joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54312c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406264
xor eax, eax
push ebp
push 0x5432c7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
xor edx, edx
call fcn.004062d0
xor eax, eax
push ebp
push 0x543198
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x423414]
call fcn.004291a8
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x543240
xor eax, eax
push ebp
push 0x543298
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00428f90
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00428cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54329f
mov eax, dword [ebp - 0x14]
call fcn.00403dbc
cmp dword [ebp - 8], 0
je 0x543297
mov eax, dword [ebp - 8]
call fcn.00406308
push eax
call sub.kernel32.dll_DeleteFileW
ret

Function at 0x5440e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406264
xor eax, eax
push ebp
push 0x5441bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x55bfec], ebx
mov dword [0x55bff0], esi
cmp dword [ebp - 4], 0
je 0x54419a
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x441eb8]
call fcn.00441f1c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x544193
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x5441d8
mov eax, dword [ebp - 8]
call fcn.00441ff8
mov edx, dword [ebp - 0xc]
mov eax, 0x55bfd8
call fcn.0040627c
lea ecx, [ebp - 0x10]
mov edx, 0x5441f8
mov eax, dword [ebp - 8]
call fcn.00441ff8
mov edx, dword [ebp - 0x10]
mov eax, 0x55bff4
call fcn.0040627c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54419a
mov eax, dword [ebp - 8]
call fcn.00403dbc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5441c4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406274
lea eax, [ebp - 4]
call fcn.0040626c
ret
Function at 0x461414
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x45d5a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x461432
push eax
call dword [fcn.0045d020]
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push dword [ebx + 0x88]
lea eax, [eax + ebx + 0x18]
push ebx
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], eax
call fcn.0045e9f5
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
je 0x4614f6
movzx eax, word [ebx + 6]
and dword [ebp - 0x14], 0
test eax, eax
push esi
push edi
jle 0x4614a1
mov edi, dword [ebp - 0x10]
push 2
pop ecx
lea esi, [ebp - 0xc]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x4614a1
add dword [ebp - 0x10], 0x28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x461486
cmp dword [ebp - 0x14], eax
je 0x4614f4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx + 0x34]
add edx, dword [eax + 0xc]
push 4
pop ecx
mov edi, 0x45eef8
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4614f4
push 4
pop ecx
mov edi, 0x45eef8
lea esi, [edx + 0x140]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4614f4
cmp dword [edx + 0x124], eax
je 0x4614e2
push 0x461294
jmp 0x4614e7
push 0x4613fc
push ebx
push dword [ebp - 0x18]
push edx
call fcn.0046106b
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004624ba
leave
ret
Function at 0x4ab0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov dx, word [eax]
shr dx, 1
push esi
movzx esi, dx
xor ecx, ecx
test si, si
push edi
mov word [esp + 8], 0x5c
mov word [esp + 0xa], 0x2f
mov word [esp + 0xc], 0x3a
mov word [esp + 0xe], 0x2a
mov word [esp + 0x10], 0x3f
mov word [esp + 0x12], 0x22
mov word [esp + 0x14], 0x3c
mov word [esp + 0x16], 0x3e
mov word [esp + 0x18], 0x7c
jbe 0x4ab137
mov edi, dword [eax + 4]
movzx edx, cx
movzx edx, word [edi + edx*2]
xor eax, eax
cmp dx, word [esp + eax*2 + 8]
je 0x4ab142
add eax, 1
cmp eax, 9
jb 0x4ab120
add ecx, 1
cmp cx, si
jb 0x4ab117
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x52b280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
xor eax, eax
test esi, esi
mov dword [esp], eax
je 0x52b2f9
mov ecx, dword [esi + 0x3c]
push ebx
push edi
mov edi, dword [ecx + esi + 0x78]
add edi, esi
xor ebx, ebx
cmp dword [edi + 0x18], eax
jbe 0x52b2f7
push ebp
mov ebp, dword [edi + 0x20]
add ebp, esi
mov eax, dword [ebp]
mov ecx, dword [esp + 0x14]
add eax, esi
test eax, 0xffff0000
je 0x52b2c1
test ecx, 0xffff0000
je 0x52b2c1
call fcn.0052b230
jmp 0x52b2ca
xor edx, edx
cmp eax, ecx
sete dl
mov eax, edx
test eax, eax
je 0x52b2e7
mov eax, dword [edi + 0x24]
lea ecx, [eax + ebx*2]
movzx edx, word [ecx + esi]
mov eax, dword [edi + 0x1c]
lea ecx, [eax + edx*4]
mov eax, dword [ecx + esi]
add eax, esi
mov dword [esp + 0xc], eax
add ebx, 1
add ebp, 4
cmp ebx, dword [edi + 0x18]
jb 0x52b2a2
mov eax, dword [esp + 0xc]
pop ebp
pop edi
pop ebx
pop ecx
ret
Function at 0x5363a0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
push esi
push edi
mov dword [ebx], 0x100da8e8
lea edi, [ebx + 4]
xor esi, esi
mov eax, 0x100
xor ecx, ecx
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], 0xff
call fcn.0053b3c0
mov dword [edi + 4], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [edi], eax
push 0x100d6cfc
lea esi, [esp + 0xc]
mov byte [eax], 0
mov dword [esp + 0x1c], 0x10000
mov dword [esp + 0x20], 0x100e1180
mov dword [esp + 0x24], 0x20000
mov dword [esp + 0x28], 0x100e1188
mov dword [esp + 0x2c], 0x100000
mov dword [esp + 0x30], 0x100e1198
mov dword [esp + 0x34], 0x40000
mov dword [esp + 0x38], 0x100e11a4
mov dword [esp + 0x3c], 0x80000
mov dword [esp + 0x40], 0x100e11b0
mov dword [esp + 0x44], 0x80000000
mov dword [esp + 0x48], 0x100e11bc
mov dword [esp + 0x4c], 0x40000000
mov dword [esp + 0x50], 0x100e11cc
mov dword [esp + 0x54], 0x20000000
mov dword [esp + 0x58], 0x100e11dc
mov dword [esp + 0x5c], 0x10000000
mov dword [esp + 0x60], 0x100e11ec
mov dword [esp + 0x64], 1
mov dword [esp + 0x68], 0x100e12bc
mov dword [esp + 0x6c], 2
mov dword [esp + 0x70], 0x100e12cc
mov dword [esp + 0x74], 4
mov dword [esp + 0x78], 0x100e12dc
mov dword [esp + 0x7c], 8
mov dword [esp + 0x80], 0x100e12f0
mov dword [esp + 0x84], 0x20
mov dword [esp + 0x88], 0x100e1308
mov dword [esp + 0x8c], 0x10
mov dword [esp + 0x90], 0x100e1318
mov dword [esp + 0x94], 0x200
mov dword [esp + 0x98], 0x100e1324
mov dword [esp + 0x9c], 0x100
mov dword [esp + 0xa0], 0x100e1334
call fcn.00475c60
mov eax, dword [esp + 8]
push eax
mov esi, edi
call fcn.00475c60
mov eax, dword [esp + 8]
test eax, eax
je 0x536537
call fcn.00472510
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + ecx*8 + 0x18]
test dword [ebp + 8], eax
je 0x536571
not eax
and dword [ebp + 8], eax
cmp dword [ebx + 8], 0
je 0x536561
push 0x100e12b0
mov esi, edi
call fcn.0052f5f0
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*8 + 0x1c]
push ecx
mov esi, edi
call fcn.0052f5f0
mov ecx, dword [esp + 0x14]
add ecx, 1
cmp ecx, 0x11
mov dword [esp + 0x14], ecx
jb 0x53653d
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x5365f7
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
push 0x100e12b4
lea esi, [esp + 0xc]
call fcn.00475c60
mov edx, dword [esp + 8]
push edx
mov esi, edi
call fcn.00475c60
mov esi, dword [esp + 8]
test esi, esi
je 0x53662f
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x11c]
call fcn.00532c00
mov eax, dword [0x100ef808]
push esi
push 1
push eax
call dword [0x100cf260]
cmp byte [esp + 0x134], 0
je 0x53662f
mov esi, dword [esp + 0x130]
call fcn.005154d0
mov eax, ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x53662f
push eax
lea ecx, [esp + 0x1c]
push 0x100d46fc
push ecx
call dword [0x100cf2ec]
add esp, 0xc
cmp dword [ebx + 8], esi
je 0x536623
push 0x100e12b0
mov esi, edi
call fcn.0052f5f0
lea edx, [esp + 0x18]
push edx
mov esi, edi
call fcn.0052f5f0
pop edi
mov eax, ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x536950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
push esi
push edi
mov dword [ebx], 0x100da8e8
lea edi, [ebx + 4]
xor esi, esi
mov eax, 0x100
xor ecx, ecx
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], 0xff
call fcn.0053b3c0
mov dword [edi + 4], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [edi], eax
push 0x100d6cfc
lea esi, [esp + 0xc]
mov byte [eax], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x100e13d8
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x28], 0x100e13ec
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 0x100e1404
mov dword [esp + 0x34], 4
mov dword [esp + 0x38], 0x100e1418
mov dword [esp + 0x3c], 0x800
mov dword [esp + 0x40], 0x100e1430
mov dword [esp + 0x44], 8
mov dword [esp + 0x48], 0x100e1444
mov dword [esp + 0x4c], 0x10
mov dword [esp + 0x50], 0x100e1464
mov dword [esp + 0x54], 0x20
mov dword [esp + 0x58], 0x100e1480
mov dword [esp + 0x5c], 0x80
mov dword [esp + 0x60], 0x100e14a0
mov dword [esp + 0x64], 0x100
mov dword [esp + 0x68], 0x100e14bc
mov dword [esp + 0x6c], 0x200
mov dword [esp + 0x70], 0x100e14d8
mov dword [esp + 0x74], 0x1000
mov dword [esp + 0x78], 0x100e14f0
mov dword [esp + 0x7c], 0x2000
mov dword [esp + 0x80], 0x100e1508
mov dword [esp + 0x84], 0x4000
mov dword [esp + 0x88], 0x100e1520
call fcn.00475c60
mov eax, dword [esp + 8]
push eax
mov esi, edi
call fcn.00475c60
mov eax, dword [esp + 8]
test eax, eax
je 0x536aa5
call fcn.00472510
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + ecx*8 + 0x18]
test dword [ebp + 8], eax
je 0x536adf
not eax
and dword [ebp + 8], eax
cmp dword [ebx + 8], 0
je 0x536acf
push 0x100e12b0
mov esi, edi
call fcn.0052f5f0
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*8 + 0x1c]
push ecx
mov esi, edi
call fcn.0052f5f0
mov ecx, dword [esp + 0x14]
add ecx, 1
cmp ecx, 0xe
mov dword [esp + 0x14], ecx
jb 0x536aab
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x536b69
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
push 0x100e12b4
lea esi, [esp + 0xc]
call fcn.00475c60
mov edx, dword [esp + 8]
push edx
mov esi, edi
call fcn.00475c60
mov esi, dword [esp + 8]
test esi, esi
je 0x536ba7
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x8c]
call fcn.00532c00
mov eax, dword [0x100ef808]
push esi
push 1
push eax
call dword [0x100cf260]
cmp byte [esp + 0xa4], 0
je 0x536ba7
mov esi, dword [esp + 0xa0]
call fcn.005154d0
mov eax, ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x536ba7
push eax
lea ecx, [esp + 0xac]
push 0x100d46fc
push ecx
call dword [0x100cf2ec]
add esp, 0xc
cmp dword [ebx + 8], esi
je 0x536b98
push 0x100e12b0
mov esi, edi
call fcn.0052f5f0
lea edx, [esp + 0xa8]
push edx
mov esi, edi
call fcn.0052f5f0
pop edi
mov eax, ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x536bc0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi], 0x100da8e8
add edi, 4
xor esi, esi
mov eax, 0x100
xor ecx, ecx
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], 0xff
call fcn.0053b3c0
mov dword [edi + 4], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [edi], eax
push 0x100d6cfc
lea esi, [esp + 0x10]
mov byte [eax], 0
mov dword [esp + 0x1c], 0x10000
mov dword [esp + 0x20], 0x100e1180
mov dword [esp + 0x24], 0x20000
mov dword [esp + 0x28], 0x100e1188
mov dword [esp + 0x2c], 0x100000
mov dword [esp + 0x30], 0x100e1198
mov dword [esp + 0x34], 0x40000
mov dword [esp + 0x38], 0x100e11a4
mov dword [esp + 0x3c], 0x80000
mov dword [esp + 0x40], 0x100e11b0
mov dword [esp + 0x44], 0x80000000
mov dword [esp + 0x48], 0x100e11bc
mov dword [esp + 0x4c], 0x40000000
mov dword [esp + 0x50], 0x100e11cc
mov dword [esp + 0x54], 0x20000000
mov dword [esp + 0x58], 0x100e11dc
mov dword [esp + 0x5c], 0x10000000
mov dword [esp + 0x60], 0x100e11ec
mov dword [esp + 0x64], 0x10
mov dword [esp + 0x68], 0x100e153c
mov dword [esp + 0x6c], 8
mov dword [esp + 0x70], 0x100e1550
mov dword [esp + 0x74], 4
mov dword [esp + 0x78], 0x100e1564
mov dword [esp + 0x7c], 2
mov dword [esp + 0x80], 0x100e1578
mov dword [esp + 0x84], 1
mov dword [esp + 0x88], 0x100e158c
call fcn.00475c60
mov ebx, dword [esp + 0xc]
push ebx
mov esi, edi
call fcn.00475c60
test ebx, ebx
je 0x536d17
mov eax, ebx
call fcn.00472510
xor ebx, ebx
lea esp, [esp]
mov eax, dword [esp + ebx*8 + 0x18]
test dword [ebp + 0xc], eax
je 0x536d4f
not eax
and dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x536d43
push 0x100e12b0
mov esi, edi
call fcn.0052f5f0
mov ecx, dword [esp + ebx*8 + 0x1c]
push ecx
mov esi, edi
call fcn.0052f5f0
add ebx, 1
cmp ebx, 0xe
jb 0x536d20
mov ebx, dword [ebp + 8]
xor esi, esi
cmp dword [ebx + 8], esi
jne 0x536dd3
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
push 0x100e12b4
lea esi, [esp + 0x10]
call fcn.00475c60
mov ebx, dword [esp + 0xc]
push ebx
mov esi, edi
call fcn.00475c60
test ebx, ebx
je 0x536dc7
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x8c]
call fcn.00532c00
mov edx, dword [0x100ef808]
push ebx
push 1
push edx
call dword [0x100cf260]
cmp byte [esp + 0xa4], 0
je 0x536dc7
mov esi, dword [esp + 0xa0]
call fcn.005154d0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x536e11
push eax
lea eax, [esp + 0xac]
push 0x100d46fc
push eax
call dword [0x100cf2ec]
add esp, 0xc
cmp dword [ebx + 8], esi
je 0x536e02
push 0x100e12b0
mov esi, edi
call fcn.0052f5f0
lea ecx, [esp + 0xa8]
push ecx
mov esi, edi
call fcn.0052f5f0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53fe90
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [edx + 0x14]
push ebx
push esi
movzx esi, word [edx + 6]
xor ecx, ecx
test si, si
lea eax, [eax + edx + 0x18]
jbe 0x53fec0
mov edx, dword [eax + 0xc]
cmp edx, edi
ja 0x53feb5
mov ebx, dword [eax + 8]
add ebx, edx
cmp ebx, edi
ja 0x53fec2
add ecx, 1
add eax, 0x28
cmp cx, si
jb 0x53fea5
xor eax, eax
pop esi
pop ebx
ret
Function at 0x4051f8
Capabilities:
Delete file

Disassembly:
push 0x5c
mov eax, 0x433a01
call fcn.00428df5
mov esi, ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
and dword [ebp - 4], 0
lea eax, [esi + 0x100]
cmp dword [eax + 0x18], 8
jb 0x405227
mov eax, dword [eax + 4]
jmp 0x40522a
add eax, 4
cmp dword [esi + 0x6c], 8
jb 0x405235
mov ebx, dword [esi + 0x58]
jmp 0x405238
lea ebx, [esi + 0x58]
cmp dword [esi + 0x50], 8
jb 0x405243
mov edi, dword [esi + 0x3c]
jmp 0x405246
lea edi, [esi + 0x3c]
push eax
lea esi, [ebp - 0x30]
call fcn.00415571
pop ecx
lea eax, [ebp - 0x68]
push eax
call fcn.00406a25
push 0xa4
mov byte [ebp - 4], 1
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
mov edi, str.StartupPatch
test eax, eax
je 0x405283
push 0
push edi
push eax
call fcn.0040650a
jmp 0x405285
xor eax, eax
mov ebx, dword [ebp - 0x34]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
mov dword [ebx + 0x1bc], eax
mov eax, dword [ebp - 0x2c]
jae 0x40529e
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x68]
call fcn.00406ad9
test al, al
je 0x4052f3
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x4052bf
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x4052f3
cmp dword [eax + 0x48], 0x10
jb 0x4052d1
mov eax, dword [eax + 0x34]
jmp 0x4052d4
add eax, 0x34
mov esi, eax
push 0xd
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4052f3
mov esi, dword [ebx + 0x1bc]
call fcn.00403166
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0x1bc], eax
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4052ff
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0
call fcn.00406a82
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
call fcn.00428e78
ret
Function at 0x4062c5
Capabilities:
Copy file

Disassembly:
push 0x74
mov eax, 0x431d56
call fcn.00428df5
lea eax, [ebp - 0x80]
push eax
mov ebx, ecx
call fcn.004171f2
and dword [ebp - 4], 0
mov esi, dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push ebx
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 3
call esi
mov ecx, dword [ebp - 0x44]
add esp, 0xc
cmp dword [ebp - 0x30], 8
jae 0x406326
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x406332
lea eax, [ebp - 0x28]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea ecx, [ebp - 0x48]
setne bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
call fcn.00428e78
ret

Function at 0x406935
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x4332f7
call fcn.00428df5
mov eax, dword [ebp + 8]
push 0x438f98
push eax
call dword [sym.imp.MSVCR90.dll__wfopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40695c
xor al, al
jmp 0x4069a5
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.004037f3
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40697f
lea eax, [ebp - 0x28]
push esi
push dword [ebp - 0x18]
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
or dword [ebp - 4], 0xffffffff
add esp, 0x14
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
call fcn.00428e78
ret 4
Function at 0x406ad9
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x4004]
mov eax, 0x4004
call fcn.00428eb0
push 0xffffffffffffffff
push 0x433424
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x445bbc]
xor eax, ebp
mov dword [ebp + 0x4000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x400c]
mov edi, ecx
push 0x438fa0
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov byte [ebp - 0xd], 1
call dword [sym.imp.MSVCR90.dll__wfopen]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x406b43
xor al, al
jmp 0x406be8
add edi, 4
call fcn.00406c0d
mov esi, dword [sym.imp.MSVCR90.dll_feof]
push ebx
call esi
pop ecx
test eax, eax
jne 0x406b91
cmp byte [ebp - 0xd], 0
je 0x406bdd
push ebx
push 0x4000
lea eax, [ebp]
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
push 0
lea ecx, [ebp]
push ecx
push edi
call fcn.00406c4d
push ebx
mov byte [ebp - 0xd], al
call esi
pop ecx
test eax, eax
je 0x406b59
cmp byte [ebp - 0xd], 0
je 0x406bdd
mov edi, dword [ebp - 0x14]
xor esi, esi
cmp dword [edi + 0x20], esi
je 0x406bdd
push 0x48
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x406bb5
push eax
call fcn.0040354c
mov esi, eax
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x10]
call dword [0x43436c]
mov edi, dword [edi + 0x20]
mov eax, esi
mov ecx, edi
call fcn.00407526
push edi
call fcn.0040711b
pop ecx
call fcn.00403166
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
mov al, byte [ebp - 0xd]
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4000]
xor ecx, ebp
call fcn.00428868
add ebp, 0x4004
leave
ret 4
Function at 0x40a86c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x445bbc]
xor eax, esp
mov dword [esp + 0x19c], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
mov dword [esp + 0xc], eax
cmp byte [esi + 0x24], bl
jne 0x40a902
lea edi, [esi + 0x28]
mov ecx, edi
call fcn.0041508a
push str.DownloadRecord.xml
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [edi + 0x18], 8
jb 0x40a8b8
mov edi, dword [edi + 4]
jmp 0x40a8bb
add edi, 4
push edi
push esi
call fcn.0040b13f
cmp dword [esp + 0xc], ebx
je 0x40a8d5
push dword [esp + 0xc]
lea ecx, [esi + 0x44]
call dword [0x43436c]
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov byte [esi + 0x24], 1
mov ecx, dword [esp + 0x1a4]
pop edi
pop ebx
xor ecx, esp
call fcn.00428868
mov esp, ebp
pop ebp
ret 4