joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438880
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x438260]
call fcn.004073fc
xor eax, eax
push ebp
push 0x4389d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00406b98
lea eax, [ebp - 0x1c]
xor edx, edx
call fcn.00406b98
lea eax, [ebp - 0x18]
xor edx, edx
call fcn.00406b98
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00406b98
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.00406b98
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406b98
mov ebx, 0xff
mov eax, ebx
call fcn.0040c764
mov esi, eax
mov eax, ebx
call fcn.0040c764
mov edi, eax
push ebx
push edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push esi
push 0x4389e0
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x43897e
lea ecx, [ebp - 4]
mov edx, 8
mov eax, dword [ebp - 0x2c]
call fcn.0040c0b0
lea eax, [ebp - 0x30]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004071c4
push dword [ebp - 0x30]
push 0x4389f4
lea eax, [ebp - 0x34]
push eax
mov ecx, 4
mov edx, 5
mov eax, dword [ebp - 4]
call fcn.004071c4
push dword [ebp - 0x34]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040703c
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406b98
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
mov ecx, dword [0x438260]
call fcn.00407658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4389d7
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00406b3c
lea eax, [ebp - 0x1c]
mov edx, dword [0x438260]
call fcn.004074d4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406b3c
ret

Function at 0x438d70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xef], 0x80
setne al
mov esp, ebp
pop ebp
ret

Function at 0x438d94
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xee], 0x80
setne al
mov esp, ebp
pop ebp
ret
Function at 0x438e54
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00406b2c
mov eax, dword [ebp - 8]
call fcn.00406b2c
mov eax, dword [ebp - 0xc]
call fcn.00406b2c
xor eax, eax
push ebp
push 0x438fea
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040e280
fstp qword [ebp - 0x18]
wait
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
push dword [ebp - 4]
push 0x43900c
push dword [ebp - 8]
push 0x43901c
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040703c
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.00404558
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], 7
xor eax, eax
push ebp
push 0x438fc8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406bd0
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406bd0
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x438fb2
mov esi, 0x102
jmp 0x438f60
call fcn.0040e280
fsub qword [ebp - 0x18]
fmul dword [0x439020]
fstp qword [ebp - 0x20]
wait
push 0x64
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov esi, eax
mov eax, dword [0x455d74]
cmp dword [eax], 0
je 0x438f60
mov eax, dword [0x455d74]
mov eax, dword [eax]
call fcn.00411bd0
cmp esi, 0x102
sete al
test al, bl
je 0x438f7c
mov dword [ebp - 0x7c], edi
fild dword [ebp - 0x7c]
fcomp qword [ebp - 0x20]
wait
fnstsw ax
sahf
ja 0x438f2b
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x24]
test eax, 0x80000000
je 0x438f9e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x438fba
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438fcf
ret
Function at 0x43cfb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
push 0x20a
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406d44
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445ddc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406b2c
xor eax, eax
push ebp
push 0x445e82
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 4]
mov edx, 0x445ea0
call fcn.0040715c
jne 0x445e60
mov eax, dword [ebx + 0x60]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x445e5c
inc edi
xor esi, esi
mov eax, dword [ebx + 0x60]
mov edx, esi
call fcn.0040b060
call fcn.004114b8
xor al, 1
push eax
mov eax, dword [ebx + 0x60]
mov edx, esi
call fcn.0040b060
pop edx
call fcn.00411518
inc esi
dec edi
jne 0x445e36
mov bl, 1
jmp 0x445e6c
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0044c0dc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445e89
lea eax, [ebp - 4]
call fcn.00406b34
ret
Function at 0x4029b0
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
xor edi, edi
push edi
call dword [0x42b350]
lea eax, [ebp - 0x10]
push eax
push 0x431978
push 1
push edi
push 0x431938
call dword [0x42b34c]
test eax, eax
je 0x4029e4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x431948
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x4029dc
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x402a9d
mov esi, dword [0x42b244]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 0x42b44c
push 0
push 0
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
js 0x402a79
mov eax, dword [ebp - 0xc]
mov ecx, 8
mov word [ebp - 0x28], cx
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0
lea ecx, [ebp - 0x28]
push ecx
push 0x43284c
push eax
call edx
test eax, eax
jne 0x402a6e
mov eax, dword [ebp - 0x20]
push eax
inc edi
call esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 8]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x402a28
call dword [0x42b348]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ed70
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040eb00
Function at 0x4158c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x48]
push eax
push 0
push esi
push 0x4156d0
push 0
push 0
call fcn.00418eb2
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x44], eax
pop esi
mov eax, ecx
ret

Function at 0x416fa0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x44]
push eax
push 0
push esi
push 0x416bd0
push 0
push 0
call fcn.00418eb2
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x40], eax
pop esi
mov eax, ecx
ret
Function at 0x408280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x408394
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub eax, 0xffffff80
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
lea esi, [ecx + 2]
sub ecx, eax
add ecx, 0xfffffffe
lea edx, [eax + 2]
mov dword [esp + 0x18], ecx
lea eax, [edi - 1]
mov dword [esp + 0x10], edx
shr eax, 3
inc eax
mov dword [esp + 0x14], eax
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
mov edx, ecx
mov ecx, dword [esp + 0x20]
call fcn.00407940
mov ecx, dword [ebp + 8]
lea esi, [esi + 8]
mov edx, dword [esp + 0x14]
add esp, 4
movzx eax, byte [ecx + 0x100]
mov ecx, dword [esp + 0x18]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp + 8]
mov dword [esp + 0x10], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [esp + 0x14], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [esp + 0x18]
jne 0x4082c5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411330
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x61f780], ecx
inc eax
cmp eax, 0x100
jb 0x411332
cmp eax, 0x800
jae 0x411403
nop
mov edx, dword [eax*4 + 0x61f380]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x61f780]
mov dword [eax*4 + 0x61f780], edx
inc eax
cmp eax, 0x800
jb 0x4113e0
mov dword [0x61accc], 0x4121a0
call fcn.00411fd0
mov ecx, dword [0x61accc]
test eax, eax
mov edx, 0x412240
cmove ecx, edx
mov dword [0x61accc], ecx
ret
Function at 0x412520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
xor ebx, ebx
and eax, 7
cmp ecx, 5
jae 0x412540
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
lea edx, [ecx - 4]
push esi
mov esi, dword [ebp + 8]
push edi
or edi, 0xffffffff
add edx, esi
mov dword [ebp - 4], edx
add esi, ebx
mov dword [ebp + 0xc], esi
cmp esi, edx
jae 0x412572
nop dword [eax]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x41256f
inc esi
cmp esi, edx
jb 0x412560
mov dword [ebp + 0xc], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x41269c
cmp ecx, 3
jbe 0x4125b2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x4125f0
cmp cl, 0xff
je 0x4125f0
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x412554
dec ecx
shl eax, cl
and eax, 7
je 0x41258a
movzx ecx, byte [eax + 0x593b1c]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x593b14], 0
mov cl, byte [edx + 4]
je 0x4125da
test cl, cl
je 0x4125da
cmp cl, 0xff
jne 0x41258a
mov edx, dword [ebp - 4]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x412554
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x41261e
lea edx, [edi + ebx]
add edx, esi
jmp 0x412624
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x412662
movzx edi, byte [eax + 0x593b1c]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x41264e
cmp cl, 0xff
jne 0x412662
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x412611
mov esi, dword [ebp + 0xc]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
dec cl
mov byte [esi + 1], dl
not cl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp - 4]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x412554
pop edi
pop esi
cmp ecx, 3
jbe 0x4126b1
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4155c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.00416a80
push dword [ebp + 0xc]
mov ecx, dword [esi + 8]
call fcn.00416a30
push dword [ebp + 0x10]
mov ecx, dword [esi + 8]
call fcn.00416ad0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x4155fc
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x415650
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x415640
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x415640
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x4159e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fd66
