joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c202
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp + 0x198], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
mov esi, 0x104
push esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41c28e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41c269
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41c274
mov esi, 0x80004005
push esi
push 0x24e
push 0x44437e
call fcn.0043180e
push 0x444362
jmp 0x41c33c
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.0041c14a
mov esi, eax
cmp esi, edi
jge 0x41c2ac
push 0x44433c
jmp 0x41c33c
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x41c324
push dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push 0x444334
push eax
call fcn.004302dc
mov esi, eax
add esp, 0xc
cmp esi, edi
jge 0x41c2e2
push 0x44430a
jmp 0x41c33c
lea eax, [ebp - 0x7c]
push eax
push SysReAllocString
push dword [ebp - 0x74]
call fcn.0041c14a
mov esi, eax
cmp esi, edi
jge 0x41c300
push 0x4442de
jmp 0x41c33c
push dword [ebp - 0x7c]
mov esi, dword [ebp - 0x78]
push dword [ebp - 0x74]
sub esi, dword [ebp - 0x7c]
push dword [ebp - 0x7c]
lea eax, [ebp + esi*2 - 0x70]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41c324
mov dword [ebp - 0x78], esi
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.0042fd78
mov esi, eax
cmp esi, edi
jge 0x41c344
push 0x4442c2
push esi
call fcn.004317fa
pop ecx
pop ecx
cmp dword [ebp - 0x74], edi
je 0x41c351
push dword [ebp - 0x74]
call fcn.0042ee18
mov ecx, dword [ebp + 0x198]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00408498
add ebp, 0x19c
leave
ret
Function at 0x41f71c
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x41f780
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41f761
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41f76c
mov esi, 0x80004005
push esi
push 0x41
push 0x445b62
call fcn.0043180e
push 0x445c02
jmp 0x41f7e3
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x41f558
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x41f7ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41f7c6
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41f7d1
mov esi, 0x80004005
push esi
push 0x4a
push 0x445b62
call fcn.0043180e
push 0x445be6
push esi
call fcn.004317fa
pop ecx
pop ecx
jmp 0x41f7fc
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x41f80f
push dword [ebp - 8]
call esi
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
je 0x41f819
push dword [ebp - 0xc]
call esi
pop edi
pop esi
leave
ret 0xc

Function at 0x420954
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov esi, ecx
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4209ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4209ac
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x4209b7
mov esi, 0x80004005
push esi
push 0x435
push 0x44620e
call fcn.0043180e
push 0x4461e2
jmp 0x4209ef
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x43e92c
push edi
call fcn.004302dc
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x4209f7
push 0x4461a2
push esi
call fcn.004317fa
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00408498
leave
ret
Function at 0x420b02
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov ecx, 0x20000004
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x420b8f
lea eax, [ebp - 4]
push eax
push 0x1a
call fcn.00420a52
mov esi, eax
cmp esi, edi
jge 0x420b3a
push 0x4462e2
jmp 0x420b80
push 2
push 8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x420b8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x420b60
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x420b6b
mov esi, 0x80004005
push esi
push 0x570
push 0x44620e
call fcn.0043180e
push 0x4462c8
push esi
call fcn.004317fa
pop ecx
pop ecx
jmp 0x420bba
mov ecx, 0x20000005
push 0x7d0
push 3
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push ecx
push 1
push dword [ebp + 0xc]
call fcn.00436748
push 0x80
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 4], edi
je 0x420bc7
push dword [ebp - 4]
call fcn.00431b78
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x422146
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x4509f8]
xor eax, ebp
mov dword [ebp + 0x1dc], eax
push ebx
push esi
mov esi, dword [ebp + 0x1ec]
xor ebx, ebx
push 0x250
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.00408720
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x4030b4
push dword [ebp + 0x1e8]
call fcn.004207ce
test eax, eax
js 0x4221aa
push 7
push dword [ebp - 0x78]
call fcn.00435b68
cmp dword [ebp + 0x1e8], ebx
jne 0x422268
push edi
lea edi, [ebp - 0x78]
mov ecx, esi
call fcn.00420954
pop edi
test eax, eax
js 0x422268
lea eax, [ebp - 0x80]
push eax
push 0x4470ba
push dword [ebp - 0x78]
call fcn.00430b92
test eax, eax
js 0x422268
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x422268
test byte [ebp - 0x74], 0x10
jne 0x422252
xor eax, eax
mov word [ebp + 0x1be], ax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jbe 0x422236
push 0x2e
add eax, eax
pop ecx
cmp cx, word [ebp + eax - 0x4c]
jne 0x422236
movzx eax, word [ebp + eax - 0x4a]
push 0x52
pop ecx
cmp cx, ax
je 0x422252
push 0x72
pop ecx
cmp cx, ax
je 0x422252
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x78]
call fcn.00430b92
test eax, eax
js 0x422252
push dword [ebp - 0x7c]
call fcn.004352fc
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4221f7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x7c], ebx
je 0x422275
push dword [ebp - 0x7c]
call fcn.0042ee18
cmp dword [ebp - 0x80], ebx
je 0x422282
push dword [ebp - 0x80]
call fcn.0042ee18
cmp dword [ebp - 0x78], ebx
pop esi
pop ebx
je 0x422291
push dword [ebp - 0x78]
call fcn.0042ee18
mov ecx, dword [ebp + 0x1dc]
xor ecx, ebp
call fcn.00408498
add ebp, 0x1e0
leave
ret 8
Function at 0x429934
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov edi, 0x43b99e
cmp eax, ebx
je 0x429954
mov ecx, dword [eax]
jmp 0x429961
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x42995f
mov ecx, dword [ecx]
jmp 0x429961
mov ecx, edi
mov edx, dword [esi + 0xc]
test edx, edx
je 0x42996a
mov edi, dword [edx]
test eax, eax
je 0x42997c
xor eax, eax
test edx, edx
setne al
add eax, 0x20000150
jmp 0x42998b
mov eax, dword [esi + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [ebp + 8]
push 0x44abfa
push edi
push ecx
push eax
push 1
call fcn.0040c33a
add esp, 0x18
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.00434e54
test eax, eax
je 0x429a0f
test byte [ebp - 4], 1
je 0x429a0f
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x429a0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4299de
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x4299e9
mov ebx, 0x80004005
push ebx
push 0x4df
push 0x44aad2
call fcn.0043180e
push dword [ebp + 0xc]
push 0x44abbc
push ebx
call fcn.004317fa
add esp, 0xc
jmp 0x429a97
push 0
lea edi, [esi + 0x20]
push edi
push esi
push fcn.00429296
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x429a97
cmp dword [edi], ebx
je 0x429a54
mov esi, 0x80070642
push esi
push 0x4e9
push 0x44aad2
mov ebx, esi
call fcn.0043180e
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x44ab8c
push esi
jmp 0x429a8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x429a68
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x429a73
mov ebx, 0x80004005
push ebx
push 0x4ed
push 0x44aad2
call fcn.0043180e
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x44ab58
push ebx
call fcn.004317fa
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x429aa0
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebx + 4]
and dword [ebp - 4], 0
push esi
push edi
mov esi, 0x43b99e
test ecx, ecx
je 0x429abe
mov eax, dword [ecx]
jmp 0x429ac7
mov eax, dword [ebx + 8]
test eax, eax
je 0x429acc
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x429acf
mov dword [ebp - 8], esi
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x429add
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
jmp 0x429ae0
mov dword [ebp - 0xc], esi
lea esi, [ecx + 0x2c]
test ecx, ecx
jne 0x429b10
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x14]
lea esi, [edx + 0x40]
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
je 0x429b1b
xor eax, eax
test edx, edx
setne al
add eax, 0x20000150
jmp 0x429b2a
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x1c]
jmp 0x429af3
mov eax, dword [ebx + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [esi]
push 0x44ac30
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
push 1
call fcn.0040c33a
mov edi, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push edi
call fcn.00434e54
test eax, eax
je 0x429bb0
test byte [ebp - 4], 1
je 0x429bb0
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x429bb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x429b7f
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x429b8a
mov edi, 0x80004005
push edi
push 0x50d
push 0x44aad2
call fcn.0043180e
push dword [ebp + 8]
push 0x44abbc
push edi
call fcn.004317fa
add esp, 0xc
jmp 0x429c3f
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], fcn.00429296
mov dword [ebp - 0x18], ebx
mov eax, dword [esi]
push 0x62
pop ecx
cmp cx, word [eax]
jne 0x429c0d
push 0x69
pop ecx
cmp cx, word [eax + 2]
jne 0x429c0d
push 0x74
pop ecx
cmp cx, word [eax + 4]
jne 0x429c0d
push 0x73
pop ecx
cmp cx, word [eax + 6]
jne 0x429c0d
movzx ecx, word [eax + 8]
push 0x3a
pop edx
cmp dx, cx
je 0x429c00
push 0x73
pop edx
cmp dx, cx
jne 0x429c0d
push 0x3a
pop ecx
cmp cx, word [eax + 0xa]
jne 0x429c0d
push edi
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.0042e80e
jmp 0x429c26
push edi
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push dword [ebp - 0x14]
push esi
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
push dword [ebx]
call fcn.0042e066
mov edi, eax
test edi, edi
jns 0x429c3f
push dword [ebp + 8]
push dword [esi]
push 0x44ac00
push edi
call fcn.004317fa
add esp, 0x10
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x42d2ce
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, dword [esp + 0xc]
or dword [esi + 0x3c], 0xffffffff
push edi
xor ebx, ebx
push ebx
push dword [esp + 0x18]
lea eax, [esi + 0x1c]
push eax
call fcn.0042fd78
mov edi, eax
cmp edi, ebx
jge 0x42d2fb
push 0x44c114
jmp 0x42d3e0
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
jne 0x42d345
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d323
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d32e
mov edi, 0x80004005
push edi
push 0x78
push 0x44bce2
call fcn.0043180e
push 0x44c0ec
jmp 0x42d3e0
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x28], eax
cmp eax, ebx
jne 0x42d386
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d367
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d372
mov edi, 0x80004005
push edi
push 0x7b
push 0x44bce2
call fcn.0043180e
push 0x44c0c0
jmp 0x42d3e0
push ebx
push ebx
push esi
push 0x42d086
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x42d3d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d3b1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42d3bc
mov edi, 0x80004005
push edi
push 0x7f
push 0x44bce2
call fcn.0043180e
push 0x44c09c
jmp 0x42d3e0
call fcn.0042ca1c
mov edi, eax
cmp edi, ebx
jge 0x42d3e8
push 0x44c074
push edi
call fcn.004317fa
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
Function at 0x42d6a4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00420856
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x42d6e1
push dword [ebp + 8]
push 0x44c320
push eax
call fcn.004317fa
add esp, 0xc
jmp 0x42d795
mov eax, dword [ebp + 0xc]
push ebx
push 0x80
push 4
push ebx
push 4
push 0xc0000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x42d747
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d718
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d726
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd0
push 0x44c21a
call fcn.0043180e
mov eax, dword [ebp + 0xc]
push dword [eax]
push 0x44c2fe
push dword [ebp - 4]
jmp 0x42d6d4
push ebx
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [edi + esi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42d79e
add edi, dword [ebp - 8]
cmp dword [ebp - 8], ebx
je 0x42d770
cmp edi, 8
jb 0x42d747
cmp edi, 8
je 0x42d77a
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
or dword [ebp + 8], 0xffffffff
mov dword [eax], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x42d795
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d7b2
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d7c0
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd7
push 0x44c21a
call fcn.0043180e
mov eax, dword [ebp + 0xc]
push dword [eax]
push 0x44c2de
push dword [ebp - 4]
call fcn.004317fa
add esp, 0xc
jmp 0x42d786
Function at 0x42d7ea
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [esi + 4]
mov dword [ebp - 8], ebx
push dword [esi]
push dword [ebp + 0xc]
call fcn.0043558a
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x42d820
push 0x44c1aa
push eax
call fcn.004317fa
pop ecx
pop ecx
jmp 0x42d98d
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x42d906
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x42d98c
xor edi, edi
mov dword [ebp - 0xc], ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
sub eax, edi
push eax
mov eax, dword [ebp + 0x1c]
add eax, edi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42d944
add edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], ebx
je 0x42d87a
cmp edi, eax
jb 0x42d84c
add dword [esi], edi
adc dword [esi + 4], ebx
cmp dword [ebp + 0x10], 0xffffffff
je 0x42d8ce
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x10], ebx
call fcn.0043558a
cmp eax, ebx
jge 0x42d8a9
push 0x44c1aa
push eax
call fcn.004317fa
pop ecx
pop ecx
jmp 0x42d8ce
push ebx
lea eax, [ebp - 0x10]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [esi + edi*8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
je 0x42d8ce
cmp edi, 8
jb 0x42d8a9
mov eax, dword [ebp + 0x24]
cmp eax, ebx
je 0x42d8f8
cmp dword [eax], ebx
je 0x42d8f8
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [esi + 4]
push dword [esi]
push eax
call fcn.00421b98
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d97f
cmp dword [ebp - 8], ebx
jne 0x42d821
jmp 0x42d98c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d91a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d928
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1ad
push 0x44c21a
call fcn.0043180e
push 0x44c39a
push dword [ebp - 4]
jmp 0x42d985
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42d958
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42d966
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1b9
push 0x44c21a
call fcn.0043180e
push 0x44c376
jmp 0x42d93f
push 0x44c358
push eax
call fcn.004317fa
pop ecx
pop ecx
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x20
Function at 0x42db56
Capabilities:
Connect to http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x42db86
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x42db93
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x14]
push dword [eax]
call fcn.00437076
mov esi, eax
xor edx, edx
cmp esi, edx
jl 0x42dcc2
mov edi, dword [ebp + 0x24]
cmp edi, edx
je 0x42dbbb
mov ecx, edi
cmp word [edi], dx
jne 0x42dbbe
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0x20]
cmp esi, edx
je 0x42dbcc
mov eax, esi
cmp word [esi], dx
jne 0x42dbcf
mov eax, dword [ebp - 0x18]
push edx
push edx
xor edx, edx
cmp dword [ebp - 0x24], 1
setne dl
lea edx, [edx + edx + 1]
push edx
push ecx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
je 0x42dcd1
test esi, esi
je 0x42dc36
cmp word [esi], 0
je 0x42dc36
test edi, edi
je 0x42dc36
cmp word [edi], 0
je 0x42dc36
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
push eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0x2b
push ebx
call esi
test eax, eax
je 0x42dc36
push dword [ebp + 0x24]
call edi
push eax
push dword [ebp + 0x24]
push 0x2c
push ebx
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp + 0x18]
push ebx
call fcn.0042d478
mov esi, eax
test esi, esi
js 0x42dd0c
push dword [ebp + 0x30]
mov edi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042d996
mov esi, eax
test esi, esi
js 0x42dd18
cmp dword [ebp - 8], 0
jne 0x42db70
mov eax, dword [ebp + 0x28]
mov dword [eax], ebx
mov eax, dword [ebp + 0x2c]
xor ebx, ebx
and dword [ebp - 4], ebx
mov ecx, edi
mov dword [eax], ecx
lea eax, [ebp - 0x24]
push eax
call fcn.00436e40
cmp dword [ebp - 4], 0
je 0x42dcae
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x42dcb9
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x2c
push 0x44c46e
push esi
call fcn.004317fa
pop ecx
pop ecx
jmp 0x42dc96
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42dce5
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x42dcf0
mov esi, 0x80004005
push esi
push 0x213
push 0x44c21a
call fcn.0043180e
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44c450
jmp 0x42dd22
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44c42e
jmp 0x42dd22
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44c40a
push esi
call fcn.004317fa
add esp, 0xc
jmp 0x42dc96