joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5607bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x648978
mov eax, dword [0x700320]
mov dword [esp + 0x8c], 0
mov dword [esp + 0xc], eax
push str.This_is_a_trial_version_for_evaluation_use_only._To_remove_this_notice_and_all_limitations__please_buy_the_full_version.
push 0x2786
mov byte [esp + 0x94], 1
call fcn.00506990
add esp, 8
lea ecx, [esp + 0xc]
push eax
call fcn.005443e7
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x98]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
add edi, eax
mov eax, 0xa
sub ecx, eax
add edx, eax
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edx
mov word [0x68dd88], 1
call fcn.0047a850
lea edx, [esp + 0x28]
push edx
call dword [0x703200]
push eax
lea ecx, [esp + 0x14]
call fcn.0054b54c
mov esi, dword [esp + 0x94]
lea ecx, [esp + 0x10]
mov byte [0x68c6b1], 0xbb
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [esi]
push 0
mov ecx, esi
mov edi, eax
call dword [edx + 0x30]
push 1
mov ecx, esi
call fcn.0054ada4
push 0
push 0
push 0x68c7e8
call fcn.004e04f0
and eax, 0x7fffffff
push 0
push eax
push 0x68c7e8
call fcn.004e0720
mov eax, dword [esp + 0x24]
mov edx, dword [esi]
add esp, 0x18
lea ebp, [esp + 0x18]
mov ecx, dword [eax - 8]
push 0x10
push ebp
push ecx
push eax
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x28]
lea ecx, [esp + 0x10]
call fcn.0054b5a3
lea ecx, [esp + 0xc]
mov dword [0x68dd8c], 0x78f3
mov byte [esp + 0x8c], 0
call fcn.00544250
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x8c], 2
call fcn.0054b5a3
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x84
ret 8
Function at 0x47cb90
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5609c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 8]
call fcn.00542726
lea ecx, [esi + 0x10]
mov dword [esp + 0x10], 0
call fcn.00542726
lea ecx, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.00542726
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi], 0x6496c0
mov dword [esi + 4], 0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x486540
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x75e0b4]
sub esp, 0x34
mov eax, dword [eax + 0x30f4]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
je 0x486562
mov dword [eax + 0xd0], 0
mov ebx, dword [0x703424]
mov edi, dword [esp + 0x48]
cmp edi, 1
mov ecx, edi
jne 0x4865ab
mov eax, dword [0x6ffe80]
cmp eax, 2
je 0x4865a4
cmp eax, 5
je 0x4865a4
cmp eax, 3
je 0x48659d
cmp eax, 4
je 0x48659d
cmp eax, 6
je 0x486596
cmp eax, 7
jne 0x4865e5
mov ecx, 7
jmp 0x4865e5
mov ecx, 6
jmp 0x4865e5
mov ecx, 5
jmp 0x4865e5
cmp edi, 2
jne 0x4865e5
mov eax, dword [0x6ffe80]
cmp eax, edi
je 0x4865e0
cmp eax, 5
je 0x4865e0
cmp eax, 3
je 0x4865d9
cmp eax, 4
je 0x4865d9
cmp eax, 6
je 0x4865d2
cmp eax, 7
jne 0x4865e5
mov ecx, 0xa
jmp 0x4865e5
mov ecx, 9
jmp 0x4865e5
mov ecx, 8
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x60], 0xffffffff
push ecx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.00548d19
mov ebp, eax
test ebp, ebp
je 0x486739
mov edx, dword [esi + 0x1c]
push 1
push edi
push 0x403
push edx
mov dword [esi + 0x4c], 1
call ebx
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
push 2
mov ecx, esi
call fcn.00486df0
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push edi
push 0x41d
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004d7d00
add esp, 8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00545b73
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.USER32.dll_IntersectRect]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], 0x14
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov dword [0x75e0d4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4864e0
push 0xffffffffffffffff
call dword [0x703444]
mov dword [0x75e0d8], eax
mov edx, dword [esi + 0x1c]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [ebp + 4]
push eax
push ecx
push 0x42
push edx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov eax, dword [0x75e0d8]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [esi + 0x1c]
xor ebp, ebp
push ebp
push edi
push 0x403
push ecx
call ebx
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [esi + 0x6c]
xor eax, eax
cmp edx, ebp
push edi
setne al
push eax
mov ecx, esi
call fcn.00486df0
mov dword [0x75e0d8], ebp
mov dword [0x75e0d4], ebp
mov edi, dword [esi + 0x60]
cmp edi, ebp
jge 0x48656c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x487250
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x561366
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.CMenu.0
mov dword [edi + 4], ebx
lea ecx, [edi + 0xc]
mov dword [esp + 0x20], ebx
call fcn.005434ec
lea ecx, [edi + 0x20]
mov byte [esp + 0x20], 1
call fcn.005434ec
mov dword [edi], method.CMenu.virtual_0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], vtable.CMenu.0
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 3
call fcn.00548da3
mov eax, dword [esp + 0x28]
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x4872ca
push 0x1e
jmp 0x4872cc
push 0xf
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
call esi
push 0x1e
mov dword [0x75e11c], eax
mov dword [0x75e100], 0xbae6fc
mov dword [0x75e118], 0xf7f8f9
call esi
push 7
mov dword [0x75e114], eax
call esi
push 0x11
mov dword [0x75e110], eax
call esi
push 4
mov dword [0x75e10c], eax
mov dword [0x75e108], 0xb7886a
mov dword [0x75e104], 0x5a4334
call esi
mov dword [0x75e0fc], eax
mov eax, 0x10
mov ecx, eax
mov dword [0x75e0f0], eax
mov eax, 3
mov dword [0x75e0f4], ecx
mov ecx, eax
mov dword [0x75e0e8], eax
mov eax, 5
mov dword [0x75e0ec], ecx
mov dword [0x75e0e0], eax
mov dword [0x75e0e4], ecx
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
mov dword [0x75e0f8], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x489df0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword [0x75e0b4]
push esi
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x489e3e
push 4
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x489e3e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x489e3e
mov edx, dword [esp + 0xc]
push esi
mov dword [eax], edx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret
Function at 0x493ed0
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x2c4
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
xor edi, edi
push eax
push 0x11
mov ebp, ecx
push edi
mov esi, 1
mov dword [esp + 0x20], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x494032
mov edx, dword [esp + 0x14]
push 0x4209
lea ecx, [esp + 0x24]
push 0x2b4
push ecx
push edi
push edx
call dword [0x703348]
mov eax, dword [esp + 0x24]
push 0xffff0002
push 0xffff0000
push 0x5c
push edi
push edi
push eax
push eax
lea eax, [esp + 0x48]
lea ebx, [ebp + 0x7c]
push eax
push 0x27
mov ecx, ebx
call fcn.005424c9
cmp eax, edi
je 0x494032
mov dword [ebp + 0xcc], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x10], edi
mov ecx, 0x1a
test esi, eax
je 0x493f5f
inc edi
shl esi, 1
dec ecx
jne 0x493f5a
lea ecx, [edi*8 + 2]
mov dword [esp + 0x10], edi
push ecx
call fcn.004df770
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 0x18], esi
je 0x494036
lea edx, [edi*4 + 1]
push esi
push edx
call dword [0x703290]
test edi, edi
mov dword [esp + 0x1c], 0
jle 0x494036
push esi
call fcn.0052731a
mov ax, word [esi]
add esp, 4
cmp ax, 0x5a
jbe 0x493fbd
add eax, 0xffffffe0
mov word [esi], ax
push 0x4211
lea eax, [esp + 0x24]
push 0x2b4
push eax
push 0x10
push esi
call dword [0x703348]
mov ecx, dword [ebp + 0xcc]
mov eax, dword [esp + 0x24]
xor edx, edx
push 0xffff0002
mov dx, word [esi]
push ecx
push edx
push 0
push 0
push eax
push eax
lea eax, [esp + 0x48]
push eax
push 0x27
mov ecx, ebx
call fcn.005424c9
mov edi, eax
test edi, edi
je 0x494032
push esi
call fcn.004e31b0
add esp, 4
test eax, eax
je 0x49401a
push edi
mov ecx, ebx
call fcn.00496de0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc eax
add esi, 8
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x493fa5
mov esi, dword [esp + 0x18]
push esi
call fcn.004df7a0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c4
ret
Function at 0x4a2b40
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x1010
call fcn.00526b50
push ebx
push ebp
push esi
push edi
call fcn.004e0150
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00526ae2
lea ecx, [esp + 0x20]
push str.gBurner.exe___1_
push ecx
call fcn.00526ab8
call fcn.004e0150
lea edx, [esp + 0x82c]
push eax
push edx
call fcn.00526ae2
lea eax, [esp + 0x834]
push str.gBurner.exe_0
push eax
call fcn.00526ab8
mov ebx, dword [esp + 0x1044]
add esp, 0x20
push ebx
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
mov ebp, dword [0x7031c0]
push edx
push 0
push 0x20006
push 0
push 0x7045ac
push 0
push 0x68c5b4
push 0x80000000
call ebp
test eax, eax
jne 0x4a2c8b
mov esi, dword [0x7031e8]
push eax
mov eax, dword [esp + 0x14]
push str.gBurner_File
push 1
push 0x7045ac
push eax
call esi
test eax, eax
je 0x4a2c10
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 0
push edx
push 1
push str.shellopencommand
push eax
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x81c]
push 0
push ecx
push 1
push str.DefaultIcon
push edx
call esi
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0x20006
push 0
push 0x7045ac
push 0
push ebx
push 0x80000000
call ebp
test eax, eax
jne 0x4a2c8b
push eax
mov eax, dword [esp + 0x14]
push 0x68c5b4
push 1
push 0x7045ac
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret

Function at 0x4a97f0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea edi, [esi + 4]
lea eax, [esi + 0x18]
push eax
mov dword [esi], ebx
mov dword [edi], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
dec edx
push edi
neg edx
sbb edx, edx
mov dword [esi + 0x38], ebx
and edx, 0xfffffffc
mov dword [esi + 0x14], ecx
add edx, 4
mov dword [esi + 0x30], 1
push edx
push esi
push 0x4aa610
push ebx
push ebx
mov dword [esi + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
mov dword [esi + 8], 1
mov eax, esi
pop edi
pop esi
pop ebx
ret 8

Function at 0x4aa1d0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x4a97e4
cmp dword [esi + 8], 1
jne 0x4a97e4
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4a97e4
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 8], 0
pop esi
ret
mov ecx, dword [ecx + 0x3c]
test ecx, ecx
je 0x4aa1dc
jmp 0x4a97c0
ret
Function at 0x4b0550
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push 0x14d
call fcn.0054b6a7
push 0
push str.IMPLEMENT_DYNCREATE_Fail_
mov dword [esi], 0x64f1c0
call fcn.004dd630
add esp, 8
push 0xffffffffffffffff
call fcn.00528d8c
pop esi
nop
nop
nop
nop
nop
nop
push esi
mov esi, ecx
call fcn.004b05d0
test byte [esp + 8], 1
je 0x4b0598
push esi
call fcn.00548c9c
add esp, 4
mov eax, esi
pop esi
ret 4

Function at 0x4b6970
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x564a3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8a0
mov eax, dword [0x692d94]
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [0x692d98]
mov dword [esp + 0x14], eax
mov eax, dword [0x700320]
push esi
push edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x8b8], ebx
mov byte [esp + 0x8b8], 1
call fcn.004e4b30
cmp eax, 2
jl 0x4b6b78
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0xac]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
lea ecx, [ebp + 0x88]
call fcn.004f45f0
cmp ax, 0x41
mov word [esp + 0x1c], ax
jb 0x4b6b78
cmp ax, 0x5a
ja 0x4b6b78
mov edx, dword [ebp + 0xd8]
lea edi, [ebp + 0xd8]
cmp dword [edx - 8], ebx
jne 0x4b6a40
push 0x400
lea eax, [esp + 0xb0]
push 0x760514
push eax
call fcn.00527768
add esp, 0xc
jmp 0x4b6a7d
push edi
call fcn.004e1b80
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4b6a7d
push 0x5c
push esi
call fcn.00526bad
add esp, 8
test eax, eax
je 0x4b6a74
push 0x400
lea ecx, [esp + 0xb0]
push esi
push ecx
call fcn.00527768
add esp, 0xc
push esi
call fcn.004df7a0
add esp, 4
cmp word [esp + 0xac], bx
je 0x4b6aa3
lea edx, [esp + 0xac]
push 0x5c
push edx
call fcn.00526bad
add esp, 8
cmp eax, ebx
je 0x4b6abd
mov word [eax + 2], bx
jmp 0x4b6abd
push ebx
lea eax, [esp + 0xb0]
push 5
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4b6b78
lea ecx, [esp + 0x2c]
push 0x40
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.004e21b0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b6ae4
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
call fcn.005443e7
cmp word [esp + 0xac], bx
je 0x4b6b78
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 8], ebx
je 0x4b6b78
mov edx, dword [ebp + 0xe0]
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.004e1610
add esp, 0xc
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.00543fbd
push ecx
lea eax, [esp + 0xb4]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0x8c4], 2
call fcn.005442c4
lea ecx, [esp + 0x20]
mov byte [esp + 0x8c0], 1
push ecx
call fcn.004e16d0
add esp, 0xc
push eax
mov ecx, edi
mov byte [esp + 0x8bc], 3
call fcn.00544397
lea ecx, [esp + 0x18]
mov byte [esp + 0x8b8], 1
call fcn.00544250
lea ecx, [esp + 0x14]
mov byte [esp + 0x8b8], bl
call fcn.00544250
lea ecx, [esp + 0x10]
mov dword [esp + 0x8b8], 0xffffffff
call fcn.00544250
mov ecx, dword [esp + 0x8b0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x8ac
ret
Function at 0x4c45b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5653a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x700320]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 8]
mov dword [ecx], eax
mov edx, dword [0x700320]
lea ebx, [esi + 0x14]
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], edx
mov al, byte [esp + 0xf]
mov dword [esi + 0x3c], edi
mov byte [esi + 0x38], al
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
push 0x7045ac
mov byte [esp + 0x20], 2
mov dword [esi], 0x651618
mov dword [esi + 0x61ad0], edi
mov dword [esi + 0x61acc], edi
mov dword [esi + 0x61ac8], edi
call fcn.005443e7
push 0x7045ac
mov ecx, ebx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.005443e7
mov ecx, dword [esp + 0x14]
or eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4c4760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5653d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ecx + 0x30]
mov dword [esp + 0xc], 0
test eax, eax
je 0x4c47a2
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 4], esp
push eax
call fcn.00543fbd
push 0
push 0
call fcn.005029e0
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call fcn.00544250
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4c47d0
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
test edi, edi
je 0x4c47e8
push 0xffffffffffffffff
push str.Connecting_to_the_server...
call edi
add esp, 8
mov eax, dword [esp + 0x10]
push 0
push 0x7045ac
push 0x7045ac
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 0x61ac8], eax
jne 0x4c4810
pop edi
pop esi
ret 0x18
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0
push 0x4400000
push 3
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 0x61acc], eax
jne 0x4c4879
push str.Failed_to_connect_to_the_server.
push 0x2732
call fcn.00506990
add esp, 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.005442c4
mov ecx, esi
call fcn.004c4760
mov eax, dword [esi + 0x61ac8]
push eax
call fcn.004df7b0
add esp, 4
xor eax, eax
pop edi
pop esi
ret 0x18
push 0
call dword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
je 0x4c48cc
push str.Failed_to_connect_to_the_server.
push 0x2732
call fcn.00506990
add esp, 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.005442c4
mov ecx, esi
call fcn.004c4760
mov ecx, dword [esi + 0x61acc]
push ecx
call fcn.004df7b0
mov edx, dword [esi + 0x61ac8]
push edx
call fcn.004df7b0
add esp, 8
xor eax, eax
pop edi
pop esi
ret 0x18
test edi, edi
je 0x4c48dc
push 0xffffffffffffffff
push str.Connected_to_the_server_successfully.
call edi
add esp, 8
pop edi
mov eax, 1
pop esi
ret 0x18
Function at 0x4c4b40
Capabilities:
Send data
Send http request

Disassembly:
sub esp, 0x108
mov eax, 0x4400000
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x4c4b5b
mov eax, 0x84c00000
mov ecx, dword [esp + 0x114]
mov edx, dword [esi + 0x61acc]
push 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x6f6360
push eax
push 0x7045ac
push str.HTTP_1.0
push ecx
push 0x6f6344
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov dword [esi + 0x61ad0], eax
jne 0x4c4bac
pop edi
pop esi
add esp, 0x108
ret 0x14
push 0x80000000
push str.Accept:___r_n
call fcn.00526b30
mov edi, dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
add esp, 4
push eax
mov eax, dword [esi + 0x61ad0]
push str.Accept:___r_n
push eax
call edi
test eax, eax
jne 0x4c4beb
mov ecx, esi
call fcn.004c4710
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 0x14
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x11c]
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
je 0x4c4c4f
push ecx
push eax
lea eax, [esp + 0x18]
push str.Range:_bytes_I64d_r_n
push eax
call fcn.00526ec2
add esp, 0x10
lea ecx, [esp + 0x10]
push 0xa0000000
push ecx
call fcn.00526b30
add esp, 4
lea edx, [esp + 0x14]
push eax
mov eax, dword [esi + 0x61ad0]
push edx
push eax
call edi
test eax, eax
jne 0x4c4c4f
mov ecx, esi
call fcn.004c4710
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 0x14
mov ecx, dword [esi + 0x61ad0]
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x108
ret 0x14

Function at 0x4c4c80
Capabilities:
Send data
Send http request

Disassembly:
mov eax, 0x4004
call fcn.00526b50
mov ax, word [0x7045ac]
push esi
mov esi, ecx
push edi
mov word [esp + 0xc], ax
mov ecx, 0xfff
xor eax, eax
lea edi, [esp + 0xe]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push 0x2000
push ecx
mov ecx, esi
mov dword [esp + 0x10], 0x6f6360
stosw word es:[edi], ax
call fcn.004c4f30
mov ecx, dword [esi + 0x34]
mov eax, 0x4400040
test ecx, ecx
je 0x4c4cd2
mov eax, 0x84c00040
mov ecx, dword [esi + 0x61acc]
push 0
lea edx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x4018]
push edx
push 0x7045ac
push str.HTTP_1.0
push eax
push str.POST
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov dword [esi + 0x61ad0], eax
jne 0x4c4d13
pop edi
pop esi
add esp, 0x4004
ret 0x14
push 0x80000000
push str.Accept:___r_n
call fcn.00526b30
mov edx, dword [esi + 0x61ad0]
add esp, 4
push eax
push str.Accept:___r_n
push edx
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
test eax, eax
jne 0x4c4d50
mov ecx, esi
call fcn.004c4710
pop edi
xor eax, eax
pop esi
add esp, 0x4004
ret 0x14
lea eax, [esp + 0xc]
push eax
call fcn.00526b30
add esp, 4
lea ecx, [esp + 0xc]
push eax
push ecx
push str.Content_Type:_application_x_www_form_urlencoded_r_n
call fcn.00526b30
mov edx, dword [esi + 0x61ad0]
add esp, 4
push eax
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x4004
ret 0x14
Function at 0x4c4da0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x61ad0]
test eax, eax
jne 0x4c4db3
xor eax, eax
pop ebx
ret 8
mov edx, dword [esp + 0xc]
push ebp
mov ecx, edx
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
push edi
xor eax, eax
mov edi, esi
push 0x75e454
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
push edx
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x61ad0]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [0x75e454]
pop edi
neg eax
sbb eax, eax
pop esi
pop ebp
and eax, ecx
pop ebx
ret 8
Function at 0x4c5c80
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4c5c92
mov dword [0x75ec6c], 1
mov eax, dword [0x75ec64]
test eax, eax
jne 0x4c5cd4
mov eax, dword [0x75ec68]
push eax
call fcn.004df7b0
add esp, 4
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x4c5ce0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x75ec68], eax
je 0x4c5cd4
mov dword [0x75ec64], 1
ret
Function at 0x4c92e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
ret
Function at 0x4cb130
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [0x75e2a0]
push 1
call fcn.004b6000
lea eax, [esp]
push eax
push 0
push 0
push 0x4caa40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4cb166
mov ecx, dword [0x75e2a0]
push eax
call fcn.004b6000
mov eax, 1
pop ecx
ret