962
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4247ed
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 4], edi
je 0x42483d
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp - 4], edi
push 0x32
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x424855
inc dword [ebx + 8]
cmp dword [ebp - 4], 0xc8
jne 0x42483c
mov esi, dword [ebx + 4]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
leave
ret
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x424841
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xc8
jl 0x424808
jmp 0x42481d

Function at 0x4263e7
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x45a400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x204]
push eax
push 0x101
mov esi, ecx
call sub.WS2_32.dll_WSAStartup
mov ecx, esi
call fcn.004263b0
test eax, eax
jne 0x426427
or eax, 0xffffffff
jmp 0x426454
push edi
call dword [esi + 4]
mov edi, eax
test edi, edi
je 0x426450
cmp edi, 0xffffffff
je 0x426450
push dword [ebp - 0x208]
call fcn.0041c468
pop ecx
mov dword [ebp - 0x208], eax
test eax, eax
jne 0x426463
push edi
call dword [esi + 8]
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00428263
leave
ret 4
or dword [ebp - 0x6c], 0xffffffff
push 0x20
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0042a4a0
add esp, 0xc
push 0x1388
push 0x4e
lea eax, [ebp - 0x74]
push eax
push 0
push 0x20
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x208]
push edi
call dword [esi + 0xc]
push edi
call dword [esi + 8]
cmp dword [ebp - 0x70], 0
jne 0x426450
mov eax, dword [ebp - 0x6c]
jmp 0x426453
Function at 0x4280cd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x45c7ec], 0
push esi
push edi
jne 0x428043
call fcn.00427faf
test eax, eax
je 0x428088
mov eax, dword [0x45c7ec]
cmp eax, 1
jne 0x428064
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x428088
jmp 0x4280ca
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4280ca
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42808c
xor eax, eax
jmp 0x4280ca
mov eax, dword [esi]
push dword [0x45c7ec]
call edi
mov edi, eax
test edi, edi
je 0x4280ae
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4280ca
lea edi, [esi + 0xff0]
push esi
push dword [0x45c7ec]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4280b4
mov eax, esi
pop edi
pop esi
ret
jmp 0x42802f

Function at 0x428263
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45a400]
jne 0x42826d
repz ret
jmp fcn.0042ae09
Function at 0x432f6a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45a400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0042d8c2
and dword [ebp - 0x14], 0
cmp dword [0x45d4d4], 0
mov dword [ebp - 0x18], eax
jne 0x43301d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4330c5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4330c5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x44acd0
push ebx
mov dword [0x45d4d4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x45d4d8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x45d4dc], eax
call edi
push eax
call esi
mov dword [0x45d4e4], eax
test eax, eax
je 0x43301d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x45d4e0], eax
mov eax, dword [0x45d4e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x433076
cmp dword [0x45d4e4], ecx
je 0x433076
push eax
call esi
push dword [0x45d4e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x433076
test ebx, ebx
je 0x433076
call edi
test eax, eax
je 0x43306d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43306d
test byte [ebp - 8], 1
jne 0x433076
or dword [ebp + 0x10], 0x200000
jmp 0x4330a9
mov eax, dword [0x45d4d8]
cmp eax, dword [ebp - 0x18]
je 0x4330a9
push eax
call esi
test eax, eax
je 0x4330a9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4330a9
mov eax, dword [0x45d4dc]
cmp eax, dword [ebp - 0x18]
je 0x4330a9
push eax
call esi
test eax, eax
je 0x4330a9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45d4d4]
call esi
test eax, eax
je 0x4330c5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4330c7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428263
leave
ret
Function at 0x436740
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.004369a0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x43676e
cmp dword [ebp - 0x50], 1
je 0x436787
cmp dword [ebp - 0x50], 2
je 0x4367a0
jmp 0x4367d2
push 0x44b696
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.0041c501
mov dword [ebp - 8], 1
jmp 0x4367d9
push str.Internet_Explorer
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.0041c501
mov dword [ebp - 8], 0
jmp 0x4367d9
mov dword [ebp - 8], 3
cmp dword [ebp + 0x10], 0
je 0x4367b7
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x4367c1
mov eax, 8
jmp 0x436842
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.0041c501
jmp 0x4367d9
mov eax, 8
jmp 0x436842
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0041c501
push 0
xor eax, eax
cmp dword [ebp - 8], 3
setne al
sub eax, 1
and eax, str._local_
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
jne 0x436824
call fcn.0043b6b0
jmp 0x436842
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 0x46
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WININET.dll_InternetSetOptionA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x438cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 4
je 0x438cf8
mov eax, 0xd
jmp 0x438cfb
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43c8d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x35
push str.Out_of_memory
push str.Out_of_memory__Please_close_some_applications_and_press_Retry_or_Cancel_to_exit_without_saving_any_data
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x43c8fa
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret