joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486470
Capabilities:
Get disk information

Disassembly:
push ecx
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x48647d
add al, 0x20
mov dl, al
sub dl, 0x61
cmp dl, 0x19
ja 0x4864cb
add al, 0x9f
push esi
movzx esi, al
cmp word [esi*2 + 0x6e5e1c], 0xffff
jne 0x4864c0
add al, 0x61
mov byte [esp + 4], al
lea eax, [esp + 4]
push eax
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov word [esi*2 + 0x6e5e1c], ax
movsx eax, word [esi*2 + 0x6e5e1c]
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x486f10
Capabilities:
Clear file content

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x486f30
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x486f25
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp fcn.004864d0
mov eax, dword [ecx + 0x10]
ret

Function at 0x487070
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x4870a6
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x487098
xor eax, eax
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004864d0
ret 8
mov eax, dword [ecx + 0x10]
ret 8

Function at 0x4870b0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x4870e5
mov ecx, dword [edx]
mov edx, dword [edx + 4]
push esi
push 0
lea esi, [esp + 8]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop esi
je 0x4870d7
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
jmp fcn.004864d0
mov eax, dword [ecx + 0x10]
pop ecx
ret
Function at 0x4897b0
Capabilities:
Write file on windows

Disassembly:
push eax
mov ecx, esi
call fcn.004899f0
mov eax, dword [esi + 4]
add esp, 4
test eax, eax
je 0x4897d4
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.00608896
add esp, 0x10
mov eax, esi
ret

Function at 0x4898b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [eax]
push ebx
xor ebx, ebx
cmp eax, ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x19], bl
mov byte [esp + 0x18], bl
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], ebx
je 0x4898e2
add eax, 4
jmp 0x4898e4
xor eax, eax
push 0x2000
push 0x6a8b60
lea esi, [esp + 0x18]
call fcn.004865f0
mov ebp, eax
cmp ebp, ebx
je 0x489928
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x489915
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x48991e
call fcn.00457970
lea ebx, [esp + 0x10]
call fcn.00486bd0
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edx, dword [esp + 0x14]
cmp edx, ebx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
je 0x489946
push edx
push 1
push eax
push ecx
call fcn.00608896
add esp, 0x10
mov esi, eax
jmp 0x489948
xor esi, esi
lea ebx, [esp + 0x10]
call fcn.00486bd0
mov eax, dword [esp + 0x10]
sub esi, 1
neg esi
sbb esi, esi
test eax, eax
mov edi, esi
je 0x489974
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x48997d
mov esi, ebx
call fcn.00457970
lea ebx, [esp + 0x10]
call fcn.00486bd0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x489a70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xa6c
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0xa64], eax
mov eax, dword [esp + 0xa74]
push ebx
push ebp
mov ebp, dword [esp + 0xa78]
push esi
push edi
lea edi, [esp + 0x48]
call fcn.00407270
mov eax, dword [esp + 0x250]
xor ebx, ebx
cmp eax, ebx
je 0x489ab9
test dword [eax], 0xffffff00
je 0x489ab9
cmp byte [eax + 4], bl
jne 0x489ac6
push ebx
lea ecx, [esp + 0x4c]
call fcn.0046d7a0
add esp, 4
mov ecx, str.cookies.bin
lea esi, [esp + 0x48]
call fcn.0045be00
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x489ae1
add eax, 4
jmp 0x489ae3
xor eax, eax
push 0x2000
push 0x67b484
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x25], bl
mov byte [esp + 0x24], bl
mov dword [esp + 0x2c], ebx
call fcn.004865f0
cmp eax, ebx
mov dword [esp + 0x20], eax
je 0x489bed
cmp eax, 0xa
je 0x489bed
lea esi, [esp + 0x40]
call fcn.00495ae0
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x489b35
add eax, 4
jmp 0x489b37
xor eax, eax
call fcn.0048a0b0
test al, al
je 0x489bed
lea eax, [esp + 0x40]
push eax
call fcn.004959f0
fcomp qword [0x6c0b40]
fnstsw ax
test ah, 0x41
je 0x489c86
mov eax, 0x1f4
call fcn.00458210
cmp eax, 0xf4242
je 0x489c86
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x489b81
add eax, 4
jmp 0x489b83
xor eax, eax
push 0x2000
push 0x67b484
lea esi, [esp + 0x34]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3c], bl
mov dword [esp + 0x44], ebx
call fcn.004865f0
mov dword [esp + 0x38], eax
mov edi, esi
lea eax, [esp + 0x14]
call fcn.00484830
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x489bd1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x489bdc
call fcn.00457970
lea ebx, [esp + 0x2c]
call fcn.00486bd0
xor ebx, ebx
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x489bed
cmp eax, 0xa
jne 0x489b44
fldz
mov eax, dword [esp + 0x18]
cmp eax, ebx
fstp dword [esp + 0x28]
je 0x489c0d
push eax
push 1
lea ecx, [esp + 0x30]
push 4
push ecx
call fcn.0060860a
add esp, 0x10
fld dword [esp + 0x28]
fld dword [0x6fa0f4]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x489c2b
lea ebx, [esp + 0x14]
call fcn.00486bd0
xor ebx, ebx
lea edi, [esp + 0x14]
mov eax, ebp
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 0x10], ebx
call fcn.00484830
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x489c59
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x489c62
mov esi, edi
call fcn.00457970
lea ebx, [esp + 0x14]
call fcn.00486bd0
lea ecx, [esp + 0x48]
call fcn.00401770
mov ecx, dword [esp + 0xa74]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00607d6d
add esp, 0xa6c
ret
lea edi, [esp + 0x14]
mov eax, ebp
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 0x10], ebx
call fcn.00484830
mov eax, edi
call fcn.00407130
jmp 0x489c62
Function at 0x489f80
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x24
push esi
push edi
push 0
push 0x2000000
push 3
push 0
push 3
push 0x100
push eax
call dword [0x6fc1a8]
mov edi, eax
cmp edi, 0xffffffff
jne 0x489fb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x24
jmp fcn.004896a0
lea ecx, [esp + 0x30]
push ecx
lea esi, [esp + 0x1c]
call fcn.004746a0
lea edx, [esp + 0x10]
push edx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [esp + 8]
push eax
mov ecx, eax
push ecx
mov edx, eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret

Function at 0x48acf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi]
xor ebx, ebx
cmp eax, ebx
je 0x48ad07
lea ecx, [eax + 4]
jmp 0x48ad09
xor ecx, ecx
call fcn.0048a090
cmp eax, ebx
jne 0x48ad1e
mov eax, 2
pop edi
pop esi
pop ebx
add esp, 0x18
ret
push ebx
mov ecx, edi
call fcn.00487200
cmp eax, ebx
jne 0x48adbc
mov eax, dword [esi]
cmp eax, ebx
je 0x48ad39
add eax, 4
jmp 0x48ad3b
xor eax, eax
push 0x2000
push 0x67b484
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x21], bl
mov byte [esp + 0x20], bl
mov dword [esp + 0x28], ebx
call fcn.004865f0
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
mov dword [esp + 0x1c], eax
jne 0x48ad72
mov edi, eax
jmp 0x48ad95
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x48ad90
mov esi, dword [edi]
push ecx
push esi
push 1
push eax
call fcn.0060860a
add esp, 0x10
cmp eax, esi
jne 0x48ad90
xor edi, edi
jmp 0x48ad95
mov edi, 2
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x48adb1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x48adba
lea esi, [esp + 0x10]
call fcn.00457970
lea ebx, [esp + 0x10]
call fcn.00486bd0
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x48c7a0
Capabilities:
Write file on windows

Disassembly:
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.00608896
sub eax, 1
add esp, 0x10
neg eax
sbb eax, eax
and eax, 2
ret

Function at 0x48c7c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 4
push ecx
mov dword [esp + 0x10], 0
call fcn.0060860a
add esp, 0x10
cmp eax, 1
je 0x48c7e5
or eax, 0xffffffff
pop ecx
ret
mov eax, dword [esp + 8]
mov edx, dword [esp]
mov dword [eax], edx
xor eax, eax
pop ecx
ret

Function at 0x48c800
Capabilities:
Write file on windows

Disassembly:
test edi, edi
push esi
je 0x48c83a
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x48c810
sub eax, edx
lea esi, [eax + 1]
test esi, esi
je 0x48c83a
push ebx
push esi
push 1
push edi
call fcn.00608896
sub eax, esi
add esp, 0x10
neg eax
sbb eax, eax
and eax, 2
pop esi
ret
push ebx
push 0
call fcn.0061b557
add esp, 8
xor eax, eax
pop esi
ret

Function at 0x48d1f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
call fcn.0048d270
mov esi, eax
mov eax, dword [esp + 0xc]
push str.XMLF
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x48d259
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, ebx
call fcn.00487200
test eax, eax
je 0x48d22d
mov eax, 4
pop edi
pop esi
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x48d259
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x48d259
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
push ecx
push eax
push edx
call fcn.0060d1b0
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret
pop edi
mov eax, 9
pop esi
ret
Function at 0x48e260
Capabilities:
Get file version info

