joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b230
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x450ca6
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xac]
cmp eax, dword [esi + 0xa8]
mov dword [esp + 0x14], 0
jl 0x42b285
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ebp, [esi + 0x54]
lea edi, [ebp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0x1c], 0
push edi
sete bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x42b26f
mov ecx, dword [esi + 0xac]
cmp ecx, dword [esi + 0xa8]
jge 0x42b40b
lea edi, [ebp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0x1c], 0
push edi
sete bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x42b40b
push 0
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
call fcn.00429d90
or ebx, 0xffffffff
cmp eax, ebx
je 0x42b424
mov edi, dword [esp + 0x14]
test edi, edi
je 0x42b424
inc dword [esi + 0xac]
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
cmp eax, ebx
jne 0x42b37c
add dword [esi + 0xac], ebx
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
test al, al
je 0x42b35b
push 0x14
call fcn.0043a403
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0
test eax, eax
je 0x42b348
mov ecx, dword [esi + 4]
push ecx
mov ecx, eax
call fcn.004349b0
jmp 0x42b34a
xor eax, eax
mov dword [esp + 0x24], ebx
test eax, eax
je 0x42b35b
mov ecx, dword [esi + 4]
push eax
call fcn.00430940
cmp byte [esi + 0x9d], 0
je 0x42b36e
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xa4], eax
jmp 0x42b3f9
cmp byte [esi + 0x9c], 0
je 0x42b3d2
add dword [esi + 0xac], ebx
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
test al, al
je 0x42b3d2
push 0x14
call fcn.0043a403
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 1
test eax, eax
je 0x42b3bf
mov ecx, dword [esi + 4]
push ecx
mov ecx, eax
call fcn.004349b0
jmp 0x42b3c1
xor eax, eax
mov dword [esp + 0x24], ebx
test eax, eax
je 0x42b3d2
mov ecx, dword [esi + 4]
push eax
call fcn.00430940
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [esi + 0x9d], 0
mov dword [esi + 0xa4], eax
je 0x42b3f1
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0xac]
cmp eax, dword [esi + 0xa8]
jl 0x42b2b6
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x42d580
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x450578
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi], ecx
mov dword [esi + 4], edx
lea ecx, [esi + 8]
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x30]
xor edx, edx
mov dword [ecx + 0x18], 7
push eax
mov word [ecx + 4], dx
call fcn.004017f0
cmp dword [esp + 0x40], 8
jb 0x42d5f1
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0043a3dd
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x42da10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450618
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x1c], ebp
lea eax, [ebp + 0xd4]
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0xb0]
add ebp, 0xb0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [eax]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], esi
nop
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp]
test edi, edi
je 0x42da8e
cmp edi, eax
je 0x42da93
call fcn.0043b0d6
cmp esi, ebx
je 0x42db6c
test edi, edi
jne 0x42dafe
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42dab0
call fcn.0043b0d6
mov ecx, dword [esp + 0x18]
sub ecx, dword [esi + 0x10]
test ecx, ecx
jle 0x42db56
test edi, edi
jne 0x42db02
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42dad4
call fcn.0043b0d6
cmp dword [esi + 0x28], 0
je 0x42db3e
test edi, edi
jne 0x42db06
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42daef
call fcn.0043b0d6
mov ebx, 8
cmp dword [esi + 0x2c], ebx
jb 0x42db0a
mov eax, dword [esi + 0x18]
jmp 0x42db0d
mov eax, dword [edi]
jmp 0x42daa6
mov eax, dword [edi]
jmp 0x42daca
mov eax, dword [edi]
jmp 0x42dae5
lea eax, [esi + 0x18]
test eax, eax
je 0x42db3e
test edi, edi
jne 0x42db30
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42db26
call fcn.0043b0d6
cmp dword [esi + 0x2c], ebx
jb 0x42db34
mov eax, dword [esi + 0x18]
jmp 0x42db37
mov eax, dword [edi]
jmp 0x42db1c
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push edi
lea edx, [esp + 0x34]
push edx
mov ecx, ebp
call fcn.0042d720
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp 0x42da77
lea ecx, [esp + 0x24]
call fcn.0042d190
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
jmp 0x42da80
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0xd0]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
sub eax, ecx
push edx
setns bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e870
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45076b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
xor edx, edx
push 0xffffffffffffffff
lea ecx, [esi + 0x38]
lea eax, [edi + 0x38]
push edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push eax
mov word [ecx + 4], dx
call fcn.004017f0
xor edx, edx
push 0xffffffffffffffff
lea ecx, [esi + 0x54]
lea eax, [edi + 0x54]
push edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push eax
mov dword [esp + 0x24], 0
mov word [ecx + 4], dx
call fcn.004017f0
mov eax, dword [edi + 0x70]
mov dword [esi + 0x70], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x42f4b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450618
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x1c], ebp
lea eax, [ebp + 0x334]
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [ebp + 0x310]
add ebp, 0x310
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov esi, dword [eax]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], esi
nop
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp]
test edi, edi
je 0x42f52e
cmp edi, eax
je 0x42f533
call fcn.0043b0d6
cmp esi, ebx
je 0x42f60c
test edi, edi
jne 0x42f59e
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42f550
call fcn.0043b0d6
mov ecx, dword [esp + 0x18]
sub ecx, dword [esi + 0x10]
test ecx, ecx
jle 0x42f5f6
test edi, edi
jne 0x42f5a2
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42f574
call fcn.0043b0d6
cmp dword [esi + 0x28], 0
je 0x42f5de
test edi, edi
jne 0x42f5a6
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42f58f
call fcn.0043b0d6
mov ebx, 8
cmp dword [esi + 0x2c], ebx
jb 0x42f5aa
mov eax, dword [esi + 0x18]
jmp 0x42f5ad
mov eax, dword [edi]
jmp 0x42f546
mov eax, dword [edi]
jmp 0x42f56a
mov eax, dword [edi]
jmp 0x42f585
lea eax, [esi + 0x18]
test eax, eax
je 0x42f5de
test edi, edi
jne 0x42f5d0
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x42f5c6
call fcn.0043b0d6
cmp dword [esi + 0x2c], ebx
jb 0x42f5d4
mov eax, dword [esi + 0x18]
jmp 0x42f5d7
mov eax, dword [edi]
jmp 0x42f5bc
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push edi
lea edx, [esp + 0x34]
push edx
mov ecx, ebp
call fcn.0042d720
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp 0x42f517
lea ecx, [esp + 0x24]
call fcn.0042d190
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
jmp 0x42f520
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x330]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
sub eax, ecx
push edx
setns bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4303f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x45094e
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x464630]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
mov eax, dword [0x467458]
test eax, eax
jne 0x4304e3
push 0x206
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.0043ae00
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x4304a6
lea eax, [esp + 0xc]
lea edx, [eax + 2]
jmp 0x430470
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x430470
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0xa], 0x5c
jne 0x4304a6
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x430490
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0xa], cx
push 0x34c
call fcn.0043a403
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
mov dword [esp + 0x220], 0
test esi, esi
je 0x4304dc
lea edx, [esp + 0xc]
push edx
call fcn.00430600
push eax
mov ecx, esi
call fcn.004302e0
jmp 0x4304de
xor eax, eax
mov dword [0x467458], eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0043a84e
add esp, 0x21c
ret
Function at 0x430f70
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x450e58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 3
mov edx, dword [esp + 0x2c]
push edx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x1c], 0
mov dword [esi], vtable.t_ipcServerTaskConditionWait.0
call fcn.004241c0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dl, byte [esp + 0x24]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], dl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18

Function at 0x431020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x450e58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 3
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x24], 0
mov dword [esi], vtable.t_ipcServerTaskConditionStart.0
call fcn.004241f0
mov eax, dword [esp + 0x28]
mov cl, byte [esp + 0x24]
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], cl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c

Function at 0x4310d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x450e58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 3
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x24], 0
mov dword [esi], vtable.t_ipcServerTaskConditionDownloading.0
call fcn.00424230
mov eax, dword [esp + 0x28]
mov cl, byte [esp + 0x24]
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], cl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c
Function at 0x432e70
Capabilities:
Check http status code

Disassembly:
push 0xffffffffffffffff
push 0x450beb
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.0043b380
mov eax, dword [0x464630]
xor eax, esp
mov dword [esp + 0x1028], eax
push ebp
push esi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0x1038]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1050]
mov ebp, dword [esp + 0x1048]
mov esi, ecx
xor ecx, ecx
push 0xffe
push ecx
lea edx, [esp + 0x3e]
push edx
mov dword [esp + 0x1c], eax
mov dword [ebx], 0
mov word [esp + 0x40], cx
call fcn.0043ae00
add esp, 0xc
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x3c]
push ecx
push 0x21
push esi
mov dword [esp + 0x20], 0x1000
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x432f0d
mov dword [ebx], 9
jmp 0x432fcb
mov edx, dword [esp + 0xc]
shr edx, 1
xor eax, eax
push esi
mov word [esp + edx*2 + 0x38], ax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], eax
mov word [esp + 0x1c], cx
mov esi, 8
mov dword [esp + 0x1040], eax
cmp dword [edi + 0x18], esi
jb 0x432f4c
mov eax, dword [edi + 4]
jmp 0x432f4f
lea eax, [edi + 4]
push eax
lea edx, [esp + 0x38]
lea ecx, [esp + 0x1c]
call fcn.00432990
add esp, 4
test al, al
jne 0x432f7f
mov dword [ebx], 0xa
cmp dword [esp + 0x30], esi
jb 0x432fcb
mov edx, dword [esp + 0x1c]
push edx
call fcn.0043a3dd
add esp, 4
jmp 0x432fcb
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.004017f0
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], esi
jae 0x432f9d
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 0x104c]
push 0
or eax, 0x200000
push eax
push 0
push 0
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
test eax, eax
jne 0x432ff3
mov dword [ebx], 5
lea ecx, [esp + 0x18]
call fcn.004016e7
xor al, al
mov ecx, dword [esp + 0x1038]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x1028]
xor ecx, esp
call fcn.0043a84e
add esp, 0x1038
ret
mov esi, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push 0x20000013
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x43301f
mov dword [ebx], 6
jmp 0x432fc2
mov eax, dword [esi]
cmp eax, 0xc8
je 0x432fc2
cmp eax, 0x12c
jb 0x432fc2
cmp eax, 0x190
jae 0x432fc2
lea ecx, [esp + 0x18]
call fcn.004016e7
mov al, 1
jmp 0x432fcd
Function at 0x433050
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
push 0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push esi
mov edi, ecx
mov ecx, dword [ebp]
push 0x20000013
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x43308a
pop edi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
cmp dword [esi], 0xc8
jne 0x43309b
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
mov dword [ebx], 0
mov eax, dword [esi]
cmp eax, 0x12c
jb 0x4330e8
cmp eax, 0x190
jae 0x4330e8
mov dword [esp + 0xc], 0
lea esp, [esp]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp]
push esi
push edx
push eax
call fcn.00432e70
add esp, 0xc
test al, al
je 0x4330e8
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 5
mov dword [esp + 0xc], eax
jl 0x4330c0
xor eax, eax
cmp dword [ebx], eax
pop edi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x433cd0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
push 0
push 4
mov esi, ecx
push esi
push 0x433ca0
push 0
push 0
call fcn.0043a95e
mov edi, eax
add esp, 0x18
test edi, edi
je 0x433d14
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x433d14
mov eax, dword [esi + 4]
push edi
push eax
call fcn.0042d610
