joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ade68
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5ade96
mov eax, ebx
call fcn.005ae91c
cmp dword [ebx + 0x40], 0
je 0x5ade8f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5adf07
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5adef9
cmp dword [ebx + 8], 0
je 0x5adeb8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5adeca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5adef9
cmp dword [ebx + 8], 0
je 0x5adeab
cmp eax, 3
je 0x5adedd
dec eax
jne 0x5adeab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5adeab
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5adeab
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5adf25
cmp dword [ebx + 0x14], 0xcc
je 0x5adf25
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005adf30
pop ebx
ret
Function at 0x608674
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x20], 0
jne 0x60878d
mov eax, esi
call fcn.004a73b8
cmp eax, 0x1e
jl 0x60878d
mov eax, dword [ebx + 4]
cmp dword [eax + 0x284], 0x1e
jl 0x60878d
mov dl, 1
mov eax, dword [0x5c0080]
call fcn.005c10c8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x608786
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
test eax, eax
jne 0x6086e6
call fcn.0040568c
jmp 0x60878d
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x30]
mov esi, eax
sar esi, 1
jns 0x6086f7
adc esi, 0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x24]
dec eax
push eax
mov eax, dword [ebp - 4]
call fcn.004a98e4
mov edx, esi
pop ecx
call fcn.004a4828
push eax
mov eax, dword [ebp - 4]
call fcn.004a98e4
xor ecx, ecx
mov edx, esi
call fcn.004a4828
pop edx
call fcn.0060860c
cmp eax, 2
jge 0x608770
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x24]
dec eax
sar eax, 1
jns 0x60873e
adc eax, 0
push eax
mov eax, dword [ebp - 4]
call fcn.004a98e4
mov edx, esi
pop ecx
call fcn.004a4828
push eax
mov eax, dword [ebp - 4]
call fcn.004a98e4
xor ecx, ecx
mov edx, esi
call fcn.004a4828
pop edx
call fcn.0060860c
cmp eax, 2
jle 0x608770
mov byte [ebx + 0x20], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60878d
mov eax, dword [ebp - 4]
call fcn.00404700
ret
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x651514
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x65156e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00651508
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0064e980
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0064e4e4
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x651575
lea eax, [ebp - 4]
call fcn.00406dcc
ret
Function at 0x66a448
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406dc4
xor eax, eax
push ebp
push 0x66a4a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00406e68
push eax
push 0x66a234
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a4a7
lea eax, [ebp - 4]
call fcn.00406dcc
ret

Function at 0x66a640
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x66a701
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetSystemDefaultLangID
mov esi, eax
lea edx, [ebp - 8]
movzx eax, si
call fcn.004712ac
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x66a71c
call fcn.004071b0
mov eax, dword [ebp - 4]
call fcn.00406e68
push eax
call sub.kernel32.dll_OutputDebugStringW
cmp si, 0x409
je 0x66a6e4
cmp si, 0x809
je 0x66a6e4
cmp si, 0x40c
je 0x66a6e4
cmp si, 0x407
je 0x66a6e4
cmp si, 0x410
je 0x66a6e4
cmp si, 0x1009
je 0x66a6e4
cmp si, 0xc0c
je 0x66a6e4
cmp si, 0xc09
je 0x66a6e4
cmp si, 0x411
je 0x66a6e4
cmp si, 0xc0a
je 0x66a6e4
cmp si, 0x1409
je 0x66a6e4
cmp si, 0x413
je 0x66a6e4
cmp si, 0x462
jne 0x66a6e6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a708
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406dd4
ret
Function at 0x66aa10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406dc4
xor eax, eax
push ebp
push 0x66ab2b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x66ab08
mov dl, 1
mov eax, dword [0x48b308]
call fcn.00491a9c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x66ab01
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x66aae1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406e68
mov ecx, eax
mov edx, 0x66ab3c
mov eax, 0x66ab5c
call fcn.0048d7d0
lea ecx, [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00471538
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x66ab88
call fcn.004071b0
mov eax, dword [ebp - 0x14]
call fcn.00406e68
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x66aaeb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66ab08
mov eax, dword [ebp - 0xc]
call fcn.00404700
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66ab32
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00406dd4
lea eax, [ebp - 4]
call fcn.00406dcc
ret

Function at 0x66ba28
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x721f38], 0
je 0x66ba42
call dword [0x721f38]
mov dword [ebp - 4], eax
jmp 0x66ba47
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x66bab5
cmp dword [ebp - 4], 0xffffffff
je 0x66bab5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x721f34]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x66bab0
xor eax, eax
push ebp
push 0x66baa9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x66ba8d
call fcn.0040568c
jmp 0x66bac9
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66bab5
mov eax, dword [ebp - 8]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x66bac1
cmp dword [ebp - 4], 0xffffffff
jne 0x66bac9
call fcn.0066b868
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x66c118
Capabilities:
Get session information
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00406ddc
cmp byte [0x76d850], 0
je 0x66c14f
xor eax, eax
call fcn.0066c0a0
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x66c1be
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0066c1e0
jmp 0x66c1be
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 5
call fcn.0066ba28
push eax
mov eax, dword [0x721f34]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x66c19c
mov eax, ebx
mov edx, dword [esp]
call fcn.00406f88
mov eax, dword [ebx]
mov edx, 0x66c1d0
call fcn.004708a0
test al, al
je 0x66c193
mov eax, ebx
xor edx, edx
call fcn.00406ddc
mov eax, dword [esp]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
cmp dword [ebx], 0
jne 0x66c1be
xor eax, eax
call fcn.0066c0a0
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x66c1be
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.0066c1e0
pop ecx
pop edx
pop ebx
ret

Function at 0x670f78
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x6710ad
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp eax, 0x419
sete bl
test bl, bl
jne 0x671092
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
mov ecx, 0x6710c8
mov edx, 0x59
call fcn.00477a78
push dword [ebp - 8]
push 0x6710dc
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
mov ecx, 0x6710ec
mov edx, 0x5a
call fcn.00477a78
push dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00407280
mov edx, 0x671100
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
jne 0x671090
mov edx, 0x671118
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
jne 0x671090
mov edx, 0x671130
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
jne 0x671090
mov edx, 0x671148
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
jne 0x671090
mov edx, 0x671160
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
jne 0x671090
mov edx, 0x671178
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
jne 0x671090
mov edx, 0x671190
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
jne 0x671090
mov edx, 0x6711a8
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
jne 0x671090
mov edx, 0x6711c0
mov eax, dword [ebp - 4]
call fcn.004708a0
test al, al
je 0x671092
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6710b4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406dd4
ret
Function at 0x671cbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x671d55
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005272b4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00472084
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x671d6c
call fcn.004071b0
push 0x671d94
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00403658
push dword [ebp - 0x14]
push 0x671dd0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00407280
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00406e68
push eax
mov eax, dword [ebp - 4]
call fcn.00406e68
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x671d5c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00406dd4
ret

Function at 0x67ce6c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406dc4
xor eax, eax
push ebp
push 0x67cf6c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor edx, edx
push ebp
push 0x67cf3f
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
mov eax, 0x67cf8c
call fcn.0052d574
mov eax, dword [ebp - 8]
test eax, eax
je 0x67cec3
sub eax, 4
mov eax, dword [eax]
dec eax
jl 0x67cf35
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004704d8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00406e30
mov edx, dword [ebp - 8]
mov eax, 0x67cfb8
call fcn.0052437c
dec eax
jne 0x67cefc
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406ddc
mov byte [ebp - 9], 0
jmp 0x67cf35
mov eax, dword [ebp - 8]
call fcn.00471b68
test al, al
je 0x67cf35
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00406e68
push eax
mov eax, dword [ebp - 8]
call fcn.00406e68
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
je 0x67cf35
mov eax, dword [ebp - 4]
call fcn.00471b68
test al, al
je 0x67cf35
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67cf49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67cf73
lea eax, [ebp - 0x10]
call fcn.00406dcc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406dd4
ret
Function at 0x67d114
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x67d25a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x67d268
call sub.kernel32.dll_OutputDebugStringW
call fcn.00671e1c
test al, al
jne 0x67d14f
mov byte [ebx + 0xc], 0
jmp 0x67d23c
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0067d010
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.0067ce6c
test al, al
je 0x67d187
mov byte [ebx + 0xc], 1
push 0x67d2a0
call sub.kernel32.dll_OutputDebugStringW
call fcn.0067f248
mov byte [0x722074], 1
jmp 0x67d23c
cmp dword [ebp - 4], 0
jne 0x67d1b2
call fcn.00671e84
test al, al
je 0x67d1a5
lea edx, [ebp - 4]
mov eax, 0x23
call fcn.0058ccb4
jmp 0x67d1b2
lea edx, [ebp - 4]
mov eax, 0x1e
call fcn.0058ccb4
cmp dword [ebx + 0x14], 0
jne 0x67d1c7
mov dl, 1
mov eax, dword [0x581458]
call fcn.00581804
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x14]
add eax, 0x48
mov edx, dword [ebp - 4]
call fcn.00406ddc
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 0x14]
call fcn.00583120
mov eax, dword [ebx + 0x14]
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x18], 0x67ce3c
xor ecx, ecx
xor edx, edx
call fcn.005831a8
call fcn.00527210
fstp qword [ebp - 0x10]
wait
jmp 0x67d233
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x733a48]
mov eax, dword [eax]
call fcn.004fc390
call fcn.00527210
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push 0x14
call fcn.00522ac0
test al, al
je 0x67d23c
cmp byte [0x722074], 0
je 0x67d201
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67d261
lea eax, [ebp - 0x14]
call fcn.00406dcc
lea eax, [ebp - 4]
call fcn.00406dcc
ret

Function at 0x67d2d4
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
call dword [edx]
cmp dword [ebx + 8], 0
je 0x67d304
cmp byte [ebx + 0xc], 0
jne 0x67d304
push 0x67d310
call sub.kernel32.dll_OutputDebugStringW
push 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
call dword [edx + 4]
pop ebx
ret
Function at 0x67e31c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406dc4
xor eax, eax
push ebp
push 0x67e51f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 1
lea eax, [ebp - 0x1c]
call fcn.00671eac
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
mov edx, 4
call fcn.0058666c
push 0x67e53c
lea eax, [ebp - 8]
push eax
mov ecx, 0x67e54c
mov edx, dword [ebp - 4]
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
push 0x67e53c
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x67e574
mov edx, dword [ebp - 4]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx]
push 0x67e59c
push dword [ebp - 0x10]
push 0x67e5b4
push 0x67e5cc
push dword [ebp - 0xc]
push 0x67e5b4
push 0x67e5e8
push dword [ebp - 8]
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00407280
mov eax, dword [ebp - 0x20]
call fcn.00406e68
push eax
call sub.kernel32.dll_OutputDebugStringW
mov edx, 0x67e604
mov eax, dword [ebp - 8]
call fcn.00585eb4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
cmp dword [ebp - 0x18], 0
je 0x67e3fa
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x18], edx
call fcn.00404700
mov edx, 0x67e604
mov eax, dword [ebp - 0xc]
call fcn.00585eb4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
cmp dword [ebp - 0x18], 0
je 0x67e427
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x18], edx
call fcn.00404700
mov eax, dword [ebp - 8]
mov edx, 0x67e53c
call fcn.00407428
jne 0x67e449
mov eax, dword [ebp - 0xc]
mov edx, 0x67e53c
call fcn.00407428
je 0x67e4f7
mov eax, dword [ebp - 0xc]
mov edx, 0x67e53c
call fcn.00407428
jne 0x67e47e
mov eax, dword [ebp - 8]
mov edx, 0x67e53c
call fcn.00407428
je 0x67e47e
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00526ed8
test eax, eax
jge 0x67e4f7
mov byte [ebp - 0x11], 0
jmp 0x67e4f7
mov eax, dword [ebp - 8]
mov edx, 0x67e53c
call fcn.00407428
jne 0x67e4b3
mov eax, dword [ebp - 0xc]
mov edx, 0x67e53c
call fcn.00407428
je 0x67e4b3
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00526ed8
test eax, eax
jge 0x67e4f7
mov byte [ebp - 0x11], 0
jmp 0x67e4f7
mov eax, dword [ebp - 8]
mov edx, 0x67e53c
call fcn.00407428
je 0x67e4f7
mov eax, dword [ebp - 0xc]
mov edx, 0x67e53c
call fcn.00407428
je 0x67e4f7
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00526ed8
test eax, eax
jl 0x67e4f3
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00526ed8
test eax, eax
jge 0x67e4f7
mov byte [ebp - 0x11], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67e526
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406dd4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406dd4
ret
Function at 0x6800a4
Capabilities:
Create http request
Print debug messages
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406dc4
lea ebx, [ebp - 0x14]
xor eax, eax
push ebp
push 0x6801f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 0
push 0x680204
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0xc], eax
push 0x680288
call sub.kernel32.dll_OutputDebugStringW
cmp dword [ebp - 0xc], 0
je 0x6801dd
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0x10], eax
push 0x6802bc
call sub.kernel32.dll_OutputDebugStringW
cmp dword [ebp - 0x10], 0
jne 0x68012d
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x6801dd
push 0x6802f8
call sub.kernel32.dll_OutputDebugStringW
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48b560]
call fcn.00492080
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x6801d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov dword [ebx], 1
push 0x680328
call sub.kernel32.dll_OutputDebugStringW
cmp dword [ebx], 0
jbe 0x6801aa
push ebx
push 0x400
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x418]
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0x10]
cmp dword [ebx], 0
ja 0x68017f
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6801dd
mov eax, dword [ebp - 0x18]
call fcn.00404700
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6801fa
lea eax, [ebp - 4]
call fcn.00406dcc
ret
Function at 0x680a18
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00406dc4
xor eax, eax
push ebp
push 0x680c2e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00403d74
mov esi, eax
lea eax, [ebp - 0x2d0]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00403cd8
cmp dword [ebp + 0x20], 0
je 0x680ad3
cmp dword [ebp - 0x10], 0
je 0x680ad3
mov eax, dword [ebp + 0x20]
call fcn.00471b68
test al, al
jne 0x680a89
mov eax, dword [ebp + 0x20]
call fcn.00471bb0
test al, al
je 0x680aac
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00406e68
push eax
call sub.shell32.dll_SHGetFileInfoW
jmp 0x680acd
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00406e68
push eax
call sub.shell32.dll_SHGetFileInfoW
mov esi, dword [ebp - 0x2cc]
cmp byte [ebp + 0x1c], 0
je 0x680afa
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x680c40
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
jmp 0x680b19
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x680c40
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00409d34
test bl, bl
je 0x680b59
cmp byte [ebp + 0x14], 0
jne 0x680b59
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004a48c4
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x680c18
mov dl, 1
mov eax, dword [0x4a1ebc]
call fcn.004a8fcc
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x680c11
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004a98e4
call fcn.004a48c4
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2dc], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.004037c4
add eax, dword [ebp - 8]
mov dword [ebp - 0x2d8], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.004037c4
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x2e0]
mov eax, dword [ebp - 4]
call fcn.0068093c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680c18
mov eax, dword [ebp - 0x1c]
call fcn.00404700
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680c35
lea eax, [ebp + 0x20]
call fcn.00406dcc
ret
Function at 0x6b610c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b61a8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0x6b61c0
call fcn.006b4ecc
mov eax, ebx
xor edx, edx
call fcn.00406ddc
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x6b6170
mov eax, ebx
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00406fdc
mov ecx, dword [ebx]
lea eax, [ebp - 0x210]
mov edx, 0x6b61ec
call fcn.004071b0
mov eax, dword [ebp - 0x210]
xor edx, edx
call fcn.006b4ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b61af
lea eax, [ebp - 0x210]
call fcn.00406dcc
ret