Disassembly:
fldz
mov eax, dword [esp + 4]
sub esp, 0x20
push ebp
mov ebp, dword [esp + 0x2c]
fst dword [ebp]
push esi
fstp dword [eax]
mov eax, dword [ecx]
test eax, eax
push edi
je 0x48e280
lea edi, [eax + 4]
jmp 0x48e282
xor edi, edi
lea eax, [esp + 0x34]
call fcn.0045b460
mov esi, dword [esp + 0x34]
test esi, esi
mov dword [esp + 0xc], 0
je 0x48e2a0
lea eax, [esi + 4]
jmp 0x48e2a2
xor eax, eax
lea edx, [esp + 0xc]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x48e2e2
lea eax, [esp + 0x20]
call fcn.00487150
test esi, esi
je 0x48e2c5
lea eax, [esi + 4]
jmp 0x48e2c7
xor eax, eax
mov esi, dword [esp + 0x24]
push esi
push edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x48e2f5
lea esi, [esp + 0x20]
call fcn.00487190
lea edi, [esp + 0x34]
call fcn.00401700
or eax, 0xffffffff
pop edi
pop esi
pop ebp
add esp, 0x20
ret
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x6a8b4c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x48e2d9
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
movzx edx, ax
mov dword [esp + 0x14], edx
shr eax, 0x10
test eax, eax
fild dword [esp + 0x14]
mov dword [esp + 0x14], eax
fld qword [0x6c0c80]
mov dword [esp + 0x18], 0
fdiv st(1), st(0)
fild dword [esp + 0x14]
jge 0x48e345
fadd dword [0x6c0a38]
mov eax, dword [esp + 0x30]
faddp st(2)
fxch st(1)
fstp dword [eax]
mov eax, dword [ecx + 0xc]
movzx ecx, ax
mov dword [esp + 0x30], ecx
shr eax, 0x10
test eax, eax
fidivr dword [esp + 0x30]
mov dword [esp + 0x30], eax
fild dword [esp + 0x30]
jge 0x48e372
fadd dword [0x6c0a38]
faddp st(1)
lea edi, [esp + 0x18]
fstp dword [ebp]
call fcn.00401700
lea esi, [esp + 0x20]
call fcn.00487190
lea edi, [esp + 0x34]
call fcn.00401700
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret

Function at 0x492c70
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax + 0x228], 0
je 0x492cc9
push ebx
push ebp
push esi
mov edx, 1
mov esi, 0x100
mov eax, edi
mov ebx, edi
and ebx, 0xff00ff
mov ebp, eax
imul ebx, edx
shr ebp, 8
and ebp, 0xffff00ff
imul ebp, edx
shr eax, 8
and eax, 0xff00ff
imul eax, edx
shr ebx, 8
xor ebx, ebp
and ebx, 0xff00ff
xor ebx, eax
mov dword [ecx], ebx
add ecx, 4
add edx, 1
sub esi, 1
jne 0x492c86
pop esi
pop ebp
pop ebx
ret
Function at 0x496380
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x24
cmp dword [0x6fa108], 0
push esi
push edi
mov edi, eax
mov dword [esp + 8], 0
jne 0x4963c4
push 0xf0000000
push 1
push 0
push 0
push 0x6fa108
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4963c4
lea edi, [esp + 8]
call fcn.00401700
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x24
ret
mov ecx, dword [0x6fa108]
lea eax, [esp + 0x10]
push eax
push 8
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
neg eax
sbb eax, eax
neg eax
je 0x4963b2
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push str._I64d
lea esi, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.00407380
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x496412
add eax, 4
mov esi, eax
jne 0x496417
mov esi, 0x67b348
call fcn.0060915b
push eax
push esi
push 0
push str._d__s__d
lea esi, [esp + 0x18]
call fcn.00407380
lea ecx, [esp + 0x28]
push ecx
mov eax, esi
call fcn.00495cf0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x49645d
lea edi, [esp + 0xc]
call fcn.00401700
lea edi, [esp + 8]
call fcn.00401700
mov eax, esi
pop edi
pop esi
add esp, 0x24
ret
lea edx, [esp + 0x18]
push edx
mov eax, edi
call fcn.00496230
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x49649a
test dword [eax], 0xffffff00
je 0x49649a
cmp byte [eax + 4], 0
je 0x49649a
lea edi, [esp + 0xc]
call fcn.00401700
lea edi, [esp + 8]
call fcn.00401700
xor eax, eax
pop edi
pop esi
add esp, 0x24
ret
lea edi, [esp + 0xc]
call fcn.00401700
lea edi, [esp + 8]
call fcn.00401700
pop edi
mov eax, 4
pop esi
add esp, 0x24
ret

Function at 0x4993a0
Capabilities:
Download url
Receive data

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
call fcn.0046e090
test al, al
mov eax, dword [ecx]
je 0x4993f1
test eax, eax
lea ecx, [eax + 4]
jne 0x4993c1
mov ecx, 0x67b348
mov eax, dword [ebx]
test eax, eax
je 0x4993cc
add eax, 4
jmp 0x4993d1
mov eax, 0x67b348
push ebp
push 0
push ecx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
je 0x49946d
mov eax, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
test eax, eax
je 0x4993fa
lea edi, [eax + 4]
jmp 0x4993fc
xor edi, edi
lea eax, [esp + 0x14]
call fcn.0045b460
mov eax, dword [eax]
test eax, eax
je 0x499410
lea esi, [eax + 4]
jmp 0x499412
xor esi, esi
mov eax, dword [ebx]
test eax, eax
je 0x49941d
lea edi, [eax + 4]
jmp 0x49941f
xor edi, edi
lea eax, [esp + 0x10]
call fcn.0045b460
mov eax, dword [eax]
test eax, eax
je 0x499433
add eax, 4
jmp 0x499435
xor eax, eax
push ebp
push 0
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileW
lea edi, [esp + 0x10]
mov esi, eax
call fcn.00401700
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
call fcn.00401700
test esi, esi
je 0x49946d
mov eax, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x499480
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
mov eax, 0x1a50
call fcn.00618800
mov eax, dword [0x6d7160]
xor eax, esp
mov dword [esp + 0x1a4c], eax
mov eax, dword [esp + 0x1a54]
mov eax, dword [eax]
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x4994ae
lea ebx, [eax + 4]
jmp 0x4994b0
xor ebx, ebx
lea eax, [esp + 0x18]
call fcn.004d39b0
push 0
push 0
push 0
push 0
push 0x6ab4e8
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
test ebp, ebp
je 0x499577
movzx eax, word [esp + 0x34]
push 0xc30
push 0
push 3
push 0
push 0
push eax
lea eax, [esp + 0x170]
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
je 0x499577
lea eax, [esp + 0xa58]
mov dword [esp + 0x14], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x499510
sub eax, edx
lea edi, [esp + 0xa58]
lea ecx, [esp + 0x14]
call fcn.00459750
lea ecx, [esp + 0x1258]
push ecx
lea eax, [esp + 0x18]
call fcn.00459410
mov eax, dword [esp + 0x14]
test eax, eax
je 0x499549
add eax, 4
jmp 0x49954b
xor eax, eax
push 0xc30
push 0x80000
push 0x6e4978
push 0
push 0
push eax
push 0
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
jne 0x499587
lea edi, [esp + 0x14]
call fcn.00401700
lea edi, [esp + 0x18]
call fcn.00401700
mov eax, 4
jmp 0x4995c4
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov esi, eax
neg esi
sbb esi, esi
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
neg esi
sub esi, 1
call edi
push ebx
call edi
push ebp
call edi
lea edi, [esp + 0x14]
call fcn.00401700
lea edi, [esp + 0x18]
call fcn.00401700
mov eax, esi
mov ecx, dword [esp + 0x1a5c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00607d6d
add esp, 0x1a50
ret

