joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443a36
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043a9e9
xor ebx, ebx
cmp dword [0x4687b4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x443b0b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x443a76
xor eax, eax
jmp 0x443bcf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x456d20
push edi
call esi
cmp eax, ebx
je 0x443a6f
push eax
call fcn.0043a986
mov dword [esp], 0x456d10
push edi
mov dword [0x4687b4], eax
call esi
push eax
call fcn.0043a986
mov dword [esp], 0x456cfc
push edi
mov dword [0x4687b8], eax
call esi
push eax
call fcn.0043a986
mov dword [0x4687bc], eax
lea eax, [ebp - 8]
push eax
call fcn.0043264e
test eax, eax
pop ecx
pop ecx
je 0x443ad9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00433c05
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x443b0b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043a986
cmp eax, ebx
pop ecx
mov dword [0x4687c4], eax
je 0x443b0b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043a986
pop ecx
mov dword [0x4687c0], eax
mov eax, dword [0x4687c0]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x443b84
cmp dword [0x4687c4], esi
je 0x443b84
push eax
call fcn.0043a9f2
pop ecx
call eax
cmp eax, ebx
je 0x443b51
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4687c4]
call fcn.0043a9f2
pop ecx
call eax
test eax, eax
je 0x443b51
test byte [ebp - 0x18], 1
jne 0x443b84
lea eax, [ebp - 0xc]
push eax
call fcn.00432685
test eax, eax
pop ecx
je 0x443b6c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00433c05
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x443b7b
or dword [ebp + 0x10], 0x200000
jmp 0x443bb5
or dword [ebp + 0x10], 0x40000
jmp 0x443bb5
mov eax, dword [0x4687b8]
cmp eax, esi
je 0x443bb5
push eax
call fcn.0043a9f2
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x443bb5
mov eax, dword [0x4687bc]
cmp eax, esi
je 0x443bb5
push dword [ebp - 4]
push eax
call fcn.0043a9f2
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4687b4]
call fcn.0043a9f2
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4486e0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46488c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00448675
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00431260
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x44872f
cmp dword [ebp - 0x1c], 5
jb 0x448747
jmp 0x448743
cmp dword [ebp - 0x10], 1
jne 0x448747
cmp dword [ebp - 0x1c], 4
ja 0x448743
jne 0x448747
cmp dword [ebp - 0x18], 0
jbe 0x448747
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x457ed8
call fcn.00448566
test eax, eax
jge 0x448768
mov byte [0x465cc4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00431081
add ebp, 0x78
leave
ret
Function at 0x46f00d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x46f03b
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x46f042
cmp ebx, dword [eax + 4]
jae 0x46f042
xor eax, eax
jmp 0x46f232
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x46f053
xor eax, eax
inc eax
jmp 0x46f231
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x46f069
cmp ecx, edx
jae 0x46f1ae
cmp dword [eax + 4], 0
je 0x46f072
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x46f05a
cmp dword [ebp + 8], 0
je 0x46f094
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x46f1ae
cmp eax, esi
jae 0x46f1ae
mov eax, dword [0x10009d28]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x46f0b9
cmp dword [esi*4 + 0x10009d30], edi
je 0x46f1b2
inc esi
cmp esi, eax
jl 0x46f0a7
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x100070bc]
test eax, eax
je 0x46f22e
cmp dword [ebp - 8], 0x1000000
jne 0x46f22e
test byte [ebp - 0xc], 0xcc
je 0x46f137
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x46f22e
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x46f22e
cmp word [eax + 0x18], 0x10b
jne 0x46f22e
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x46f22e
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x46f137
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x46f137
test byte [ecx + 0x27], 0x80
jne 0x46f1ae
push 1
push 0x10009d70
call dword [0x100070b8]
test eax, eax
jne 0x46f04b
mov ecx, dword [0x10009d28]
test ecx, ecx
mov edx, ecx
jle 0x46f16b
lea eax, [ecx*4 + 0x10009d2c]
cmp dword [eax], edi
je 0x46f16b
dec edx
sub eax, 4
test edx, edx
jg 0x46f15f
test edx, edx
jne 0x46f19c
push 0xf
pop ebx
cmp ecx, ebx
jg 0x46f178
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x46f190
lea eax, [edx*4 + 0x10009d30]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x46f17e
cmp ecx, 0x10
jge 0x46f19c
inc ecx
mov dword [0x10009d28], ecx
push 0
push 0x10009d70
call dword [0x100070b8]
jmp 0x46f04b
xor eax, eax
jmp 0x46f231
test esi, esi
jle 0x46f04b
mov ebx, dword [0x100070b8]
push 1
push 0x10009d70
call ebx
test eax, eax
jne 0x46f04b
cmp dword [esi*4 + 0x10009d30], edi
je 0x46f208
mov eax, dword [0x10009d28]
lea esi, [eax - 1]
test esi, esi
jl 0x46f1f6
cmp dword [esi*4 + 0x10009d30], edi
je 0x46f1f2
dec esi
jns 0x46f1e6
test esi, esi
jge 0x46f206
cmp eax, 0x10
jge 0x46f201
inc eax
mov dword [0x10009d28], eax
lea esi, [eax - 1]
jmp 0x46f208
je 0x46f220
xor ecx, ecx
test esi, esi
jl 0x46f220
lea eax, [ecx*4 + 0x10009d30]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x46f20e
push 0
push 0x10009d70
call ebx
jmp 0x46f04b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6242f2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x624329
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x624303
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x6242fe
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x62435a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x62433c
pop edi
not eax
pop esi
ret 0xc

Function at 0x6a2d3e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x6a2d75
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x6a2d4f
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x6a2d4a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x6a2da6
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x6a2d88
pop edi
not eax
pop esi
ret 0xc
Function at 0x4015a1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov al, byte [esi + 0x34]
test al, al
jne 0x4015b3
xor al, al
jmp 0x401603
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4015d3
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x2c], 0
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x4014c9
push 0
push 0
mov byte [esi + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x4015fa
mov byte [esi + 0x34], 1
jmp 0x4015af
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
pop esi
leave
ret
Function at 0x4096a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x4096ce
cmp eax, edi
jge 0x4096c6
mov eax, esi
call fcn.00409067
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edi, dword [esi + 8]
xor ecx, ecx
test edi, edi
jle 0x4096fb
mov eax, dword [esi + 0xc]
push ebx
mov dl, byte [esi + 0xc]
sub edi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, edi
inc ecx
mov dword [esi + 0xc], eax
test ebx, ebx
jg 0x4096db
mov dword [esi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x40971a
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x409708
xor eax, eax
jmp 0x409710
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x4096fe
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x40974c
mov eax, str.zlib_corrupt
call fcn.0040693f
jmp 0x409787
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x40975c
mov eax, str.read_past_buffer
jmp 0x409745
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x409771
mov ecx, edi
call fcn.0040909d
test eax, eax
je 0x409787
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004418a0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x40e5a1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x40e5af
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x40e66a
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x45a2f0]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x45a2f0]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x45a2f0]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x45a2f0]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x45a2f0]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x45a2f0]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x45a2f0]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x45a2f0]
add edx, 8
sub edi, 8
dec esi
jne 0x40e5cd
pop ebx
test edi, edi
je 0x40e683
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x45a2f0]
inc edx
dec edi
jne 0x40e66e
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x40eb30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x40eb64
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40eb5f
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x40eb8c
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x40eb75
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.004418a0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x40f9ae
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x46d1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40fa56
movzx ecx, word [esi]
test cx, cx
je 0x40fa56
mov eax, esi
mov edx, esi
cmp cx, 0x2f
je 0x40f9e9
cmp cx, 0x5c
jne 0x40f9eb
mov eax, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x40f9dd
cmp eax, esi
je 0x40fa2a
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00444d5a
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0040f9ae
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00444d39
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00444d08
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00442145
leave
ret

Function at 0x410f83
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x410ffe
cmp dword [esi + 4], 0xffffffff
jne 0x410ffe
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x45a8ec
push edi
call fcn.00444d08
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x410fd0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x410fd0
mov eax, 0x2000000
jmp 0x411003
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040e93d
add esp, 0x10
test eax, eax
jne 0x410fee
mov eax, dword [ebp + 0x10]
jmp 0x411003
push eax
call fcn.00410b72
mov dword [esi], eax
mov eax, dword [0x46e7d8]
pop ecx
jmp 0x411003
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x411635
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x46d1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x418], eax
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00442260
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00442260
add esp, 0x18
test edi, edi
je 0x411752
xor eax, eax
cmp ax, word [edi]
je 0x411752
push ebx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00444d5a
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call fcn.00444be7
add esp, 0x10
test eax, eax
jle 0x4116ef
push 0x5c
lea eax, [ebp + esi*2 - 0x20c]
pop ecx
cmp cx, word [eax]
jne 0x4116dd
push 0x2f
pop ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
inc esi
call fcn.00444be7
pop ecx
cmp esi, eax
jl 0x4116c8
push 0x2f
lea eax, [ebp - 0x20c]
push eax
jmp 0x41173f
lea eax, [ebp - 0x20c]
cmp esi, eax
je 0x411739
movzx edi, word [esi]
xor eax, eax
mov word [esi], ax
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00444d5a
add esp, 0xc
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esi], di
add esi, 2
push 0x2f
push esi
call fcn.00444ed4
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4116fa
xor eax, eax
inc eax
pop ebx
jmp 0x411754
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00442145
leave
ret 8

Function at 0x41338c
Capabilities:
Create http request

Disassembly:
push 0x18
mov eax, 0x454f97
call fcn.00442154
mov dword [ebp - 0x20], ecx
xor esi, esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
xor edi, edi
add eax, 0xfffffff0
inc edi
push eax
mov dword [ebp - 4], edi
call fcn.004124f0
mov ebx, dword [ebp + 8]
add eax, 0x10
pop ecx
mov dword [ebx], eax
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, esi
je 0x413459
push 4
lea eax, [ebp - 0x14]
push eax
push 2
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push esi
push 0x80200000
push esi
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
cmp edi, esi
je 0x413450
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
cmp eax, esi
je 0x413449
mov ecx, dword [ebp - 0x20]
push 0x21
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.004132f9
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0041304e
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004115db
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004115db
mov eax, ebx
call fcn.0044222c
ret 8
Function at 0x413672
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x1c
mov eax, 0x455017
call fcn.00442154
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 8]
xor eax, eax
inc eax
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov dword [ebp - 4], eax
mov byte [edi], bl
push ebx
push ebx
push ebx
push eax
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, ebx
je 0x413772
push 4
lea eax, [ebp - 0x20]
push eax
push 2
push esi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push ebx
push 0x102
push ebx
push ebx
push dword [ebp + 0xc]
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x413769
mov esi, 0x100000
push esi
mov dword [ebp - 0x14], ebx
call fcn.004166bb
push esi
push ebx
push eax
mov dword [ebp - 0x10], eax
call fcn.00442260
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x413757
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x413757
lea esi, [eax + 1]
push esi
mov dword [ebp - 0x24], eax
call fcn.004166bb
push esi
mov edi, eax
push ebx
push edi
call fcn.00442260
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push edi
call fcn.004418a0
add esp, 0x1c
cmp edi, ebx
je 0x413754
push edi
call fcn.00443cb0
pop ecx
mov ecx, dword [ebp + 8]
push eax
push edi
call fcn.0040372c
mov edi, dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.004440a1
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x28]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004115db
mov eax, edi
call fcn.0044222c
ret
Function at 0x413785
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45503a
mov eax, dword fs:[0]
push eax
mov eax, 0x2f24
call fcn.00444800
mov eax, dword [0x46d1b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x2ef4], ecx
lea eax, [ebp - 0xfb0]
mov dword [ebp - 0x2f2c], eax
lea eax, [ebp - 0x1780]
mov dword [ebp - 0x2f20], eax
lea eax, [ebp - 0x1f50]
mov dword [ebp - 0x2f14], eax
lea eax, [ebp - 0x2ef0]
mov dword [ebp - 0x2f0c], eax
lea eax, [ebp - 0x7e0]
mov dword [ebp - 0x2f04], eax
lea eax, [ebp - 0x2720]
mov dword [ebp - 0x2efc], eax
mov eax, 0x3e8
mov dword [ebp - 0x2f28], eax
mov dword [ebp - 0x2f1c], eax
mov dword [ebp - 0x2f10], eax
mov dword [ebp - 0x2f08], eax
mov dword [ebp - 0x2f00], eax
mov dword [ebp - 0x2ef8], eax
lea eax, [ebp - 0x2f30]
push eax
push ecx
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x2f30], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
lea eax, [ebp - 0x7e0]
push eax
mov ecx, esi
call fcn.0041346e
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004115db
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00442145
leave
ret 8

Function at 0x413c4f
Capabilities:
Check if file exists
Download url
Receive data

Disassembly:
push 0x2a0
mov eax, 0x455083
call fcn.004421bd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x29c]
xor edi, edi
push eax
mov esi, ecx
mov dword [ebp - 0x2a0], edi
call fcn.00417493
pop ecx
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00416aac
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0041346e
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 2
call fcn.00416a92
lea ecx, [esi + 0x918]
call fcn.00416aac
push ecx
mov ecx, esp
mov dword [ebp - 0x2ac], esp
push eax
call fcn.0041346e
lea eax, [ebp - 0x2a4]
push eax
mov ecx, esi
call fcn.00413785
push 0x45a8ec
push 0x45b1b0
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 3
call fcn.00412eaa
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.00442260
add esp, 0xc
push dword [ebp - 0x2a0]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x2a4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413d63
push edi
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00411635
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x918]
call fcn.00416aac
push eax
push edi
call sub.urlmon.dll_URLDownloadToFileW
mov ecx, dword [ebp - 0x2a8]
lea eax, [ebp - 0x218]
push eax
call fcn.0041346e
mov ecx, dword [ebp - 0x2a4]
add ecx, 0xfffffff0
call fcn.004115db
mov ecx, dword [ebp - 0x2a0]
add ecx, 0xfffffff0
call fcn.004115db
mov eax, dword [ebp - 0x2a8]
call fcn.00442240
ret 4