joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9288
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x519220]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea esi, [edi + 0x238]
push ebx
mov ecx, esi
call fcn.0040fd90
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
push esi
mov esi, dword [ebp + 8]
push esi
mov eax, dword [eax + 0x18]
call eax
test al, al
jne 0x451899
cmp byte [edi + 0x354], al
je 0x45185f
add edi, 0x244
jmp 0x451865
mov edi, dword [edi + 0x240]
push 0x506244
mov ecx, esi
call fcn.004062d0
lea ecx, [edi + 4]
push ecx
push 0x50258c
push eax
call fcn.00405280
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x14], vtable.t_mutex::t_locker.0
mov dword [ebp - 0x10], 0
push ecx
push esi
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
call fcn.0043b210
test al, al
je 0x4519cb
lea eax, [edi + 4]
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [ebx + 0x11c], 0
lea eax, [ebx + 0xc]
jne 0x4518dd
mov eax, dword [ebx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45192f
shr eax, 4
not al
and al, 1
je 0x45192f
cmp byte [ebx + 0x11c], 0
lea eax, [ebx + 0xc]
jne 0x451904
mov eax, dword [ebx + 8]
push 0
push 0x80
push 3
push 0
push 3
push 4
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x234], eax
cmp eax, 0xffffffff
je 0x451962
mov bl, 1
jmp 0x451a02
cmp byte [ebx + 0x11c], 0
lea eax, [ebx + 0xc]
jne 0x45193e
mov eax, dword [ebx + 8]
push 0
push 0x80
push 1
push 0
push 3
push 4
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x234], eax
cmp eax, 0xffffffff
jne 0x4519a6
cmp byte [edi + 0x354], 0
je 0x451973
add edi, 0x244
jmp 0x451979
mov edi, dword [edi + 0x240]
mov ecx, esi
call fcn.00429910
push 0x506244
mov esi, eax
push 0x50258c
push esi
call fcn.00405280
lea ecx, [edi + 4]
push ecx
push 0x50258c
push esi
call fcn.00405280
add esp, 0x18
jmp 0x451a00
push 2
push 0x5099b0
push esi
mov ecx, edi
call fcn.00451f00
test al, al
jne 0x451928
push 0x50327c
mov ecx, esi
call fcn.004062d0
jmp 0x451a00
cmp byte [edi + 0x354], 0
je 0x4519dc
add edi, 0x244
jmp 0x4519e2
mov edi, dword [edi + 0x240]
push 0x506244
mov ecx, esi
call fcn.004062d0
lea ecx, [edi + 4]
push ecx
push 0x50258c
push eax
call fcn.00405280
add esp, 0xc
xor bl, bl
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x451a15
call fcn.0043b2c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x451f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
test esi, esi
je 0x451f41
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov eax, esi
sub eax, ebx
push eax
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
push dword [edi + 0x234]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x451f4c
add ebx, dword [ebp - 4]
cmp ebx, esi
jb 0x451f12
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [edi + 0x354], 0
lea eax, [edi + 0x244]
jne 0x451f61
mov eax, dword [edi + 0x240]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.00429910
push 0x505dd4
mov esi, eax
push 0x50258c
push esi
call fcn.00405280
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
push 0x50258c
push esi
call fcn.00405280
mov ecx, dword [ebp + 8]
add esp, 0x18
push 0x509970
call fcn.004062d0
push dword [ebp + 0x10]
mov esi, eax
push 0x50256c
push esi
call fcn.00405280
push 0x509984
push 0x50258c
push esi
call fcn.00405280
push ebx
push 0x50256c
push esi
call fcn.00405280
push 0x509994
push 0x50258c
push esi
call fcn.00405280
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x452330
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004520c0
add esp, 4
test eax, eax
js 0x45251c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x4523a4
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x452364
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x452517
lea esi, [ebx + 2]
nop dword [eax + eax]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x500c30]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x500330]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x500730]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x501c60]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x500c30]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x500330]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x500730]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x501c60]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x500c30]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x500330]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x500730]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x501c60]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + str.cc]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x500c30]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x500330]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x500730]
movzx eax, dl
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x501c60]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x4523c0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x460b60
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x51a7f8], 0
push esi
mov esi, edx
je 0x460bb5
push dword [0x51a800]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x460bb5
cmp dword [eax], 1
jbe 0x460bb5
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x460bb5
push 0
push 0x51c5cc
push 0x51c268
push 0
push eax
call fcn.004e49f1
mov ecx, eax
add esp, 0x14
test ecx, ecx
je 0x460bb5
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov byte [esi], al
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x461350
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9390
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x519220]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
push 0xc
mov dword [ebp - 4], 0
call fcn.0048ed6f
mov esi, eax
add esp, 4
mov dword [esi], 0
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4613c6
push eax
push esi
call fcn.0048ed9f
add esp, 8
push 0
push dword [edi + 4]
jmp 0x4613fd
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468c20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x468c2e
xor al, al
pop ebp
ret
push esi
push 0x4ed9a0
push eax
call fcn.0049cfd9
mov esi, eax
add esp, 8
test esi, esi
jne 0x468c48
xor al, al
pop esi
pop ebp
ret
push edi
push esi
call fcn.004af58e
push eax
call fcn.004afb9b
mov edi, eax
push edi
call fcn.004af1b3
add esp, 0xc
mov dword [0x52de3c], eax
push esi
test eax, eax
je 0x468c84
push edi
push 1
push eax
call fcn.004af79d
mov eax, dword [0x52de3c]
add esp, 0x10
cmp dword [eax], 0x504d444d
push esi
je 0x468c92
call fcn.0049cc86
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
ret
call fcn.0049cc86
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
ret

Function at 0x4697c0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x40
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [edi + 0x148]
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4697f0
sub edx, esi
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x469800
push dword [ebp - 0x30]
mov ecx, 0x64
sub eax, esi
push dword [ebp - 0x34]
sub ecx, edx
add edi, 0x148
push str.__I64d
push ecx
add eax, edi
push eax
call fcn.00427780
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x46ab10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push 0x4ed9a0
lea eax, [ebp - 4]
push esi
push eax
call fcn.0049cff0
add esp, 0xc
test eax, eax
je 0x46ab46
push eax
mov ecx, esi
call fcn.00469e80
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, eax
jne 0x46ab57
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
push edi
push eax
call fcn.004af58e
push eax
call fcn.004afb9b
mov edi, eax
add esp, 8
test edi, edi
jg 0x46ab80
push edi
mov ecx, esi
call fcn.00469e80
pop edi
mov eax, 3
pop esi
mov esp, ebp
pop ebp
ret
cdq
push 1
push edi
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], edx
call fcn.0049c7a6
add esp, 8
mov dword [esi + 0x104], eax
test eax, eax
jne 0x46abbc
push edi
mov ecx, esi
call fcn.00469e80
mov ecx, esi
call fcn.004697c0
pop edi
mov eax, 4
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push edi
push 1
push eax
call fcn.004af79d
push dword [ebp - 4]
call fcn.0049cc86
add esp, 0x14
mov ecx, esi
call fcn.0046a990
test eax, eax
jne 0x46ac11
mov ecx, esi
call fcn.0046ae20
test eax, eax
jne 0x46ac11
mov ecx, esi
call fcn.0046aa00
test eax, eax
jne 0x46ac11
mov ecx, esi
call fcn.0046ac20
test eax, eax
jne 0x46ac11
mov ecx, esi
call fcn.00469ed0
test eax, eax
jne 0x46ac11
mov ecx, esi
call fcn.0046aed0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46bc30
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x40
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea eax, [edi + 0x124]
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x46bc60
sub edx, esi
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46bc70
push dword [ebp - 0x30]
mov ecx, 0x64
sub eax, esi
push dword [ebp - 0x34]
sub ecx, edx
add edi, 0x124
push str.__I64d
push ecx
add eax, edi
push eax
call fcn.00427780
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x46c960
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5132e8
push 0x491a90
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x519220]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
push 0x4ed9a0
push esi
lea eax, [ebp - 0x1c]
push eax
call fcn.0049cff0
add esp, 0xc
test eax, eax
je 0x46c9d6
push 0
push eax
mov ecx, esi
call fcn.0046c5a0
mov eax, 6
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x46c9f4
mov eax, 5
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.004af58e
push eax
call fcn.004afb9b
add esp, 8
mov edi, eax
test edi, edi
jg 0x46ca2a
push 0
push edi
mov ecx, esi
call fcn.0046c5a0
mov eax, 7
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
push 1
push edi
call fcn.0049c7a6
add esp, 8
mov dword [esi + 0x104], eax
mov dword [ebp - 4], 0xfffffffe
test eax, eax
jne 0x46ca94
mov dword [ebp - 0x20], 0x3e7
lea eax, [ebp - 0x20]
push eax
call fcn.004afc62
add esp, 4
push 0
push edi
mov ecx, esi
call fcn.0046c5a0
mov ecx, esi
call fcn.0046bc30
push 1
push dword [ebp - 0x20]
mov ecx, esi
call fcn.0046c5a0
mov eax, 8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1c]
push edi
push 1
push eax
call fcn.004af79d
push dword [ebp - 0x1c]
call fcn.0049cc86
add esp, 0x14
mov ecx, esi
call fcn.0046c690
test eax, eax
jne 0x46cb09
mov ecx, esi
