joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4167a0
Capabilities:
Set current directory
Terminate process

Disassembly:
mov eax, 0x44b896
call fcn.00439d44
push ecx
mov eax, 0x1168
call fcn.0043abb0
mov eax, dword [0x45f584]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
call fcn.00432a03
call fcn.004088d5
test al, al
jne 0x4167ec
push 0
push str.Fatal_Error
push str.Files_are_altered_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
jmp 0x4176fe
push 0x44d5c8
push 0x4643d8
call fcn.00439590
pop ecx
pop ecx
push 0x104
mov edi, 0x4647d8
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
call fcn.0043ae60
cmp eax, esi
pop ecx
pop ecx
jne 0x41682f
push esi
push str.Fatal_Error
push str.Invalid_access_rights_
jmp 0x416ba1
push edi
mov byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x416845
lodsd eax, dword [esi]
adc byte [eax], bl
imul ebp, dword fs:[0x86a8222d], 0x23
sub eax, 0x1910ad2d
imul ebp, dword fs:[0xb3a8222d], 0x23
sub eax, 0xb810ad2d
int3
loopne 0x416b6f
sub eax, 0x37f5db2d
in eax, dx
shr ebp, cl
jnp 0x416bb8
add eax, edx
imul ebp, dword [0xdd32a8a5], 0x4c5d2d2
push 0x7474d2d2
cmpsd dword [esi], dword es:[edi]
in eax, 0xa7
test al, 0x32
fst st(2)
rcr bl, cl
hlt
jnp 0x416bdd
int1
leave
imul ebp, dword [0x69d02145], 0x15c47b2d
rcl edx, 1
shl byte [esi + 0x3455c5e6], cl
sub eax, 0xe6a67d2d
lds eax, [edi + 0x7d2d2d34]
mov al, byte [0xd2d919a8]
rol byte [ebp - 0xf], cl
jnp 0x416b67
adc eax, 0xa6d2d2d1
out 0xc5, al
push ebp
xor al, 0x2d
sub eax, 0xc5e6a67d
xchg dword [ebp - 0x575f82d3], esi
sbb ecx, ebx
rcl dl, cl
inc ebp
int1
test al, 0x19
invalid
shr dword [ecx + 0x2d], 1
jge 0x416b96
cli
scasb al, byte es:[edi]
jmp 0x7d9aff08
sub eax, 0xe9c5e3a6
out 0xd3, al
rol byte [edi + 0x2d], cl
inc edi
aaa
mov al, byte [0xd2d119a8]
sar byte [ebp + 0x47], cl
sub eax, 0xff9938d2
imul ebp, dword [0xd119a8a0], 0xc57dd2d2
rol dword [0xa0742d2f], 0xa0
sbb ecx, edx
rcl dl, cl
lodsd eax, dword fs:[esi]
adc dword [0xf2c99571], esp
imul ebp, dword [0xe5952858], 0x7d2d69f8
mov al, byte [0xd2d119a8]
sar byte [ebp + 0x45], cl
std
shr dword [ecx + 0x2d], 1
xchg ebx, eax
std
outsd dx, dword [esi]
imul ebp, dword [0xaefad27b], 0xffffffe9
cmp eax, 0xd27b2d47
cmp byte [0xa62d69fc], dl
out 0xc5, al
xor dword [ebp + 0x457b7d2d], esi
imul ebp, dword [0x6b6ffd93], 0xfad27b2d
scasb al, byte es:[edi]
jmp 0x7b6eb374
inc edi
sub eax, 0x1538d27b
cld
imul ebp, dword [0x31c5e6a6], 0x7d2d2d34
jnp 0x416c8c
in eax, 0xd1
imul ebp, dword [0xaefad27b], 0x2d473de9
jnp 0x416c27
cmp byte [0x7b2d69fc], dl
inc ebp
in eax, dx
shr dword [ecx + 0x2d], 1
jnp 0x416c34
cli
scasb al, byte es:[edi]
jmp 0x7b6eb38a
cli
inc ebp
sub eax, 0xc52d2d29
jbe 0x416caf
das
sub eax, 0xdd01a8a4
rcl dl, cl
mov word [ecx], ss
imul bp, word [0xa83de9ae], 0xffed
pop ecx
inc ebp
int1
int1
imul ebp, dword [0x6d7ac57d], 0xeda92d2c
je 0x416d2c
lds edi, [edx + 0x6d]
sub al, 0x2d
test eax, 0xea7474ed
test al, 5
fst st(2)
shl byte [ecx], cl
iretd
ljmp 0x21d2:0xd2dd05a8
rcr byte [eax - 0x2d2d22ff], cl
invalid
call fcn.0043b149
int3
Function at 0x41a57b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b8]
sub esp, 0x838
mov eax, dword [0x45f584]
push esi
mov dword [ebp + 0x7b4], eax
lea eax, [ebp - 0x50]
push eax
push 0x20019
push 0
mov esi, ecx
push dword [esi + 0x100]
mov dword [ebp - 0x60], 0x800
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a66d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x41a664
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
inc eax
push edi
push eax
call fcn.0043a3f2
pop ecx
mov edi, eax
lea eax, [ebp - 0x5c]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.dgfilename
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a65c
cmp dword [ebp - 0x58], 1
jne 0x41a65c
push dword [esi + 0xf8]
call fcn.0043a3ed
and dword [esi + 0xf8], 0
push edi
call fcn.004394f0
inc eax
push eax
call fcn.0043a3f2
push edi
push eax
mov dword [esi + 0xf8], eax
call fcn.00439590
add esp, 0x14
push edi
call fcn.0043a3ed
pop ecx
pop edi
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xf8]
mov ecx, dword [ebp + 0x7b4]
pop esi
call fcn.004394dc
add ebp, 0x7b8
leave
ret
Function at 0x41a687
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b8]
sub esp, 0x838
mov eax, dword [0x45f584]
push esi
mov dword [ebp + 0x7b4], eax
lea eax, [ebp - 0x50]
push eax
push 0x20019
push 0
mov esi, ecx
push dword [esi + 0x100]
mov dword [ebp - 0x60], 0x800
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41a779
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x41a770
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
inc eax
push edi
push eax
call fcn.0043a3f2
pop ecx
mov edi, eax
lea eax, [ebp - 0x5c]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.cdgfilename
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a768
cmp dword [ebp - 0x58], 1
jne 0x41a768
push dword [esi + 0xfc]
call fcn.0043a3ed
and dword [esi + 0xfc], 0
push edi
call fcn.004394f0
inc eax
push eax
call fcn.0043a3f2
push edi
push eax
mov dword [esi + 0xfc], eax
call fcn.00439590
add esp, 0x14
push edi
call fcn.0043a3ed
pop ecx
pop edi
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xfc]
mov ecx, dword [ebp + 0x7b4]
pop esi
call fcn.004394dc
add ebp, 0x7b8
leave
ret

Function at 0x41cc81
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
test esi, esi
je 0x41ccb4
push esi
call fcn.004394f0
pop ecx
xor ecx, ecx
test eax, eax
jbe 0x41cca3
xor byte [ecx + esi], 0x2f
inc ecx
cmp ecx, eax
jb 0x41cc9a
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x41ddbd
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x45f584]
mov dword [ebp - 4], eax
je 0x41dfd9
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x41dfd8
push dword [ebp + 0xc]
call fcn.004394f0
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x41dfd8
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0043ae60
cmp eax, edi
pop ecx
pop ecx
je 0x41de40
mov byte [eax + 1], 0
lea eax, [ebp - 0x108]
push str.wrapperdl.tdat
push eax
call fcn.004395a0
pop ecx
pop ecx
push ebx
push esi
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x41de9e
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x41dfd6
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x41dedb
cmp eax, 0x19000
jbe 0x41dedb
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x41dee1
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x41dfd6
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x41df1a
push dword [ebp + 0x10]
call fcn.004394f0
cmp eax, esi
pop ecx
jle 0x41df1a
push dword [ebp + 0x10]
call fcn.004394f0
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.0043a3f2
mov ebx, 0x4504d8
mov esi, eax
push ebx
push esi
call fcn.00439590
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x41df41
push edi
call fcn.0041cc81
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.00439778
lea eax, [ebp + 8]
push eax
call fcn.0043bc33
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.0043bc18
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.00439590
push edi
call fcn.0041cc81
push dword [ebp + 0xc]
push esi
call fcn.00439590
push edi
call fcn.0041cc81
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x41dfb8
push dword [ebp + 0x10]
call fcn.004394f0
test eax, eax
pop ecx
jbe 0x41dfb8
push dword [ebp + 0x10]
push esi
call fcn.00439590
push edi
call fcn.0041cc81
add esp, 0xc
push ebx
push esi
call fcn.00439590
push edi
call fcn.0041cc81
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004394a6
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.004394dc
leave
ret
Function at 0x41ff3d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xc0]
sub esp, 0x140
mov eax, dword [0x45f584]
push edi
mov dword [ebp + 0xbc], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0xc8]
mov dword [ebp - 0x5c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x420094
mov eax, dword [ebp - 0x58]
push ebx
inc eax
push esi
push eax
mov dword [ebp - 0x4c], eax
call fcn.0043957b
mov ebx, eax
mov eax, dword [ebp - 0x58]
inc eax
push eax
push edi
push ebx
mov dword [ebp - 0x4c], eax
call fcn.0043abf0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push edi
push str.Publisher
push dword [ebp + 0xc8]
call esi
test eax, eax
jne 0x42008b
cmp dword [ebp - 0x54], 1
jne 0x42008b
push 0x450c90
push ebx
call fcn.0043af59
test eax, eax
pop ecx
pop ecx
jne 0x42008b
mov eax, dword [ebp - 0x58]
inc eax
push eax
push edi
push ebx
mov dword [ebp - 0x4c], eax
call fcn.0043abf0
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push edi
push str.GameID
push dword [ebp + 0xc8]
call esi
test eax, eax
jne 0x42008b
cmp dword [ebp - 0x54], 4
jne 0x42008b
push 4
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0x50], edi
call fcn.00439d70
add esp, 0xc
cmp dword [ebp - 0x50], edi
jbe 0x42008b
mov esi, dword [ebp + 0xd0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
cmp eax, dword [ebp - 0x50]
jne 0x42008b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x40]
push 4
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
push 4
push edi
push str.BuildType
push dword [ebp + 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
call fcn.004394a6
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0xbc]
pop edi
call fcn.004394dc
add ebp, 0xc0
leave
ret
Function at 0x4206b1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xcc]
sub esp, 0x14c
mov eax, dword [0x45f584]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp + 0xc8], eax
lea eax, [ebp - 0x40]
push eax
xor esi, esi
mov ebx, 0x20019
push ebx
push esi
push dword [ebp + 0xd8]
mov dword [ebp - 0x5c], 0x104
push dword [ebp + 0xd4]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x48], esi
call edi
test eax, eax
jne 0x420834
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x42082b
mov eax, dword [ebp - 0x44]
inc eax
push eax
mov dword [ebp - 0x50], eax
call fcn.0043957b
push dword [ebp + 0xd8]
mov dword [ebp - 0x54], eax
call fcn.004394f0
add eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x58]
lea eax, [eax + ecx + 0xa]
push eax
call fcn.0043957b
add esp, 0xc
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x60], esi
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x60]
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
mov dword [ebp - 0x78], eax
jne 0x420805
push dword [ebp - 0x54]
push dword [ebp + 0xd8]
push str._s_s
push dword [ebp - 0x4c]
call fcn.0043a5ec
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push ebx
push esi
push dword [ebp - 0x4c]
push dword [ebp + 0xd4]
call edi
test eax, eax
jne 0x42080d
push dword [ebp - 0x4c]
push dword [ebp + 0xe0]
push dword [ebp - 0x48]
call fcn.004200a8
add esp, 0xc
cmp eax, esi
je 0x4207fa
mov edx, dword [ebp + 0xdc]
mov ecx, dword [edx]
cmp ecx, esi
jne 0x4207f2
mov dword [edx], eax
jmp 0x4207fa
mov ecx, dword [ecx + 0x34]
cmp dword [ecx + 0x34], esi
jne 0x4207ef
mov dword [ecx + 0x34], eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42080d
cmp eax, 0x103
je 0x42080d
nop
inc dword [ebp - 0x60]
cmp dword [ebp - 0x78], esi
je 0x420771
push dword [ebp - 0x4c]
call fcn.004394a6
push dword [ebp - 0x54]
call fcn.004394a6
pop ecx
pop ecx
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xc8]
pop edi
pop esi
pop ebx
call fcn.004394dc
add ebp, 0xcc
leave
ret
Function at 0x4216eb
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x45f584]
mov dword [ebp - 4], eax
je 0x421907
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x421906
push dword [ebp + 0xc]
call fcn.004394f0
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x421906
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0043ae60
cmp eax, edi
pop ecx
pop ecx
je 0x42176e
mov byte [eax + 1], 0
lea eax, [ebp - 0x108]
push str.wrapperdl.tdat
push eax
call fcn.004395a0
pop ecx
pop ecx
push ebx
push esi
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x4217cc
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x421904
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x421809
cmp eax, 0x19000
jbe 0x421809
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x42180f
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x421904
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x421848
push dword [ebp + 0x10]
call fcn.004394f0
cmp eax, esi
pop ecx
jle 0x421848
push dword [ebp + 0x10]
call fcn.004394f0
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.0043a3f2
mov ebx, 0x4504d8
mov esi, eax
push ebx
push esi
call fcn.00439590
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x42186f
push edi
call fcn.0041cc81
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.00439778
lea eax, [ebp + 8]
push eax
call fcn.0043bc33
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.0043bc18
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.00439590
push edi
call fcn.0041cc81
push dword [ebp + 0xc]
push esi
call fcn.00439590
push edi
call fcn.0041cc81
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x4218e6
push dword [ebp + 0x10]
call fcn.004394f0
test eax, eax
pop ecx
jbe 0x4218e6
push dword [ebp + 0x10]
push esi
call fcn.00439590
push edi
call fcn.0041cc81
add esp, 0xc
push ebx
push esi
call fcn.00439590
push edi
call fcn.0041cc81
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004394a6
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.004394dc
leave
ret
Function at 0x423985
Capabilities:
Delete file

Disassembly:
mov eax, 0x44bce8
call fcn.00439d44
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xa054]
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [esi], 0x451090
mov dword [ebp - 4], ebx
je 0x4239b4
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [esi + 0x1c], ebx
je 0x4239f9
mov ecx, esi
call fcn.004225e4
mov edi, eax
cmp edi, ebx
je 0x4239dd
mov eax, dword [esi + 0x1c]
push dword [eax + 4]
push 0x456570
push edi
call fcn.00411a67
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov edi, dword [esi + 0x1c]
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x4239ed
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi + 0x20], ebx
je 0x423a1d
push dword [esi + 0x2c]
push 0x456610
push dword [esi + 0x28]
call fcn.00411a67
mov eax, dword [esi + 0x20]
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x423a2a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x423a37
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0x30]
cmp dword [ecx], ebx
je 0x423a43
call fcn.00421662
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x423a51
push eax
call fcn.0043a3ed
pop ecx
mov eax, dword [esi + 0x38]
cmp eax, ebx
je 0x423a5f
push eax
call fcn.0043a3ed
pop ecx
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x423a6d
push eax
call fcn.0043a3ed
pop ecx
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x423a7b
push eax
call fcn.0043a3ed
pop ecx
lea eax, [esi + 0x48]
cmp byte [eax], bl
je 0x423a89
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4243dd
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45f584]
push ebx
push esi
xor ebx, ebx
push ebx
mov esi, 0x44d5c8
push esi
push esi
push 1
push str.MyZylomActiveXPlugin
mov dword [ebp - 4], eax
mov byte [ebp - 0x11], bl
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x4245a9
push edi
mov edi, dword [ebp + 0x10]
cmp di, 0x50
jne 0x424421
push 0x50
pop edi
jmp 0x42442d
cmp di, 0x1bb
jne 0x42442d
mov edi, 0x1bb
push ebx
push 0x4000000
push 3
push ebx
push ebx
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x42459f
push ebx
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
jne 0x424596
cmp dword [ebp + 0x14], ebx
lea eax, [ebp - 0x10]
jne 0x42446b
push 0x451190
jmp 0x424470
push str.POST
push eax
call fcn.00439590
cmp di, 0x1bb
pop ecx
pop ecx
mov eax, 0xa0000000
jne 0x424489
mov eax, 0xa0800000
push ebx
push eax
push ebx
push esi
push str.HTTP_1.0
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x424596
mov eax, dword [0x4650dc]
xor esi, esi
cmp eax, ebx
je 0x4244d6
push eax
call fcn.004394f0
inc eax
push eax
call fcn.0043957b
push dword [0x4650dc]
mov esi, eax
push esi
call fcn.00439590
add esp, 0x10
cmp dword [ebp + 0x18], ebx
jbe 0x424556
cmp dword [ebp + 0x14], ebx
je 0x424556
mov edi, dword [ebp + 0x1c]
cmp edi, ebx
je 0x424556
cmp esi, ebx
jne 0x424513
push edi
call fcn.004394f0
add eax, 0x14
push eax
call fcn.0043957b
mov esi, eax
push str.Content_Type:
push esi
call fcn.00439590
push edi
push esi
call fcn.004395a0
add esp, 0x18
jmp 0x424556
push esi
mov dword [ebp - 0x1c], esi
call fcn.004394f0
push edi
mov esi, eax
call fcn.004394f0
lea eax, [esi + eax + 0x15]
push eax
call fcn.0043957b
push dword [ebp - 0x1c]
mov esi, eax
push esi
call fcn.00439590
push str.Content_Type:
push esi
call fcn.004395a0
push edi
push esi
call fcn.004395a0
push dword [ebp - 0x1c]
call fcn.004394a6
add esp, 0x28
cmp esi, ebx
jne 0x42455e
xor eax, eax
jmp 0x424565
push esi
call fcn.004394f0
pop ecx
mov ecx, dword [ebp + 0x14]
neg ecx
sbb ecx, ecx
and ecx, dword [ebp + 0x18]
push ecx
push dword [ebp + 0x14]
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x424586
mov byte [ebp - 0x11], 1
push esi
call fcn.004394a6
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x20]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x11]
pop esi
pop ebx
call fcn.004394dc
leave
ret