joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d0f2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov esi, eax
push ebx
push esi
xor edx, edx
call fcn.004950e6
call fcn.00428ac9
lea eax, [esi + 0x4c]
push eax
lea edi, [ebp - 4]
call fcn.00402f03
push str.ttpres.dll
mov eax, edi
push eax
call fcn.00402fdb
push dword [ebp - 4]
call fcn.0049c7b8
test eax, eax
pop ecx
je 0x49d1c2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x3c], eax
je 0x49d1c2
push eax
push 0x4f20a8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x3c]
mov ecx, dword [0x4f0980]
push 0x80
push eax
mov dword [0x4f2800], eax
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], ecx
call fcn.00403692
xor eax, eax
not word [eax + 0x4f1f38]
not word [eax + 0x4f1f2c]
inc eax
inc eax
cmp eax, 8
jl 0x49d177
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
push 0x4f1f38
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x49d1dd
push 0x4f1f2c
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x49d1dd
push 0x4f1f18
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x49d1dd
push 0x10
push 0x4d63d4
push str.Load_resource__ttpres.dll__failed__please_resetup_this_program_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ebx, [esi + 0x44]
lea edi, [ebp + 8]
mov eax, ebx
call fcn.00402f73
push 0x8292
lea eax, [ebp - 8]
call fcn.00408e92
push dword [eax]
add esi, 0x48
push dword [ebx]
push 0x4d9178
push esi
call fcn.00405986
mov eax, dword [ebp - 8]
add esp, 0x14
pop edi
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
pop esi
pop ebx
je 0x49d223
push eax
call fcn.004013aa
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x49d237
push eax
call fcn.004013aa
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x49d24b
push eax
call fcn.004013aa
xor eax, eax
leave
ret 4
Function at 0x49d5d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [0x4f2814]
test esi, esi
je 0x49d6a8
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49d6a8
mov eax, dword [ebp + 8]
mov esi, dword [esi + 0xc]
push ebx
push edi
push dword [eax]
lea edi, [ebp - 4]
call fcn.00402f03
mov ebx, edi
call fcn.0049cd82
mov edi, dword [ebp - 4]
cmp dword [edi - 8], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
je 0x49d671
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push 0x4d91e4
call fcn.00495411
test eax, eax
je 0x49d63c
mov dword [ebp - 4], 1
jmp 0x49d654
mov eax, dword [ebp + 8]
push 0x4d91e0
call fcn.00495411
test eax, eax
je 0x49d654
mov dword [ebp - 4], 2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edi - 8]
lea eax, [eax + eax + 2]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x4a
push esi
mov dword [ebp - 8], edi
call ebx
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xf120
push 0x112
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
add edi, 0xfffffff4
cmp edi, dword [0x4f0984]
je 0x49d6a1
push edi
call fcn.004013aa
xor eax, eax
pop edi
inc eax
pop ebx
jmp 0x49d6aa
xor eax, eax
pop esi
leave
ret
Function at 0x49d6ad
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x4cdce5
call fcn.004c7e20
sub esp, 0x14
push ebx
call sub.ttpcomm.dll_Ordinal_1
mov ecx, 0x50301
cmp eax, ecx
je 0x49d6e5
push 0x10
push 0x4d63d4
push str.Error_in_ttpcomm.dll__please_resetup_this_program_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
jmp 0x49d898
push esi
push edi
xor edi, edi
cmp dword [0x4f2808], edi
je 0x49d84c
mov ebx, dword [0x4f2814]
cmp ebx, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
je 0x49d727
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ecx
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebx + 4]
push eax
call edi
call esi
push eax
add ebx, 8
push ebx
call edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push str.wWinMain
mov dword [0x4ee544], eax
call esi
push eax
call fcn.0040405d
pop ecx
pop ecx
push edi
call sub.ole32.dll_OleInitialize
mov eax, 0x781
call fcn.004338c4
push dword [ebp + 8]
mov ebx, 0x4f2c30
mov eax, ebx
call fcn.0049d0f2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.ttpcomm.dll_Ordinal_3
lea edi, [ebp - 0x10]
mov dword [esp], 0x4f2c7c
call fcn.00402f03
and dword [ebp - 4], 0
push str.AddIn
mov eax, edi
push eax
call fcn.00402fdb
mov edi, dword [ebp - 0x10]
push 0
push edi
push 0x4f3508
call fcn.004a73d8
test eax, eax
mov dword [ebp + 8], eax
jge 0x49d7d7
mov esi, ebx
call fcn.0049d251
call sub.ole32.dll_OleUninitialize
push 0x10
push dword [0x4f2c74]
push str.Sound_Library_init_failed__the_player_can_not_run_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [edi - 0xc]
