joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453648
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45dbb4]
cmp dword [eax + 0x30], 0
je 0x4536f2
cmp dword [ebx + 0x94], 0
jne 0x4536ec
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4535d8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4536ec
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4536b2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4536ec
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417b7c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4536c1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454254
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454289
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004040bc
jmp 0x454296
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404020
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4552f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455339
mov eax, esi
call fcn.0043bb6c
test al, al
je 0x455339
mov eax, dword [ebx + 0x84]
call fcn.0043b90c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455339
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043b90c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x455ff8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415000]
call fcn.00404938
xor eax, eax
push ebp
push 0x45613c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45be7c], 0
jne 0x45604b
mov ecx, dword [0x45bf00]
mov dl, 1
mov eax, dword [0x4071a0]
call fcn.0040ba24
call fcn.00403a08
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402c90
mov eax, ebx
call fcn.00404808
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45614c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004058bc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404818
test eax, eax
jle 0x4560e3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4560dc
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404254
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040423c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00407fac
test eax, eax
jne 0x4560dc
mov ebx, 0x15
jmp 0x4560e8
mov ebx, 0x10
jmp 0x4560e8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x45be7c]
call fcn.00455f50
mov eax, dword [ebp - 8]
call fcn.00455f50
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004058d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456143
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403ff0
lea eax, [ebp - 0x10]
mov edx, dword [0x415000]
call fcn.00404a08
ret
Function at 0x459be4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x459d49
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x45bec8], 0
jne 0x459d2e
mov byte [0x45bec8], 1
mov dl, 1
mov eax, dword [0x45dc5c]
call fcn.0042bb80
xor eax, eax
push ebp
push 0x459d11
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [0x45dc7c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov edx, 0x459d60
call fcn.004043d8
jne 0x459c5b
mov eax, ebx
call fcn.00451000
jmp 0x459d07
lea ecx, [ebp - 8]
mov edx, esi
mov eax, dword [0x45dc7c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
mov edx, 0x459d70
call fcn.004043d8
jne 0x459c9e
push 5
push 0
push 0
mov eax, dword [0x45dc80]
call fcn.0040448c
push eax
push 0x459d78
mov eax, ebx
call fcn.0043b90c
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x459d07
lea ecx, [ebp - 0xc]
mov edx, esi
mov eax, dword [0x45dc7c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
mov edx, 0x459d88
call fcn.004043d8
jne 0x459d07
mov eax, dword [0x45dc80]
call fcn.0040889c
push 5
push 0
push 0
lea ecx, [ebp - 0x14]
mov edx, esi
mov eax, dword [0x45dc78]
mov esi, dword [eax]
call dword [esi + 0xc]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, dword [0x45dc80]
call fcn.004042d8
mov eax, dword [ebp - 0x10]
call fcn.0040448c
push eax
push 0x459d78
mov eax, ebx
call fcn.0043b90c
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459d2e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459d50
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403ff0
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x62854548
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x6f36407e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x41f5c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x418015
lea edi, [esi - 0x17015]
push edi
or ebp, 0xffffffff
jmp 0x41f5e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f5e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f5d8
mov eax, 1
add ebx, ebx
jne 0x41f5fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f5f0
jne 0x41f60c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f5f0
xor ecx, ecx
sub eax, 3
jb 0x41f620
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f692
mov ebp, eax
add ebx, ebx
jne 0x41f62b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f638
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f65c
inc ecx
add ebx, ebx
jne 0x41f648
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f63d
jne 0x41f659
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f63d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f67c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f66d
jmp 0x41f5de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f67c
add edi, ecx
jmp 0x41f5de
pop esi
mov edi, esi
mov ecx, 0x64d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f69a
cmp byte [edi], 6
jne 0x41f69a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41f69f
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f70e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1fab8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1fb6c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f6cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1fb70]
or eax, eax
je 0x41f708
mov dword [ebx], eax
add ebx, 4
jmp 0x41f6e9
call dword [esi + 0x1fb74]
popal
jmp 0x401220
Function at 0x1f29090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1973000]
push edi
or ebp, 0xffffffff
jmp 0x1f290b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1f290b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f290a8
mov eax, 1
add ebx, ebx
jne 0x1f290cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1f290dc
jne 0x1f290fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f290fb
dec eax
add ebx, ebx
jne 0x1f290e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1f290c0
add ebx, ebx
jne 0x1f290f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1f2914d
xor ecx, ecx
sub eax, 3
jb 0x1f29113
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1f29182
sar eax, 1
mov ebp, eax
jmp 0x1f2911e
add ebx, ebx
jne 0x1f2911e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f290ec
inc ecx
add ebx, ebx
jne 0x1f2912c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f290ec
add ebx, ebx
jne 0x1f29139
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1f2912e
jne 0x1f2914a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1f2912e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1f2916c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1f2915e
jmp 0x1f290ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1f2916c
add edi, ecx
jmp 0x1f290ae
pop esi
mov edi, esi
mov ecx, 0x4ca7fd
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1f291a7
cmp byte [edi], 0x65
jne 0x1f2918c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x1f2918a
lea edi, [esi + 0x1aed000]
mov eax, dword [edi]
or eax, eax
je 0x1f291ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2fb6120]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2fb6250]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1f291ad
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2fb6258]
or eax, eax
je 0x1f291e9
mov dword [ebx], eax
add ebx, 4
jmp 0x1f291ca
call dword [esi + 0x2fb6254]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1f29220
cmp al, 0xef
ja 0x1f29213
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1f291f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1f29202
mov ebp, dword [esi + 0x2fb625c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1f29254
sub esp, 0xffffff80
jmp 0x92006c
Function at 0x406600
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x408d58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
push edi
mov esi, ecx
lea eax, [esp + 0xc]
mov dword [esp + 0x34], 0
push eax
call sub.MFC42.DLL_CTime::GetTickCount
lea ecx, [esp + 8]
push str._Y__m__d__H:_M:_S
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CTime::Format
lea edx, [esp + 0x3c]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x40], 1
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
mov edx, dword [esi + 0x140]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0xffffffffffffffff
push 0x181
push edx
call edi
lea ecx, [esp + 0x10]
call fcn.00407b8c
mov eax, dword [esi + 0x140]
push 0
push 0
push 0x18b
push eax
call edi
mov ecx, dword [esi + 0x140]
dec eax
push 0
push eax
push 0x186
push ecx
call edi
push 0x3041
push str.chuan_sell.log
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CStdioFile::CStdioFile_1
mov edx, dword [esp + 0x18]
push 2
push 0
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 2
call dword [edx + 0x30]
lea eax, [esp + 0x3c]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call sub.MFC42.DLL_operator_2
push 0x41007c
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x3c], 3
push eax
call sub.MFC42.DLL_operator
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push eax
mov byte [esp + 0x38], 4
call sub.MFC42.DLL_CStdioFile::WriteString
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call fcn.00407b8c
mov byte [esp + 0x34], 2
lea ecx, [esp + 0x14]
call fcn.00407b8c
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 1
call fcn.00407d90
lea ecx, [esp + 8]
mov byte [esp + 0x34], 0
call fcn.00407b8c
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], 0xffffffff
call fcn.00407b8c
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x406d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x408dff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
mov bl, 3
push str.http:__apps.renren.com_chuanzhang_
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x10]
push 1
push eax
push ecx
call fcn.00407300
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x41015c
call sub.MFC42.DLL_CString::CString_2
push ecx
mov byte [esp + 0x34], 4
mov ecx, esp
mov dword [esp + 0x28], esp
push str.http:__xn.lp.sgcai.com_aliaschuanzhangamp_origin50115amp_
call sub.MFC42.DLL_CString::CString_2
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x3c], bl
call fcn.004079b0
add esp, 0x10
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 5
call fcn.00407d8a
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.00407b8c
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x406ea0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x41015c
call sub.MFC42.DLL_CString::CString_2
push ecx
mov byte [esp + 0x34], 6
mov ecx, esp
mov dword [esp + 0x24], esp
push str.http:__xn.lp.sgcai.com_aliaschuanzhangamp_
call sub.MFC42.DLL_CString::CString_2
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x3c], bl
call fcn.004079b0
add esp, 0x10
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 7
call fcn.00407d8a
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.00407b8c
push 0x4100e8
push str.amp_
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace
mov esi, dword [esp + 0x34]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x18], 1
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call fcn.00407b8c
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.00407b8c
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.00407b8c
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret 4
Function at 0x407300
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x408ee6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
push ebx
push ebp
push esi
push edi
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], edi
call sub.MFC42.DLL_CString::CString
push edi
push edi
push edi
push edi
push str.Mozilla_4.0__compatible_
mov dword [esp + 0x444], edi
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
cmp ebp, edi
jne 0x407365
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], 0xffffffff
call fcn.00407b8c
xor eax, eax
jmp 0x4074d1
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea eax, [esp + 0x14]
push 4
push eax
push 2
push ebp
mov dword [esp + 0x24], 0x1388
call esi
lea ecx, [esp + 0x14]
push 4
push ecx
push 5
push ebp
call esi
lea edx, [esp + 0x14]
push 4
push edx
push 6
push ebp
call esi
lea eax, [esp + 0x14]
push 4
push eax
push 3
push ebp
mov dword [esp + 0x24], 1
call esi
mov cl, byte [esp + 0x440]
mov eax, SysReAllocString
test cl, cl
jne 0x4073c0
mov eax, 0x80200000
mov ecx, dword [esp + 0x438]
push edi
push eax
push edi
push edi
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
cmp esi, edi
jne 0x4073f4
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], 0xffffffff
call fcn.00407b8c
xor eax, eax
jmp 0x4074d1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Empty
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x28]
push 0x400
push eax
push esi
call ebx
lea ecx, [esp + 0x24]
mov edi, eax
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_2
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x434], 1
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x430], 0
test eax, eax
lea ecx, [esp + 0x18]
je 0x407468
call fcn.00407b8c
test edi, edi
jne 0x407403
jmp 0x40746d
call fcn.00407b8c
mov al, byte [esp + 0x440]
test al, al
je 0x40749b
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 0x440]
push ecx
call fcn.00407740
add esp, 8
jmp 0x4074ac
mov ecx, dword [esp + 0x43c]
lea edx, [esp + 0x10]
push edx
call fcn.00407d8a
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x430], 0xffffffff
call fcn.00407b8c
mov eax, 1
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x424
ret
Function at 0x407740
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x408f28
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
mov dword [esp + 0x30], 0
call ebx
mov edi, eax
lea ecx, [edi + edi + 2]
push ecx
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x28]
add esp, 4
mov esi, eax
push edi
push esi
push 0xffffffffffffffff
push edx
push 0
push 0xfde9
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call ebp
mov ebx, eax
lea eax, [ebx + 1]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call ebp
mov ecx, dword [esp + 0x20]
push edi
call sub.MFC42.DLL_CString::operator
push esi
call sub.MFC42.DLL_operatordelete
push edi
call sub.MFC42.DLL_operatordelete
add esp, 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.00407b8c
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x404610
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4165d8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 3
push 0
push 0
push connect
push 0x416808
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x404735
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40472b
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404721
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x404717
cmp dword [ebp - 0x10], 0x100
jae 0x4046ae
jmp 0x404717
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040b230
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4046c5
jmp 0x404717
mov edx, dword [ebp - 0x10]
sub edx, 0x100
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0xc]
jae 0x4046ea
mov edx, dword [ebp - 0x18]
push edx
call fcn.00408c90
add esp, 4
jmp 0x404717
push 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
add ecx, 0x100
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00404500
add esp, 0x10
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
sub edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
jmp 0x40469d
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x404bf0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x41c], ecx
cmp dword [ebp - 0x41c], 2
jb 0x404c65
cmp dword [ebp - 0x41c], 3
jbe 0x404c2c
cmp dword [ebp - 0x41c], 6
je 0x404c2c
jmp 0x404c65
push 0x208
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x404c65
push 4
push str.___
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x404c65
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x404cd0
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], reloc.WS2_32.dll_bind
mov dword [ebp - 4], reloc.WS2_32.dll_accept
mov dword [ebp - 0x14], 0
jmp 0x404d06
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jae 0x404d76
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + edx*4 - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404d74
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 4
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.NoDrives
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404d6a
cmp dword [ebp - 0x1c], 0
je 0x404d6a
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404cfd
mov eax, dword [ebp - 0xc]
not eax
and eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret