joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a5f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.00477c40
add esp, 0xc
lea edx, [esp + 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x41a6a5
test eax, eax
je 0x41a6a5
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00477c40
add esp, 0xc
lea edx, [esp + 8]
push edx
mov ecx, edi
call fcn.0041a350
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x214]
push ecx
push str._s_s.json
push esi
call fcn.00401570
push esi
push str.CInternal::getLogSavedFile
push str._UNO___s___s
call fcn.00419c60
add esp, 0x1c
mov eax, 1
jmp 0x41a6a7
xor eax, eax
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.00477bf8
add esp, 0x414
ret 4

Function at 0x41a6c0
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a786
push ebx
push esi
lea eax, [ebp + 6]
push 0x499f44
push eax
call fcn.00479b6a
push 0x208
mov esi, eax
call fcn.00477742
add esp, 0xc
mov ebx, eax
test esi, esi
je 0x41a765
push edi
lea ebx, [ebx]
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a705
sub eax, edx
sar eax, 1
cmp esi, eax
ja 0x41a764
push 0x104
push 0x499f40
push ebx
call fcn.00478ec2
lea edi, [esi + 4]
push edi
push ebp
push ebx
call fcn.00478ec2
add esp, 0x18
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41a74a
push ebx
call fcn.0047ab81
add esp, 4
lea ecx, [ebp + edi*2]
push 0x499f44
push ecx
call fcn.00479b6a
lea esi, [esi + eax + 1]
add esp, 8
test esi, esi
jne 0x41a700
pop edi
push ebp
call fcn.0047ab81
add esp, 4
test ebx, ebx
je 0x41a77b
push ebx
call fcn.00477e1a
add esp, 4
push ebp
call fcn.00424fb0
add esp, 4
pop esi
pop ebx
push 2
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
pop ebp
ret 4

Function at 0x41a7a0
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
sub esp, 8
push esi
push edi
xor edi, edi
push edi
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], edi
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x41a80c
push edi
push edi
push edi
push edi
push str.Microsoft_Internet_Explorer
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
je 0x41a80c
push str.Sensapi.DLL
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41a80c
push str.IsNetworkAlive
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a7fc
lea ecx, [esp + 0xc]
push ecx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, str.TRUE
test edi, edi
jne 0x41a811
mov eax, str.FALSE
push eax
push str.CInternal::isNetworkConnected
push 0x499f48
call fcn.00419c60
add esp, 0xc
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x41b920
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x41b940
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x41b954
pop edi
lea eax, [esi + 0xd]
pop esi
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
inc eax
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x41b980
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], ecx
test ebp, ebp
jne 0x41b996
lea eax, [ebp + 0xd]
pop ebp
pop ecx
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x41b9a3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x41c080
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx + 4]
push edi
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
push ecx
xor ebx, ebx
or esi, 0x2001f
push esi
push ebx
push edx
push eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x10]
mov edi, eax
cmp edi, ebx
jne 0x41c0ff
xor eax, eax
cmp ecx, ebx
je 0x41c0e7
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
and esi, 0x300
mov edi, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
cmp eax, ebx
je 0x41c123
cmp ecx, ebx
je 0x41c10a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00477bf8
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x44]
push edx
push ebx
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
jne 0x41c18a
jmp 0x41c150
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.0041c080
mov edi, eax
cmp edi, ebx
jne 0x41c1d9
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x44]
push eax
push ebx
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
je 0x41c150
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x41c19d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
mov dword [esp + 0x18], ebx
call fcn.0041b860
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x41c1c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00477bf8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x41c1e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x134]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00477bf8
mov esp, ebp
pop ebp
ret 4
Function at 0x420970
Capabilities:
Get mac address on windows

Disassembly:
push 0xffffffffffffffff
push 0x4905a6
mov eax, dword fs:[0]
push eax
mov eax, 0x2ac8
call fcn.00477c10
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0x2ac4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0x2adc]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2aec]
mov ebp, dword [esp + 0x2af0]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
mov dword [esp + 0x1c], 0x2880
call sub.iphlpapi.dll_GetAdaptersInfo
mov ecx, 7
xor edi, edi
xor edx, edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], edi
mov word [esp + 0x38], dx
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov dword [esp + 0x2ae4], edi
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], cx
mov byte [esp + 0x2ae4], 1
cmp eax, edi
jne 0x420b91
lea esi, [esp + 0x50]
jmp 0x420a20
push 0x206
lea eax, [esp + 0x28d6]
xor edx, edx
push edi
push eax
mov word [esp + 0x28dc], dx
call fcn.00477c40
mov eax, dword [esi + 0x1a0]
add esp, 0xc
cmp eax, 6
jne 0x420abe
movzx ecx, byte [esi + 0x199]
movzx edx, byte [esi + 0x198]
movzx eax, byte [esi + 0x197]
push ecx
movzx ecx, byte [esi + 0x196]
push edx
movzx edx, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push ecx
push edx
push eax
lea ecx, [esp + 0x28e8]
push str._02X__02X__02X__02X__02X__02X
push ecx
call fcn.00401570
lea eax, [esp + 0x28f0]
add esp, 0x20
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x420aa0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x28d4]
push edx
lea ecx, [esp + 0x3c]
jmp 0x420b2e
cmp eax, 0x47
jne 0x420b33
movzx eax, byte [esi + 0x199]
movzx ecx, byte [esi + 0x198]
movzx edx, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push ecx
movzx ecx, byte [esi + 0x195]
push edx
movzx edx, byte [esi + 0x194]
push eax
push ecx
push edx
lea eax, [esp + 0x28e8]
push str._02X__02X__02X__02X__02X__02X
push eax
call fcn.00401570
lea eax, [esp + 0x28f0]
add esp, 0x20
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x420b12
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x28d0]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00415a20
mov esi, dword [esi]
cmp esi, edi
jne 0x420a20
mov eax, dword [esp + 0x38]
mov esi, 8
cmp dword [esp + 0x4c], esi
jae 0x420b50
lea eax, [esp + 0x38]
push eax
push 0x495010
push ebx
call fcn.00401570
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp dword [esp + 0x30], esi
jae 0x420b6d
lea eax, [esp + 0x1c]
push eax
push 0x495010
push ebp
call fcn.00401570
add esp, 0xc
cmp dword [esp + 0x30], esi
jb 0x420b96
mov edx, dword [esp + 0x1c]
push edx
call fcn.00477a90
add esp, 4
jmp 0x420b96
mov esi, 8
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], ax
cmp dword [esp + 0x4c], esi
jb 0x420bbc
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00477a90
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x2adc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2ac4]
xor ecx, esp
call fcn.00477bf8
add esp, 0x2ad4
ret 8
Function at 0x4250f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0x492c18
lea eax, [esp + 8]
push esi
push eax
mov dword [esp + 0x10], 0
call fcn.00477f1a
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x425137
push 0x492c18
lea ecx, [esp + 8]
push esi
push ecx
call fcn.00477f1a
mov eax, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x425137
pop esi
pop ecx
ret
push edi
push 2
push 0
push eax
call fcn.0047aafc
mov edx, dword [esp + 0x14]
push edx
call fcn.0047aa07
mov esi, dword [esp + 0x24]
push 0
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
push 0
push eax
call fcn.0047aafc
mov ecx, dword [esi]
inc ecx
push ecx
call fcn.0047a435
mov edx, dword [esp + 0x28]
mov edi, eax
mov eax, dword [esi]
push edx
push eax
push 1
push edi
call fcn.00478798
mov ecx, dword [esi]
mov byte [edi + ecx], 0
mov edx, dword [esp + 0x38]
push edx
call fcn.00477fdc
add esp, 0x34
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x426500
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x490bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov edi, dword [esp + 0xa0]
mov eax, ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 0x14]
xor ebx, ebx
mov dword [esp + 0x14], eax
xor edx, edx
mov eax, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
lea esi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x426570
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.00415c80
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x70]
push ecx
mov dword [esp + 0x9c], ebx
call fcn.00425270
add esp, 8
mov esi, 8
mov byte [esp + 0x94], 2
cmp dword [esp + 0x30], esi
jb 0x4265c3
mov edx, dword [esp + 0x1c]
push edx
call fcn.00477a90
add esp, 4
xor eax, eax
mov word [esp + 0x1c], ax
xor ecx, ecx
mov eax, edi
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], cx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4265f0
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x3c]
call fcn.00415c80
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x9c], 3
call fcn.00425270
add esp, 8
cmp dword [esp + 0x4c], esi
jb 0x426637
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00477a90
add esp, 4
mov eax, dword [esp + 0x70]
mov esi, 0x10
cmp dword [esp + 0x84], esi
jae 0x42664d
lea eax, [esp + 0x70]
mov edi, dword [esp + 0x14]
push edi
push eax
lea ecx, [esp + 0x20]
call fcn.00425be0
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x68], esi
jae 0x42666a
lea eax, [esp + 0x54]
push edi
push eax
lea ecx, [esp + 0x3c]
call fcn.00425be0
mov ecx, dword [esp + 0x10]
push edi
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x20]
push eax
add ecx, 4
call fcn.004256b0
cmp dword [esp + 0x68], esi
jb 0x42669f
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00477a90
add esp, 4
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
cmp dword [esp + 0x84], esi
jb 0x4266c5
mov edx, dword [esp + 0x70]
push edx
call fcn.00477a90
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00477bf8
add esp, 0x88
ret 8
Function at 0x4266f0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x490c08
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x58]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
jne 0x4267f0
lea esi, [edi + 4]
cmp esi, ebx
je 0x426744
mov dword [esi + 0xc], 3
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push 0x493e30
lea eax, [esp + 0x5c]
push ebp
push eax
mov dword [esp + 0x64], ebx
call fcn.00477f1a
mov eax, dword [esp + 0x64]
add esp, 0xc
cmp eax, ebx
je 0x426839
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ebx
call fcn.0047ba95
add esp, 4
cmp eax, 0xffffffff
je 0x426787
inc dword [esp + 0x28]
mov byte [esp + 0x24], al
jmp 0x426791
cmp byte [esp + 0x24], bl
je 0x426791
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x20]
push 0x100
mov dword [esp + 0x30], ecx
push ebx
lea ecx, [esp + 0x38]
call fcn.0041cea0
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
mov dword [esp + 0x54], ebx
call fcn.00425ca0
mov eax, dword [esp + 0x58]
push eax
call fcn.00477fdc
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [esp + 0x50], 0xffffffff
mov esi, ecx
cmp ecx, ebx
je 0x426839
call fcn.0041abb0
mov ecx, dword [esi + 0x10]
push ecx
call fcn.00477a90
push esi
call fcn.00477a90
add esp, 8
jmp 0x426839
lea edx, [esp + 0x14]
push edx
push ebp
mov dword [esp + 0x1c], ebx
call fcn.004250f0
mov esi, eax
add esp, 8
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 4]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.00421ae0
cmp dword [eax + 0x28], ebx
je 0x426830
push str.CLogFile::LoadLog
push str._UNO___s__Parse_error
call fcn.00419c60
add esp, 8
push esi
call fcn.0047a4f8
add esp, 4
push ebp
push str.CLogFile::LoadLog
push 0x49ba10
call fcn.00419c60
add esp, 0xc
mov eax, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4

Function at 0x426b50
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
lea eax, [edi + 4]
je 0x426ba8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, eax
test esi, esi
je 0x426ba8
push esi
push str._CThreadMgr::DestroyThread__WaitForSingleObject:__d._n
call fcn.00419e50
mov eax, dword [esp + 0x14]
add esp, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x426b93
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push str._CThreadMgr::DestroyThread__CloseHandle:__d._n
call fcn.00419e50
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x426dd0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x426de8
push 0x3e8
call fcn.00426b50
test eax, eax
jl 0x426e60
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x426b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x426e4c
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x426e45
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x426e45
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x426e2f
and eax, 0xffff
or eax, 0x80070000
push 0x3e8
mov ecx, esi
mov edi, eax
call fcn.00426b50
mov eax, edi
pop edi
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x426e60
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ecx
ret 4

Function at 0x427ab0
Capabilities:
Create http request

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
jne 0x427ae5
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x192
call fcn.004278b0
ret

Function at 0x427af0
Capabilities:
Connect to http server

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x427b04
push edi
push str.CHttpToolA::OpenConnection:_hInternet_can_not_be_NULL.
call fcn.00427880
mov edx, dword [esp + 0xc]
test edx, edx
jne 0x427b17
push edx
push str.CHttpToolA::OpenConnection:_szServerAddr_can_not_be_NULL.
call fcn.00427880
mov eax, edx
push esi
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427b20
sub eax, esi
pop esi
push 0
jne 0x427b38
push str.CHttpToolA::OpenConnection:_szServerAddr_can_not_be_an_empty_string.
call fcn.00427880
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push 3
push eax
mov eax, dword [esp + 0x20]
push ecx
push eax
push edx
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
jne 0x427b69
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x193
call fcn.004278b0
pop edi
ret

Function at 0x427da0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x427db3
push eax
push str.CHttpToolA::GetFileSize:_hFile_can_not_be_NULL.
call fcn.00427880
push esi
mov esi, dword [esp + 0xc]
push 0
test esi, esi
jne 0x427dc8
push str.CHttpToolA::GetFileSize:_szFilePath_can_not_be_NULL.
call fcn.00427880
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x427de6
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x25d
call fcn.004278b0
pop esi
ret
Function at 0x428e20
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x104]
sub esp, 0x104
push 0xffffffffffffffff
push 0x490d50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4b0650]
xor eax, ebp
mov dword [ebp + 0x100], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x10c]
test esi, esi
jne 0x428e72
push esi
push esi
push str.CHttpToolW::GetMimeType:_hFile_can_not_be_NULL.
call fcn.00428cc0
mov edi, dword [ebp + 0x110]
cmp edi, 0xfde9
je 0x428fdf
cmp edi, 0xfde8
je 0x428fdf
cmp esi, 0xffffffff
jne 0x428ef3
mov edi, dword [str.application_octet_stream]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428ea0
sub eax, edx
inc eax
push eax
call fcn.0047a435
add esp, 4
test eax, eax
jne 0x428ebe
push 0x66
call fcn.00427f90
mov esi, eax
mov ecx, edi
sub esi, edi
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x428ec4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.00477bf8
add ebp, 0x104
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18]
push eax
push 0x100
lea ecx, [ebp]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
test eax, eax
jne 0x428f20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x25a
call fcn.00427ff0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
cmp eax, 0xffffffff
jne 0x428f43
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x25c
call fcn.00427ff0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push eax
lea ecx, [ebp]
push ecx
push 0
push 0
mov dword [ebp - 0x14], 0
call sub.urlmon.dll_FindMimeFromData
test eax, eax
je 0x428fa5
mov edi, dword [str.application_octet_stream]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428f72
sub eax, edx
inc eax
push eax
call fcn.0047a435
add esp, 4
test eax, eax
jne 0x428f90
push 0x66
call fcn.00427f90
mov esi, eax
mov ecx, edi
sub esi, edi
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x428f96
jmp 0x428ece
mov edx, dword [ebp - 0x14]
push edi
push edx
mov dword [ebp - 4], 0
call fcn.00428d60
mov esi, eax
mov eax, dword [ebp - 0x14]
add esp, 8
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
jmp 0x428ece
push 0
push 0
push str.CHttpToolW::GetMimeType:_CP_UTF8_and_CP_UTF7_can_not_be_used_for_the_CodePage_parameter.
call fcn.00428cc0
int3

Function at 0x42ea40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x42ea6d
push esi
push edi
jmp 0x42ea50
movzx esi, byte [edx]
movzx esi, byte [esi + 0x49ee48]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x42ea50
pop edi
pop esi
ret
Function at 0x43c420
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [ebx]
mov ebp, dword [edi + 0xc]
lea esi, [eax + 2]
mov ecx, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
call fcn.00434290
mov esi, eax
mov eax, edi
mov dword [esp + 0x14], esi
call fcn.00434240
mov dword [esp + 0x1c], eax
mov eax, edi
call fcn.00434180
mov eax, ebx
push 0
mov ecx, esi
mov ebx, edi
call fcn.0043b5c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx + 8]
add esi, eax
push ebp
mov eax, esi
mov edx, 0x37
call fcn.0043a030
lea ebx, [esi + 1]
mov esi, dword [esp + 0x34]
push 1
call fcn.0043b2b0
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push esi
push edx
push eax
push 0x1f
mov eax, ebp
call fcn.00439f90
mov ebx, dword [esp + 0x44]
mov cl, byte [ebx + 6]
not cl
movzx edx, cl
mov ecx, dword [esp + 0x40]
mov ecx, dword [ecx + 8]
shr edx, 6
and edx, 1
or edx, 0x60
push ebp
mov eax, esi
call fcn.0043a030
add esp, 0x20
mov edx, edi
call fcn.00434260
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, edi
call fcn.004342c0
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x43c55f
mov ebx, dword [ebx + 0x34]
lea esi, [ebx + 1]
test ebx, ebx
jne 0x43c4f9
mov esi, eax
push ebp
mov eax, esi
mov ecx, 0x7a
call fcn.0043a010
mov edi, eax
or eax, 0xffffffff
push ebp
mov ecx, esi
lea edx, [eax + 0x15]
call fcn.0043a030
push ebp
mov eax, 1
call fcn.00439ff0
mov esi, eax
mov eax, edi
mov ecx, ebp
call fcn.00432b40
mov edi, dword [esp + 0x30]
mov eax, dword [edi + 8]
push ebp
mov ecx, 0x43
call fcn.0043a010
mov eax, dword [edi + 8]
push ebp
mov ecx, 0x3b
call fcn.0043a010
add esp, 0x14
pop edi
mov eax, esi
pop esi
mov ecx, ebp
pop ebp
pop ebx
add esp, 0x10
jmp fcn.00432b40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret