joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5903b0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [0xd44044]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
not eax
cmp esi, 3
jbe 0x590490
lea edx, [esi - 4]
shr edx, 2
lea ebx, [ecx + edx*4 + 4]
nop
mov edx, eax
xor al, byte [ecx]
add ecx, 4
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa8b500]
mov eax, edx
xor dl, byte [ecx - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa8b500]
mov edx, eax
xor al, byte [ecx - 2]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa8b500]
mov eax, edx
xor dl, byte [ecx - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0xa8b500]
cmp ecx, ebx
jne 0x5903e0
and esi, 3
test esi, esi
je 0x590476
mov edx, eax
xor al, byte [ebx]
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0xa8b500]
mov eax, edx
cmp esi, 1
je 0x590476
xor al, byte [ebx + 1]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa8b500]
mov eax, edx
cmp esi, 2
je 0x590476
xor al, byte [ebx + 2]
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0xa8b500]
mov eax, edx
not eax
mov edx, dword [esp + 0xc]
sub edx, dword [0xd44044]
jne 0x590494
add esp, 0x14
pop ebx
pop esi
ret
mov ebx, ecx
jmp 0x590431
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
Function at 0x401ae1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401aeb
repz ret
jmp fcn.00401eae
Function at 0x10006a26
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10006a65
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10006a65
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10006a65
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10006a65
cmp dword [ecx + 0x74], 0xe
jbe 0x10006a65
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100078c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100078ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100078ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10007c6d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10017630
push 0x10017628
push str.FlsAlloc
push 0x1f
call fcn.10007f50
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007ca1
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x10007ca7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10007ceb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10017640
push 0x10017638
push str.FlsGetValue
push 0x21
call fcn.10007f50
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007d22
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10007d2a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10017648
push 0x10017640
push str.FlsSetValue
push 0x22
call fcn.10007f50
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007d64
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000b079
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000b116
push ebx
push esi
call fcn.1000b119
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000af7d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000b0c3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b115
push edi
push eax
call fcn.1000b4da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000b0e3
call fcn.10009237
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b114
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000af7d
add esp, 0x20
test eax, eax
jne 0x1000b102
push edi
call fcn.10009237
jmp 0x1000b10a
push ebx
call fcn.10009237
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x402dd0
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
sub esp, 0x28
or eax, 0xffffffff
mov word [esp + 0x10], ax
push ebp
xor ecx, ecx
mov eax, 0x65
xor ebp, ebp
mov dword [esp + 0x20], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
mov dword [esp + 0x24], ebp
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
xor ecx, ecx
push 4
mov dword [esp + 0x24], eax
mov word [eax], cx
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42b3f4
add al, byte [eax]
mov dword [eax], 1
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x3c]
cmp dword [edx + 8], ebp
jbe 0x402e63
xor edi, edi
mov eax, edx
mov ecx, dword [eax + 4]
mov esi, dword [ecx + edi*4]
test esi, esi
je 0x402e5d
movzx eax, word [esi + 8]
cmp ax, 0x3f
jle 0x402f2d
push esi
call fcn.004112ef
mov eax, dword [esp + 0x40]
add esp, 4
inc edi
cmp edi, dword [eax + 8]
jb 0x402e38
mov edx, dword [esp + 0x3c]
mov dword [edx + 8], ebp
cmp word [ebx], bp
je 0x40306f
jmp 0x402e80
cmp ax, 0x30
jl 0x402e50
mov ecx, dword [esi]
test ecx, ecx
je 0x402e50
mov eax, dword [ecx + 0xc]
dec dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x10], ecx
cmp dword [edx], ebp
je 0x42b3fd
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004112ef
add esp, 4
jmp 0x402e50
mov dword [esp + 0x2c], ebp
jmp 0x402e2b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ecx
call fcn.004112ef
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0xc]
add esp, 4
push eax
call fcn.004112ef
add esp, 4
jmp 0x402f55
Function at 0x40f5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
push ebx
push esi
mov ebx, 0x4848e8
call fcn.0040f580
mov esi, eax
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00413990
push esi
call fcn.004112ef
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0040f6a0
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.0040f6d0
xor ebx, ebx
mov dword [edi + 8], ebx
xor ecx, ecx
mov eax, ebx
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x40f631
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x4876c8
push eax
call fcn.00414e06
add esp, 8
mov dword [edi], eax
cmp eax, ebx
je 0x42b2ee
push edi
call fcn.0040f450
cmp eax, ebx
je 0x42b2f8
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.00414e94
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x40f690
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.004151b0
add esp, 0x10
push 0x99f2
push 0x10
lea ecx, [esp + 0x10]
push ecx
call int.0044afdc
xor eax, eax
mov dword [edi + 8], ebx
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42b324
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.00415484
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x40f690

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x443494
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
rol dword [ecx + 0x3d9e2], 1
jg 0x4434cf
push ss
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x33a9aa8c]
pop edi
xor edx, eax
mov dword [esi], edx
inc esi
or byte [esi - 0x3e], bl
or byte [0xb6e80040], cl
call 0x50456172
stc
inc ecx
jb 0x4434ce
cmp cx, 0
mov dword [ecx], 0xa75c33b
mov byte [edi + 0x1d], 1
invalid
invalid
mov byte [edi + 0x56], 0xe8
invalid
inc edi
push esi

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401064
Capabilities:
Copy file

Disassembly:
push 0x280
mov eax, 0x502ab6
call fcn.004a5338
mov eax, dword [ebp + 8]
and dword [ebp - 0x240], 0
push 7
pop ebx
mov dword [ebp - 0x28c], eax
xor eax, eax
push 0x517588
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x23c], ebx
mov word [ebp - 0x250], ax
call fcn.004014eb
and dword [ebp - 4], 0
mov eax, dword [0x558f5c]
test eax, eax
je 0x4010e8
mov ecx, dword [0x558f54]
lea edi, [eax + ecx*4]
mov esi, eax
cmp eax, edi
je 0x4010e8
push dword [esi]
lea ecx, [ebp - 0x250]
call fcn.00401c7e
test eax, eax
je 0x4010d9
add esi, 4
cmp esi, edi
jne 0x4010c1
cmp esi, edi
je 0x4010e8
lea eax, [esi + 4]
cmp eax, edi
je 0x4010e8
mov edi, dword [eax]
jmp 0x4010ea
xor edi, edi
or dword [ebp - 4], 0xffffffff
xor esi, esi
push 0
inc esi
push esi
lea ecx, [ebp - 0x250]
call fcn.00401512
test edi, edi
jne 0x40110b
xor al, al
call fcn.004a53bb
ret
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401103
and dword [ebp - 0x224], 0
xor eax, eax
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], ebx
call fcn.004014eb
push edi
lea ecx, [ebp - 0x26c]
mov dword [ebp - 4], esi
call fcn.00401267
mov byte [ebp - 4], 2
cmp dword [ebp - 0x258], 8
mov ecx, dword [ebp - 0x26c]
jae 0x401177
lea ecx, [ebp - 0x26c]
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x40118c
lea eax, [ebp - 0x234]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4011bf
xor bl, bl
push 0
push esi
lea ecx, [ebp - 0x26c]
call fcn.00401512
push 0
push esi
lea ecx, [ebp - 0x234]
call fcn.00401512
mov al, bl
jmp 0x401105
lea ebx, [ebp - 0x288]
call fcn.004011e9
mov ecx, eax
lea eax, [ebp - 0x26c]
call fcn.00449b20
push 0
push esi
lea ecx, [ebp - 0x288]
mov bl, al
call fcn.0040136b
jmp 0x40119c
Function at 0x406115
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x500888
call fcn.004a5338
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x406137
xor eax, eax
jmp 0x4062aa
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x406165
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x406165
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x4062aa
cmp dword [esi + 0x54], ebx
je 0x4062a5
mov ecx, esi
call fcn.00407e4d
cmp dword [esi + 0x44], ebx
jne 0x406195
push dword [esi + 0x54]
push edi
call fcn.00403850
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x4062aa
jmp 0x4062a5
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040977a
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x406252
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push eax
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x14]
xor ebx, ebx
inc ebx
test eax, eax
js 0x40629a
cmp eax, ebx
jg 0x40625a
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x406204
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x406229
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x406217
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push ebx
push eax
call fcn.0049f92c
add esp, 0x10
cmp edi, eax
jne 0x40629a
lea eax, [ebp - 0x30]
mov byte [esi + 0x4a], bl
cmp dword [ebp - 0x38], eax
jne 0x406289
test edi, edi
jne 0x4061b6
cmp dword [ebp - 0x1c], 0x20
push edi
lea ecx, [ebp - 0x2c]
jae 0x40629f
push 8
call fcn.004073b1
jmp 0x4061b6
mov edx, dword [ebp - 0x2c]
jmp 0x4061c8
cmp eax, 3
jne 0x40629a
push dword [esi + 0x54]
push dword [ebp - 0x30]
call fcn.00403850
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x406279
mov esi, 0xffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040136b
mov ax, si
jmp 0x4062aa
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040136b
mov ax, word [ebp + 8]
jmp 0x4062aa
push 0
lea ecx, [ebp - 0x2c]
push ebx
call fcn.0040136b
mov eax, 0xffff
call fcn.004a53bb
ret 4
Function at 0x407d4e
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x5019e3
call fcn.004a5338
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x407e45
cmp byte [esi + 0x4a], bl
je 0x407e45
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x407d8a
xor al, al
jmp 0x407e47
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.0040977a
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x407de8
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x407ded
dec eax
je 0x407df1
dec eax
dec eax
je 0x407e41
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040136b
mov al, bl
jmp 0x407e47
mov edx, dword [ebp - 0x2c]
jmp 0x407db3
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x407dfd
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x407e23
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x407e10
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.0049f92c
add esp, 0x10
cmp edi, eax
jne 0x407dd6
cmp byte [esi + 0x4a], 0
je 0x407e41
test edi, edi
jne 0x407da5
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004073b1
jmp 0x407da5
mov bl, 1
jmp 0x407dd8
mov al, 1
call fcn.004a53bb
ret

