joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f2b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004175be
lea esi, [ebp - 0x1c]
mov ecx, eax
push esi
call fcn.0041760e
movzx eax, byte [esi + 0xb]
mov edx, esi
test al, al
jns 0x40f2e3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
lea edi, [ebp - 0x28]
mov ecx, edi
push eax
push edx
call fcn.0046ed80
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x40f2fd
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
lea ebx, [ebp - 0x34]
mov ecx, ebx
push eax
push esi
call fcn.0046ed80
lea esi, [ebp - 0x40]
mov ecx, ebx
push 0xa
push 0x6426ca
push esi
call fcn.0046fbd0
mov ecx, ebx
push esi
call fcn.0046ee80
mov ecx, esi
call fcn.0046ee40
push edi
call fcn.00482720
add esp, 4
test al, al
je 0x40f386
lea ecx, [ebp - 0x28]
push 7
push str.npflash
push esi
call fcn.0046fbd0
movzx eax, byte [ebp - 0x35]
test al, al
jns 0x40f352
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x40f37e
push esi
call fcn.00482720
add esp, 4
test al, al
je 0x40f37e
lea ecx, [ebp - 0x40]
call fcn.0040f5a8
test al, al
je 0x40f37e
push 1
push ebx
lea eax, [ebp - 0x40]
push eax
call fcn.00482210
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.0046ee40
lea ecx, [ebp - 0x34]
call fcn.0046ee40
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x40f39e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x40f3a1
lea edx, [ebp - 0x1c]
lea ebx, [ebp - 0x34]
mov ecx, ebx
push eax
push edx
call fcn.0046ed80
mov ecx, ebx
push 0xa
push 0x6426ca
push esi
call fcn.0046fbd0
mov ecx, ebx
push esi
call fcn.0046ee80
mov ecx, esi
call fcn.0046ee40
push edi
call fcn.00482720
add esp, 4
test al, al
je 0x40f426
lea ecx, [ebp - 0x28]
push 7
push str.ppflash
push esi
call fcn.0046fbd0
movzx eax, byte [ebp - 0x35]
test al, al
jns 0x40f3f3
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x40f41e
push esi
call fcn.00482720
add esp, 4
test al, al
je 0x40f41e
lea esi, [ebp - 0x40]
mov ecx, esi
call fcn.0040f5a8
test al, al
je 0x40f41e
push 1
push ebx
push esi
call fcn.00482210
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.0046ee40
lea esi, [ebp - 0x34]
mov ecx, esi
call fcn.0046ee40
call fcn.00418bcc
test al, al
jne 0x40f46f
call fcn.00418bac
test al, al
je 0x40f44b
call fcn.00418bdc
test al, al
je 0x40f46f
mov dword [ebp - 0x34], 1
mov eax, 4
push eax
push esi
push eax
push str.update_components
push 0x642724
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x28]
call fcn.0046ee40
cmp byte [ebp - 0x11], 0
jns 0x40f488
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f49a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x40f4c1
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea edi, [ebp - 0x1c]
mov ecx, edi
push edx
push eax
call fcn.0046ed80
movzx eax, byte [esi + 0xb]
mov edx, esi
test al, al
jns 0x40f4dc
mov edx, dword [esi]
mov eax, dword [esi + 4]
lea ebx, [ebp - 0x28]
mov ecx, edi
push eax
push edx
push ebx
call fcn.0046fbd0
mov ecx, edi
push ebx
call fcn.0046ee80
mov ecx, ebx
call fcn.0046ee40
cmp byte [ebp - 0x11], 0
jns 0x40f501
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40f588
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax + 0xb]
test dl, dl
jns 0x40f51c
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, ebx
push edx
push eax
call fcn.0046ed80
movzx eax, byte [esi + 0xb]
test al, al
jns 0x40f532
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea edi, [ebp - 0x34]
mov ecx, ebx
push eax
push esi
push edi
call fcn.0046fbd0
mov ecx, ebx
push edi
call fcn.0046ee80
mov ecx, edi
call fcn.0046ee40
mov ecx, edi
push ebx
call fcn.0046ed40
lea eax, [ebp - 0x1c]
lea esi, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0046ed40
push edi
push esi
call fcn.00470c60
add esp, 8
mov ebx, eax
mov ecx, esi
call fcn.0046ee40
mov ecx, edi
call fcn.0046ee40
lea ecx, [ebp - 0x28]
call fcn.0046ee40
jmp 0x40f58a
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0046ee40
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x410886
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x28], eax
call fcn.004175be
lea ebx, [esp + 0x10]
mov ecx, eax
push ebx
call fcn.0041760e
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x4108c0
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x1c]
mov ecx, edi
push eax
push ebx
call fcn.0046ed80
cmp byte [esp + 0x1b], 0
jns 0x4108e0
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
call fcn.00418a10
mov ecx, eax
call fcn.00418be6
test al, al
je 0x41093d
call fcn.00418a10
mov ecx, eax
call fcn.00418ca6
test al, al
jne 0x410932
lea esi, [esp + 4]
lea ecx, [esp + 0x1c]
push esi
call fcn.0046f6e0
lea ebx, [esp + 0x10]
mov ecx, esi
push ebx
call fcn.0046f6e0
lea ecx, [esp + 0x1c]
push ebx
call fcn.0046ee80
mov ecx, ebx
call fcn.0046ee40
mov ecx, esi
call fcn.0046ee40
push edi
call fcn.00482020
jmp 0x410a32
xor eax, eax
lea ebx, [esp + 0x10]
mov dword [ebx + 4], eax
mov dword [ebx], eax
mov dword [ebx + 8], eax
push ebx
call fcn.00438fec
add esp, 4
movzx eax, byte [ebx + 0xb]
mov ecx, eax
test al, al
jns 0x410962
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4109cf
lea edi, [esi + 0x18]
cmp byte [esi + 0x23], 0
js 0x41097d
je 0x4109cf
test al, al
jns 0x410979
mov ebx, dword [esp + 0x10]
mov eax, edi
jmp 0x410993
cmp dword [esi + 0x1c], 0
je 0x4109cf
test al, al
jns 0x41098d
mov ebx, dword [esp + 0x10]
jmp 0x410991
lea ebx, [esp + 0x10]
mov eax, dword [edi]
push ebx
push eax
call fcn.00438124
add esp, 8
test eax, eax
je 0x4109cf
movzx eax, byte [esi + 0x23]
test al, al
jns 0x4109af
mov edi, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
lea esi, [esp + 4]
lea ecx, [esp + 0x1c]
push eax
push edi
push esi
call fcn.0046fbd0
push esi
call fcn.00482020
add esp, 4
mov ecx, esi
call fcn.0046ee40
call fcn.004175be
lea esi, [esp + 4]
mov ecx, eax
push 0
push esi
call fcn.004182fa
cmp byte [esi + 0xb], 0
jns 0x4109ec
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410a0f
cmp byte [esp + 0xf], 0
jns 0x410a04
mov eax, dword [esp + 4]
jmp 0x410a08
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [esp + 0xf], 0
jns 0x410a22
push dword [esp + 4]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x1b], 0
jns 0x410a35
push dword [esp + 0x10]
call fcn.00517bd6
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0046ee40
mov ecx, dword [esp + 0x28]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x410a52
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x430
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
jbe 0x410a8b
xor ebx, ebx
jmp 0x410b79
lea edi, [ebp - 0x430]
mov ecx, edi
push ebx
call fcn.00401a6c
mov ecx, edi
push str.CHFA2CD249_E6BC.ini
call fcn.00469188
lea ebx, [ebp - 0x422]
push 0x208
push 0
push ebx
call fcn.006030b0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x410ac7
mov edi, dword [ebp - 0x430]
push edi
push 0x104
mov edi, ebx
push ebx
push 0x6390a0
push 0x642930
push str.revert
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov bl, 1
test eax, eax
je 0x410b62
cmp word [ebp - 0x422], 0
je 0x410b62
lea eax, [esi + 0x18]
cmp byte [esi + 0x23], 0
jns 0x410b00
mov eax, dword [eax]
push edi
push eax
call fcn.00438124
add esp, 8
test eax, eax
js 0x410b12
xor ebx, ebx
jmp 0x410b62
lea esi, [ebp - 0x43c]
mov ecx, esi
call fcn.00485150
mov ecx, esi
push 0xf003f
push str.Software360ChromeChrome
push SysReAllocStringLen
call fcn.004852c0
test eax, eax
jne 0x410b57
lea ecx, [ebp - 0x43c]
push 1
push str.verback
call fcn.00485af0
call fcn.00436db0
mov byte [0x771231], 1
lea ecx, [ebp - 0x43c]
call fcn.00485370
cmp byte [ebp - 0x425], 0
jns 0x410b79
push dword [ebp - 0x430]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x430
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41170e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.00436db0
mov ecx, eax
push 0x25c
push 0x1c
call fcn.004374f6
mov eax, dword [esi]
test eax, eax
jne 0x411741
xor eax, eax
push eax
push eax
push eax
push 0x411750
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
setne al
pop esi
pop ebp
ret
Function at 0x411be4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0xc0], eax
