joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422ecc
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.004318c0
add esp, 0xc
push 0x64
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x40], esi
mov edi, dword [eax - 0xc]
mov ebx, 0x45a140
push eax
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.004091fd
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x422f43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00404645
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov ecx, ebx
lea esi, [ebp - 4]
call fcn.004091fd
mov edi, dword [ebp + 0x14]
mov eax, esi
call fcn.00408905
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00404645
push dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov ecx, ebx
lea esi, [ebp - 4]
call fcn.004091fd
mov edi, dword [ebp + 0x18]
mov eax, esi
call fcn.00408905
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00404645
cmp dword [ebp - 0x24], 0
je 0x422fb8
push dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov ecx, ebx
lea esi, [ebp - 4]
call fcn.004091fd
mov edi, dword [ebp + 0x1c]
mov eax, esi
call fcn.00408905
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00404645
cmp dword [ebp - 0x1c], 0
je 0x422fe3
push dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov ecx, ebx
lea esi, [ebp - 4]
call fcn.004091fd
mov edi, dword [ebp + 0x20]
mov eax, esi
call fcn.00408905
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00404645
cmp dword [ebp - 0xc], 0
je 0x42300e
push dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov ecx, ebx
lea esi, [ebp - 4]
call fcn.004091fd
mov edi, dword [ebp + 0x24]
mov eax, esi
call fcn.00408905
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00404645
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ax, word [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
xor esi, esi
jmp 0x422f31
Function at 0x42314a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push ecx
mov dword [ebp - 0x90], eax
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x98], esi
cmp esi, 0xffffffff
jne 0x423194
push eax
jmp 0x4231ce
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x4231c9
cmp eax, dword [ebp + 0xc]
jbe 0x4231c9
sub eax, dword [ebp + 0xc]
mov edi, 0x10000
push edi
mov dword [ebp - 0x8c], eax
call fcn.004318aa
pop ecx
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x4231e5
push ebx
call fcn.004318b5
pop ecx
cmp esi, ebx
je 0x4231d4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043189b
leave
ret
lea eax, [ebp - 0x78]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x79], bl
call fcn.00401515
jmp 0x423204
mov esi, dword [ebp - 0x98]
push ebx
lea eax, [ebp - 0x84]
push eax
push edi
push dword [ebp - 0x80]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x423260
mov esi, dword [ebp - 0x84]
cmp esi, ebx
je 0x423260
mov eax, dword [ebp - 0x88]
lea ecx, [esi + eax]
cmp ecx, dword [ebp - 0x8c]
jbe 0x423248
mov esi, dword [ebp - 0x8c]
sub esi, eax
mov dword [ebp - 0x84], esi
mov byte [ebp - 0x79], 1
push dword [ebp - 0x80]
mov eax, esi
lea ecx, [ebp - 0x78]
call fcn.004013a6
add dword [ebp - 0x88], esi
cmp byte [ebp - 0x79], bl
je 0x4231fe
lea esi, [ebp - 0x78]
call fcn.00401457
mov ebx, dword [ebp - 0x90]
mov eax, esi
call fcn.004014ce
push dword [ebp - 0x80]
mov bl, al
call fcn.004318b5
cmp dword [ebp - 0x98], 0
pop ecx
je 0x423295
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x4231d6

Function at 0x423b6d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push edi
push eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x78], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x423c00
push ebx
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
call fcn.0040455c
lea ebx, [ebp - 0x7c]
call fcn.00409680
mov eax, dword [ebp - 0x7c]
inc dword [ebp - 0x74]
add eax, 0xfffffff0
call fcn.00404645
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x104
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x423bba
pop ebx
mov ecx, dword [ebp + 0x198]
pop edi
xor ecx, ebp
pop esi
call fcn.0043189b
add ebp, 0x19c
leave
ret 4
Function at 0x423c19
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ecx
mov esi, eax
mov eax, dword [ebx]
push 0
push eax
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
cmp eax, 0xea
jne 0x423c7b
push dword [ebp - 4]
call fcn.00404496
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
call fcn.00402073
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
or eax, 0xffffffff
call fcn.00409c5f
xor eax, eax
cmp dword [ebp - 8], eax
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x423c88
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x458090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea esi, [ebp + 8]
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x274], eax
call fcn.00409cf7
mov eax, dword [0x45a140]
mov ecx, 0x45a140
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
lea esi, [ebp - 0x264]
mov ebx, esp
call fcn.00409c7d
add eax, 0x10
mov edx, esi
mov ecx, edi
mov dword [ebx], eax
call fcn.00423ee6
test al, al
je 0x423d79
mov eax, esi
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.0041ccb3
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.0041ce7c
mov esi, dword [ebp - 0x274]
mov ebx, eax
call fcn.00409680
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.00404645
lea eax, [ebp - 0x288]
push eax
mov eax, dword [ebp - 0x270]
call fcn.00423fcb
test al, al
je 0x423d79
xor esi, esi
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.00404645
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00404645
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043189b
leave
ret 0x10
cmp dword [ebp + 0xc], 1
jge 0x423d84
xor esi, esi
inc esi
jmp 0x423d4d
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00409c7d
add eax, 0x10
mov dword [ebp - 0x25c], eax
push 0x44ba08
lea eax, [ebp - 0x25c]
push eax
call fcn.00402105
lea eax, [ebp - 0x258]
push eax
lea esi, [ebp - 0x25c]
call fcn.00402073
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp dword [ebp - 0x26c], 0xffffffff
setne al
test al, al
je 0x423e60
lea eax, [ebp - 0x258]
call fcn.00423ebe
test al, al
je 0x423e48
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp + 8]
lea ecx, [ebp - 0x260]
call fcn.00408dee
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x260]
pop ecx
push dword [ebp - 0x274]
dec eax
push edi
push eax
push ecx
add esi, 0xfffffff0
mov eax, esi
mov ebx, esp
call fcn.00409c7d
mov ecx, dword [ebp - 0x270]
add eax, 0x10
mov dword [ebx], eax
call fcn.00423c88
test eax, eax
je 0x423e88
mov eax, esi
call fcn.00404645
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x423de9
cmp dword [ebp - 0x26c], 0
je 0x423e75
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.00404645
jmp 0x423d7f
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.00404645
cmp dword [ebp - 0x26c], 0
je 0x423eab
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
call fcn.00404645
jmp 0x423d4b
Function at 0x424174
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp byte [ebp + 0xc], bl
jne 0x4241b5
push dword [ebp + 8]
call fcn.004240f8
pop ecx
cmp byte [ebp + 0x10], bl
je 0x4241ad
cmp eax, ebx
setne byte [ebp + 0x13]
cmp eax, ebx
je 0x4241a5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp + 0x13]
jmp 0x424245
cmp eax, ebx
sete byte [ebp + 0x13]
jmp 0x42419a
push 0x5c
call fcn.00408c79
mov edi, eax
cmp edi, ebx
mov dword [ebp + 0xc], 3
jl 0x424230
lea eax, [ebp - 4]
push eax
mov ecx, edi
xor edx, edx
mov eax, esi
call fcn.00408d0f
push dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.004240f8
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x424225
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
lea eax, [ebp + 0xc]
lea edx, [edi + 1]
push eax
sub ecx, edx
mov eax, esi
call fcn.00408d0f
mov esi, dword [ebp + 0xc]
push ebx
push ebx
push ebx
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 0xc], eax
lea eax, [esi - 0x10]
call fcn.00404645
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00404645
xor eax, eax
cmp byte [ebp + 0x10], bl
je 0x42423f
cmp dword [ebp + 0xc], ebx
sete al
jmp 0x424245
cmp dword [ebp + 0xc], ebx
setne al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42486e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, 0x400
push ebx
call fcn.004318aa
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
cmp eax, ecx
jne 0x42489a
push ecx
call fcn.004318b5
pop ecx
push 3
jmp 0x4249ed
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ecx
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
sub dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
inc dword [ebp - 0xc]
add dword [ebp - 0x10], 0xa
cmp dword [ebp - 0xc], 1
cdq
mov esi, eax
mov ecx, edx
jle 0x4248d2
mov eax, dword [ebp - 0x10]
cdq
add esi, eax
adc ecx, edx
push 2
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
call edi
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x4248f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4249a7
mov esi, dword [ebp - 4]
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4249e4
cmp dword [ebp - 0x14], ebx
jne 0x4249e4
add esi, 0x3f6
jmp 0x424939
push 0xa
push str.ADVINSTSFX
push esi
call fcn.00432e98
add esp, 0xc
test eax, eax
je 0x4249a2
dec esi
cmp esi, dword [ebp - 4]
jae 0x424924
or esi, 0xffffffff
test esi, esi
jl 0x4248b2
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x24], 0
push 0
lea ecx, [ebp - 0x24]
lea eax, [esi + eax - 0x40]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
call edi
cmp eax, 0xffffffff
je 0x4249a7
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 0x14]
push eax
push 0x4a
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4249d4
cmp dword [ebp - 0x14], 0
je 0x4249d4
push 0xa
lea eax, [esi + 0x40]
push str.ADVINSTSFX
push eax
call fcn.00432e98
add esp, 0xc
test eax, eax
je 0x4249ac
push 5
jmp 0x4249d6
sub esi, dword [ebp - 4]
jmp 0x424941
push dword [ebp - 4]
jmp 0x4249e5
cmp dword [esi + 0xc], 0x64
jne 0x42499e
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 0x28]
push dword [ebp - 4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x24]
sbb eax, ecx
mov dword [esi + 0x50], edx
mov dword [esi + 0x54], eax
call fcn.004318b5
pop ecx
xor eax, eax
jmp 0x4249ee
push 2
pop esi
push dword [ebp - 4]
call fcn.004318b5
pop ecx
mov eax, esi
jmp 0x4249ee
push esi
call fcn.004318b5
pop ecx
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x424a4e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [eax + 0x10], ebx
cmp dword [eax + 4], edi
je 0x424ae0
cmp ebx, edi
je 0x424a8b
push edi
push edi
push edi
push edi
lea esi, [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.00408e65
push dword [esi]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebp + 8]
xor edi, edi
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push 0x424ae9
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp ebx, edi
je 0x424aab
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x424ad5
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x424ad1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x424ae2
cmp esi, edi
je 0x424ae0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42502f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2e
mov esi, edi
mov ebx, eax
call fcn.00408c79
test eax, eax
jg 0x425051
mov al, 1
jmp 0x4251b5
mov ecx, eax
lea edx, [ebp - 8]
mov eax, edi
call fcn.00408d86
mov eax, dword [0x45a140]
mov esi, 0x45a140
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp - 8]
add eax, 0x10
push dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x10]
push 0x454090
push eax
call fcn.00409762
add esp, 0x14
cmp dword [ebx + 0x10], 0
je 0x42509c
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
push edi
call dword [eax + 0x14]
push 0
push 0x8000008
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
call fcn.0040f8e1
add esp, 0x14
lea edi, [ebp - 0x20]
lea ecx, [ebp - 8]
mov byte [ebp - 1], 1
call fcn.0040a41e
test al, al
je 0x4250da
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42517e
mov eax, dword [0x45a140]
mov ecx, esi
call dword [eax + 0xc]
push dword [ebp + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.00410199
mov eax, dword [0x45a140]
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
push 0xca
lea esi, [ebp - 0x18]
mov dword [ebp - 0xc], eax
call fcn.00422e4c
mov eax, dword [ebp - 8]
mov edi, dword [eax - 0xc]
pop ecx
push 0x5c
lea esi, [ebp - 8]
call fcn.00408c79
mov ecx, edi
sub ecx, eax
lea eax, [ebp - 0x1c]
push eax
mov eax, esi
call fcn.00410725
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
push esi
push dword [eax]
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.00409762
mov eax, dword [ebp - 0x1c]
add esp, 0x10
add eax, 0xfffffff0
call fcn.00404645
push 0
lea eax, [ebp - 0xc]
call fcn.00416e78
pop ecx
lea eax, [edi - 0x10]
mov byte [ebp - 1], 0
call fcn.00404645
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00404645
lea eax, [esi - 0x10]
call fcn.00404645
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebx + 0x10], 0
je 0x42519c
mov ebx, dword [ebx + 0x10]
push dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404645
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00404645
