joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10091420
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.10096dd0
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x1009145b
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.10096dd0
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x10097400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0xc], edx
push esi
xor edx, edx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 8]
cmp dword [eax + 0x14], edx
jle 0x100974bd
push ebx
mov eax, dword [eax + 0x10]
mov ebx, esi
xor ebx, 1
cmp esi, 2
cmovge ebx, esi
mov ecx, ebx
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
test edi, edi
je 0x10097482
mov eax, dword [eax + ecx*8]
sub edi, eax
movzx edx, byte [eax]
movzx ecx, byte [edi + eax]
cmp edx, ecx
jne 0x10097458
test edx, edx
je 0x10097482
inc eax
jmp 0x10097446
movzx ecx, byte [ecx + 0x101b71d0]
movzx edx, byte [edx + 0x101b71d0]
sub edx, ecx
jne 0x1009746d
inc eax
jmp 0x10097446
test ebx, ebx
jne 0x100974a1
mov edx, dword [ebp + 8]
mov ecx, str.main
call fcn.10054e00
test eax, eax
jne 0x100974a1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
push 0
lea ecx, [ecx + 0x18]
call fcn.10056320
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x100974b4
jmp 0x100974a4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
inc esi
mov edi, dword [ebp + 8]
cmp esi, dword [eax + 0x14]
jl 0x10097424
pop ebx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e0b40
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019239c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x101f62b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
xor eax, eax
mov word [edi], 0
mov byte [edi + 2], 0
mov dword [edi + 4], 0x20000
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 7
mov word [edi + 8], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], 7
mov word [edi + 0x38], ax
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], 7
mov word [edi + 0x50], ax
mov byte [ebp - 4], 3
lea esi, [edi + 0x84]
mov dword [edi + 0x68], 0x200000
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], eax
mov word [edi + 0x80], 0x100
push 0x40
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.1015c88b
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov byte [edi + 0x8c], 0
mov dword [edi + 0x90], 0x3c
mov word [edi + 0x94], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e2110
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
mov eax, ecx
mov ebx, edx
push 0x40000000
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100e2196
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x101fc26c]
mov dword [ebx], eax
test edi, edi
je 0x100e215b
cmp byte [0x101fc262], 0
jne 0x100e2166
call fcn.100e0c40
mov edi, dword [0x101fc26c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push dword [ebp - 4]
push str.Failed_to_open_the_file_handle_at__s._Error___d_
push 0x101ace0c
push edi
call dword [0x1019a4f8]
call esi
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101fc26c]
test eax, eax
je 0x100e21a8
cmp byte [0x101fc262], 0
jne 0x100e21b2
call fcn.100e0c40
mov eax, dword [0x101fc26c]
push dword [ebp + 0xc]
mov esi, dword [eax]
push dword [ebp + 8]
push str.file_size_to_which_we_have_to_extend_is__llu
mov esi, dword [esi + 4]
mov ecx, esi
push eax
call dword [0x1019a4f8]
call esi
add esp, 0x10
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x100e223e
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x100e2202
push edi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov ebx, dword [0x101fc26c]
test ebx, ebx
je 0x100e221d
cmp byte [0x101fc262], 0
jne 0x100e2228
call fcn.100e0c40
mov ebx, dword [0x101fc26c]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Failed_to_set_the_end_of_the_file_to_size__llu._Error____d
jmp 0x100e2278
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov ebx, dword [0x101fc26c]
test ebx, ebx
je 0x100e2259
cmp byte [0x101fc262], 0
jne 0x100e2264
call fcn.100e0c40
mov ebx, dword [0x101fc26c]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Failed_to_resize_the_file_to_size__ld._Error____d
mov esi, dword [esi + 0x24]
mov ecx, esi
push 0x101ace0c
push ebx
call dword [0x1019a4f8]
call esi
add esp, 0x18
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e22a0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100e22f5
mov edx, dword [0x101fc26c]
test edx, edx
je 0x100e22c8
cmp byte [0x101fc262], al
jne 0x100e22d3
call fcn.100e0c40
mov edx, dword [0x101fc26c]
mov eax, dword [edx]
push ebx
push str.File_does_not_exist_at__s
push edx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100e22ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x101fc26c]
mov dword [esi], eax
test edi, edi
je 0x100e231f
cmp byte [0x101fc262], 0
jne 0x100e232a
call fcn.100e0c40
mov edi, dword [0x101fc26c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 4]
mov ecx, esi
push eax
push ebx
push str.Failed_to_delete_file_at_path:_ls_error:_d
push edi
call dword [0x1019a4f8]
call esi
mov al, byte [ebp - 1]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e2360
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100e23a8
mov edx, dword [0x101fc26c]
test edx, edx
je 0x100e2380
cmp byte [0x101fc262], al
jne 0x100e238b
call fcn.100e0c40
mov edx, dword [0x101fc26c]
mov eax, dword [edx]
push esi
push str.File_does_not_exist_at__s
push edx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x100e23b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x100e241a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100e2423
mov edi, dword [0x101fc26c]
test edi, edi
je 0x100e23e8
cmp byte [0x101fc262], 0
jne 0x100e23f3
call fcn.100e0c40
mov edi, dword [0x101fc26c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push dword [ebp - 4]
push str.Failed_to_get_the_directory_attributes_for____s._Error_is__d.
push 0x101ace0c
push edi
call dword [0x1019a4f8]
call esi
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101fc26c]
test eax, eax
je 0x100e2435
cmp byte [0x101fc262], 0
jne 0x100e243f
call fcn.100e0c40
mov eax, dword [0x101fc26c]
mov esi, dword [eax]
push ebx
push edi
push str.The_file_attributes_of_directory____s_is__d
mov esi, dword [esi + 4]
mov ecx, esi
push eax
call dword [0x1019a4f8]
call esi
add esp, 0x10
shr ebx, 4
and bl, 1
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e6010
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101928e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101f62b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1015c88b
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1015ad74
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e8900
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018d710
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x101f62b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x24]
mov dword [edi], vtable.WorkerThread.0
test eax, eax
je 0x100e899f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test ebx, ebx
je 0x100e898f
mov ecx, dword [0x101fc26c]
test ecx, ecx
je 0x100e895d
cmp byte [0x101fc262], 0
jne 0x100e8968
call fcn.100e0c40
mov ecx, dword [0x101fc26c]
mov esi, dword [ecx]
push ebx
push dword [edi + 0x38]
mov esi, dword [esi + 0x14]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push ecx
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0x10
push 0
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x24], 0
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x3c
push edi
call fcn.1015cbd5
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100ea500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10192e14
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101f62b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 7
mov word [esi + 0x30], ax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
lea ecx, [esi + 0x50]
mov dword [ebp - 4], eax
call fcn.100efdb0
xor eax, eax
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 7
mov word [esi + 0x98], ax
mov byte [ebp - 4], 2
mov dword [esi], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ea7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x100ea838
mov ecx, dword [0x101fc26c]
test ecx, ecx
je 0x100ea810
cmp byte [0x101fc262], 0
jne 0x100ea81b
call fcn.100e0c40
mov ecx, dword [0x101fc26c]
mov eax, dword [ecx]
push str.file_handler_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 8
jmp 0x100ea922
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x100ea8bf
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 8]
push 0
push eax
push esi
push ebx
push dword [edi]
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
cmp dword [ebp - 8], esi
jb 0x100ea881
test ebx, ebx
jne 0x100ea913
mov dword [edi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [0x101fc26c]
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x100ea8a4
cmp byte [0x101fc262], 0
jne 0x100ea8af
call fcn.100e0c40
mov ebx, dword [0x101fc26c]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_write_data._Error_code____d
jmp 0x100ea8fb
mov dword [edi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [0x101fc26c]
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x100ea8e2
cmp byte [0x101fc262], 0
jne 0x100ea8ed
call fcn.100e0c40
mov ebx, dword [0x101fc26c]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.file_pointer_set_error____d
mov esi, dword [esi + 0x24]
mov ecx, esi
push 0x101ace0c
push ebx
call dword [0x1019a4f8]
call esi
add esp, 0x10
xor ebx, ebx
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 1
je 0x100ea946
push 0x41
push str.Failed_to_write_the_segment_in_the_file_which_is_to_be_downloaded
lea ecx, [edi + 0x30]
call fcn.10001d60
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100ea960
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x100ea9b8
mov ecx, dword [0x101fc26c]
test ecx, ecx
je 0x100ea990
cmp byte [0x101fc262], 0
jne 0x100ea99b
call fcn.100e0c40
mov ecx, dword [0x101fc26c]
mov eax, dword [ecx]
push str.file_handler_to_read_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 8
jmp 0x100eaac4
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x100eaa5d
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 8]
push 0
push eax
push esi
push ebx
push dword [edi]
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], esi
jb 0x100eaa06
test eax, eax
jne 0x100eaab3
mov dword [edi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [0x101fc26c]
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x100eaa29
cmp byte [0x101fc262], 0
jne 0x100eaa34
call fcn.100e0c40
mov ebx, dword [0x101fc26c]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push str.failed_to_read_data._Error_code____d
push 0x101ace0c
push ebx
call dword [0x1019a4f8]
call esi
mov esi, dword [ebp - 0xc]
add esp, 0x10
jmp 0x100eaab5
mov dword [edi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [0x101fc26c]
mov dword [edi + 0x28], eax
test ebx, ebx
je 0x100eaa80
cmp byte [0x101fc262], 0
jne 0x100eaa8b
call fcn.100e0c40
mov ebx, dword [0x101fc26c]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push str.file_pointer_set_error____d
push 0x101ace0c
push ebx
call dword [0x1019a4f8]
call esi
add esp, 0x10
xor esi, esi
jmp 0x100eaab5
mov esi, eax
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, 1
je 0x100eaae8
push 0x33
push str.Failed_to_read_the_segment_from_the_downloaded_file
lea ecx, [edi + 0x30]
call fcn.10001d60
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100ec580
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0xc], eax
mov edi, ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x24
jne 0x100ec5ce
cmp eax, 0x2f76
je 0x100ec5db
cmp eax, 0x7a
je 0x100ec5f0
push eax
mov ecx, edi
call fcn.100ebbe0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
test eax, eax
jne 0x100ec646
mov ecx, dword [0x101fc26c]
test ecx, ecx
je 0x100ec609
cmp byte [0x101fc262], al
jne 0x100ec614
call fcn.100e0c40
mov ecx, dword [0x101fc26c]
mov eax, dword [ecx]
push str.retrieveHeaderFromHttpRequest:_Zero_buffer_required....
push 0x101ace0c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
push 0x101fb180
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1015d891
mov esi, eax
add esp, 8
test esi, esi
jne 0x100ec6d2
mov ecx, dword [0x101fc26c]
test ecx, ecx
je 0x100ec67e
cmp byte [0x101fc262], al
jne 0x100ec689
call fcn.100e0c40
mov ecx, dword [0x101fc26c]
mov eax, dword [ecx]
push str.failed_to_allocate_memory
push 0x101ace0c
push ecx
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x1019a4f8]
call esi
sub esp, 0xc
mov ecx, esp
push str.Memory_Allocation_Failed
call fcn.10001cb0
push 0
push 0x14
mov ecx, edi
call fcn.100eba40
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 8]
push eax
push esi
push 0
push ebx
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x100ec718
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.100ebbe0
push esi
call fcn.1015c886
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
push esi
call fcn.10001c70
push esi
call fcn.1015c886
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.1015c875
mov esp, ebp
pop ebp
ret 8
Function at 0x100ec740
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
mov esi, ecx
push 0
push 0x16
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100ec7f5
mov eax, dword [ebp - 8]
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1015cbe3
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push 0
push eax
push edi
push 0
push 0x16
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x100ec7e8
mov ecx, dword [0x101fc26c]
test ecx, ecx
je 0x100ec7c4
cmp byte [0x101fc262], 0
jne 0x100ec7cf
call fcn.100e0c40
mov ecx, dword [0x101fc26c]
mov eax, dword [ecx]
push edi
push str.Header_contents:__n_s
push ecx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
test edi, edi
je 0x100ec7f5
push edi
call fcn.1015c886
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1015c875
mov esp, ebp
pop ebp
ret
Function at 0x100ed720
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x101f62b4]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [edi + 0x20], 0
je 0x100ed88f
cmp byte [edi + 0x28], 0
je 0x100ed88f
lea eax, [esp + 0x10]
mov dword [esi], 0
push eax
push dword [edi + 0xb0]
mov dword [esp + 0x18], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x100ed7dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.100ebbe0
mov edi, dword [0x101fc26c]
test edi, edi
je 0x100ed797
cmp byte [0x101fc262], 0
jne 0x100ed7a2
call fcn.100e0c40
mov edi, dword [0x101fc26c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push str.Error__d_in_WinHttpQueryDataAvailable._n
push 0x101ace0c
push edi
call dword [0x1019a4f8]
call esi
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x10]
cmp ecx, dword [ebp + 0x14]
cmova ecx, dword [ebp + 0x14]
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x100ed806
lea eax, [ecx + 2]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10
push ecx
push 0
push dword [ebx]
call fcn.10160450
add esp, 0xc
push esi
push dword [esp + 0x14]
push dword [ebx]
push dword [edi + 0xb0]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x100ed870
call fcn.100e0f20
push str.Error__u_in_WinHttpReadData._n
push 0x101ace0c
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.100ebbe0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
add eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x101fc26c]
test ecx, ecx
je 0x100ed8a2
cmp byte [0x101fc262], 0
jne 0x100ed8ad
call fcn.100e0c40
mov ecx, dword [0x101fc26c]
mov eax, dword [ecx]
push str.downloader_is_not_initialized
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1019a4f8]
call esi
sub esp, 0x10
xor eax, eax
mov ecx, esp
push eax
push 0x101ace0c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.10001d60
push 0
push 0x13
mov ecx, edi
call fcn.100eba40
mov ecx, dword [esp + 0x14]
mov eax, 3
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1015c875
mov esp, ebp
pop ebp
ret 0x10