joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfa8250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xfbc808
push 0xfac288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xfa8329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xfa8329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00fab1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xfa8329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xfa8329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xfa832c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00fa8351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xfa8d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xfa8d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xfa8d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xfa8d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xfa8d94
push eax
push esi
call fcn.00fab20b
add esp, 8
pop esi
ret 0x10

Function at 0xfa8da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xfa8e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xfa8e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xfc1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00faadff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xfa8dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xfa8e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xfa8ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xfa8eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xfc1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00faadff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xfa8eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xfa8e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xfa9000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xfa9131
push esi
call fcn.00fac145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00f9b080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xfa9131
push 0
push ebp
call fcn.00f9b3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00f9b260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xfa908b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00f9b2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xfa9121
push 0xfc1918
push edi
call fcn.00faa3f0
push eax
push ebx
push esi
call fcn.00fa8f60
push 0xfc18f8
push edi
call fcn.00faa3f0
push eax
push ebx
push esi
call fcn.00fa8f60
push 0xfc18d8
push edi
call fcn.00faa3f0
push eax
push ebx
push esi
call fcn.00fa8f60
push 0xfc18c0
push edi
call fcn.00faa3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00fa8f60
push 0xfc18a0
push edi
call fcn.00faa3f0
push eax
push ebx
push esi
call fcn.00fa8f60
push 0xfc1888
push edi
call fcn.00faa3f0
push eax
push ebx
push esi
call fcn.00fa8f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xfaa1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00faa140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00faa140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00faa140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00faa140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xfaabfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xfaac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xfbc87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xfaac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xfaac52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001919
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000b078]
jne 0x10001923
repz ret
jmp fcn.10002176

Function at 0x1000534a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000b078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100027b9
and dword [ebp - 0x14], 0
cmp dword [0x1000c8a8], 0
mov dword [ebp - 0x18], eax
jne 0x100053fd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100054a5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100054a5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000c8a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000c8ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000c8b0], eax
call edi
push eax
call esi
mov dword [0x1000c8b8], eax
test eax, eax
je 0x100053fd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000c8b4], eax
mov eax, dword [0x1000c8b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10005456
cmp dword [0x1000c8b8], ecx
je 0x10005456
push eax
call esi
push dword [0x1000c8b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10005456
test ebx, ebx
je 0x10005456
call edi
test eax, eax
je 0x1000544d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000544d
test byte [ebp - 8], 1
jne 0x10005456
or dword [ebp + 0x10], 0x200000
jmp 0x10005489
mov eax, dword [0x1000c8ac]
cmp eax, dword [ebp - 0x18]
je 0x10005489
push eax
call esi
test eax, eax
je 0x10005489
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10005489
mov eax, dword [0x1000c8b0]
cmp eax, dword [ebp - 0x18]
je 0x10005489
push eax
call esi
test eax, eax
je 0x10005489
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000c8a8]
call esi
test eax, eax
je 0x100054a5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100054a7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001919
leave
ret
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x40891d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
sub esi, 0xb57d7099
inc eax
call fcn.00408953
add eax, esi
dec esi
xor dword [ecx], ebx
add esi, 0x5c5ada51
or eax, esi
add ecx, 1
dec esi
add eax, esi
cmp ecx, edx
jne fcn.0040891d
add esi, 0x90b07048
ret
Function at 0x40a3f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ed88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4b6798]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40a437
and al, 0x10
xor cl, cl
cmp cl, al
sbb edx, edx
neg edx
jne 0x40a515
lea eax, [ebp - 0x18]
call fcn.00409e50
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a450
sub eax, edx
sar eax, 1
cmp eax, 1
jle 0x40a473
cmp word [esi + eax*2 - 2], 0x5c
jne 0x40a473
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
push 0x5c
push esi
call fcn.004741fe
add esp, 8
push esi
test eax, eax
jne 0x40a4a2
call fcn.00473f95
add esp, 4
mov eax, 0xf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
mov word [eax], dx
call fcn.0040a3f0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40a4d2
push esi
call fcn.00473f95
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40a50c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
je 0x40a50c
push esi
call fcn.00473f95
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00473f95
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a650
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi], 0
je 0x40a65b
mov eax, 1
ret
push edi
push str.Wininet.Dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49bf14
push eax
mov dword [esi], eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi]
push str.InternetConnectW
push eax
call edi
mov ecx, dword [esi]
push str.InternetCloseHandle
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi]
push str.InternetReadFile
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi]
push 0x49bf60
push eax
call edi
mov ecx, dword [esi]
push str.InternetGetLastResponseInfoW
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi]
push str.InternetGetConnectedState
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push 0x49bfb0
push eax
call edi
mov ecx, dword [esi]
push str.HttpAddRequestHeadersW
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi]
push str.HttpOpenRequestW
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov eax, dword [esi]
push str.HttpSendRequestW
push eax
call edi
mov ecx, dword [esi]
push str.HttpQueryInfoW
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi]
push str.FtpOpenFileW
push edx
mov dword [esi + 0x30], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi]
push str.FtpCommandW
push eax
call edi
mov ecx, dword [esi]
push str.FtpGetFileSize
push ecx
mov dword [esi + 0x38], eax
call edi
cmp dword [esi + 4], 0
mov dword [esi + 0x3c], eax
pop edi
je 0x40a78d
cmp dword [esi + 8], 0
je 0x40a78d
cmp dword [esi + 0xc], 0
je 0x40a78d
cmp dword [esi + 0x10], 0
je 0x40a78d
cmp dword [esi + 0x14], 0
je 0x40a78d
cmp dword [esi + 0x18], 0
je 0x40a78d
cmp dword [esi + 0x1c], 0
je 0x40a78d
cmp dword [esi + 0x20], 0
je 0x40a78d
cmp dword [esi + 0x24], 0
je 0x40a78d
cmp dword [esi + 0x28], 0
je 0x40a78d
cmp dword [esi + 0x2c], 0
je 0x40a78d
cmp dword [esi + 0x30], 0
je 0x40a78d
cmp dword [esi + 0x34], 0
je 0x40a78d
cmp dword [esi + 0x38], 0
je 0x40a78d
test eax, eax
jne 0x40a655
mov dword [esi], 0
xor eax, eax
ret

Function at 0x40a910
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fafc
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4b6798]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 4], 3
call fcn.0040b3b0
mov eax, dword [esi + 0x1668]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esi + 0x1460]
push edi
mov dword [esi + 0x1668], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
push edx
mov word [edi], cx
call fcn.00473f95
mov eax, dword [esi + 0x14]
push eax
call fcn.00473f95
mov ecx, dword [esi + 0xc]
push ecx
call fcn.00473f95
mov edx, dword [esi + 4]
push edx
call fcn.00473f95
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40ae10
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48f5d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x4b6798]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, edi
mov dword [eax], ebx
call fcn.0040b340
cmp dword [edi + 0x1440], ebx
jne 0x40ae68
lea eax, [ebx + 6]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x142c], 3
je 0x40ae8a
mov eax, 0x57
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x12c
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00409ee0
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov word [edx], cx
push 0x49be3c
lea eax, [edi + 0x224]
push eax
push str._s_s
mov dword [esp + 0x34], ebx
call fcn.0040a1c0
or dword [edi + 0x1430], 0x400000
mov eax, dword [edi + 0x1430]
add esp, 0xc
cmp dword [edi + 0x1428], 4
jne 0x40aeea
or eax, 0x800000
mov dword [edi + 0x1430], eax
mov eax, 1
test byte [0x4e1978], al
jne 0x40af03
or dword [0x4e1978], eax
mov dword [0x4e1980], ebx
mov ecx, dword [edi + 0x1430]
mov edx, dword [edi + 0x1440]
push ebx
push ecx
push ebx
push ebx
mov ebx, dword [esp + 0x24]
push str.HTTP_1.1
push ebx
push 0x49c0c4
push edx
call dword [0x4e19a8]
mov dword [edi + 0x1444], eax
test eax, eax
jne 0x40af87
cmp dword [edi + 0x1448], 0
je 0x40af60
push ebx
mov esi, 0x4c7
call fcn.00473f95
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
call fcn.00473f95
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push edi
call fcn.0040b470
test eax, eax
je 0x40af33
call fcn.0040a7a0
mov edx, dword [edi + 0x1444]
mov eax, dword [eax + 0x2c]
push 0
push 0
push 0
push 0
push edx
call eax
test eax, eax
je 0x40af33
mov ecx, dword [ebp + 8]
mov eax, 0x13
mov esi, edi
call fcn.0040b1f0
mov esi, eax
test esi, esi
jne 0x40af68
cmp dword [esp + 0xc], eax
je 0x40b002
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0xce
je 0x40b02f
push ebx
call fcn.00473f95
add esp, 4
mov eax, 0x2f78
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp + 8]
cmp dword [edx], 0xc8
je 0x40b02f
push ebx
call fcn.00473f95
add esp, 4
mov eax, 0x2f78
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x10]
mov eax, 5
mov esi, edi
call fcn.0040b1f0
mov eax, dword [esp + 0x10]
push ebx
mov dword [edi + 0x1450], eax
mov dword [edi + 0x1454], 0
call fcn.00473f95
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov dword [ebp + 8], 0
jmp 0x40b290
cmp dword [esi + 0x1448], 0
jne 0x40b316
mov eax, dword [ebp + 0xc]
sub eax, dword [edi]
cmp eax, 0x4e20
jbe 0x40b2aa
mov eax, 0x4e20
test byte [0x4e1978], 1
jne 0x40b2c4
or dword [0x4e1978], 1
mov dword [0x4e1980], 0
mov edx, dword [esi + 0x1444]
lea ecx, [ebp + 8]
push ecx
push eax
push ebx
push edx
call dword [0x4e1990]
test eax, eax
je 0x40b323
mov eax, dword [ebp + 8]
add dword [edi], eax
mov ecx, dword [edi]
add ebx, eax
add dword [esi + 0x1458], eax
adc dword [esi + 0x145c], 0
test eax, eax
je 0x40b2fa
cmp ecx, dword [ebp + 0xc]
jb 0x40b290
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [ebp - 4]
cmp eax, 1
jb 0x40b30c
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
pop esi
mov eax, 0x4c7
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x1448], 0
jne 0x40b316
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40b430
Capabilities:
Delete file

Disassembly:
push esi
mov esi, eax
call fcn.0040b3b0
mov eax, dword [esi + 0x1668]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1668], 0
add esi, 0x1460
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
mov word [esi], cx
pop esi
ret
Function at 0x40b540
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490436
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4b6798]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ecx
xor esi, esi
cmp word [edi], si
jne 0x40b5d8
mov eax, dword [ebx + 0x1668]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebx + 0x1460]
push edi
mov dword [ebx + 0x1668], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x21c]
push edx
xor ecx, ecx
push 0x104
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40b5c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b723
push edi
push esi
push 0x49c0bc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40b5b5
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], esi
push 0x12c
lea esi, [ebp - 0x228]
call fcn.00409ee0
mov edx, dword [ebp - 0x228]
xor ecx, ecx
mov word [edx], cx
lea eax, [ebp - 0x230]
mov dword [ebp - 4], ecx
call fcn.00409e50
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x230]
push 0x5c
push esi
call fcn.004741fe
add esp, 8
test eax, eax
jne 0x40b64f
push eax
lea esi, [ebp - 0x228]
call fcn.00409ee0
mov esi, dword [ebp - 0x228]
push 0
push 0x49be3c
push esi
call fcn.004740c4
add esp, 0xc
xor eax, eax
mov word [esi], ax
jmp 0x40b691
add eax, 2
sub eax, esi
sar eax, 1
push eax
lea esi, [ebp - 0x228]
mov dword [ebp - 0x220], eax
call fcn.00409ee0
mov ecx, dword [ebp - 0x220]
mov edx, dword [ebp - 0x230]
mov esi, dword [ebp - 0x228]
push ecx
push edx
push esi
call fcn.004740c4
mov ecx, dword [ebp - 0x220]
add esp, 0xc
xor eax, eax
mov word [esi + ecx*2], ax
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x230]
push edx
call fcn.00473f95
add esp, 4
push esi
call fcn.0040a3f0
add esp, 4
mov dword [ebp - 0x220], eax
test eax, eax
je 0x40b6c8
push esi
call fcn.00473f95
mov eax, dword [ebp - 0x220]
add esp, 4
jmp 0x40b723
mov eax, dword [ebx + 0x1668]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push edi
mov dword [ebx + 0x1668], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x1668], eax
cmp eax, 0xffffffff
jne 0x40b718
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.00473f95
add esp, 4
mov eax, edi
jmp 0x40b723
push esi
call fcn.00473f95
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004736db
mov esp, ebp
pop ebp
ret 4