call fcn.0046cb20
test eax, eax
jne 0x46cb09
mov ecx, esi
call fcn.0046d390
test eax, eax
jne 0x46cb09
mov ecx, esi
call fcn.0046d1b0
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e860
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9d18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x46e9a6
cmp byte [ebx + 0x3d], 0
je 0x46e9a6
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x46e8b4
xor al, al
jmp 0x46e9a8
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00461fe0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
nop dword [eax]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x46e90f
sub eax, 1
je 0x46e913
mov edx, dword [ebp - 0x14]
sub eax, 2
mov eax, dword [ebp - 0x28]
je 0x46e969
xor bl, bl
jmp 0x46e96b
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae ecx, eax
sub esi, ecx
je 0x46e94b
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.0049d351
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
mov eax, dword [ebp - 0x28]
jne 0x46e90b
cmp byte [ebx + 0x3d], 0
je 0x46e969
test esi, esi
jne 0x46e8d0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00465aa0
jmp 0x46e8c7
mov bl, 1
cmp edx, 0x10
jb 0x46e99d
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x46e994
test al, 0x1f
jne 0x46e9a1
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x46e9a1
sub eax, ecx
cmp eax, 4
jb 0x46e9a1
cmp eax, 0x23
ja 0x46e9a1
mov eax, ecx
push eax
call fcn.0048ed6a
add esp, 4
mov al, bl
jmp 0x46e9a8
call fcn.0049c4f8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x470166
Capabilities:
Check http status code
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 4
pop eax
push 0x800
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x804]
push ecx
push eax
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], ecx
mov dword [ebx], ecx
call fcn.00491400
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004b0ab0
add esp, 0x14
xor eax, eax
push eax
push SysReAllocString
push eax
push eax
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x470261
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
lea eax, [ebp - 0x814]
push 0
push eax
lea eax, [ebp - 0x810]
push eax
push 0x20000013
push esi
call edi
test eax, eax
je 0x470261
cmp dword [ebp - 0x810], 0xc8
jne 0x470261
push 0
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0x20000005
push esi
call edi
test eax, eax
je 0x470261
mov eax, dword [ebp - 0x80c]
inc eax
push eax
call fcn.004af1b3
push dword [ebp - 0x80c]
mov dword [ebx], eax
push eax
push esi
call fcn.00471532
mov edi, eax
add esp, 0x10
test edi, edi
je 0x470267
mov ecx, dword [ebx]
mov byte [edi + ecx], 0
jmp 0x470277
mov edi, dword [ebp - 0x808]
cmp dword [ebx], 0
je 0x470277
push dword [ebx]
call fcn.0049c7b1
and dword [ebx], 0
pop ecx
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x470fe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, 0x104
push edi
push 0
push eax
call fcn.00491400
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x471025
xor al, al
jmp 0x471084
push 0x4ee54c
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0049c6ec
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00470f4b
add esp, 0x14
test al, al
je 0x471021
movzx eax, word [ebp - 0x10a]
push eax
movzx eax, word [ebp - 0x10c]
push eax
movzx eax, word [ebp - 0x10e]
push eax
movzx eax, word [ebp - 0x110]
push eax
push 0x4ee55c
push dword [ebp + 0xc]
push esi
call fcn.00427780
add esp, 0x1c
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret

Function at 0x471094
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 4], 0xbb8
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x47110e
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea eax, [ebp - 4]
push 4
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 8
push edi
call esi
push ebx
push 0x84200000
push ebx
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x47110a
mov bl, 1
push eax
call esi
push edi
call esi
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471532
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x471562
add esi, ecx
add ebx, ecx
sub edi, ecx
je 0x47156a
test eax, eax
je 0x47156a
test ecx, ecx
jne 0x471544
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4718f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
jne 0x4718fd
xor al, al
pop ebp
ret
mov dword [ebp + 0xc], 0x4ee92c
pop ebp
jmp fcn.00471930

Function at 0x471930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x100
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00491400
add esp, 0xc
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
push dword [ebp - 0x10c]
call fcn.00471910
add esp, 4
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4719b2
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], 0x100
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push esi
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x108]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4719a0
lea edx, [ebp - 0x104]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x471a05
sub edx, esi
lea eax, [ebp - 0x104]
push edx
push eax
mov ecx, edi
call fcn.00465d40
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret