joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6a88
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
push 0x1a
push eax
call fcn.004c8ad0
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x4c75f7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c7675
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov ecx, esi
push 1
push eax
call fcn.004c8ad0
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x4c763b
mov ecx, eax
call fcn.0040f820
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4c7675
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4c766b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c777d
push edx
push ecx
call fcn.004433ea
add esp, 8
cmp dword [ebp - 0x18], 0
jne 0x4c76a0
xor eax, eax
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x4ec534
mov word [edi], ax
call fcn.00419250
jmp 0x4c7756
call fcn.00418250
mov ecx, eax
test ecx, ecx
je 0x4c7782
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0040c100
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004c80b0
mov edx, dword [ebp - 0x48]
add esp, 8
mov byte [ebp - 4], 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c7707
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x44]
xor eax, eax
mov ecx, esi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c7722
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00419250
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4c7756
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
call fcn.00403c70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret 8
call fcn.004701f6
push 0x80004005
call fcn.00404b50
int3
Function at 0x4cb7f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e71b2
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x5181bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x4cb920
test eax, eax
je 0x4cb920
test ebx, ebx
je 0x4cb920
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cb90f
cmp dword [ebp - 0x818], eax
je 0x4cb920
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.00466070
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4cb90f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cb8f1
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00419250
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x4cb920
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004437fa
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4cbaf0
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x4cbaff
pop ebp
jmp fcn.004cbb10
xor al, al
pop ebp
ret 4
Function at 0x4d05c0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5181bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
test edi, edi
je 0x4d0709
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4d0709
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d0709
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4d0709
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push SysReAllocStringLen
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, 0xffffffff
je 0x4d06f5
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4d06ee
cmp dword [ebp - 0x1c], ebx
jne 0x4d06ee
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp eax, ecx
ja 0x4d068d
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 0x10
jb 0x4d0687
mov ecx, dword [esi]
mov byte [ecx + eax], 0
jmp 0x4d0699
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0040f890
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x20]
mov ecx, esi
push 0
call fcn.0042064d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x4d06ee
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dbed0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8fb0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5181bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.004dc5f0
push 0
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.004dc800
add esp, 0x18
mov edx, dword [ebp - 0x14]
or esi, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4dbf3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 0x14], 0
je 0x4dbf6f
push 0
push dword [ebp - 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4dbf6f
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x4ec534
call fcn.0040c100
jmp 0x4dbf7d
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.0044d210