Function at 0x407fb9
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x250
mov eax, 0x503e8c
call fcn.004a5338
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x238], ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x23c], esi
mov word [esi], ax
mov dword [ebp - 4], ebx
push 0x206
mov word [ebp - 0x218], ax
xor edi, edi
lea eax, [ebp - 0x216]
push ebx
inc edi
push eax
mov dword [ebp - 0x238], edi
call fcn.004a2800
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x408078
push 0x16
push str.SHGetFolderPath_FAILED
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], 0xf
mov dword [ebp - 0x224], ebx
mov byte [ebp - 0x234], bl
call fcn.00401570
lea eax, [ebp - 0x234]
lea esi, [ebp - 0x25c]
mov dword [ebp - 4], edi
call fcn.00403c95
push 0x26
push str.d:_buildbot_slaves_ad_aware_antivirus_ad_aware_antivirus_buildProjectsPathHelperIncludePathHelper_Special.h
push str.class_boost::filesystem::path___cdecl_PathHelper::Detail::Special_struct_PathHelper::SpecialTag_::FolderPath_int_void__
push eax
mov byte [ebp - 4], 2
call fcn.0040efad
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.004014eb
mov eax, esi
call fcn.004a53bb
ret
Function at 0x40b783
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x503d1f
call fcn.004a52cf
mov edi, dword [ebp + 8]
test byte [0x55a220], 1
mov esi, 0x55a208
jne 0x40b7b9
or dword [0x55a220], 1
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x50890a
call fcn.0049eb25
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x559fb4], 0
jne 0x40b7d9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x54b42c], eax
call fcn.004031d1
inc dword [0x559fb4]
mov eax, dword [0x559fb4]
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
and dword [ebp - 4], 0
lea esi, [edi + 4]
lea eax, [esi + 4]
lea ecx, [ebx + 4]
push eax
mov dword [ebp - 0x10], esi
call fcn.0040c488
lea ecx, [ebx + 0x14]
lea eax, [esi + 0x14]
push ecx
push eax
mov byte [ebp - 4], 1
call fcn.0040cc8a
lea eax, [ebx + 0x24]
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004057b6
add esi, 0x40
lea ecx, [ebx + 0x40]
push esi
mov byte [ebp - 4], 3
call fcn.0040c868
lea eax, [edi + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [edi + 0x6c], 5
mov eax, edi
call fcn.004a53a7
ret 4

Function at 0x41dd14
Capabilities:
Accept command line arguments

Disassembly:
push 0xe4
mov eax, 0x50685d
call fcn.004a5338
xor ebx, ebx
mov dword [ebp - 0x54], ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x58], esi
mov word [esi], ax
xor edi, edi
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], ebx
inc edi
push eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x50], eax
cmp eax, ebx
jne 0x41ddf6
lea eax, [ebp - 0xf0]
push eax
call fcn.00405986
lea eax, [ebp - 0xf0]
push str.couldnt_convert_command_line_to_argv
push eax
mov dword [ebp - 4], edi
call fcn.0040e1a9
pop ecx
pop ecx
push 0x2c
push str.AdAwareWebInstaller::CommandLine::Parameters
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00401570
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 2
call fcn.00405a2d
mov edi, eax
mov byte [ebp - 4], 3
call fcn.0041f5f7
mov ecx, dword [eax + 4]
push edi
push 0x48
mov edi, 0xfa0
lea edx, [ebp - 0x2c]
call fcn.00404574
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00401512
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040136b
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], bl
call fcn.0040380f
jmp 0x41de21
mov ebx, edi
cmp dword [ebp - 0x4c], edi
jle 0x41de21
mov eax, dword [ebp - 0x50]
push dword [eax + ebx*4]
mov ecx, esi
call fcn.0040128c
inc ebx
cmp ebx, dword [ebp - 0x4c]
je 0x41de21
push 0x517598
mov ecx, esi
call fcn.0040128c
cmp ebx, dword [ebp - 0x4c]
jl 0x41ddfd
mov eax, esi
call fcn.004a53bb
ret
Function at 0x428849
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop ebp
ret 0x10