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x6160b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x638], esi
lea eax, [esi + 8]
mov dword [esi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], esi
jb 0x415a3a
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], ecx
cmp dword [esi + 0x34], 8
mov dword [ebp - 4], ecx
jb 0x415a57
mov eax, dword [esi + 0x20]
jmp 0x415a5a
lea eax, [esi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x415a74
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x415a8e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [esi + 0x68]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x415aa8
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov byte [ebp - 4], 4
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
call fcn.00437072
push eax
call fcn.004433fc
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00434140
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x415b67
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.00434140
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x415b58
test eax, eax
je 0x415b58
add eax, eax
cmp eax, 0x412
jae 0x415b53
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x415b5e
call fcn.00414c62
lea eax, [ebp - 0x220]
push eax
lea ecx, [esi + 0x20]
call fcn.00402c80
mov eax, dword [esi + 0x30]
test eax, eax
je 0x415b93
cmp dword [esi + 0x34], 8
jb 0x415b79
mov ecx, dword [esi + 0x20]
jmp 0x415b7c
lea ecx, [esi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x415b93
push 1
push 0x60dce0
lea ecx, [esi + 0x20]
call fcn.004034d0
cmp dword [esi + 0x30], 0
jne 0x415ba8
push 3
push 0x593c54
lea ecx, [esi + 0x20]
call fcn.00403020
mov dword [esi + 4], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004144d9
mov esp, ebp
pop ebp
ret
Function at 0x415bd0
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x60], 0
je 0x415bec
cmp dword [edi + 0x64], 8
lea eax, [edi + 0x50]
jb 0x415be5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x80]
test eax, eax
je 0x415c09
push eax
call fcn.004144ea
add esp, 4
mov dword [edi + 0x80], 0
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x68]
cmp eax, 8
jb 0x415c1f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00403340
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x415c35
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x50]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x415c50
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00403340
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x415c66
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x415c81
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00403340
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x415c97
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x415cb2
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00403340
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x415cc8
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x415ce2
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.00403340
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x415d01
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x417440
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
je 0x41747e
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 4
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41747e
mov eax, dword [ebp - 4]
xor edx, edx
mov esp, ebp
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret
Function at 0x41a9d6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
je 0x41aabb
call fcn.0041d04e
test al, al
je 0x41aa28
push ebx
push edx
pop esi
pop eax
pop ecx
pop esp
pop esi
pop esi
pop ebp
push esp
push edx
pop edi
pop eax
pop ebx
push edx
pop esi
push edi
push ecx
push esp
push eax
pop edx
mov ebx, dword [ebp - 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0041cb74
test al, al
je 0x41aa6b
pop eax
push esi
push edx
pop eax
push ebp
push edx
push edx
pop esp
pop ebp
pop esi
pop edx
push edi
push ebx
pop esi
push ebx
push eax
push edx
push ebp
push edx
pop edi
push edx
push ebp
push ebx
pop esi
push ebp
call fcn.0041cd12
test al, al
je 0x41aa87
push esi
pop ecx
push eax
pop ebp
push esi
push ecx
pop ebp
push edx
pop eax
push ebp
pop ecx
push esi
pop ebp
pop ebx
push edi
pop eax
push ecx
push esp
pop ecx
call fcn.0041d009
test al, al
je 0x41aaa8
push ebp
pop edx
pop eax
pop esp
pop ecx
pop ecx
push eax
push ebp
push edx
push edi
pop ecx
pop esp
push edi
push ebx
pop ebp
push ecx
pop edi
pop esp
pop esp
push esi
push ecx
push eax
pop esi
push edx
cmp dword [ebp - 8], 0
je 0x41aabb
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
jne 0x41aabb
xor eax, eax
inc eax
jmp 0x41aabd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret