joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b2c2
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x4e7384]
push ebx
xor ebx, ebx
cmp dword [0x4ec12c], ebx
push esi
mov dword [ebp + 0x1b0], eax
push edi
jne 0x49b433
xor eax, eax
mov word [ebp - 0x58], bx
mov ecx, 0x81
lea edi, [ebp - 0x56]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x1c8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x78], edi
je 0x49b389
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x49b474
cmp eax, 0x40
jbe 0x49b474
push ebx
push eax
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, ebx
mov dword [ebp - 0x64], eax
je 0x49b474
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
jne 0x49b390
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
jmp 0x49b45e
mov eax, dword [esi + 0x3c]
and dword [ebp - 0x60], 0
lea ebx, [eax + esi + 4]
xor eax, eax
lea edi, [ebp - 0x72]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x5c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x74]
push eax
mov word [ebp - 0x74], 0x7b2
mov word [ebp - 0x72], 1
mov word [ebp - 0x6e], 1
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x60]
mov edi, dword [ebp - 0x5c]
mov edx, 0x989680
mul edx
add ecx, eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
adc edi, edx
push eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x74]
mov dword [0x4ec12c], eax
movzx eax, word [ebp - 0x72]
mov dword [0x4ec128], eax
movzx eax, word [ebp - 0x6e]
push esi
mov dword [0x4ec124], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x78]
call esi
mov eax, dword [ebp + 0x1bc]
mov ecx, dword [0x4ec12c]
mov dword [eax], ecx
mov eax, dword [0x4ec128]
mov ecx, dword [ebp + 0x1c0]
mov dword [ecx], eax
mov eax, dword [0x4ec124]
mov ecx, dword [ebp + 0x1c4]
mov dword [ecx], eax
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1b0]
pop edi
pop esi
pop ebx
call fcn.004c2215
add ebp, 0x1b4
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49b389
Function at 0x49be6f
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4e7384]
push esi
xor esi, esi
mov dword [ebp + 0x18c], eax
mov dword [ebp - 0x80], esi
mov eax, dword [0x4e9150]
push esi
mov dword [ebp - 0x80], eax
push 0x26
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x49bed8
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x7c]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x49bed8
push str.Program_Files
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
call fcn.00402ec3
mov esi, dword [ebp + 0x198]
lea ecx, [ebp - 0x80]
call fcn.00402de7
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff4
cmp eax, dword [0x4e9154]
pop esi
je 0x49bf07
push eax
call fcn.004013aa
mov ecx, dword [ebp + 0x18c]
mov eax, dword [ebp + 0x198]
call fcn.004c2215
add ebp, 0x190
leave
ret

Function at 0x49bf83
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword [0x4e9150]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jle 0x49bfc3
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 4]
call fcn.00402f4f
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, esi
lea ecx, [ebp - 4]
call fcn.00402f7b
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00402de7
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
cmp eax, dword [0x4e9154]
pop esi
je 0x49bfe3
push eax
call fcn.004013aa
mov eax, dword [ebp + 8]
leave
ret

Function at 0x49c1fe
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
push ebp
push ebp
push 0x1037
push edi
call esi
mov ebx, 0x100
or eax, ebx
push eax
push ebp
push 0x1036
push edi
call esi
mov esi, dword [sym.imp.COMCTL32.dll_FlatSB_SetScrollProp]
push ebp
push 0xd
push 8
push edi
call esi
push ebp
push 0xd
push 1
push edi
call esi
push ebp
push 0xd
push 2
push edi
call esi
push ebp
push 0xd
push 4
push edi
call esi
inc ebp
push ebp
push ebp
push 0x200
push edi
call esi
push ebp
push ebp
push ebx
push edi
call esi
pop esi
pop ebp
pop ebx
ret
Function at 0x49c753
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov eax, 0x1014
lea ebp, [esp - 0xf94]
call fcn.004c2440
mov eax, dword [0x4e7384]
push ebx
push esi
mov dword [ebp + 0xf90], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
xor ebx, ebx
push ebx
xor esi, esi
push str.SOFTWAREMicrosoftInternet_Explorer
inc esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49c82c
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.Version
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49c823
lea eax, [ebp - 0x70]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_wcschr]
cmp eax, ebx
pop ecx
pop ecx
je 0x49c820
mov word [eax], bx
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
cmp eax, 5
pop ecx
jl 0x49c81c
mov eax, dword [ebp + 0xf9c]
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push edi
push 4
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
push 0x49
push ebx
call esi
push 4
mov edi, eax
lea eax, [ebp - 0x78]
push eax
push 0x4a
push ebx
call esi
and edi, eax
pop edi
je 0x49c81c
mov esi, dword [ebp + 0xf9c]
jmp 0x49c823
push 2
jmp 0x49c822
push 4
pop esi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xf90]
mov eax, esi
pop esi
pop ebx
call fcn.004c2215
add ebp, 0xf94
leave
ret

Function at 0x49e1e1
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, eax
call fcn.0049dc65
push dword [esp + 0x14]
lea eax, [edi + 0x14]
call fcn.004030ca
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49e226
mov dword [edi + 0x24], 2
xor al, al
jmp 0x49e295
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push esi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, eax
call esi
cmp ebp, ebx
jne 0x49e25a
mov dword [edi + 0x24], 2
xor al, al
jmp 0x49e294
push dword [esp + 0x18]
push ebx
push ebx
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebp
mov dword [esp + 0x14], eax
call esi
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x49e24f
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
call fcn.0049ee0c
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
cmp dword [edi + 0x24], ebx
sete al
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x49e29c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov ebx, eax
je 0x49e2b8
push dword [ebp + 8]
lea eax, [ebx + 0x14]
call fcn.004030ca
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x49e2dc
xor al, al
jmp 0x49e343
mov esi, 0x4d4f00
push 0x2000
mov dword [ebp - 0x14], esi
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [ebp - 8], 0x2000
call dword [eax + 8]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov al, bl
pop esi
pop ebx
leave
ret 8

Function at 0x49fb52
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x20], 0
je 0x49fb66
cmp dword [esi + 0x14], 0
je 0x49fb66
call fcn.0040db70
mov ecx, esi
call fcn.0049fa67
push edx
push eax
push esi
call fcn.0040daad
mov ecx, eax
and ecx, edx
cmp ecx, 0xffffffff
jne 0x49fb82
xor eax, eax
pop esi
ret
push dword [esi]
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
ret
Function at 0x49fc9d
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
mov ebx, ecx
je 0x49fd6f
cmp dword [esi], 0x18
jne 0x49fd6f
push edi
push dword [esi + 8]
lea edi, [ebp - 4]
call fcn.00402e10
mov eax, dword [esi + 4]
mov edi, dword [ebp - 4]
xor ecx, ecx
cmp eax, ecx
jne 0x49fcdd
push 0x10000000
push ecx
push ecx
push 1
jmp 0x49fd50
cmp eax, 1
je 0x49fd48
cmp dword [edi - 8], ecx
je 0x49fd48
push dword [esi + 0x10]
lea eax, [ebx + 0x18]
call fcn.00402ec3
push dword [esi + 0x14]
lea eax, [ebx + 0x1c]
call fcn.00402ec3
push dword [esi + 0xc]
