joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c390
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [ebx]
push edi
test esi, esi
je 0x43c3d0
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x43c3bf
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x43c3ca
test eax, eax
jne 0x43c3ca
mov esi, dword [ebx]
call fcn.0045f130
mov dword [ebx], 0
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
inc esi
cmp dword [ebx], 0
jne 0x43c3f9
lea edi, [esi + 8]
call fcn.0045eff0
mov ecx, esi
shl ecx, 8
mov dword [ebx], eax
inc ecx
mov dword [eax], ecx
mov edx, dword [ebx]
mov byte [edx + 4], 0
jmp 0x43c402
push 0
push esi
push ebx
call fcn.0043be20
mov ebx, dword [ebx]
test ebx, ebx
je 0x43c41e
push esi
add ebx, 4
push ebx
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
pop ecx
ret 8

Function at 0x43cda0
Capabilities:
Create thread

Disassembly:
push edi
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push 0
push 0x43cce0
call fcn.0049d7be
add esp, 0xc
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
ret

Function at 0x43cdd0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [esp + 8]
mov dword [edi + 4], 1
call fcn.0044a610
mov eax, dword [edi + 0xc]
xor esi, esi
cmp eax, esi
je 0x43ce45
cmp ebx, esi
je 0x43cdff
mov ecx, ebx
jmp 0x43ce02
or ecx, 0xffffffff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x43ce33
mov eax, dword [edi + 0xc]
cmp eax, esi
je 0x43ce23
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0xc], esi
mov dword [edi + 4], esi
mov eax, 0xf4242
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [esp + 8]
call fcn.0044a720
fstp st(0)
mov dword [edi + 4], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444c40
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x5c]
test eax, eax
je 0x444c51
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
xor eax, eax
ret

Function at 0x446df0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, eax
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x446e57
mov ecx, dword [esp + 4]
push ecx
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x446e57
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret

Function at 0x4472f0
Capabilities:
Get hostname

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, 0x18
call fcn.0045eff0
mov esi, eax
mov dword [esi], 0x1001
mov byte [esi + 4], 0
mov eax, dword [esi]
shr eax, 8
mov dword [esp + 0x14], eax
movzx ecx, byte [esi]
mov dword [esp + 0x10], esi
cmp ecx, 1
jbe 0x447334
lea edx, [esp + 0x10]
push edx
call fcn.0043bf30
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea eax, [esi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x447388
mov dword [ebp], esi
test esi, esi
je 0x4473cd
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x44736c
push esi
call edi
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x4473c4
push esi
call ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 7
push str.Unknown
push ebp
mov dword [ebp], 0
call fcn.0043c200
test esi, esi
je 0x4473cd
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x4473c4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test eax, eax
jne 0x4473cd
call fcn.0045f130
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4473e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x428]
push ebx
mov ebx, dword [esp + 0x430]
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
test ebx, ebx
jne 0x447413
mov ebx, 0x561880
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x447455
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44744f
push edi
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0x400
push eax
push edi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
xor ebp, ebp
jmp 0x447464
call fcn.0045eff0
mov esi, eax
mov ebp, esi
neg ebp
sbb ebp, ebp
and ebp, edi
push esi
push ebp
push 0
push ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4474a5
mov eax, dword [esp + 0x10]
mov edi, 8
mov dword [eax], 0
call fcn.0045eff0
mov edi, dword [esp + 0x10]
mov dword [edi], eax
mov dword [eax], 1
mov ecx, dword [edi]
mov byte [ecx + 4], 0
jmp 0x447528
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
push str.VarFileInfoTranslation
push esi
mov dword [esp + 0x24], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x44751e
cmp dword [esp + 0x18], 4
jb 0x44751e
mov eax, dword [esp + 0x24]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xFileDescription
lea edx, [esp + 0x34]
call fcn.00449450
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x44751e
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
call fcn.004011f0
lea edi, [esp + 0x1c]
call fcn.0044a4d0
mov eax, esi
jmp 0x447537
mov edi, dword [esp + 0x10]
mov dword [edi], 0
test ebp, ebp
je 0x447535
test esi, esi
je 0x447535
call fcn.0045f130
mov eax, edi
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049ca20
add esp, 0x424
ret
Function at 0x447550
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x561880
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x44756e
xor esi, esi
xor ebx, ebx
jmp 0x44757d
call fcn.0045eff0
mov esi, eax
mov ebx, esi
neg ebx
sbb ebx, ebx
and ebx, edi
push esi
push ebx
push 0
push 0x561880
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4475e6
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x4baac8
push esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4475e6
mov eax, dword [esp + 0xc]
movzx edx, word [eax + 0x12]
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
movzx edx, word [eax + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
test ebx, ebx
je 0x4475dd
test esi, esi
je 0x4475dd
call fcn.0045f130
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
test ebx, ebx
je 0x4475f3
test esi, esi
je 0x4475f3
call fcn.0045f130
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x4481b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x3c
lea eax, [esp + 4]
push 0
push eax
call fcn.004a16b0
mov ecx, dword [esp + 0x4c]
add esp, 0xc
lea edx, [esp]
push edx
mov dword [esp + 4], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], str.runas
mov dword [esp + 0x14], 0x561880
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 5
mov dword [esp + 8], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp byte [esp + 0x44], 0
je 0x448229
mov eax, dword [esp + 0x38]
test eax, eax
je 0x448229
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x3c
ret

Function at 0x448230
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40
push esi
push edi
mov edi, 0x208
call fcn.0045eff0
mov esi, eax
mov edi, esi
push 0x3c
neg edi
lea eax, [esp + 0x10]
sbb edi, edi
push 0
push eax
and edi, 0x208
call fcn.004a16b0
mov ecx, dword [esp + 0x58]
add esp, 0xc
push ecx
push str._select___s_
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x20], str.open
mov dword [esp + 0x24], str.explorer
mov dword [esp + 0x30], 5
mov dword [esp + 0x28], esi
mov dword [esp + 0x10], esi
call fcn.00449470
add esp, 8
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test edi, edi
je 0x4482b4
test esi, esi
je 0x4482b4
call fcn.0045f130
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret

Function at 0x448410
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x44841c
lea edx, [eax + 4]
jmp 0x44841e
xor edx, edx
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x44842a
add eax, 4
jmp 0x44842c
xor eax, eax
push 5
push 0
push edx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 0xfffffffe
ret

Function at 0x448480
Capabilities:
Create process on windows
Create thread

Disassembly:
cmp byte [esp + 0xc], 0
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
je 0x4484ee
push 0x566aa8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edi, 0x30
call fcn.0045eff0
mov esi, eax
test esi, esi
je 0x4484ba
push ebx
mov eax, ebp
call fcn.004482f0
mov esi, eax
jmp 0x4484bc
xor esi, esi
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
push 0
push 0x43cce0
call fcn.0049d7be
add esp, 0xc
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push 5
push 0
push ebx
push ebp
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop edi
pop esi
pop ebp
pop ebx
dec ecx
mov eax, ecx
ret
Function at 0x448600
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 9
lea eax, [esp + 8]
push eax
pxor xmm0, xmm0
push 0x59
push 0x800
movq qword [esp + 0x14], xmm0
movq qword [esp + 0x1c], xmm0
movq qword [esp + 0x24], xmm0
movq qword [esp + 0x2c], xmm0
call edi
push 9
lea eax, [esp + eax + 8]
push eax
push 0x5a
push 0x800
mov byte [eax - 1], 0x2d
call edi
lea eax, [esp + 4]
mov dword [esi], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448662
sub eax, edx
push eax
lea ecx, [esp + 8]
push ecx
push esi
call fcn.0043c200
mov ecx, dword [esp + 0x24]
pop edi
xor ecx, esp
mov eax, esi
call fcn.0049ca20
add esp, 0x28
ret
Function at 0x448940
Capabilities:
Get token membership

Disassembly:
sub esp, 0x58
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x1a
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x44899c
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x44899c
xor esi, esi
jmp 0x4489a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x4489bb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 4], 0
test esi, esi
je 0x4489d2
push 0x4def00
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], esi
call fcn.004a1447
mov ecx, dword [esp + 0x58]
mov al, byte [esp + 8]
pop esi
xor ecx, esp
call fcn.0049ca20
add esp, 0x58
ret

