joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450a40
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2494
call fcn.0049af20
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x26d8]
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edi
jbe 0x450c39
mov ebx, dword [eax + edi*4]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 7
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x450be4
lea edi, [esi + 0x5f5c0]
lea eax, [esi + 0x5d530]
cmp word [esi + 0x5f5c0], 0
cmove edi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x2494], xmm0
lea eax, [ebp - 0x2464]
push 0x2454
push 0
push eax
call fcn.0049dcc0
add esp, 0xc
mov dword [ebp - 0x24a0], 0x3c
lea eax, [ebp - 0x245c]
mov dword [ebp - 0x249c], eax
mov dword [ebp - 0x2498], 0x20
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x2490], eax
mov dword [ebp - 0x248c], 0x100
lea eax, [ebp - 0x241c]
mov dword [ebp - 0x2474], eax
mov dword [ebp - 0x2470], 0x800
lea eax, [ebp - 0x141c]
mov dword [ebp - 0x246c], eax
mov dword [ebp - 0x2468], 0x800
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x2484], eax
mov dword [ebp - 0x2480], 0x80
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x247c], eax
mov dword [ebp - 0x2478], 0x80
push edi
call fcn.004b8b3c
add esp, 4
lea ecx, [ebp - 0x24a0]
push ecx
push 0x10000000
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x450c04
mov eax, dword [ebp - 0x2494]
cmp eax, 4
ja 0x450c04
mov ecx, 0x1a
bt ecx, eax
jae 0x450c04
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
movzx ecx, word [ebp - 0x2488]
mov word [ebp - 0x2464], cx
mov dword [ebp - 0x2460], eax
mov dword [ebp - 0x14], 0xffffffff
push ebx
push 0x80000002
push 0x80000000
lea eax, [ebp - 0x241c]
push eax
push dword [ebx + 0x18]
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov dword [ebx + 0x1c], eax
test eax, eax
mov edi, dword [ebp + 8]
jne 0x450bf7
jmp 0x450c07
push 0
push 0
push 0
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_HttpEndRequestW]
test eax, eax
je 0x450c07
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov bl, 1
jmp 0x450c20
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, 1
cmp eax, 0x3e5
je 0x450c20
mov ecx, esi
push edi
call fcn.004516f0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x2494
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d348e
call fcn.00424574
int3
Function at 0x450fc0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x26d8]
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edx
jbe 0x4510f1
mov ebx, dword [eax + edx*4]
xorps xmm0, xmm0
movups xmmword [ebx + 0x8058], xmm0
movups xmmword [ebx + 0x8048], xmm0
mov dword [ebx + 0x8068], 0
mov dword [ebx + 0x8044], 0x28
lea edi, [ebx + 0x40]
push 0x8000
push 0
push edi
call fcn.0049dcc0
add esp, 0xc
mov dword [ebx + 0x8058], edi
lea edi, [ebx + 0x805c]
mov dword [ebx + 0x805c], 0x8000
mov ecx, dword [ebx + 0x8040]
test ecx, ecx
je 0x45104d
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 0x10]
add edx, dword [ecx + 0x18]
sub eax, edx
inc eax
jmp 0x451066
mov eax, dword [esi + 0x5d100]
mov ecx, dword [esi + 0x5d104]
and ecx, eax
cmp ecx, 0xffffffff
je 0x451075
sub eax, dword [esi + 0x5d110]
cmp eax, 0x8000
mov ecx, 0x8000
cmovl ecx, eax
mov dword [edi], ecx
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 9
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x4510b5
push edi
push dword [ebx + 0x805c]
push dword [ebx + 0x8058]
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4510cc
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
jmp 0x4510ea
lea eax, [ebx + 0x8044]
push ebx
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x4510a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov al, 1
cmp ecx, 0x3e5
je 0x4510ea
mov ecx, esi
push dword [ebp + 8]
call fcn.004516f0
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d348e
call fcn.00424574
Function at 0x451500
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1040
call fcn.0049af20
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x2480], 0
mov eax, 0x4d991c
mov edi, str.POST
cmove edi, eax
mov dword [ebp - 0x18], 0x4d992e
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1018]
push 0x1000
push 0
push eax
call fcn.0049dcc0
add esp, 0xc
mov eax, dword [esi + 0x20]
lea ecx, [eax + 0x1048]
add eax, 0x48
push ecx
push eax
push str._s_s
push 0x7ff
lea eax, [ebp - 0x1018]
push eax
call fcn.00451f00
add esp, 0x14
xor eax, eax
mov dword [ebp - 0x104c], ebx
cmp dword [ebx + 0x62cb4], 0
setne al
shl eax, 0x13
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 4], 4
mov ecx, 0x8480f300
mov edx, 0x8400c300
cmove edx, ecx
or edx, eax
lea eax, [ebp - 0x18]
push esi
push edx
push eax
push 0
push str.HTTP_1.1
lea eax, [ebp - 0x1018]
push eax
push edi
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4516ab
mov ebx, esi
mov dword [ebp - 0x101c], 0x3a98
lea ecx, [ebp - 0x101c]
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
push ecx
push 2
push eax
call esi
mov dword [ebp - 0x1020], 1
lea eax, [ebp - 0x1020]
push 4
push eax
push 0x41
push dword [ebx + 0x1c]
call esi
mov esi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1034], xmm0
movups xmmword [ebp - 0x1044], xmm0
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1048], 0x28
push 0xa2d0
call fcn.00494263
add esp, 4
test eax, eax
je 0x4516af
mov edi, eax
mov eax, esi
mov esi, ebx
xor ebx, ebx
test eax, eax
setne bl
push 0xa2d0
push 0
push edi
call fcn.0049dcc0
add esp, 0xc
mov ecx, dword [ebp - 0x104c]
push ebx
push 0x5167
push edi
push esi
call fcn.00451f60
mov dword [ebp - 0x1040], edi
push edi
call fcn.004b8b3c
add esp, 4
mov dword [ebp - 0x103c], eax
lea eax, [ebp - 0x1048]
push esi
push 1
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
push edi
call fcn.0049426c
add esp, 4
jmp 0x4516c6
xor ebx, ebx
jmp 0x4516cb
lea eax, [ebp - 0x1048]
push ebx
push 1
push 0
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x1040
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x451b60
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esp + 0x18], eax
mov bl, 1
cmp dword [ecx + 8], 0
jne 0x451ca7
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea edi, [ecx + 0x5d120]
push edi
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
mov word [esp + 0x10], ax
mov dword [esp + 0x12], 0x5c003a
mov word [esp + 0x16], 0
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x451ca5
mov ecx, dword [esi + 0x5d100]
mov eax, dword [esi + 0x5d104]
mov edx, ecx
and edx, eax
cmp edx, 0xffffffff
je 0x451c03
cmp ecx, dword [esp + 8]
sbb eax, dword [esp + 0xc]
jb 0x451c03
mov dword [esi + 0x2470], 2
jmp 0x451ca5
sub esp, 0x1c
movaps xmm0, xmmword [0x4d98b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x451c8f
mov bl, 1
cmp byte [esi + 0x26f0], 0
je 0x451ca7
lea edi, [esi + 0x26e4]
mov eax, dword [esi + 0x26e4]
mov ecx, dword [esi + 0x26e8]
cmp ecx, eax
je 0x451c68
add ecx, 0xfffffffc
jne 0x451c50
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
push 0x4d348e
call fcn.00424574
mov dword [esi + 0x26e8], eax
mov ecx, esi
call fcn.00452250
test al, al
jne 0x451ca7
mov ecx, dword [esi + 0x2468]
test ecx, ecx
je 0x451cbc
mov eax, 0xa
cmp ecx, 0xb
jae 0x451cc1
jmp 0x451cc7
mov dword [esi + 0x2470], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x2474], eax
xor ebx, ebx
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 5
mov dword [esi + 0x2468], eax
lea ecx, [esi + 0x5cfb8]
mov dword [esi + 0x5cfc4], 0
mov dword [esi + 0x5cfc0], 0
mov eax, dword [esi + 0x5d100]
mov edx, dword [esi + 0x5d104]
add eax, 0xffffffff
adc edx, 0xffffffff
mov dword [esi + 0x5cfc8], eax
mov dword [esi + 0x5cfcc], edx
mov dword [esp + 4], ecx
mov eax, dword [esi + 0x26e8]
cmp eax, dword [esi + 0x26ec]
jae 0x451d1c
test eax, eax
je 0x451d5d
mov dword [eax], ecx
add eax, 4
jmp 0x451d28
lea eax, [esp + 4]
mov ecx, edi
push eax
call fcn.00452ac0
mov dword [esi + 0x26e8], eax
mov eax, dword [esi + 0x5d100]
mov ecx, dword [esi + 0x5d104]
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
push 0
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x451ca7
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x4d348e
call fcn.00424574
int3
Function at 0x451d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x805c]
mov edx, dword [edi + 0x20]
cmp dword [edx + 4], 1
cmove eax, edi
mov esi, ecx
mov ebx, dword [eax]
cmp byte [ecx + 0x26f0], 0
je 0x451e2d
mov ecx, esi
call fcn.004524c0
mov edi, dword [edi + 0x8040]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
add eax, dword [edi + 8]
adc ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x451e6b
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
add eax, 0x40
lea ecx, [ebp - 0x18]
push 0
push ecx
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x451e79
cmp dword [ebp - 0x18], ebx
jne 0x451e79
add dword [edi + 0x18], ebx
adc dword [edi + 0x1c], 0
add dword [esi + 0x5d110], ebx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push ebx
push dword [ebp + 8]
call fcn.004526b0
mov ecx, esi
call fcn.004525b0
mov bl, 1
jmp 0x451e7b
mov dword [ebp - 0x14], 0
lea eax, [edi + 0x40]
lea ecx, [ebp - 0x14]
push 0
push ecx
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x451e79
cmp dword [ebp - 0x14], ebx
jne 0x451e79
add dword [esi + 0x5d110], ebx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push ebx
push edi
call fcn.004526b0
mov bl, 1
jmp 0x451e7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x451ddc
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x452250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x22c
mov edi, ecx
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x224], 0
lea esi, [ebp - 0x218]
push 0x208
push 0
push esi
call fcn.0049dcc0
add esp, 0xc
push 2
push 0
push 0xffffffffffffff96
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x21c]
push 0
push eax
push 0x6a
push esi
mov dword [ebp - 0x234], edi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x21c], 0x6a
jne 0x452446
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push esi
call fcn.004b8a98
add esp, 8
xor ebx, ebx
test eax, eax
jne 0x452492
mov eax, 0xfffffffc
sub eax, dword [ebp - 0x21c]
push 1
push 0
push eax
mov esi, dword [ebp - 0x234]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x220]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edi, [ebp - 0x21c]
push edi
push 4
push eax
push dword [esi + 8]
call ebx
mov eax, dword [ebp - 0x220]
add eax, dword [ebp - 0x21c]
neg eax
push 1
push 0
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x224]
push 0
push edi
push 4
push eax
push dword [esi + 8]
call ebx
cmp dword [ebp - 0x224], 0
je 0x45244a
lea eax, [esi + 0x26e4]
mov dword [ebp - 0x238], eax
lea edi, [esi + 0x5cfb8]
mov ebx, esi
xor esi, esi
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x230], 0
jmp 0x4523be
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x228]
push eax
call fcn.00452ac0
mov ebx, dword [ebp - 0x234]
mov dword [ebx + 0x26e8], eax
inc esi
add edi, 0x20
cmp esi, dword [ebp - 0x224]
jae 0x452460
push 0
lea eax, [ebp - 0x21c]
push eax
push 0x20
push edi
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov word [edi], 0
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0xc]
add ecx, dword [edi + 0x18]
adc eax, dword [edi + 0x1c]
mov dword [edi + 8], ecx
mov edx, dword [ebp - 0x22c]
sub edx, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov ecx, dword [ebp - 0x230]
sbb ecx, eax
add edx, dword [edi + 0x10]
adc ecx, dword [edi + 0x14]
add edx, 1
adc ecx, 0
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x228], edi
mov eax, dword [ebx + 0x26e8]
cmp eax, dword [ebx + 0x26ec]
mov dword [ebp - 0x22c], edx
jae 0x452390
test eax, eax
je 0x4524a9
mov dword [eax], edi
add eax, 4
jmp 0x4523a2
xor ebx, ebx
jmp 0x452492
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov ebx, esi
mov eax, dword [ebx + 0x5d100]
mov ecx, dword [ebx + 0x5d104]
sub eax, dword [ebp - 0x22c]
sbb ecx, dword [ebp - 0x230]
mov dword [ebx + 0x5d118], eax
mov dword [ebx + 0x5d11c], ecx
mov dword [ebx + 0x5d110], eax
mov dword [ebx + 0x5d114], ecx
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
push 0x4d348e
call fcn.00424574
int3
Function at 0x4524c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
lea ebx, [ebp - 0x218]
push 0x208
push 0
push ebx
call fcn.0049dcc0
add esp, 0xc
push 2
push 0
push 0xffffffffffffff96
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edi, [ebp - 0x21c]
push 0
push edi
push 0x6a
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x21c], 0x6a
jne 0x452592
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push ebx
call fcn.004b8a98
add esp, 8
test eax, eax
jne 0x452592
mov eax, 0xfffffffc
sub eax, dword [ebp - 0x21c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push eax
push dword [esi + 8]
call ebx
lea eax, [ebp - 0x220]
push 0
push edi
push 4
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x220]
add eax, dword [ebp - 0x21c]
neg eax
push 1
push 0
push eax
push dword [esi + 8]
call ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4525b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov edi, dword [ecx + 0x26e8]
mov ebx, dword [ecx + 0x26e4]
mov eax, edi
sub eax, ebx
sar eax, 2
mov dword [ebp - 0x18], eax
push 2
push 0
push 0
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, ebx
je 0x45268d
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push 0
push eax
push 4
push ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26e4]
cmp dword [esi + 0x26e8], eax
je 0x45265f
mov ebx, 4
xor edi, edi
nop word cs:[eax + eax]
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x20
push dword [eax + edi*4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, 0x20
inc edi
mov eax, dword [esi + 0x26e4]
mov ecx, dword [esi + 0x26e8]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jb 0x452630
jmp 0x452664
mov ebx, 4
mov dword [ebp - 0x18], ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ebx, [ebp - 0x14]
push ebx
push 4
lea eax, [ebp - 0x18]
push eax
push dword [esi + 8]
call edi
push 0
push ebx
push 0x6a
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push dword [esi + 8]
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x452850
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x44ec
call fcn.0049af20
mov esi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
call fcn.004b8b3c
add esp, 4
mov dword [ebp - 0x44f8], eax
push str.filename
push esi
call fcn.0049e3ab
add esp, 8
test eax, eax
je 0x452a72
mov edi, eax
cmp word [eax + 0x12], 0x22
jne 0x4528a5
add edi, 0x14
push 0x4d9b70
jmp 0x4528ad
add edi, 0x12
push 0x4d9b74
push edi
call fcn.0049e3ab
add esp, 8
test eax, eax
je 0x4528c2
mov ebx, eax
sub ebx, edi
sar ebx, 1
jmp 0x4528cd
push edi
call fcn.004b8b3c
add esp, 4
mov ebx, eax
push ebx
push edi
push dword [ebp - 0x44f8]
push esi
call fcn.004b9063
add esp, 0x10
mov word [esi + ebx*2], 0
lea ebx, [ebp - 0x34ac]
push 0x1048
push 0
push ebx
call fcn.0049dcc0
add esp, 0xc
push esi
push 0x4d9b78
push 0x823
push ebx
call fcn.0041b740
add esp, 0x10
xorps xmm0, xmm0
movups xmmword [ebp - 0x44e8], xmm0
lea eax, [ebp - 0x2464]
push 0x2454
push 0
push eax
call fcn.0049dcc0
add esp, 0xc
mov dword [ebp - 0x44f4], 0x3c
lea eax, [ebp - 0x245c]
mov dword [ebp - 0x44f0], eax
mov dword [ebp - 0x44ec], 0x20
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x44e4], eax
mov dword [ebp - 0x44e0], 0x100
lea eax, [ebp - 0x241c]
mov dword [ebp - 0x44c8], eax
mov dword [ebp - 0x44c4], 0x800
lea eax, [ebp - 0x141c]
mov dword [ebp - 0x44c0], eax
mov dword [ebp - 0x44bc], 0x800
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x44d8], eax
mov dword [ebp - 0x44d4], 0x80
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x44d0], eax
mov dword [ebp - 0x44cc], 0x80
push ebx
call fcn.004b8b3c
add esp, 4
lea edi, [ebp - 0x44f4]
push edi
push 0x10000000
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x452a72
mov eax, dword [ebp - 0x44e8]
cmp eax, 4
ja 0x452a72
mov ecx, 0x1a
bt ecx, eax
jae 0x452a72
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
movzx ecx, word [ebp - 0x44dc]
mov word [ebp - 0x2464], cx
mov dword [ebp - 0x2460], eax
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [ebp - 0x44f8]
push ebx
push 0
push esi
call fcn.0049dcc0
add esp, 0xc
push 0x1048
push 0
push edi
call fcn.0049dcc0
add esp, 0xc
lea eax, [ebp - 0x241a]
lea ecx, [ebp - 0x141c]
push ecx
push eax
push str._s_s
push 0x823
push edi
call fcn.0041b740
add esp, 0x14
push edi
push ebx
push esi
call fcn.004b8ad8
add esp, 0xc
mov bl, 1
jmp 0x452a74
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x44ec
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x457240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x210
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.0045c560
mov ecx, eax
push str.enable_logging
call fcn.0045cb00
test al, al
je 0x457483
mov bl, 1
cmp dword [0x4f2fc0], 0
jne 0x457485
mov ebx, dword [0x4f2fac]
test ebx, ebx
je 0x45729a
test byte [0x4ec1c8], 1
jne 0x457377
jmp 0x45749c
push 0xc
call fcn.00494206
add esp, 4
mov ebx, eax
lea esi, [ebp - 0x218]
push 0x208
push 0xff
push esi
call fcn.0049dcc0
add esp, 0xc
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], 0xffffffff
mov ecx, ebx
push esi
call fcn.00411fe0
movzx ecx, byte [ebx + 0xb]
test cl, cl
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov edi, ecx
cmovs edi, edx
mov esi, ebx
mov dword [ebp - 0x21c], eax
cmovs esi, eax
test edi, edi
je 0x457358
add edi, edi
nop word [eax + eax]
test edi, edi
je 0x457358
lea eax, [edi - 2]
cmp word [esi + edi - 2], 0x5c
mov edi, eax
jne 0x457310
cmp eax, 0xfffffffe
je 0x457358
sar eax, 1
lea esi, [eax + 1]
test cl, cl
js 0x457340
cmp eax, ecx
jae 0x4574a0
mov ecx, esi
mov byte [ebx + 0xb], cl
mov ecx, ebx
jmp 0x457351
cmp edx, eax
jbe 0x4574a0
mov dword [ebx + 4], esi
mov ecx, dword [ebp - 0x21c]
mov word [ecx + eax*2 + 2], 0
mov ecx, ebx
push str.debug.log
call fcn.004431d8
mov dword [0x4f2fac], ebx
test byte [0x4ec1c8], 1
je 0x45749c
cmp byte [ebx + 0xb], 0
jns 0x45737f
mov ebx, dword [ebx]
sub esp, 0x1c
movaps xmm0, xmmword [0x4d9d20]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4f2fc0], eax
inc eax
cmp eax, 1
ja 0x45749c
lea eax, [ebp - 0x216]
push 0x206
push 0xff
push eax
call fcn.0049dcc0
add esp, 0xc
mov word [ebp - 0x218], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
mov bl, 1
jb 0x457483
mov ecx, dword [0x4f2fac]
push esi
call fcn.00442c80
mov ecx, dword [0x4f2fac]
call fcn.00440180
cmp word [eax], 0x5c
je 0x457429
mov ecx, dword [0x4f2fac]
push 0x4d46f4
call fcn.004431d8
mov ecx, dword [0x4f2fac]
push str.debug.log
call fcn.004431d8
mov eax, dword [0x4f2fac]
cmp byte [eax + 0xb], 0
jns 0x457446
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x4d9d20]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4f2fc0], eax
inc eax
cmp eax, 1
ja 0x457485
mov dword [0x4f2fc0], 0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x210
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x457485
mov ecx, ebx
call fcn.0041b7f8
int3