mov eax, dword [0x4e9150]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.httphttp:___s:_d
push eax
call fcn.00405c38
mov esi, dword [ebp - 4]
add esp, 0x10
push 0x10000000
push str._local_
push esi
push 3
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx], eax
lea eax, [esi - 0xc]
cmp eax, dword [0x4e9154]
je 0x49fd5b
push eax
call fcn.004013aa
jmp 0x49fd5b
push 0x10000000
push ecx
push ecx
push ecx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx], eax
lea eax, [edi - 0xc]
cmp eax, dword [0x4e9154]
pop edi
je 0x49fd82
push eax
call fcn.004013aa
jmp 0x49fd82
push 0x10000000
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx], eax
mov ebx, dword [ebx]
test ebx, ebx
jne 0x49fd8c
xor eax, eax
jmp 0x49fda2
push 0x4a013d
push ebx
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebx
leave
ret 4
Function at 0x4a05b8
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
lea esi, [ebx + 0x70]
mov dword [ebx + 0x6c], edi
call fcn.0040dcb2
mov eax, dword [ebx + 0x74]
cmp eax, edi
je 0x4a05f2
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
cmp eax, edi
pop ecx
mov dword [ebx + 0x78], eax
jne 0x4a05e9
mov eax, 0x8007000e
jmp 0x4a0658
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], edi
push edi
lea ecx, [ebx + 4]
mov eax, 0x4ebc68
call fcn.0049fc9d
test eax, eax
jne 0x4a060b
mov eax, 0x80004014
jmp 0x4a0658
push dword [ebp + 0xc]
mov dword [ebx + 0x64], edi
push dword [ebp + 8]
mov dword [ebx + 0x68], edi
xor edi, edi
mov esi, ebx
call fcn.004a07c6
test eax, eax
jl 0x4a0658
and dword [ebp - 4], edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea esi, [ebx + 0x64]
push esi
push 0x20000005
push dword [ebx + 0x5c]
mov dword [ebp - 8], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, 0x7ffbff9b
add eax, 0x80040065
pop edi
pop esi
leave
ret 8

Function at 0x4a0919
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [esi + 0x68]
mov ecx, dword [esi + 0x64]
push edi
lea edi, [edx + eax]
cmp edi, ecx
jb 0x4a0930
sub ecx, edx
mov eax, ecx
xor edi, edi
cmp eax, edi
je 0x4a098c
mov ecx, dword [ebp + 8]
push edi
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
push 1
lea eax, [esi + 0x34]
push eax
push dword [esi + 0x5c]
mov dword [esi + 0x48], ecx
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x4a0990
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4a098c
push dword [ebp + 0xc]
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 8]
push eax
xor eax, eax
cmp ebx, edi
setne al
mov dword [ebp - 4], ebx
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x4a098c
cmp dword [esi + 0x4c], edi
jne 0x4a0990
xor eax, eax
jmp 0x4a0996
mov eax, dword [esi + 0x4c]
add dword [esi + 0x68], eax
pop edi
leave
ret 8
Function at 0x4a5026
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4e7384]
and dword [ebp - 0x20], 0
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x18]
push 0
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
call fcn.00401603
mov eax, dword [ebp - 0x18]
mov eax, dword [eax - 8]
cdq
sub eax, edx
pop ecx
mov esi, eax
pop ecx
lea eax, [ebp - 0x14]
push eax
lea edi, [ebp + 0xc]
sar esi, 1
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x29
mov byte [ebp - 0xb], 0x25
mov byte [ebp - 0xa], 0x21
mov byte [ebp - 9], 0x24
mov byte [ebp - 8], 0
call fcn.004077c4
jmp 0x4a50a9
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0041a2fd
mov eax, dword [ebp + 0xc]
cmp dword [eax - 8], esi
jl 0x4a509c
mov eax, esi
lea ecx, [ebp + 0xc]
call fcn.0040311a
mov eax, dword [0x4e9150]
mov dword [ebp - 0x1c], eax
lea eax, [esi + 1]
lea ecx, [ebp - 0x1c]
call fcn.004030ee
lea edi, [esi - 1]
test edi, edi
jl 0x4a5122
mov ecx, eax
sub ecx, edi
lea ecx, [ecx + esi - 1]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x18]
mov al, byte [eax + edi*2]
call fcn.0049b23a
mov bl, al
mov eax, dword [ebp - 0x18]
mov al, byte [eax + edi*2 + 1]
call fcn.0049b23a
test bl, bl
jl 0x4a5122
test al, al
jl 0x4a5122
mov ecx, dword [ebp - 0x20]
shl bl, 4
add bl, al
mov eax, dword [ebp - 0x24]
xor bl, byte [ecx + eax]
dec edi
mov byte [eax], bl
inc eax
test edi, edi
mov dword [ebp - 0x24], eax
jge 0x4a50e8
mov eax, esi
lea ecx, [ebp - 0x1c]
call fcn.0040311a
push ecx
lea ecx, [ebp - 0x1c]
mov esi, esp
mov dword [ebp - 0x20], esp
call fcn.0040308d
lea eax, [ebp - 0x28]
push eax
call fcn.004a1b0b
mov eax, dword [ebp - 0x28]
push 0
push dword [ebp + 8]
call fcn.00406406
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff4
add esp, 0x10
cmp eax, dword [0x4e9154]
je 0x4a5167
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff4
cmp eax, dword [0x4e9154]
je 0x4a517b
push eax
call fcn.004013aa
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff4
cmp eax, dword [0x4e9154]
je 0x4a518f
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff4
cmp eax, dword [0x4e9154]
je 0x4a51a3
push eax
call fcn.004013aa
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004c2215
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4a7c47
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
test byte [edi + 0x10], 1
push ebx
push esi
jne 0x4a7cbf
call dword [0x4e91a8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4a7c74
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4a7cac
mov esi, dword [edi + 4]
test esi, esi
jne 0x4a7c7f
xor eax, eax
jmp 0x4a7ca5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.004c2440
mov eax, esp
push dword [ebp - 4]
push ebx
push esi
mov esi, eax
call fcn.004a7bc8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4a7cbf
test al, 1
je 0x4a7cbb
and dword [edi + 0x10], 0xfffffffb
jmp 0x4a7cbf
or dword [edi + 0x10], 4
mov eax, dword [edi + 0x10]
lea esp, [ebp - 0xc]
pop esi
pop ebx
leave
ret
Function at 0x4acdcf
Capabilities:
Create directory

Disassembly:
mov eax, 0x4c4172
call fcn.004c2540
sub esp, 0x31c
mov eax, dword [0x4e7384]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x4acdf8
xor eax, eax
jmp 0x4acf5a
test edx, edx
je 0x4ace08
cmp word [edx], 0
je 0x4ace08
push edx
call fcn.00402ec3
push ebx
push esi
push edi
lea eax, [ebp - 0x2c4]
call fcn.0049e1cd
and dword [ebp - 4], 0
push 0x4cc280
push 0x4cc278
push 0x4cc274
lea esi, [ebp - 0x328]
call fcn.0049e575
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 1
call fcn.0049dca2
push 0x4d66d8
lea edi, [ebp - 0x2fc]
call fcn.0049ddf6
push 0xa
lea eax, [ebp - 0x90]
push eax
push 3
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCRT.dll__itoa]
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
push str.version
mov ebx, edi
call fcn.0049dedd
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0049dca2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2c4]
push eax
mov ecx, esi
call fcn.004ad2c6
mov eax, dword [esi]
lea ecx, [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x298]
push ecx
push 0x104
xor ebx, ebx
push eax
mov dword [ebp - 0x29c], ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [ebp - 0x29c]
cmp eax, ebx
je 0x4acee7
mov word [eax], bx
push ebx
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ebx
push ecx
call fcn.00401603
pop ecx
pop ecx
mov byte [ebp - 4], 3
mov eax, dword [eax]
push ebx
push eax
lea eax, [ebp - 0x2c4]
call fcn.0049e29c
movzx esi, al
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
cmp eax, dword [0x4e9154]
je 0x4acf1f
push eax
call fcn.004013aa
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 1
call fcn.0049de45
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], bl
call fcn.004017ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 0x4cbfe4
call fcn.0049dc36
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004c2215
leave
ret 4
Function at 0x4b1306
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
je 0x4b1326
cmp word [eax], 0
je 0x4b1326
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b1326
and al, 0x10
sub al, 0x10
neg al
sbb eax, eax
inc eax
ret
xor eax, eax
ret

Function at 0x4b1654
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000013
push dword [esi + 0x34]
mov dword [ebp - 8], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x4b1682
leave
ret
cmp dword [ebp - 4], 0x197
push edi
jne 0x4b16d2
cmp dword [esi + 0x40], 0
jne 0x4b171b
mov eax, dword [esi + 0x24]
mov ecx, dword [eax - 8]
test ecx, ecx
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
je 0x4b16b3
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 0x2b
push dword [esi + 0x34]
call edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4b16ca
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 0x2c
push dword [esi + 0x34]
call edi
xor eax, eax
inc eax
mov dword [esi + 0x40], eax
jmp 0x4b1722
cmp dword [ebp - 4], 0x191
jne 0x4b1712
cmp dword [esi + 0x40], 0
jne 0x4b171b
mov eax, dword [esi + 0x24]
mov ecx, dword [eax - 8]
test ecx, ecx
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
je 0x4b16fe
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 0x1c
push dword [esi + 0x34]
call edi
mov eax, dword [esi + 0x28]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4b16ca
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 0x1d
jmp 0x4b16c5
cmp dword [ebp - 4], 0x190
jb 0x4b171f
xor eax, eax
jmp 0x4b1722
push 2
pop eax
pop edi
leave
ret
Function at 0x4b1a16
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov eax, 0x2494
lea ebp, [esp - 0x2414]
call fcn.004c2440
mov eax, dword [0x4e7384]
push ebx
xor ebx, ebx
cmp dword [edi + 0x34], ebx
mov dword [ebp + 0x2410], eax
push esi
jne 0x4b1af6
push 0x10000000
push ebx
lea esi, [ebp - 0x78]
call fcn.00417677
mov eax, dword [edi + 0x20]
push 0x10000000
push eax
mov eax, esi
call fcn.004176d8
test eax, eax
je 0x4b1b77
push ebx
push ebx
push 3
push dword [ebp - 0x54]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x68]
push dword [edi + 0x2c]
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
mov dword [edi + 0x30], eax
je 0x4b1b77
lea eax, [ebp - 0x80]
push eax
mov eax, esi
call fcn.00417740
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
call fcn.004177a4
mov esi, dword [esi]
mov eax, dword [eax]
lea ecx, [edi + 0x44]
push ecx
push 0x84400200
push ebx
push esi
push ebx
push eax
push 0x4cfd8c
push dword [edi + 0x30]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 0x34], eax
mov eax, dword [ebp - 0x7c]
add eax, 0xfffffff4
cmp eax, dword [0x4e9154]
je 0x4b1ad9
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff4
cmp eax, dword [0x4e9154]
je 0x4b1aed
push eax
call fcn.004013aa
cmp dword [edi + 0x34], ebx
je 0x4b1b77
mov eax, dword [0x4e9150]
mov dword [ebp - 0x7c], eax
mov eax, dword [edi + 0x6c]
mov ecx, dword [eax + 0xc]
add ecx, dword [eax + 4]
lea eax, [ebp - 0x7c]
push ecx
push str.Range:_bytes_u__r_n
push eax
call fcn.00405c38
mov esi, dword [ebp - 0x7c]
mov eax, dword [esi - 8]
add esp, 0xc
push ebx
push ebx
push eax
push esi
push dword [edi + 0x34]
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4b1b46
lea eax, [esi - 0xc]
cmp eax, dword [0x4e9154]
je 0x4b1b41
push eax
call fcn.004013aa
push 2
pop eax
jmp 0x4b1b79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
lea eax, [esi - 0xc]
jne 0x4b1b69
cmp eax, dword [0x4e9154]
je 0x4b1b64
push eax
call fcn.004013aa
xor eax, eax
inc eax
jmp 0x4b1b79
cmp eax, dword [0x4e9154]
je 0x4b1b77
push eax
call fcn.004013aa
xor eax, eax
mov ecx, dword [ebp + 0x2410]
pop esi
pop ebx
call fcn.004c2215
add ebp, 0x2414
leave
ret