test al, al
je 0x433d14
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, 1
pop esi
ret
push 0x458428
push 0
push 0
push 0
push 0xc
mov ecx, esi
call fcn.004321a0
pop edi
mov eax, 1
pop esi
ret

Function at 0x433e10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x250
mov eax, dword [0x464630]
xor eax, esp
mov dword [esp + 0x24c], eax
push edi
lea eax, [esp + 4]
push 0x21
push eax
mov edi, ecx
call fcn.00422120
add esp, 8
test al, al
jne 0x433e50
pop edi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.0043a84e
add esp, 0x250
ret
lea ecx, [esp + 4]
push esi
push ecx
call fcn.004220c0
mov esi, eax
add esp, 4
test esi, esi
jne 0x433e7d
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.0043a84e
add esp, 0x250
ret
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x56]
push eax
mov word [esp + 0x58], dx
call fcn.0043ae00
add esp, 0xc
lea ecx, [esp + 0x4c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x433ee6
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433eb2
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x4a], 0x5c
jne 0x433ee6
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433ed0
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x4a], dx
push 1
lea eax, [esp + 0x50]
push eax
push 0x455f60
push reloc.WS2_32.dll_accept
push esi
call fcn.00401294
push esi
mov byte [edi + 0x18], al
call fcn.0043a3dd
mov al, byte [edi + 0x18]
mov ecx, dword [esp + 0x26c]
add esp, 0x18
pop esi
pop edi
xor ecx, esp
call fcn.0043a84e
add esp, 0x250
ret
Function at 0x434970
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0
push 4
mov esi, ecx
push esi
push 0x434940
push 0
push 0
call fcn.0043a95e
add esp, 0x18
test eax, eax
jne 0x4349a1
push 0x458428
push eax
push 0xc
mov ecx, esi
call fcn.004345b0
or eax, 0xffffffff
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
Function at 0x434e40
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x450e2b
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x464630]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
call fcn.00429700
xor ebx, ebx
cmp dword [esp + 0x50], ebx
mov esi, eax
jl 0x43504c
cmp esi, ebx
je 0x43504c
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov dword [esp + 0x50], ebx
call fcn.00431640
mov edi, dword [esi + 0x18]
mov esi, dword [esi]
mov ebp, dword [esp + 0x20]
cmp esi, ebx
je 0x434ec2
cmp esi, ebp
je 0x434ec7
call fcn.0043b0d6
mov esi, dword [esp + 0x24]
cmp edi, esi
jne 0x434f53
mov ebx, 1
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x28]
call fcn.00425640
mov edx, dword [esp + 0x50]
push edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 1
call fcn.004256f0
push ebx
lea ecx, [esp + 0x2c]
call fcn.00425820
mov eax, dword [esi + 8]
push eax
lea ecx, [esp + 0x2c]
call fcn.00423810
test eax, eax
je 0x435033
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x435033
push eax
call fcn.00429f80
push 0x14
call fcn.0043a403
add esp, 4
mov dword [esp + 0x50], eax
mov byte [esp + 0x48], 2
test eax, eax
je 0x435002
mov ecx, dword [esi + 0x18]
push ecx
mov ecx, eax
call fcn.004349b0
jmp 0x435004
test ebp, ebp
jne 0x434f78
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x434f68
call fcn.0043b0d6
cmp dword [esi + 0x10], 1
jne 0x434f7d
mov ebx, 2
jmp 0x434ed8
mov eax, dword [ebp]
jmp 0x434f5e
test ebp, ebp
jne 0x434f9c
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x434f92
call fcn.0043b0d6
cmp dword [esi + 0x14], 0xffffffff
je 0x434fa1
xor edi, edi
jmp 0x434fa5
mov eax, dword [ebp]
jmp 0x434f88
mov edi, dword [esp + 0x1c]
test ebp, ebp
jne 0x434ffd
call fcn.0043b0d6
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x434fba
call fcn.0043b0d6
mov dword [esi + 0x10], 1
test edi, edi
jne 0x434ed8
mov esi, dword [esp + 0x14]
push edi
push edi
push esi
push 0x434e20
push edi
push edi
call fcn.0043a95e
add esp, 0x18
test eax, eax
je 0x434edc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x43504e
mov eax, dword [ebp]
jmp 0x434fb0
xor eax, eax
mov byte [esp + 0x48], 1
test eax, eax
je 0x435016
mov ecx, dword [esi + 0x18]
push eax
call fcn.00430940
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 0
call fcn.004235c0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x43504e
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 0
call fcn.004235c0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4