Function at 0x4489f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x94], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.004a16b0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x448a45
xor al, al
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0049ca20
add esp, 0x98
ret
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x94]
setae al
xor ecx, esp
call fcn.0049ca20
add esp, 0x98
ret
Function at 0x44d7d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov ecx, esi
xor ecx, 0x15231239
cmp esi, 4
jb 0x44d81a
push ebx
push edi
mov edi, esi
shr edi, 2
jmp 0x44d7f0
mov eax, dword [edx]
imul ecx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
mov ebx, eax
shr ebx, 0x18
xor ebx, eax
imul ebx, ebx, 0x5bd1e995
xor ecx, ebx
add edx, 4
sub esi, 4
sub edi, 1
jne 0x44d7f0
pop edi
pop ebx
sub esi, 1
je 0x44d83b
sub esi, 1
je 0x44d832
sub esi, 1
jne 0x44d848
movzx eax, byte [edx + 2]
shl eax, 0x10
xor ecx, eax
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx edx, byte [edx]
xor edx, ecx
imul edx, edx, 0x5bd1e995
mov ecx, edx
mov edx, ecx
shr edx, 0xd
xor edx, ecx
imul edx, edx, 0x5bd1e995
mov eax, edx
shr eax, 0xf
xor eax, edx
pop esi
ret
Function at 0x454f10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
push 0
push 0x1c
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea edi, [esi + 0x40e]
push edi
lea edx, [esi + 0x30d]
push edx
mov dword [esi + 0x510], 0
lea ecx, [esi + 0x20c]
lea eax, [esi + 0x208]
push ecx
mov byte [edx], 0
push eax
lea edx, [esp + 0x14]
push edx
mov byte [esi], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edi], 0
call fcn.004a00bc
mov ecx, dword [esp + 0x220]
add esp, 0x14
pop edi
xor ecx, esp
mov eax, esi
call fcn.0049ca20
add esp, 0x20c
ret

Function at 0x454fa0
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 2
push ecx
mov dword [esp + 0x10], 0
call fcn.0049e588
add esp, 0x10
cmp eax, 1
je 0x454fc5
or eax, 0xffffffff
pop ecx
ret
mov dx, word [esp]
mov eax, dword [esp + 8]
rol dx, 8
mov word [eax], dx
xor eax, eax
pop ecx
ret

Function at 0x454fe0
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 4
push ecx
mov dword [esp + 0x10], 0
call fcn.0049e588
add esp, 0x10
cmp eax, 1
je 0x455005
or eax, 0xffffffff
pop ecx
ret
mov eax, dword [esp]
rol eax, 0x10
mov edx, eax
mov ecx, eax
shr edx, 8
shl ecx, 8
xor edx, ecx
shl eax, 8
and edx, 0xff00ff
xor edx, eax
mov eax, dword [esp + 8]
mov dword [eax], edx
xor eax, eax
pop ecx
ret

Function at 0x455030
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 4
push ecx
mov dword [esp + 0x10], 0
call fcn.0049e588
add esp, 0x10
cmp eax, 1
jne 0x45508d
mov eax, dword [esp]
rol eax, 0x10
mov ecx, eax
shr ecx, 8
mov edx, eax
shl edx, 8
xor ecx, edx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esp], ecx
fild dword [esp]
test ecx, ecx
jge 0x45507d
fadd qword [0x4d3588]
fmul qword [0x4d3858]
mov eax, dword [esp + 8]
fstp dword [eax]
xor eax, eax
pop ecx
ret
or eax, 0xffffffff
pop ecx
ret

Function at 0x4553d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 0xc]
sub esp, 8
test eax, eax
je 0x4553df
add eax, 4
jmp 0x4553e1
xor eax, eax
mov edx, dword [esi]
mov dword [esp], edx
lea edx, [esp]
push edx
mov edx, dword [esp + 0x10]
push edx
lea edx, [esp + 0xc]
push edx
push 0
push eax
mov eax, dword [ecx]
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x455411
mov ecx, dword [esp]
mov dword [esi], ecx
add esp, 8
ret 4
Function at 0x45bd40
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 8
push esi
push edi
mov dword [esp + 0xc], 0
mov byte [esp + 8], 1
test eax, eax
jne 0x45bd5b
mov eax, str.rootwmi
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0xc]
push eax
push 0x4ba938
push 1
push 0
push 0x4baa08
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x45bdb8
test esi, esi
je 0x45bd96
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 8], 0
je 0x45bdad
mov eax, dword [esp + 0xc]
test eax, eax
je 0x45bdad
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
or eax, 0xffffffff
pop edi
pop esi
add esp, 8
ret 4
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
add edi, 0x30
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push eax
call edx
test eax, eax
jne 0x45bd8b
mov edi, dword [edi]
push eax
push eax
push 3
push 4
push eax
push eax
push 0xa
push edi
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x45bd8b
test esi, esi
je 0x45bdff
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [esp + 8], 0
je 0x45be16
mov eax, dword [esp + 0xc]
test eax, eax
je 0x45be16
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4

Function at 0x45f950
Capabilities:
Create directory

Disassembly:
sub esp, 0x514
push esi
push edi
push 0
push ecx
mov esi, ecx
call fcn.0045f650
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x45f9cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x45f9cb
cmp eax, 0xb7
je 0x45f9cb
cmp eax, 3
jne 0x45f9cd
call fcn.0045f900
test al, al
jne 0x45f9cb
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0045f7c0
mov ecx, eax
call fcn.0045f950
lea ecx, [esp + 8]
mov edi, eax
call fcn.00403870
test edi, edi
je 0x45f9bc
mov eax, edi
pop edi
pop esi
add esp, 0x514
ret
mov ecx, esi
pop edi
pop esi
add esp, 0x514
jmp fcn.0045f950
xor eax, eax
pop edi
pop esi
add esp, 0x514
ret
Function at 0x460b40
Capabilities:
Send data

Disassembly:
push ecx
mov eax, dword [edi]
push esi
test eax, eax
je 0x460b50
mov esi, dword [eax]
shr esi, 8
dec esi
jmp 0x460b52
xor esi, esi
test eax, eax
je 0x460b69
movzx eax, byte [eax]
cmp eax, 1
jbe 0x460b64
push edi
call fcn.0043bf30
mov eax, dword [edi]
add eax, 4
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push esi
push eax
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov eax, dword [esp + 4]
sub eax, esi
neg eax
sbb eax, eax
pop esi
pop ecx
ret 4

Function at 0x460b90
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
cmp dword [eax], 0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
je 0x460bb4
mov esi, dword [eax + 4]
test esi, esi
je 0x460bb4
call fcn.0045f130
mov eax, dword [esp + 0x24]
xor edi, edi
xor ebp, ebp
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edi
cmp ebx, edi
je 0x460c38
lea ecx, [ecx]
push 0
push 0
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x460c38
mov eax, dword [esp + 0x20]
test eax, eax
jbe 0x460c38
shr edi, 1
lea ecx, [edi + eax]
push ecx
lea esi, [esp + 0x14]
call fcn.0041f0c0
test eax, eax
je 0x460c1e
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
lea ecx, [edi + ebp]
push ecx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edi, dword [esp + 0x14]
jmp 0x460bd0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x460c2b
call fcn.0045f130
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
shr edi, 1
je 0x460c76
call fcn.0045eff0
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x460c8b
push edi
push ebp
mov ebx, edi
push esi
mov dword [esp + 0x1c], ebx
call fcn.004a8520
add esp, 0xc
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x10]
call fcn.0042e350
test ebx, ebx
je 0x460c76
test esi, esi
je 0x460c76
call fcn.0045f130
test ebp, ebp
je 0x460c81
mov esi, ebp
call fcn.0045f130
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
xor ebx, ebx
mov dword [esp + 0x10], ebx
jmp 0x460c5c

Function at 0x460ca0
Capabilities:
Download url
Receive data

Disassembly:
lea eax, [esi + 0x40e]
push eax
lea ecx, [esi + 0x30d]
push ecx
lea edx, [esi + 0x20c]
push edx
lea eax, [esi + 0x208]
push eax
push 0x208
push esi
call fcn.004a0108
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
add esp, 0x18
test eax, eax
je 0x460cd9
add eax, 4
jmp 0x460cdb
xor eax, eax
push 0
push 0
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
neg eax
sbb eax, eax
and eax, 4
ret
Function at 0x460e80
Capabilities:
Download url
Receive data

Disassembly:
sub esp, 0x61c
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x618], eax
mov eax, dword [esp + 0x620]
mov eax, dword [eax]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x460ea9
add eax, 4
jmp 0x460eab
xor eax, eax
push ebx
push ebx
push 0x104
lea ecx, [esp + 0x524]
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToCacheFileA
test eax, eax
je 0x460ee0
mov eax, 4
pop ebx
mov ecx, dword [esp + 0x618]
xor ecx, esp
call fcn.0049ca20
add esp, 0x61c
ret
lea edx, [esp + 0x412]
push edx
lea eax, [esp + 0x315]
push eax
lea ecx, [esp + 0x218]
push ecx
lea edx, [esp + 0x218]
push edx
lea eax, [esp + 0x528]
push eax
mov dword [esp + 0x528], ebx
mov byte [esp + 0x18], bl
mov byte [esp + 0x220], bl
mov byte [esp + 0x224], bl
mov byte [esp + 0x325], bl
mov byte [esp + 0x426], bl
call fcn.004a00bc
add esp, 0x14
push esi
lea eax, [esp + 8]
call fcn.00401700
lea ecx, [esp + 4]
call fcn.00403870
mov ecx, dword [esp + 0x61c]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0049ca20
add esp, 0x61c
ret