joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408179
Capabilities:
Set registry value

Disassembly:
push 0x20
push 0x4e2aa0
call fcn.0043d380
mov dword [ebp - 0x30], ecx
xor edi, edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp + 0x10]
push 3
call fcn.00404e73
add esp, 0x10
test eax, eax
jne 0x408293
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], edi
mov ebx, dword [ebp - 0x20]
lea ecx, [ebx + 8]
cmp ebx, ecx
sbb eax, eax
test ecx, eax
je 0x408211
cmp ebx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x4081ed
cmp ebx, ecx
sbb eax, eax
and eax, ecx
call fcn.0043d3e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
test esi, esi
je 0x408213
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x28], esi
jmp 0x408213
cmp ebx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.00443bd6
pop ecx
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x408213
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x2c], esi
jmp 0x408213
mov esi, edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x408249
test esi, esi
jne 0x408252
push 0xe
pop eax
jmp 0x408293
push ebx
push edi
push esi
call fcn.0043f630
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp + 0x10]
push 3
call fcn.00404e73
add esp, 0x1c
mov ebx, eax
test ebx, ebx
jne 0x40828a
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push edi
push dword [ebp + 8]
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
push esi
call fcn.00408ccb
pop ecx
mov eax, ebx
lea esp, [ebp - 0x40]
call fcn.0043d3c9
ret 0x10
Function at 0x4082e4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x11c], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x110], ecx
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x118], edx
test eax, eax
je 0x408331
cmp dword [edi + 4], 0
je 0x408331
push edx
push dword [ebp + 0x10]
push ecx
call eax
mov ecx, dword [ebp - 0x110]
jmp 0x408334
xor eax, eax
inc eax
cmp dword [ebp + 0x18], 0
je 0x4083f0
test eax, eax
jne 0x4083f0
mov ebx, eax
push eax
push eax
push eax
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x114], 0x104
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
test esi, esi
jne 0x4083d0
and dword [ebp - 0x10c], eax
lea eax, [ebp - 0x10c]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4083d8
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x11c]
push dword [ebp - 0x118]
push dword [ebp + 0x10]
push dword [ebp - 0x10c]
push edi
call fcn.004082e4
push dword [ebp - 0x10c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4083d8
cmp esi, 0x103
je 0x4083ee
mov ecx, dword [ebp - 0x110]
inc ebx
push 0
pop eax
test esi, esi
je 0x408348
mov eax, esi
jmp 0x4083f0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4088f8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], ebx
jne 0x408941
push edi
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.00449375
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00442270
add esp, 0x14
test eax, eax
je 0x408941
mov byte [eax], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
xor ecx, ecx
inc ecx
movzx eax, bl
test esi, esi
cmove eax, ecx
mov dword [ebp - 0x210], eax
je 0x408985
push esi
call fcn.0043cfd1
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40897e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x408985
push ebx
call fcn.0043cfda
pop ecx
mov byte [ebp - 0x210], 1
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x20c]
push eax
call esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp byte [ebp - 0x210], 0
mov edi, eax
jne 0x4089b4
test ebx, ebx
je 0x4089b4
push ebx
call esi
push ebx
call fcn.0043cfda
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 8
Function at 0x409544
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x409617
xor eax, eax
cmp ax, word [esi]
je 0x409617
push esi
call fcn.00443c45
pop ecx
cmp eax, 3
jbe 0x409617
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0043f630
push 0x4b4950
push esi
push 0x4b4958
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040a5c9
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call fcn.00409628
add esp, 0x28
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x409612
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4095f1
cmp eax, 0x91
jne 0x409612
push 1
push 0
push esi
call fcn.004097da
add esp, 0xc
neg eax
sbb eax, eax
inc eax
test edi, edi
je 0x409610
test eax, eax
je 0x409610
xor edi, edi
inc edi
jmp 0x409612
xor edi, edi
mov eax, edi
pop edi
jmp 0x409619
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret
Function at 0x409a77
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x940
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x930], eax
mov esi, 0x104
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push esi
mov dword [ebp - 0x934], eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.0043f630
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x409c16
push str.WinInit.Ini
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0040a421
push ebx
push 0x8000080
push 4
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409c0d
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x93c], eax
test eax, eax
je 0x409b9d
lea ecx, [eax + 1]
mov dword [ebp - 0x92c], ebx
push ecx
lea ecx, [ebp - 0x92c]
call fcn.00408f75
mov edi, dword [ebp - 0x92c]
test al, al
je 0x409cb0
push ebx
lea eax, [ebp - 0x938]
mov dword [ebp - 0x938], ebx
push eax
push dword [ebp - 0x93c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409cb0
mov eax, dword [ebp - 0x938]
push str._Rename_
push edi
mov byte [eax + edi], bl
call fcn.004423b0
pop ecx
pop ecx
test eax, eax
jne 0x409c26
push str._rename_
push edi
call fcn.004423b0
pop ecx
pop ecx
test eax, eax
jne 0x409c26
push edi
call fcn.00443bd1
pop ecx
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, 0x410
lea eax, [ebp - 0x928]
push edi
push ebx
push eax
call fcn.0043f630
push dword [ebp - 0x930]
lea eax, [ebp - 0x928]
push dword [ebp - 0x934]
push str._r_n_rename__r_n_s_s_r_n
push edi
push eax
call fcn.0040a568
add esp, 0x20
mov dword [ebp - 0x940], ebx
lea eax, [ebp - 0x940]
push ebx
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.00443f40
pop ecx
push eax
lea eax, [ebp - 0x928]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
pop edi
test esi, esi
je 0x409c14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x410
lea eax, [ebp - 0x518]
push ebx
push eax
call fcn.0043f630
mov eax, dword [ebp - 0x93c]
add esp, 0xc
push dword [ebp - 0x930]
cmp byte [edi + eax - 1], 0xa
lea eax, [ebp - 0x518]
push dword [ebp - 0x934]
jne 0x409c6c
push str._s_s_r_n
jmp 0x409c71
push str._r_n_s_s_r_n
push 0x410
push eax
call fcn.0040a568
add esp, 0x14
mov dword [ebp - 0x92c], ebx
lea eax, [ebp - 0x92c]
push ebx
push eax
lea eax, [ebp - 0x518]
push eax
call fcn.00443f40
pop ecx
push eax
lea eax, [ebp - 0x518]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409cb0
xor ebx, ebx
inc ebx
push edi
call fcn.00443bd1
pop ecx
jmp 0x409c08
Function at 0x40a7ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40a8f0
xor ebx, ebx
cmp word [esi], bx
je 0x40a8f0
push esi
call fcn.0040aa0a
pop ecx
test eax, eax
je 0x40a82c
mov eax, 0xb7
jmp 0x40a8f3
push edi
mov edi, 0x208
lea eax, [ebp - 0x414]
push edi
push ebx
push eax
call fcn.0043f630
add esp, 0xc
lea eax, [ebp - 0x414]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0043f630
push 0x5c
push esi
call fcn.004427c6
add esp, 0x14
pop edi
push esi
test eax, eax
je 0x40a8ac
cmp eax, esi
jne 0x40a8a5
mov ax, word [ebp - 0x414]
mov word [ebp - 0x20c], ax
mov ax, word [ebp - 0x412]
mov word [ebp - 0x20a], ax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0040a490
jmp 0x40a8d7
cmp word [esi + 2], 0x3a
je 0x40a8ca
lea eax, [ebp - 0x414]
push eax
push 0x4b4958
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0040a5c9
add esp, 0x14
jmp 0x40a8d7
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040a523
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0040a903
neg eax
pop ecx
sbb eax, eax
pop ecx
and eax, 0x52
jmp 0x40a8f3
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret

Function at 0x40a9c8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40aa04
push esi
call fcn.00443c45
pop ecx
cmp eax, 3
jbe 0x40aa04
push esi
call fcn.004091fb
pop ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40aa00
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40aa07
xor eax, eax
jmp 0x40aa07
push 0x57
pop eax
pop esi
pop ebp
ret

Function at 0x40aa0a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x40aa2a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40aa2a
test al, 0x10
je 0x40aa2a
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40b31e
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b32f
push 0x57
pop eax
jmp 0x40b39b
and dword [eax], 0
lea edx, [ebp - 4]
and dword [ebp - 4], 0
push edi
push 4
pop edi
push edx
lea edx, [ebp - 8]
mov dword [ebp - 8], edi
push edx
push eax
push 0x20000005
push dword [ecx + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x40b35c
xor eax, eax
jmp 0x40b39a
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
mov dword [ebp + 8], esi
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40b397
lea eax, [ebp + 8]
push eax
push str.HttpQueryInfo_returned_error__ld
push 0x14e
push str.CMcHttpResponse::GetContentLength
push str...includeMcHttp3.cpp
push edi
call fcn.00402fc0
mov esi, dword [ebp + 8]
add esp, 0x18
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x40b838
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 0x250], esi
call fcn.0040b7e2
pop ecx
test eax, eax
je 0x40b896
push 1
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40b88e
lea eax, [ebp - 0x250]
push eax
push str.Custom_Protocol___trusted____s
push 0x79
push str.IsUrlTrusted
push str.E:BT_f666431d_6c2e_48d8_8174_cbb21aff6831UBF_1_shared_srcincludeUrlTrust.h
push 1
call fcn.00402fc0
add esp, 0x18
xor eax, eax
inc eax
jmp 0x40b9f6
push edi
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x290]
push 0
push eax
call fcn.0043f630
add esp, 0xc
mov dword [ebp - 0x290], edi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x288], 0x21
mov dword [ebp - 0x28c], eax
mov edi, 0x101
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x290]
push eax
push 0x90000000
push 0
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x40b942
push 4
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40b9f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x250]
push eax
push str.InternetCrackUrl_failed_for___s_____u
push 0x88
push str.IsUrlTrusted
push str.E:BT_f666431d_6c2e_48d8_8174_cbb21aff6831UBF_1_shared_srcincludeUrlTrust.h
push 4
call fcn.00402c40
add esp, 0x1c
jmp 0x40b9f3
cmp dword [ebp - 0x284], 4
je 0x40b96e
push 1
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40b9f3
lea eax, [ebp - 0x250]
push eax
push str.Protocol_not_ssl___dont_trust____s
push 0x8f
jmp 0x40b9df
lea eax, [ebp - 0x24c]
push edi
push eax
call fcn.0044b35e
lea eax, [ebp - 0x24c]
push eax
call fcn.0040b786
add esp, 0xc
push 1
test eax, eax
je 0x40b9c4
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40b9bf
lea eax, [ebp - 0x250]
push eax
push str.domain_trusted____s
push 0x97
push str.IsUrlTrusted
push str.E:BT_f666431d_6c2e_48d8_8174_cbb21aff6831UBF_1_shared_srcincludeUrlTrust.h
push 1
call fcn.00402fc0
add esp, 0x18
xor eax, eax
inc eax
jmp 0x40b9f5
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40b9f3
lea eax, [ebp - 0x250]
push eax
push str.domain_not_trusted___dont_trust____s
push 0x9b
push str.IsUrlTrusted
push str.E:BT_f666431d_6c2e_48d8_8174_cbb21aff6831UBF_1_shared_srcincludeUrlTrust.h
push 1
call fcn.00402fc0
add esp, 0x18
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret
Function at 0x40c1d1
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], ecx
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x40c238
call ebx
push 4
mov dword [ebp + 8], eax
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40c238
lea eax, [ebp + 8]
push eax
push str.Create_File_returned_error__ld
push 0x1cd
push str.CMcHttpResponse::Save
push str...includeMcHttp3.cpp
push 4
call fcn.00402fc0
add esp, 0x18
push 0x2800
call fcn.00443bd6
mov edi, eax
pop ecx
test edi, edi
jne 0x40c299
push 0xe
pop esi
push 4
mov dword [ebp + 8], esi
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40c2ee
lea eax, [ebp + 8]
push eax
push str.error__ld
push 0x1d4
jmp 0x40c2d7
cmp dword [ebp - 4], esi
je 0x40c2ee
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push dword [ebp - 4]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c312
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x40c30d
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
mov eax, dword [ebp - 0xc]
push 0x2800
push edi
push dword [eax + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x40c26f
call ebx
mov esi, eax
push 4
mov dword [ebp + 8], esi
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40c2ee
lea eax, [ebp + 8]
push eax
push str.InternetReadFile_error__ld
push 0x1e0
push str.CMcHttpResponse::Save
push str...includeMcHttp3.cpp
push 4
call fcn.00402fc0
mov esi, dword [ebp + 8]
add esp, 0x18
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40c302
push edi
call fcn.00443bd1
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x1d
pop esi
jmp 0x40c2ee
call ebx
mov esi, eax
push 4
mov dword [ebp + 8], esi
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40c2ee
lea eax, [ebp + 8]
push eax
push str.WriteFile_error__ld
push 0x1ee
jmp 0x40c2d7
Function at 0x40edf2
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
mov edi, ecx
call fcn.0043f630
add esp, 0xc
lea esi, [edi + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 8], ebx
jne 0x40ef3e
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0044ae7c
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 8], eax
test eax, eax
jne 0x40ee81
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x40ef90
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpQueryHeaders
push eax
call esi
push str.WinHttpReadData
push dword [edi + 8]
mov dword [edi + 0x28], eax
call esi
push str.WinHttpOpenRequest
push dword [edi + 8]
mov dword [edi + 0x2c], eax
call esi
push str.WinHttpAddRequestHeaders
push dword [edi + 8]
mov dword [edi + 0x30], eax
call esi
push str.WinHttpSendRequest
push dword [edi + 8]
mov dword [edi + 0x34], eax
call esi
push str.WinHttpReceiveResponse
push dword [edi + 8]
mov dword [edi + 0x38], eax
call esi
push str.WinHttpCloseHandle
push dword [edi + 8]
mov dword [edi + 0x3c], eax
call esi
push str.WinHttpCrackUrl
push dword [edi + 8]
mov dword [edi + 0x40], eax
call esi
push str.WinHttpOpen
push dword [edi + 8]
mov dword [edi + 0x44], eax
call esi
push str.WinHttpSetOption
push dword [edi + 8]
mov dword [edi + 0x48], eax
call esi
push str.WinHttpConnect
push dword [edi + 8]
mov dword [edi + 0x4c], eax
call esi
push str.WinHttpGetProxyForUrl
push dword [edi + 8]
mov dword [edi + 0x50], eax
call esi
push str.WinHttpQueryOption
push dword [edi + 8]
mov dword [edi + 0x54], eax
call esi
push str.WinHttpGetIEProxyConfigForCurrentUser
push dword [edi + 8]
mov dword [edi + 0x58], eax
call esi
mov dword [edi + 0x5c], eax
lea esi, [edi + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0x28], ebx
je 0x40ef8e
cmp dword [edi + 0x2c], ebx
je 0x40ef8e
cmp dword [edi + 0x30], ebx
je 0x40ef8e
cmp dword [edi + 0x34], ebx
je 0x40ef8e
cmp dword [edi + 0x38], ebx
je 0x40ef8e
cmp dword [edi + 0x3c], ebx
je 0x40ef8e
cmp dword [edi + 0x40], ebx
je 0x40ef8e
cmp dword [edi + 0x44], ebx
je 0x40ef8e
cmp dword [edi + 0x48], ebx
je 0x40ef8e
cmp dword [edi + 0x4c], ebx
je 0x40ef8e
cmp dword [edi + 0x50], ebx
je 0x40ef8e
cmp dword [edi + 0x54], ebx
je 0x40ef8e
cmp dword [edi + 0x58], ebx
je 0x40ef8e
cmp dword [edi + 0x5c], ebx
je 0x40ef8e
xor ebx, ebx
inc ebx
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret
Function at 0x40f005
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x40f02f
cmp word [edi], si
jne 0x40f01c
mov eax, esi
jmp 0x40f023
push edi
call fcn.00443c45
pop ecx
push eax
push edi
mov ecx, 0x4ef10c
call fcn.00403c60
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x40f052
cmp word [edi], si
jne 0x40f03f
mov eax, esi
jmp 0x40f046
push edi
call fcn.00443c45
pop ecx
push eax
push edi
mov ecx, 0x4ef124
call fcn.00403c60
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x40f073
cmp word [edi], si
je 0x40f067
push edi
call fcn.00443c45
pop ecx
mov esi, eax
push esi
push edi
mov ecx, 0x4ef13c
call fcn.00403c60
mov eax, dword [ebp + 8]
mov ecx, 0x4ef0a8
mov dword [0x4ef0a8], eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [0x4ef0ac], eax
pop esi
pop ebp
jmp fcn.0040edf2

Function at 0x40f0ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], ecx
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x40f154
call ebx
push 4
mov dword [ebp + 8], eax
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40f154
lea eax, [ebp + 8]
push eax
push str.Create_File_returned_error__ld
push 0x19c
push str.CMcHttpHResponse::Save
push str...includeMcHttpH.cpp
push 4
call fcn.00402fc0
add esp, 0x18
push 0x2800
call fcn.00443bd6
mov edi, eax
pop ecx
test edi, edi
jne 0x40f18e
push 0xe
pop esi
push 4
mov dword [ebp + 8], esi
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40f248
lea eax, [ebp + 8]
push eax
push str.error__ld
push 0x1a3
jmp 0x40f231
mov ecx, dword [0x4ef0d4]
mov eax, esi
mov dword [ebp - 4], eax
test ecx, ecx
je 0x40f1be
cmp dword [0x4ef0b4], eax
je 0x40f1be
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push 0x2800
push edi
push dword [eax + 8]
call ecx
mov ecx, eax
mov eax, dword [ebp - 4]
jmp 0x40f1c1
xor ecx, ecx
inc ecx
test ecx, ecx
je 0x40f210
test eax, eax
je 0x40f248
push esi
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
push ecx
push eax
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40f1ed
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x40f18e
push 0x1d
pop esi
jmp 0x40f248
call ebx
mov esi, eax
push 4
mov dword [ebp + 8], esi
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40f248
lea eax, [ebp + 8]
push eax
push str.WriteFile_error__ld
push 0x1bd
jmp 0x40f231
call ebx
mov esi, eax
push 4
mov dword [ebp + 8], esi
call fcn.0042c3e0
pop ecx
test eax, eax
je 0x40f248
lea eax, [ebp + 8]
push eax
push str.WinHttpReadData_error__ld
push 0x1af
push str.CMcHttpHResponse::Save
push str...includeMcHttpH.cpp
push 4
call fcn.00402fc0
mov esi, dword [ebp + 8]
add esp, 0x18
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40f25c
push edi
call fcn.00443bd1
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4