joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4212d6
Capabilities:
Check if file exists
Delete directory
Delete file
Set current directory

Disassembly:
mov eax, 0x467422
call fcn.00452544
sub esp, 0x30
push ebx
push esi
push edi
mov esi, str.fs::ClearTemp_433
mov dword [ebp - 0x10], esp
push esi
call fcn.004508dd
mov dword [ebp - 0x18], eax
push esi
xor edi, edi
push 0x474efc
push edi
mov dword [ebp - 4], edi
call fcn.00441366
mov ebx, dword [ebp + 8]
add ebx, 0x44
add esp, 0x10
push ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea esi, [ebx + 0x18]
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
je 0x421367
cmp dword [edi + 0x18], 0x10
jb 0x421338
mov eax, dword [edi + 4]
jmp 0x42133b
lea eax, [edi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42135f
cmp dword [edi + 0x18], 0x10
jb 0x421351
mov eax, dword [edi + 4]
jmp 0x421354
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x421362
inc dword [ebp - 0x14]
add edi, 0x1c
jmp 0x421328
mov eax, esi
call fcn.0042d734
push eax
push dword [ebp - 0x14]
xor edi, edi
push str.__remove__d__d_files
push edi
call fcn.00441366
add esp, 0x10
call fcn.004167d1
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp byte [ebp + 0xc], 0
jne 0x421405
mov esi, dword [ebp + 8]
cmp dword [esi + 0x3c], edi
je 0x421405
lea eax, [ebp - 0x3c]
push eax
call fcn.00421fbf
cmp dword [eax + 0x18], 0x10
pop ecx
jb 0x4213b5
mov eax, dword [eax + 4]
jmp 0x4213b8
add eax, 4
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
push edi
push 1
lea ecx, [ebp - 0x3c]
call fcn.0041b05c
add esi, 0x28
cmp dword [esi + 0x18], 0x10
jb 0x4213d8
mov eax, dword [esi + 4]
jmp 0x4213db
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
jne 0x4213fb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.__cant_remove_temp__err_d
push edi
call fcn.00441366
add esp, 0xc
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.0041a8a0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x18]
call fcn.0041ba42
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x4215af
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x463d8c
call fcn.00452544
sub esp, 0x5c
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], esi
call fcn.0041bf87
push str..html
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], esi
call fcn.0041be0b
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
push str..mht
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x14], ebx
call fcn.0041be0b
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x14], 3
call fcn.0044dae0
add esp, 0xc
test eax, eax
je 0x421634
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x421626
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov byte [ebp - 0xd], bl
jne 0x421638
mov byte [ebp - 0xd], 0
push esi
push ebx
lea ecx, [ebp - 0x4c]
call fcn.0041b05c
push esi
push ebx
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], esi
call fcn.0041b05c
cmp byte [ebp - 0xd], 0
mov ecx, edi
je 0x42165d
lea eax, [ebp - 0x30]
push eax
jmp 0x421660
push dword [ebp + 8]
call fcn.0041bf87
push esi
lea ecx, [ebp - 0x30]
push ebx
call fcn.0041b05c
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x421748
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, 0x463d48
call fcn.00452544
sub esp, 0x8ac
push ebx
push esi
push edi
push str.APPCOMPANY
lea eax, [ebp - 0x64]
xor ebx, ebx
push eax
mov dword [ebp - 0x10], ebx
push dword [0x48f704]
call fcn.0041d7d4
push str._Agent___
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.0041867b
add esp, 0xc
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0041b05c
xor eax, eax
mov byte [ebp - 0x8b8], bl
mov ecx, 0x1ff
lea edi, [ebp - 0x8b7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x8b8]
push eax
push ebx
mov dword [ebp - 0x10], 0x800
call sub.urlmon.dll_ObtainUserAgentString
cmp eax, ebx
jl 0x4217dd
lea eax, [ebp - 0x8b8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b834
mov edi, 0x472cd8
push edi
lea ecx, [ebp - 0x48]
call fcn.0041be0b
lea eax, [ebp - 0x9c]
push 0x996
push eax
mov byte [ebp - 4], 3
call fcn.0044dbd0
push eax
lea eax, [ebp - 0x80]
push str.__OI_build
push eax
mov byte [ebp - 4], 4
call fcn.0041b282
push edi
push eax
lea eax, [ebp - 0xb8]
push eax
mov byte [ebp - 4], 5
call fcn.0041867b
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 6
call fcn.0044dae0
add esp, 0x2c
push ebx
push esi
lea ecx, [ebp - 0xb8]
call fcn.0041b05c
push ebx
push esi
lea ecx, [ebp - 0x80]
call fcn.0041b05c
push ebx
push esi
lea ecx, [ebp - 0x9c]
call fcn.0041b05c
push ebx
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.0041b05c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041bf87
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.0041b05c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x421894
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0x10]
xor edi, edi
push dword [ebp + 0xc]
push str.fs::LoadResourceToString_563
push str._s__id_d_type_s_
push edi
call fcn.00441366
movzx eax, word [ebp + 0xc]
add esp, 0x14
push dword [ebp + 0x10]
push eax
push dword [0x48f1cc]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
cmp esi, edi
je 0x42194c
cmp esi, 0xffffffff
je 0x42194c
push esi
push dword [0x48f1cc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
cmp ebx, edi
jne 0x4218f5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x4784f8
jmp 0x42192e
push esi
push dword [0x48f1cc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
push esi
push str.__size:__d
push edi
call fcn.00441366
add esp, 0xc
cmp esi, edi
jbe 0x421959
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
cmp eax, edi
jne 0x42193e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x4784cc
push str.___s_failed:__d
push edi
call fcn.00441366
add esp, 0x10
jmp 0x421959
mov ecx, dword [ebp + 8]
push esi
push eax
call fcn.0041b851
mov al, 1
jmp 0x42195b
push str.__not_found
push edi
call fcn.00441366
pop ecx
pop ecx
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x421960
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x464b41
call fcn.00452544
sub esp, 0x460
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0x10
push edi
mov dword [ebp - 0x10], esp
lea edi, [esi + 4]
jb 0x421985
mov eax, dword [edi]
jmp 0x421987
mov eax, edi
push eax
push str.fs::LoadFileToString_598
push str._s__fn_s_
xor ebx, ebx
push ebx
call fcn.00441366
add esp, 0x10
mov dword [ebp - 4], ebx
cmp dword [esi + 0x18], 0x10
jb 0x4219a8
mov edi, dword [edi]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x421a73
cmp esi, 0xffffffff
je 0x421a73
push ebx
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x400
lea eax, [ebp - 0x46c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x421a21
cmp dword [ebp - 0x14], ebx
jbe 0x421a21
push dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x46c]
push eax
call fcn.0041638a
add edi, dword [ebp - 0x14]
jmp 0x4219e9
cmp edi, dword [ebp - 0x18]
jae 0x421a59
push 0x471e5a
lea ecx, [ebp - 0x58]
call fcn.0041be0b
lea eax, [ebp - 0x58]
push eax
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.0041be2d
mov esi, eax
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_load_file__err_d_
jmp 0x421aa4
cmp esi, ebx
je 0x421a64
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x471e5a
lea ecx, [ebp - 0x58]
call fcn.0041be0b
lea eax, [ebp - 0x58]
push eax
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.0041be2d
mov esi, eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_open_file__err_d_
push esi
call fcn.0041b692
add esp, 0xc
mov ecx, eax
jmp fcn.0041be69
Function at 0x421b18
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x464b07
call fcn.00452544
sub esp, 0x5c
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0x10
push edi
mov dword [ebp - 0x10], esp
lea edi, [esi + 4]
jb 0x421b3a
mov eax, dword [edi]
jmp 0x421b3c
mov eax, edi
push eax
push str.fs::SaveFileFromBuffer_629
push str._s__fn_s_
xor ebx, ebx
push ebx
call fcn.00441366
add esp, 0x10
mov dword [ebp - 4], ebx
cmp dword [esi + 0x18], 0x10
jb 0x421b5d
mov edi, dword [edi]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x421be7
cmp esi, 0xffffffff
je 0x421be7
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x421bd1
push 0x471e5a
lea ecx, [ebp - 0x68]
call fcn.0041be0b
lea eax, [ebp - 0x68]
push eax
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.0041be2d
mov esi, eax
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_save_file__err_d_
jmp 0x421c18
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push 0x471e5a
lea ecx, [ebp - 0x68]
call fcn.0041be0b
lea eax, [ebp - 0x68]
push eax
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.0041be2d
mov esi, eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_create_file__err_d_
push esi
call fcn.0041b692
add esp, 0xc
mov ecx, eax
jmp fcn.0041be69
Function at 0x421c6d
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x463d08
call fcn.00452544
sub esp, 0x58
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], esi
call fcn.0041bf87
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], esi
je 0x421d1c
mov edi, 0x4783d8
push edi
call fcn.004506e0
pop ecx
push eax
push edi
or ecx, 0xffffffff
lea edi, [ebp - 0x2c]
call fcn.0042dcd5
cmp eax, 0xffffffff
push 2
pop ebx
je 0x421cd5
push eax
push esi
mov eax, edi
push eax
lea eax, [ebp - 0x64]
call fcn.004153e3
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 1
jmp 0x421ce8
push 0x471e5a
lea ecx, [ebp - 0x48]
call fcn.0041be0b
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ab6e
test byte [ebp - 0x10], bl
je 0x421d08
and dword [ebp - 0x10], 0xfffffffd
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0041b05c
mov dword [ebp - 4], esi
test byte [ebp - 0x10], 1
je 0x421d1c
push esi
push 1
lea ecx, [ebp - 0x64]
call fcn.0041b05c
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x421dff
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x421d33
lea eax, [ebp - 0x28]
cmp byte [eax + ecx - 1], 0x5c
je 0x421d47
push 0x478668
lea ecx, [ebp - 0x2c]
call fcn.0041532a
xor edi, edi
cmp dword [ebp - 0x18], esi
jbe 0x421dff
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x421d5e
lea eax, [ebp - 0x28]
cmp byte [eax + edi], 0x5c
jne 0x421da1
lea eax, [edi + 1]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
call fcn.004153e3
cmp dword [eax + 0x18], 0x10
jb 0x421d80
mov eax, dword [eax + 4]
jmp 0x421d83
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push 1
lea ecx, [ebp - 0x64]
inc bl
call fcn.0041b05c
test bl, bl
jne 0x421dfa
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x421d52
jmp 0x421dfa
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x421db5
lea eax, [ebp - 0x28]
cmp byte [eax + edi], 0x5c
jne 0x421df9
lea eax, [edi + 1]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
call fcn.004153e3
cmp dword [eax + 0x18], 0x10
jb 0x421dd7
mov eax, dword [eax + 4]
jmp 0x421dda
add eax, 4
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push 1
lea ecx, [ebp - 0x64]
inc bl
call fcn.0041b05c
test bl, bl
jne 0x421e1d
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x421da9
mov bl, 1
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0041b05c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
xor bl, bl
jmp 0x421e01
Function at 0x421e21
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x464acd
call fcn.00452544
sub esp, 0x414
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
push ebx
push esi
push edi
mov edi, ecx
jb 0x421e49
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
jmp 0x421e4f
add eax, 4
mov dword [ebp - 0x10], eax
cmp dword [edi + 0x18], 0x10
lea esi, [edi + 4]
jb 0x421e5c
mov ecx, dword [esi]
jmp 0x421e5e
mov ecx, esi
push eax
push ecx
push str.fs::CopyFileA_688
push str._s__in_s_out_s_
xor ebx, ebx
push ebx
call fcn.00441366
add esp, 0x14
cmp dword [edi + 0x18], 0x10
jb 0x421e7d
mov esi, dword [esi]
push ebx
mov edi, 0x80
push edi
push 3
push ebx
push 1
push SysReAllocStringLen
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileA]
call esi
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x421f79
cmp eax, 0xffffffff
je 0x421f72
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
mov eax, dword [ebp - 0x10]
jb 0x421ebc
mov eax, dword [eax]
push ebx
push edi
push 2
push ebx
push ebx
push 0x40000000
push eax
call esi
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x421f62
cmp eax, 0xffffffff
je 0x421f6f
push ebx
push dword [ebp - 0x18]
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], ebx
mov edi, 0x400
jmp 0x421f2c
cmp dword [ebp - 0x14], ebx
jbe 0x421f42
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x421f59
mov eax, dword [ebp - 0x14]
add dword [ebp + 8], eax
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x421f02
mov eax, dword [ebp - 0x20]
cmp dword [ebp + 8], eax
jb 0x421f59
push str.__ok
push ebx
call fcn.00441366
pop ecx
pop ecx
mov bl, 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
jmp 0x421f7b
push eax
jmp 0x421f5c
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x422405
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x463cb2
call fcn.00452544
sub esp, 0x40
and dword [ebp - 0x14], 0
cmp dword [esi + 0x18], 0x10
jb 0x422421
mov eax, dword [esi + 4]
jmp 0x422424
lea eax, [esi + 4]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
xor ebx, ebx
inc ebx
test eax, eax
je 0x42247c
push 0x478668
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.0041867b
push dword [ebp + 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x14], ebx
call fcn.004187fe
add esp, 0x18
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 0x14], 3
jb 0x42246b
mov eax, dword [eax + 4]
jmp 0x42246e
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov byte [ebp - 0xd], bl
je 0x422480
mov byte [ebp - 0xd], 0
test byte [ebp - 0x14], 2
je 0x422495
and dword [ebp - 0x14], 0xfffffffd
push 0
push ebx
lea ecx, [ebp - 0x30]
call fcn.0041b05c
test byte [ebp - 0x14], bl
je 0x4224a5
push 0
push ebx
lea ecx, [ebp - 0x4c]
call fcn.0041b05c
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4224b5
Capabilities:
Get file size

Disassembly:
cmp dword [eax + 0x18], 0x10
jb 0x4224c0
mov eax, dword [eax + 4]
jmp 0x4224c3
add eax, 4
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x4224f6
cmp esi, 0xffffffff
je 0x4224f6
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
jmp 0x4224f8
xor ebx, ebx
test esi, esi
je 0x422503
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x422557
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x422576
mov eax, dword [edi]
jmp 0x422578
mov eax, edi
lea ecx, [ebp - 4]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x42259b
mov ecx, dword [ebp + 8]
push 0x471e5a
call fcn.0041be0b
jmp 0x422635
push ebx
push eax
call fcn.0044ea28
cmp dword [esi + 0x18], 0x10
pop ecx
mov ebx, eax
jb 0x4225ad
mov edi, dword [edi]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call sub.VERSION.dll_GetFileVersionInfoA
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x478668
push ebx
call sub.VERSION.dll_VerQueryValueA
push 0x3f
pop ecx
mov byte [ebp - 0x10c], 0
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov ecx, 0xffff
and edx, ecx
push edx
movzx edx, word [eax + 0xe]
push edx
mov edx, dword [eax + 8]
movzx eax, word [eax + 0xa]
and edx, ecx
push edx
push eax
push str._d._d._d._d
lea eax, [ebp - 0x10c]
push 0xff
push eax
call fcn.00451838
push ebx
call fcn.0044fbbd
mov ecx, dword [ebp + 8]
add esp, 0x20
lea eax, [ebp - 0x10c]
push eax
call fcn.0041be0b
pop ebx
mov eax, dword [ebp + 8]
pop edi
leave
ret
Function at 0x4247cd
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [esi], edi
mov dword [esi + 8], eax
call fcn.0041bf87
mov eax, dword [edi + 0xc]
xor ebx, ebx
mov dword [esi + 0x28], eax
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esi + 0x2c], eax
cmp dword [edi], ebx
je 0x424831
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esi + 0x38], eax
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x424880
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, esi
pop ebx
pop ebp
ret 8
Function at 0x4252d6
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
jne 0x42531f
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateEventA]
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x18], eax
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x1c], eax
call ebx
push edi
push 4
push esi
push 0x425619
push edi
push edi
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
pop ebx
pop edi
ret

Function at 0x425321
Capabilities:
Terminate thread

Disassembly:
cmp dword [esi + 0x14], 0
je 0x425359
push edi
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0x3e8
push eax
call edi
test eax, eax
je 0x425358
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push 0xffffffffffffffff
push dword [esi + 0x14]
call edi
pop edi
ret

Function at 0x425500
Capabilities:
Check internet connectivity via wininet

Disassembly:
mov eax, 0x463c7d
call fcn.00452544
sub esp, 0x6c
push ebx
push esi
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov eax, dword [edi + 0x20]
mov esi, dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x14]
push 0x2710
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x18]
push eax
push 2
call esi
mov ebx, 0x102
jmp 0x425568
and dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
setne al
test al, al
je 0x4255ce
push 0x2710
push 0
lea eax, [ebp - 0x18]
push eax
push 2
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x425540
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
cmp dword [ebp - 0x10], 0
jne 0x425595
cmp dword [edi + 0x28], 0
ja 0x425595
mov ecx, dword [ebp - 0xc]
mov al, byte [edi + 0x2c]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push 0x471e5a
lea ecx, [ebp - 0x5c]
call fcn.0041be0b
push 0xc353
push 1
lea eax, [ebp - 0x5c]
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.0042fe1c
mov byte [ebp - 4], 3
push dword [edi + 0x28]
push str.InetRequestCtx::WorkerThread
push str._s_failed__err_d
jmp 0x425609
mov esi, edi
call fcn.00425321
push 0x471e5a
lea ecx, [ebp - 0x78]
call fcn.0041be0b
and dword [ebp - 4], 0
push 0xc353
push 1
lea eax, [ebp - 0x78]
lea esi, [ebp - 0x40]
call fcn.0042fe1c
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
push str.InetRequestCtx::WorkerThread
push str._s_timeout__conn.type_d_
push eax
call fcn.0041b692
add esp, 0x10
mov ecx, eax
jmp fcn.0041be69
Function at 0x425cf8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push str.fs::ShowCriticalErrorBox
xor ebx, ebx
push ebx
call fcn.00441366
cmp byte [0x48f709], bl
pop ecx
pop ecx
jne 0x425d58
cmp byte [ebp + 8], bl
push esi
je 0x425d2c
mov esi, dword [0x48f700]
cmp esi, ebx
je 0x425d2c
push ebx
call fcn.00409cd7
jmp 0x425d2e
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push 0x425d5b
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x425d57
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop ebx
leave
ret