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4dbf9c
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4dc800
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e91c0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5181bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4dc919
cmp dword [ebp + 0x10], 0
je 0x4dc919
call fcn.00418250
mov ecx, eax
test ecx, ecx
je 0x4dc969
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp + 0xc], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x105
or eax, ecx
mov dword [ebp - 4], 1
jge 0x4dc87e
push 0x105
lea ecx, [ebp + 0xc]
call fcn.004060c0
mov esi, dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [esi - 8]
push esi
call fcn.004854ef
add esp, 8
test eax, eax
js 0x4dc973
cmp eax, dword [esi - 8]
jg 0x4dc973
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [ebp + 0x14], ecx
je 0x4dc909
push ecx
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4dc909
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x4ec534
call fcn.0040c100
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4dc8f6
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov ecx, edi
call fcn.0044d210
jmp 0x4dc8d7
call fcn.00418250
mov ecx, eax
test ecx, ecx
je 0x4dc97d
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x4ec534
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00404b70
test al, al
jne 0x4dc956
push 0
push 0x4ec534
mov ecx, esi
call fcn.00406410
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404b50
push 0x80070057
call fcn.00404b50
push 0x80004005
call fcn.00404b50
int3
Function at 0x10001650
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1001d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [0x1001e378], 1
mov dword [0x1001e374], ecx
mov dword [0x1001e37c], edx
mov dword [0x1001e388], eax
cmp ecx, 4
je 0x1000169d
cmp ecx, 1
je 0x1000169d
mov eax, dword [0x1001d8a0]
mov dword [0x1001e384], eax
inc eax
mov dword [0x1001d8a0], eax
jmp 0x100016b1
mov dword [0x1001e378], 0x84
mov dword [0x1001e384], 0
push esi
push 0x1001e370
push dword [0x1001e390]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov esi, eax
test esi, esi
jne 0x1000173d
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.ModdedService
push esi
mov dword [0x1001e38c], eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
push dword [0x1001e38c]
mov edi, eax
lea eax, [ebp - 0x204]
push str.ModdedService
push str._s_error:__d
push eax
call fcn.10001750
add esp, 0x10
mov dword [ebp - 0x208], 0x1001aac4
lea eax, [ebp - 0x204]
mov dword [ebp - 0x20c], eax
test edi, edi
je 0x1000173a
push esi
lea eax, [ebp - 0x20c]
push eax
push esi
push 2
push esi
push esi
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10002224
mov esp, ebp
pop ebp
ret
Function at 0x401360
Capabilities:
Connect to http server
Create http request
Parse url

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [esi + 0xc], 0x823
mov dword [esi + 0x18], 0x823
mov dword [esi + 0x24], 0x823
mov dword [esi + 0x2c], 0x823
mov dword [esi + 0x34], 0x823
mov dword [esi + 0x3c], 0x823
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4013e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x4013b3
mov esi, eax
jmp 0x4013bc
movzx esi, ax
or esi, 0x80070000
push esi
push eax
push 0x4a1920
push str._s_failed__error___d__0x_x_
call fcn.00413860
push str._ERROR_CreateConnection__InternetCrackUrl___failed_
call fcn.004010d0
add esp, 0x14
mov eax, esi
pop esi
pop ebp
ret 4
push 0x4000000
push 0
push 0
push 0
push str.WinInetPost_0.0.4
call dword [sym.imp.WININET.dll_InternetOpenW]
push 4
lea ecx, [ebp + 8]
push ecx
push 0x4d
push eax
mov dword [esi + 0x40], eax
mov dword [ebp + 8], 1
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x401453
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x401425
mov esi, eax
jmp 0x40142e
movzx esi, ax
or esi, 0x80070000
push esi
push eax
push str.InternetOpen
push str._s_failed__error___d__0x_x_
call fcn.00413860
push str._ERROR_CreateConnection__InternetOpenW___failed_
call fcn.004010d0
add esp, 0x14
mov eax, esi
pop esi
pop ebp
ret 4
push ebx
push 0x401590
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
lea ebx, [esi - 0xc]
push ebx
push 0
push 3
push dword [esi + 0x28]
push dword [esi + 0x20]
push 0x50
push dword [esi + 0x14]
push dword [esi + 0x40]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 0x44], eax
test eax, eax
jne 0x401520
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x401496
mov edi, eax
jmp 0x40149f
movzx edi, ax
or edi, 0x80070000
push edi
push eax
push str.InternetConnect
push str._s_failed__error___d__0x_x_
call fcn.00413860
push dword [esi + 0x40]
push str._param0___x
call fcn.00413860
push dword [esi + 0x14]
push str._param1___s
call fcn.00413860
push 0x50
push str._param2___d
call fcn.00413860
push dword [esi + 0x20]
push str._param3___s
call fcn.00413860
push dword [esi + 0x28]
push str._param4___s
call fcn.00413860
push 0
push str._param6___x
call fcn.00413860
add esp, 0x40
push ebx
push str._param7___x
call fcn.00413860
push str._ERROR_CreateConnection__InternetConnectW___failed_
call fcn.004010d0
add esp, 0xc
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret 4
pop ebx
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x401e70
Capabilities:
Check internet connectivity via wininet
Parse url
Reference google public dns server
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, 0x80004005
test ecx, ecx
je 0x401f28
lea eax, [edi + 0x10]
push eax
push 0
push 0
push ecx
mov dword [edi + 0x18], 0x823
mov dword [edi + 0x24], 0x823
mov dword [edi + 0x30], 0x823
mov dword [edi + 0x38], 0x823
mov dword [edi + 0x40], 0x823
mov dword [edi + 0x48], 0x823
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x401f28
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x401ed3
mov esi, eax
jmp 0x401edc
movzx esi, ax
or esi, 0x80070000
push esi
push eax
push 0x4a1920
push str._s_failed__error___d__0x_x_
call fcn.00413860
push str._ERROR_CheckServerReachability__InternetCrackUrl___failed_
call fcn.004010d0
add esp, 0x14
cmp esi, 0x80004005
jne 0x401f1e
push str.8.8.8.8
mov ecx, edi
call fcn.00403570
test eax, eax
jns 0x401f1e
push str.8.8.4.4
mov ecx, edi
call fcn.00403570
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x401f4e
push str._ERROR_CheckServerReachability__InternetGetConnectedState___failed_
call fcn.004010d0
add esp, 4
jmp 0x401f02
push 0
lea eax, [ebp + 8]
push eax
push 0
push 8
push 1
push dword [edi + 0x20]
mov dword [ebp + 8], 0
call sub.DNSAPI.dll_DnsQuery_W
test eax, eax
jne 0x401f02
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x401f02
push 1
push ecx
call sub.DNSAPI.dll_DnsFree
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4028a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x3bc]
mov eax, dword [esi + 0x3c0]
sub eax, edx
xor ebx, ebx
sar eax, 2
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x210], ebx
test eax, eax
je 0x402919
lea esp, [esp]
mov eax, dword [edx + ecx*4]
cmp dword [eax + 0x454], 0x80700001
je 0x4028fd
mov eax, dword [esi + 0x890]
inc ebx
mov dword [eax + ecx*4], 3
mov edx, dword [esi + 0x3bc]
mov eax, dword [esi + 0x3c0]
sub eax, edx
inc ecx
sar eax, 2
cmp ecx, eax
jb 0x4028e0
mov dword [ebp - 0x210], ebx
mov ecx, dword [esi + 0x3bc]
mov ebx, dword [esi + 0x3c0]
sub ebx, ecx
sar ebx, 2
cmp dword [ebp - 0x210], ebx
jne 0x402a16
xor edx, edx
test ebx, ebx
je 0x40297c
lea esp, [esp]
test edi, edi
js 0x402960
mov eax, dword [ecx]
mov edi, dword [eax + 0x454]
cmp edi, 0x80004004
je 0x40295c
inc edx
add ecx, 4
cmp edx, ebx
jb 0x402940
test edi, edi
jns 0x40297c
mov eax, dword [esi + 0x378]
test eax, eax
je 0x402a16
push dword [esi + 0x37c]
push 1
push edi
jmp 0x402a0c
cmp byte [esi + 0x385], 0
mov ecx, esi
je 0x40298e
call fcn.00404230
jmp 0x402993
call fcn.00403010
test eax, eax
jne 0x4029af
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret 8
lea eax, [esi + 0x5d0]
push eax
push str._s.tmp
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00401690
mov eax, dword [esi + 0x83c]
add esp, 0x10
test eax, eax
je 0x4029e2
push eax
call fcn.00487717
add esp, 4
lea eax, [esi + 0x3c8]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004872ac
mov eax, dword [esi + 0x378]
add esp, 8
xor edi, edi
test eax, eax
je 0x402a16
push dword [esi + 0x37c]
push edi
push edi
push 0x474
call eax
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00487c50
mov esp, ebp
pop ebp
ret 8
Function at 0x402f30
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push edi
mov edi, ecx
test eax, eax
jne 0x402f4c
mov eax, 0x80070057
pop edi
mov esp, ebp
pop ebp
ret 8