cmp eax, dword [0x4f0984]
je 0x49d847
push eax
call fcn.004013aa
jmp 0x49d847
or dword [ebp - 4], 0xffffffff
lea eax, [edi - 0xc]
cmp eax, dword [0x4f0984]
je 0x49d7ec
push eax
call fcn.004013aa
mov edi, 0x4f34c0
mov esi, edi
call fcn.004959be
call sub.ttpcomm.dll_Ordinal_200
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.0049d274
mov esi, 0x4f2808
mov dword [ebp + 8], eax
call fcn.004956c7
call sub.ttpcomm.dll_Ordinal_201
mov esi, edi
call fcn.00495a0b
mov ecx, 0x4f3508
call fcn.004a779d
mov esi, ebx
call fcn.0049d251
call sub.ole32.dll_OleUninitialize
mov eax, dword [0x4ee544]
cmp eax, 0xffffffff
je 0x49d847
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, dword [ebp + 8]
jmp 0x49d896
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.004952d9
push 0x1388
push dword [0x4f280c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x49d883
lea eax, [ebp - 0x20]
push eax
call fcn.0049d5d0
pop ecx
lea eax, [ebp - 0x20]
call fcn.00495297
lea esi, [ebp - 0x1c]
call fcn.004553e0
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x49dde0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x4ed384]
push ebx
xor ebx, ebx
cmp dword [0x4f3a1c], ebx
push esi
mov dword [ebp + 0x1b0], eax
push edi
jne 0x49df51
xor eax, eax
mov word [ebp - 0x58], bx
mov ecx, 0x81
lea edi, [ebp - 0x56]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x1c8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x78], edi
je 0x49dea7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x49df92
cmp eax, 0x40
jbe 0x49df92
push ebx
push eax
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, ebx
mov dword [ebp - 0x64], eax
je 0x49df92
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
jne 0x49deae
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
jmp 0x49df7c
mov eax, dword [esi + 0x3c]
and dword [ebp - 0x60], 0
lea ebx, [eax + esi + 4]
xor eax, eax
lea edi, [ebp - 0x72]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x5c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x74]
push eax
mov word [ebp - 0x74], 0x7b2
mov word [ebp - 0x72], 1
mov word [ebp - 0x6e], 1
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x60]
mov edi, dword [ebp - 0x5c]
mov edx, 0x989680
mul edx
add ecx, eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
adc edi, edx
push eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x74]
mov dword [0x4f3a1c], eax
movzx eax, word [ebp - 0x72]
mov dword [0x4f3a18], eax
movzx eax, word [ebp - 0x6e]
push esi
mov dword [0x4f3a14], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x78]
call esi
mov eax, dword [ebp + 0x1bc]
mov ecx, dword [0x4f3a1c]
mov dword [eax], ecx
mov eax, dword [0x4f3a18]
mov ecx, dword [ebp + 0x1c0]
mov dword [ecx], eax
mov eax, dword [0x4f3a14]
mov ecx, dword [ebp + 0x1c4]
mov dword [ecx], eax
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1b0]
pop edi
pop esi
pop ebx
call fcn.004c7b01
add ebp, 0x1b4
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49dea7
Function at 0x49e952
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4ed384]
push esi
xor esi, esi
mov dword [ebp + 0x18c], eax
mov dword [ebp - 0x80], esi
mov eax, dword [0x4f0980]
push esi
mov dword [ebp - 0x80], eax
push 0x26
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x49e9bb
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x7c]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x49e9bb
push str.Program_Files
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
call fcn.00402fb6
mov esi, dword [ebp + 0x198]
lea ecx, [ebp - 0x80]
call fcn.00402eaa
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
pop esi
je 0x49e9ea
push eax
call fcn.004013aa
mov ecx, dword [ebp + 0x18c]
mov eax, dword [ebp + 0x198]
call fcn.004c7b01
add ebp, 0x190
leave
ret

Function at 0x49ea66
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword [0x4f0980]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jle 0x49eaa6
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 4]
call fcn.00403042
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, esi
lea ecx, [ebp - 4]
call fcn.0040306e
mov esi, dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.00402eaa
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
pop esi
je 0x49eac6
push eax
call fcn.004013aa
mov eax, dword [ebp + 8]
leave
ret

Function at 0x49ece1
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
push ebp
push ebp
push 0x1037
push edi
call esi
mov ebx, 0x100
or eax, ebx
push eax
push ebp
push 0x1036
push edi
call esi
mov esi, dword [sym.imp.COMCTL32.dll_FlatSB_SetScrollProp]
push ebp
push 0xd
push 8
push edi
call esi
push ebp
push 0xd
push 1
push edi
call esi
push ebp
push 0xd
push 2
push edi
call esi
push ebp
push 0xd
push 4
push edi
call esi
inc ebp
push ebp
push ebp
push 0x200
push edi
call esi
push ebp
push ebp
push ebx
push edi
call esi
pop esi
pop ebp
pop ebx
ret
Function at 0x49f350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov eax, 0x1014
lea ebp, [esp - 0xf94]
call fcn.004c7d30
mov eax, dword [0x4ed384]
push ebx
push esi
mov dword [ebp + 0xf90], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
xor ebx, ebx
push ebx
xor esi, esi
push str.SOFTWAREMicrosoftInternet_Explorer
inc esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49f429
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.Version
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49f420
lea eax, [ebp - 0x70]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_wcschr]
cmp eax, ebx
pop ecx
pop ecx
je 0x49f41d
mov word [eax], bx
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
cmp eax, 5
pop ecx
jl 0x49f419
mov eax, dword [ebp + 0xf9c]
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push edi
push 4
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
push 0x49
push ebx
call esi
push 4
mov edi, eax
lea eax, [ebp - 0x78]
push eax
push 0x4a
push ebx
call esi
and edi, eax
pop edi
je 0x49f419
mov esi, dword [ebp + 0xf9c]
jmp 0x49f420
push 2
jmp 0x49f41f
push 4
pop esi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xf90]
mov eax, esi
pop esi
pop ebx
call fcn.004c7b01
add ebp, 0xf94
leave
ret

Function at 0x4a046e
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x20], 0
je 0x4a0482
cmp dword [esi + 0x14], 0
je 0x4a0482
call fcn.0040da81
mov ecx, esi
call fcn.004a0383
push edx
push eax
push esi
call fcn.0040d9be
mov ecx, eax
and ecx, edx
cmp ecx, 0xffffffff
jne 0x4a049e
xor eax, eax
pop esi
ret
push dword [esi]
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
ret
Function at 0x4a05b2
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
mov ebx, ecx
je 0x4a0684
cmp dword [esi], 0x18
jne 0x4a0684
push edi
push dword [esi + 8]
lea edi, [ebp - 4]
call fcn.00402f03
mov eax, dword [esi + 4]
mov edi, dword [ebp - 4]
xor ecx, ecx
cmp eax, ecx
jne 0x4a05f2
push 0x10000000
push ecx
push ecx
push 1
jmp 0x4a0665
cmp eax, 1
je 0x4a065d
cmp dword [edi - 8], ecx
je 0x4a065d
push dword [esi + 0x10]
lea eax, [ebx + 0x1c]
call fcn.00402fb6
push dword [esi + 0x14]
lea eax, [ebx + 0x20]
call fcn.00402fb6
push dword [esi + 0xc]
mov eax, dword [0x4f0980]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.httphttp:___s:_d
push eax
call fcn.00405986
mov esi, dword [ebp - 4]
add esp, 0x10
push 0x10000000
push str._local_
push esi
push 3
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx], eax
lea eax, [esi - 0xc]
cmp eax, dword [0x4f0984]
je 0x4a0670
push eax
call fcn.004013aa
jmp 0x4a0670
push 0x10000000
push ecx
push ecx
push ecx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx], eax
lea eax, [edi - 0xc]
cmp eax, dword [0x4f0984]
pop edi
je 0x4a0697
push eax
call fcn.004013aa
jmp 0x4a0697
push 0x10000000
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx], eax
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4a06a1
xor eax, eax
jmp 0x4a06b7
push 0x4a0c53
push ebx
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebx
leave
ret 4
Function at 0x4a09fd
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x4a0a5f
and dword [esi + 0x44], 0
mov dword [esi + 0x3c], ecx
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x40], ecx
push 1
lea ecx, [esi + 0x28]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x4a0a63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4a0a5f
push dword [ebp + 0xc]
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 8]
push eax
xor eax, eax
test edi, edi
setne al
mov dword [ebp - 4], edi
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x4a0a5f
cmp dword [esi + 0x40], eax
jne 0x4a0a63
xor eax, eax
jmp 0x4a0a69
mov eax, dword [esi + 0x40]
mov dword [esi + 0x44], eax
leave
ret 8
Function at 0x4a0a6d
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2498
call fcn.004c7d30
mov eax, dword [0x4ed384]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [edi + 4], eax
push ebx
mov ebx, ecx
je 0x4a0a96
mov eax, 0x80004005
jmp 0x4a0c46
cmp dword [ebp + 0xc], eax
jne 0x4a0aa5
mov eax, 0x80004003
jmp 0x4a0c46
push esi
push 0x10000000
push eax
lea esi, [ebp - 0x248c]
mov dword [edi + 0x18], eax
call fcn.0041752a
push 0x10000000
push dword [ebp + 8]
mov eax, esi
call fcn.0041758b
test eax, eax
jne 0x4a0ad7
mov eax, 0x80004005
jmp 0x4a0c45
push 0
push 0
push 3
push dword [ebp - 0x2468]
push dword [ebp - 0x2470]
push dword [ebp - 0x2474]
push dword [ebp - 0x247c]
push dword [edi]
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [edi + 4], eax
je 0x4a0acd
lea eax, [ebp - 0x2490]
push eax
lea eax, [ebp - 0x248c]
call fcn.004175f3
mov esi, eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x248c]
call fcn.00417657
mov esi, dword [esi]
mov eax, dword [eax]
push edi
or ebx, 0x400000
push ebx
xor ebx, ebx
push ebx
push esi
push ebx
push eax
push str.POST
push dword [edi + 4]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x4a0b5e
push eax
call fcn.004013aa
mov eax, dword [ebp - 0x2490]
add eax, 0xfffffff4
cmp eax, dword [0x4f0984]
je 0x4a0b75
push eax
call fcn.004013aa
cmp dword [edi + 8], ebx
jne 0x4a0b81
mov ebx, 0x80004005
jmp 0x4a0bf9
cmp dword [ebp + 0x10], 0xffffffff
jne 0x4a0b93
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
mov dword [ebp + 0x10], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [edi + 8]
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x4a0c04
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x3e5
setne cl
mov eax, ecx
cmp eax, ebx
jne 0x4a0bf9
push dword [edi + 0x14]
mov eax, dword [edi + 0xc]
push ebx
lea ecx, [ebp - 0x2494]
push ecx
mov dword [ebp - 0x2494], eax
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
cmp eax, ebx
setne cl
mov dword [ebp - 0x2490], eax
inc ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
neg eax
sbb eax, eax
neg eax
mov dword [ebp + 0x10], eax
je 0x4a0c04
mov esi, edi
call fcn.004a06bd
mov eax, ebx
jmp 0x4a0c45
push ebx
lea eax, [ebp - 0x2498]
push eax
lea ebx, [edi + 0x18]
push ebx
push 0x20000013
push dword [edi + 8]
mov dword [ebp - 0x2498], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x4a0c2e
and dword [ebx], eax
mov esi, edi
call fcn.004a06bd
mov eax, dword [ebx]
sub eax, 0xc8
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.004c7b01
leave
ret 0x18
Function at 0x4a112d
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
xor edi, edi
lea esi, [ebx + 0x68]
mov dword [ebx + 0x64], edi
call fcn.0040dbc3
mov eax, dword [ebx + 0x6c]
cmp eax, edi
je 0x4a1167
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
cmp eax, edi
pop ecx
mov dword [ebx + 0x70], eax
jne 0x4a1161
mov eax, 0x8007000e
jmp 0x4a11c9
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x78], edi
push edi
lea ecx, [ebx + 4]
mov eax, 0x4f3568
call fcn.004a05b2
test eax, eax
jne 0x4a1180
mov eax, 0x80004014
jmp 0x4a11c9
push dword [ebp + 0xc]
lea esi, [ebx + 0x5c]
push dword [ebp + 8]
mov dword [esi], edi
push edi
mov dword [ebx + 0x60], edi
call fcn.004a1340
cmp eax, edi
jl 0x4a11c9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x20000005
push dword [ebx + 0x54]
mov dword [ebp - 8], 4
mov dword [ebp - 4], edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, 0x7ffbff9b
add eax, 0x80040065
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4a39ec
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, eax
call fcn.004a3470
push dword [esp + 0x14]
lea eax, [edi + 0x14]
call fcn.004031bd
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a3a31
mov dword [edi + 0x24], 2
xor al, al
jmp 0x4a3aa0
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push 2
push ebx
push esi
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, eax
call esi
cmp ebp, ebx
jne 0x4a3a65
mov dword [edi + 0x24], 2
xor al, al
jmp 0x4a3a9f
push dword [esp + 0x18]
push ebx
push ebx
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebp
mov dword [esp + 0x14], eax
call esi
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x4a3a5a
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
call fcn.004a4617
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
cmp dword [edi + 0x24], ebx
sete al
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x4a3aa7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov ebx, eax
je 0x4a3ac3
push dword [ebp + 8]
lea eax, [ebx + 0x14]
call fcn.004031bd
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x4a3ae7
xor al, al
jmp 0x4a3b4e
mov esi, 0x4d5ffc
push 0x2000
mov dword [ebp - 0x14], esi
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [ebp - 8], 0x2000
call dword [eax + 8]
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov al, bl
pop esi
pop ebx
leave
ret 8