Function at 0x4288ba
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebx
push edi
mov ebx, eax
xor edi, edi
cmp dword [ebx + 0x34fc], edi
je 0x4288cf
xor eax, eax
jmp 0x428976
mov edx, dword [ebx + 0x2480]
mov eax, dword [edx - 0xc]
mov ecx, eax
neg ecx
sbb ecx, ecx
push edi
and ecx, edx
neg eax
push edi
sbb eax, eax
push ecx
and eax, 3
push eax
push str.VCSoapClient
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx + 0x34f8], eax
cmp eax, edi
je 0x42896c
lea ecx, [ebx + 0x2484]
cmp dword [ecx], edi
je 0x428940
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
push ecx
push 2
push eax
call esi
push 4
lea eax, [ebx + 0x2484]
push eax
push 6
push dword [ebx + 0x34f8]
call esi
push 4
lea eax, [ebx + 0x2484]
push eax
push 5
push dword [ebx + 0x34f8]
call esi
pop esi
movzx eax, word [ebx + 0x2450]
push edi
push edi
push 3
push edi
push edi
push eax
lea eax, [ebx + 0x46]
push eax
push dword [ebx + 0x34f8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [ebx + 0x34fc], eax
cmp eax, edi
jne 0x4288c8
call fcn.00428873
mov eax, 0x80004005
pop edi
pop ebx
ret
Function at 0x428cbf
Capabilities:
Send data
Send http request

Disassembly:
push 0x10
mov eax, 0x503486
call fcn.004a5302
mov esi, ecx
mov eax, esi
call fcn.004288ba
test eax, eax
je 0x428cec
mov dword [esi + 0x34f4], 4
mov eax, 0x80004005
jmp 0x428e5b
mov eax, dword [0x5450d0]
mov ecx, 0x5450d0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.SOAPAction:__http:__tempuri.org_GetComponentInfo__r_n
lea eax, [ebp - 0x14]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov byte [ebp - 4], 1
call fcn.00432fab
push str.Content_Type:_text_xml__charsetutf_8_r_n
lea eax, [ebp - 0x14]
push eax
call fcn.00432fab
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x2454]
mov ecx, dword [esi + 0x2494]
sub eax, 3
neg eax
sbb eax, eax
push edi
and eax, 0xff800000
add eax, 0x800000
or eax, 0x400200
push eax
push 0x5530e8
push edi
push str.HTTP_1.0
push ecx
push str.POST
push dword [esi + 0x34fc]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
cmp eax, edi
mov edi, dword [ebp - 0x14]
mov dword [esi + 0x3500], eax
je 0x428e2e
mov ecx, dword [esi + 0x2474]
mov edx, dword [ecx - 0xc]
mov ebx, dword [edi - 0xc]
push edx
push ecx
push ebx
push edi
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x428e38
mov eax, dword [esi + 0x3500]
push esi
mov dword [esi + 0x247c], eax
call fcn.00428e71
cmp eax, 0x1f4
je 0x428dc0
lea eax, [edi - 0x10]
call fcn.00422ed6
xor eax, eax
jmp 0x428e5b
and dword [ebp - 0x18], 0
mov dword [esi + 0x34f4], 7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax]
test eax, eax
js 0x428e1b
lea eax, [esi + 0x2478]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
push eax
lea ebx, [esi + 0x3504]
mov dword [ebp - 0x1c], eax
call fcn.00425b15
test eax, eax
jns 0x428e0a
mov dword [esi + 0x34f4], 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x428e1b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x428e38
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x428e38
mov dword [esi + 0x34f4], 5
lea eax, [edi - 0x10]
call fcn.00422ed6
jmp 0x428ce2
call fcn.004a53a7
ret