Function at 0x4995e0
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub esp, 0x24
push ebp
push esi
push edi
lea eax, [esp + 0xc]
push eax
xor ebp, ebp
push str.EnableAutodial
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], ebp
call fcn.00409510
mov eax, esi
call fcn.004029c0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xc]
mov edi, esi
mov dword [esp + 0xc], ebp
call fcn.004073f0
push ebp
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], ebp
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x499671
mov ecx, dword [esp + 0x34]
push ebp
call fcn.004993a0
mov edx, dword [esp + 0x30]
mov esi, eax
add esp, 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], edx
call fcn.004073f0
lea edi, [esp + 0x1c]
call fcn.00401700
lea edi, [esp + 0x18]
mov dword [esp + 0x1c], ebp
call fcn.00401700
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
lea edi, [esp + 0x14]
call fcn.004073f0
lea edi, [esp + 0x1c]
call fcn.00401700
lea edi, [esp + 0x18]
mov dword [esp + 0x1c], ebp
call fcn.00401700
pop edi
pop esi
mov eax, 6
pop ebp
add esp, 0x24
ret
Function at 0x49cca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x1a4]
sub esp, 0x78
shr eax, 1
push ebx
push ebp
push esi
je 0x49cdb9
xor ebx, ebx
xor ebp, ebp
cmp eax, ebx
jbe 0x49cdb9
fld1
mov eax, dword [edi + 0x1a0]
fldz
mov esi, vtable.ytUIEvent.0
fxch st(1)
mov dword [esp + 0x10], esi
fst dword [esp + 0x38]
mov byte [esp + 0x5c], 1
fst dword [esp + 0x48]
mov dword [esp + 0x78], ebx
fstp dword [esp + 0x58]
mov dword [esp + 0x34], ebx
mov byte [esp + 0x7c], bl
mov byte [esp + 0x7d], bl
mov byte [esp + 0x74], bl
fst dword [esp + 0x3c]
mov dword [esp + 0x60], ebx
fst dword [esp + 0x40]
mov dword [esp + 0x30], ebx
fst dword [esp + 0x44]
mov dword [esp + 0x18], 0x1b
fst dword [esp + 0x4c]
fst dword [esp + 0x50]
fst dword [esp + 0x54]
fst dword [esp + 0x64]
fst dword [esp + 0x68]
fst dword [esp + 0x6c]
fstp dword [esp + 0x70]
fldz
fstp qword [esp + 0x20]
mov ecx, dword [eax + ebp*4]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push edi
call edx
mov eax, dword [esp + 0x78]
cmp eax, ebx
mov dword [esp + 0x10], esi
je 0x49cda6
movzx ecx, byte [eax]
cmp ecx, 0x80
mov esi, eax
jae 0x49cda6
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x49cd95
movzx edx, byte [esi]
cmp edx, 0x80
jae 0x49cd90
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x49cd95
mov eax, 0xff
cmp eax, ebx
jne 0x49cda6
mov eax, dword [esp + 0x78]
push eax
call fcn.0045da90
add esp, 4
mov ecx, dword [edi + 0x1a4]
add ebp, 1
shr ecx, 1
cmp ebp, ecx
jb 0x49ccc0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x78
ret
Function at 0x49f230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
test dword [esi + 0x1a4], 0xfffffffe
push edi
mov dword [esp + 0x10], ebx
jbe 0x49f37e
fld1
mov eax, dword [ebp + 8]
fldz
mov ecx, dword [esi + 0x1a0]
mov edx, dword [esp + 0x10]
fxch st(1)
fst dword [esp + 0x40]
mov edi, vtable.ytUIEvent.0
fst dword [esp + 0x50]
mov dword [esp + 0x18], edi
fstp dword [esp + 0x60]
mov byte [esp + 0x64], 1
mov dword [esp + 0x80], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x84], bl
fst dword [esp + 0x44]
mov byte [esp + 0x85], bl
fst dword [esp + 0x48]
mov byte [esp + 0x7c], bl
fst dword [esp + 0x4c]
mov dword [esp + 0x68], ebx
fst dword [esp + 0x54]
mov dword [esp + 0x38], ebx
fst dword [esp + 0x58]
mov dword [esp + 0x20], 0x21
fst dword [esp + 0x5c]
mov dword [esp + 0x14], ebx
fst dword [esp + 0x6c]
fst dword [esp + 0x70]
fst dword [esp + 0x74]
fstp dword [esp + 0x78]
fldz
fstp qword [esp + 0x28]
mov dword [esp + 0x28], eax
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1c]
push edx
push esi
call eax
cmp eax, 0xf4240
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], edi
je 0x49f3a4
cmp eax, ebx
je 0x49f363
movzx ecx, byte [eax]
cmp ecx, 0x80
mov edi, eax
jae 0x49f363
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x49f34f
movzx edx, byte [edi]
cmp edx, 0x80
jae 0x49f34a
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x49f34f
mov eax, 0xff
cmp eax, ebx
jne 0x49f363
mov eax, dword [esp + 0x80]
push eax
call fcn.0045da90
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1a4]
add eax, 1
shr ecx, 1
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x49f254
cmp byte [esi + 0x213], bl
jne 0x49f402
mov ecx, dword [esi + 0x244]
cmp ecx, ebx
je 0x49f402
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
mov edx, dword [edx + 0x70]
push eax
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, ebx
je 0x49f3f7
movzx edx, byte [eax]
cmp edx, 0x80
mov esi, eax
jae 0x49f3f7
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x49f3e3
movzx eax, byte [esi]
cmp eax, 0x80
jae 0x49f3de
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x49f3e3
mov eax, 0xff
cmp eax, ebx
jne 0x49f3f7
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0045da90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
call fcn.0049b700
cmp eax, ebx
je 0x49f423
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov edx, dword [edx + 0x54]
push ecx
mov ecx, eax
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret 4