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42529c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebx + 0x10], eax
cmp dword [eax], edi
je 0x4252d3
push edi
push edi
push edi
push edi
lea esi, [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.00408e65
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x4254fb
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x18], esi
cmp dword [eax], edi
je 0x425329
mov edi, ebx
call fcn.00425367
mov ebx, dword [ebx + 4]
mov esi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], edx
call fcn.0040c0f0
add esi, eax
adc dword [ebp - 0xc], edx
mov eax, dword [edi + 0x10]
push dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
call dword [eax]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebp - 0x18]
xor edi, edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x425353
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x42534f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x425360
cmp esi, edi
je 0x42535e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x425870
Capabilities:
Get geographical location

Disassembly:
push ebp
push esi
push edi
push 0
push 0x44d016
movzx ebx, bx
push 0x1001
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, eax
mov ecx, 0x45a140
lea edi, [ebp - 1]
call fcn.0040462a
test edi, edi
jle 0x4258b9
push edi
call fcn.004020bf
push edi
push 0x78
push eax
call fcn.004318c0
add esp, 0xc
mov eax, edi
mov edx, esi
call fcn.004020e5
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x4258cd
push dword [eax + 4]
push esi
call fcn.004021d9
mov eax, dword [esi]
push ebp
push eax
push 0x1001
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x425b14
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
pop edi
push edi
mov esi, eax
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004318c0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0
push eax
mov dword [ebp - 0x28], 0x64
mov dword [ebp - 0x3c], edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x425b5e
mov ecx, 0x45a140
call fcn.0040462a
jmp 0x425b6b
push dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov eax, esi
call fcn.0041070e
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x425f75
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea esi, [edi + 4]
push dword [esi]
call fcn.00410a14
pop ecx
push esi
call fcn.0040ec04
mov eax, dword [edi + 0x28]
push dword [eax]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi]
call ebx
mov eax, dword [0x45a140]
mov ecx, 0x45a140
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
push 0xdc
lea eax, [ebp - 4]
push eax
call fcn.00404378
push 0x40a
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp - 4]
push eax
call ebx
lea eax, [edi + 0x40]
push eax
mov eax, dword [esi]
call fcn.00428e2c
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push edi
push 0x426051
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00404645
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x4261db
Capabilities:
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
push esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call sub.NETAPI32.dll_NetLocalGroupGetMembers
test eax, eax
jne 0x426268
mov dword [ebp - 4], esi
cmp dword [ebp - 8], esi
jbe 0x426260
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp + 0xc]
add edi, 8
mov esi, dword [edi]
push esi
lea eax, [ebp + 0xc]
call fcn.0040455c
lea eax, [ebp + 0xc]
push eax
call fcn.00426803
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.00404645
push ebx
push ecx
mov eax, esp
push esi
call fcn.0040455c
mov ecx, dword [ebp - 0x14]
call fcn.004261db
add edi, 0xc
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x426221
push dword [ebp - 0xc]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00404645
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x42627a
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 8]
push ecx
xor esi, esi
push 1
push esi
push eax
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x4262e8
push edi
mov edi, dword [ebp - 8]
cmp dword [ebp - 4], esi
jbe 0x4262df
push ebx
push dword [edi]
lea eax, [ebp - 0xc]
call fcn.0040455c
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00426803
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00404645
add edi, 4
inc esi
cmp esi, dword [ebp - 4]
jb 0x4262b4
pop ebx
push dword [ebp - 8]
call sub.NETAPI32.dll_NetApiBufferFree
pop edi
pop esi
leave
ret 4