push esi
push eax
push str._s.tmp
lea esi, [edi + 0x40]
push 0x103
push esi
call fcn.00401690
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402fc7
cmp byte [edi + 0x450], 0
je 0x402fc7
cmp byte [ebp + 0xc], 0
jne 0x402fc7
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402fab
pop esi
mov eax, 0x80700004
pop edi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [edi + 0x28]
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x402fde
mov dword [ecx], 0
mov dword [ecx + 4], 0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x403190
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x5d0]
push eax
push str._s.tmp
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00401690
mov eax, dword [esi + 0x83c]
add esp, 0x10
test eax, eax
je 0x4031d9
push eax
call fcn.00487717
add esp, 4
lea eax, [esi + 0x3c8]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004872ac
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00487c50
mov esp, ebp
pop ebp
ret
Function at 0x403200
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
jne 0x403235
pop edi
mov eax, 0x80070057
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4
push edi
push str._s.tmp
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00401690
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40326d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
lea ebx, [esi + 0x40]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403304
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x403304
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x4032a0
mov ecx, eax
jmp 0x4032a9
movzx ecx, ax
or ecx, 0x80070000
push ecx
push eax
push str.MoveFile
push str._s_failed__error___d__0x_x_
mov dword [ebp - 0x210], ecx
call fcn.00413860
add esp, 0x10
lea eax, [ebp - 0x20c]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x403304
lea eax, [ebp - 0x210]
push str.CopyFile
push eax
call fcn.004015b0
mov eax, dword [ebp - 0x210]
add esp, 8
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4
push 0
push edi
mov ecx, esi
call fcn.00402f30
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [esi + 0x454], 0x80700001
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4
Function at 0x404230
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x4a3068
mov esi, ecx
call fcn.00413860
mov eax, dword [esi + 0x378]
add esp, 4
mov ebx, 1
test eax, eax
je 0x404277
push dword [esi + 0x37c]
push 0
push 0
push 0x47d
call eax
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0
push esi
push 0x404b90
push 0
push 0
mov dword [esi + 0x840], 0x80004005
mov byte [esi + 0x844], 0
mov dword [ebp - 0x210], 0
call fcn.00487a23
add esp, 0x18
test eax, eax
jne 0x4042e5
push str.MultiBlockDownloader::SignCheck
push str.__S___beginthreadex_failed
call fcn.00413860
push dword [esi + 0x37c]
mov eax, dword [esi + 0x378]
push 0
push 0
push 0x47a
call eax
add esp, 0x18
mov byte [esi + 0x844], bl
jmp 0x4043f1
push edi
xor edi, edi
cmp byte [esi + 0x844], 0
jne 0x404353
push dword [esi + 0x38c]
mov eax, edi
push dword [esi + 0x388]
cdq
push edx
push eax
call fcn.00488150
push 0
push 0x64
push edx
push eax
call fcn.004880a0
mov dword [esi + 0x3a0], eax
mov eax, dword [esi + 0x378]
mov dword [esi + 0x3a4], edx
test eax, eax
je 0x40433c
push dword [esi + 0x37c]
push 0
push 0
push 0x47b
call eax
add esp, 0x10
push 0xc8
add edi, 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x844], 0
je 0x4042f1
cmp dword [esi + 0x840], 0
pop edi
jl 0x404391
push dword [esi + 0x37c]
mov eax, dword [esi + 0x388]
mov dword [esi + 0x3a0], eax
mov eax, dword [esi + 0x38c]
push 0
mov dword [esi + 0x3a4], eax
mov eax, dword [esi + 0x378]
push 0
push 0x47b
call eax
add esp, 0x10
jmp 0x4043f3
cmp dword [esi + 0x378], 0
je 0x4043f3
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004866f0
push str._ERROR_Digital_Sign_validation_failed
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00401690
lea eax, [ebp - 0x20c]
push eax
call fcn.004010d0
push dword [esi + 0x37c]
mov eax, dword [esi + 0x378]
push 0
push 0
push 0x47a
call eax
add esp, 0x2c
xor ebx, ebx
mov eax, dword [esi + 0x378]
test eax, eax
je 0x404411
push dword [esi + 0x37c]
push 0
push 0
push 0x47e
call eax
add esp, 0x10
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00487c50
mov esp, ebp
pop ebp
ret