xor eax, eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xa8], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x411c3a
mov eax, dword [edi]
lea ecx, [esp + 0xa8]
lea edx, [esp + 0xb0]
lea esi, [esp + 0xb8]
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x411c76
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xac]
shld ecx, eax, 0xc
mov bl, 1
cmp ecx, dword [ebp + 0xc]
ja 0x411cc5
push 0
call fcn.00473360
add esp, 4
test al, al
je 0x411cc3
mov esi, esp
mov ecx, esi
push 0
push 0x4f
push str..._..chrome_installer_tdsetup_tdsetup_ee_check_condition.h
call fcn.004733f0
lea eax, [esp + 8]
cmp byte [edi + 0xb], 0
jns 0x411ca2
mov edi, dword [edi]
push edi
push eax
call fcn.00473e90
add esp, 8
push 0x1a
push str._do_not_has_enough_space_r_n
push eax
call fcn.00403cc6
add esp, 0xc
mov ecx, esi
call fcn.00473790
xor ebx, ebx
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412ece
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ecx]
test eax, eax
jne 0x412f01
mov esi, ecx
call fcn.00436db0
mov ecx, eax
push 0x1f5
push 0x1c
call fcn.004374f6
xor eax, eax
push eax
push eax
push eax
push 0x412f10
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
setne al
pop esi
pop ebp
ret

Function at 0x413200
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp byte [eax + 0xb], 0
jns 0x41321f
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x639390]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4132b7
mov esi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [eax - 1]
xor ebx, ebx
cmp ecx, 0x1f3ffffe
ja 0x4132ae
mov edi, eax
mov dword [ebp - 0x18], eax
inc edi
push edi
call fcn.00517c03
add esp, 4
push edi
mov edi, eax
push ebx
push eax
call fcn.006030b0
add esp, 0xc
lea eax, [ebp - 0x14]
mov dword [eax], ebx
push ebx
push eax
push dword [ebp - 0x18]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne bl
je 0x4132a5
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x14]
push edi
call fcn.00467f02
push edi
call fcn.00517c15
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4132b9
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x417aca
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov ecx, dword [0x6f4e3c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea esi, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00468aa8
push esi
call fcn.0043a54c
add esp, 4
test al, al
je 0x417b31
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x28]
mov ecx, edi
push esi
call fcn.00468aa8
cmp byte [esi + 0xb], 0
jns 0x417b10
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
test eax, eax
jne 0x417bdb
movzx eax, byte [ebp - 0x1d]
test al, al
jns 0x417b39
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x417b3c
xor ebx, ebx
inc ebx
jmp 0x417c7d
lea ecx, [ebp - 0x28]
xor edx, edx
inc edx
push edx
push edx
push 0x6391f0
push eax
push ecx
call fcn.0047b2e0
add esp, 0x14
test al, al
je 0x417bbc
movzx eax, byte [ebp - 0x1d]
test al, al
jns 0x417b5f
mov eax, dword [ebp - 0x24]
dec eax
lea edx, [ebp - 0x1c]
lea edi, [ebp - 0x28]
lea ecx, [ebp - 0x34]
push edx
push eax
push 0
push edi
call fcn.00468b4c
cmp byte [edi + 0xb], 0
js 0x417b85
mov word [ebp - 0x28], 0
mov byte [ebp - 0x1d], 0
jmp 0x417bac
mov eax, dword [ebp - 0x28]
mov word [eax], 0
mov dword [ebp - 0x24], 0
cmp byte [ebp - 0x1d], 0
jns 0x417bac
push dword [ebp - 0x28]
call fcn.00517bd6
add esp, 4
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
movsd xmm0, qword [ebp - 0x34]
movsd qword [ebp - 0x28], xmm0
lea edi, [ebp - 0x28]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x417bca
mov eax, dword [ebp - 0x28]
push eax
call fcn.0040121e
add esp, 4
test eax, eax
je 0x417c64
call fcn.00488190
xor ecx, ecx
cmp eax, 2
setg al
cmp byte [ebp - 0x1d], 0
mov edx, edi
jns 0x417bf3
mov edx, dword [ebp - 0x28]
mov cl, al
push ecx
push edx
call fcn.00401326
add esp, 8
test al, al
je 0x417c47
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x417c43
movzx eax, byte [ebp - 0x1d]
test al, al
jns 0x417c18
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
lea esi, [ebp - 0x34]
mov ecx, esi
push eax
push edi
call fcn.0046ed80
push ebx
push esi
call fcn.0043a2b4
add esp, 8
mov byte [ebp - 0x35], al
mov ecx, esi
call fcn.0046ee40
mov ebx, 4
cmp byte [ebp - 0x35], 0
je 0x417c69
xor ebx, ebx
jmp 0x417c69
mov ebx, 3
test esi, esi
jne 0x417c69
cmp byte [ebp - 0x1d], 0
jns 0x417c59
mov edi, dword [ebp - 0x28]
push edi
call fcn.00401b54
add esp, 4
jmp 0x417c69
mov ebx, 2
cmp byte [ebp - 0x1d], 0
jns 0x417c7a
push dword [ebp - 0x28]
call fcn.00517bd6
add esp, 4
lea esi, [ebp - 0x1c]
cmp byte [esi + 0xb], 0
jns 0x417c8e
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x417ca4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x417cca
mov eax, dword [edi + 4]
test eax, eax
jne 0x417cfb
xor ebx, ebx
lea esi, [ebp - 0x218]
push 0x208
push ebx
push esi
call fcn.006030b0
add esp, 0xc
push ebx
push 0x1c
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, edi
push esi
mov esi, dword [ebp + 8]
call fcn.0046930c
mov ecx, esi
push edi
call fcn.00468aa8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x418ca6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, 0x208
lea edi, [ebp - 0x218]
push esi
push 0
push edi
call fcn.006030b0
add esp, 0xc
lea eax, [ebp - 0x21c]
mov dword [eax], 1
lea ecx, [ebp - 0x220]
mov dword [ecx], esi
push ecx
push edi
push eax
push 0x63a9f4
push 0x643160
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41adc6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
xor eax, eax
push eax
push eax
push eax
push 0x41ae00
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test eax, eax
je 0x41ade9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne al
pop esi
pop ebp
ret
Function at 0x428cca
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov esi, ecx
mov eax, dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
mov edx, dword [0x6f4e3c]
xor edx, ebp
mov dword [esp + 0x238], edx
mov edx, dword [esi + 0x18]
sub esp, 0x20
movaps xmm0, xmmword [0x647da0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x428dd7
mov edi, dword [ebp + 0x14]
xorps xmm0, xmm0
lea ebx, [esp + 0x210]
movaps xmmword [ebx + 0x10], xmm0
movaps xmmword [ebx], xmm0
cmp dword [esi + 0xc], 1
mov eax, str.POST
mov ecx, 0x647dba
cmove ecx, eax
push ecx
push ebx
call fcn.006207f6
add esp, 8
xor eax, eax
cmp dword [esi + 0x14], 0
setne al
shl eax, 0x13
or eax, 0x80048200
test edi, edi
je 0x428d81
xor ecx, ecx
cmp dword [esi + 0x10], 0
setne cl
shl ecx, 0xc
or ecx, eax
or ecx, 0x800000
mov eax, ecx
xor edi, edi
push edi
push eax
push edi
push edi
push str.HTTP_1.0
push dword [ebp + 0x10]
push ebx
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [esi + 0x20], eax
test eax, eax
je 0x428de2
lea edi, [esp + 8]
push 0x208
push 0
push edi
call fcn.006030b0
add esp, 0xc
push str.Accept:___r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__r_nConnection:close_r_n
push edi
call fcn.00428e62
add esp, 8
push 0xa0000000
push 0xffffffffffffffff
push edi
push dword [esi + 0x20]
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
mov edi, eax
jmp 0x428de9
mov ecx, esi
call fcn.00428c70
xor edi, edi
jmp 0x428de9
mov ecx, esi
call fcn.00428c70
mov ecx, dword [esp + 0x238]
xor ecx, ebp
call fcn.00517c1a
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x428fa6
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x63110
call fcn.00517f10
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x63108], eax
mov esi, 0x208
xor eax, eax
lea edi, [esp + 0x62f00]
push esi
push eax
push edi
call fcn.006030b0
add esp, 0xc
push edi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x62cf8]
push esi
xor eax, eax
push eax
push ebx
call fcn.006030b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push eax
push 0x647e94
push edi
mov edi, dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, esp
mov ecx, esi
call fcn.0048b0f0
mov ecx, esi
call fcn.0048b640
lea esi, [esp + 0x5d530]
push 0x1048
xor eax, eax
push eax
push esi
call fcn.006030b0
add esp, 0xc
push dword [ebp + 8]
push 0x639712
push 0x823
push esi
call fcn.00405a12
add esp, 0x10
test edi, edi
je 0x429084
lea esi, [esp + 0x5e578]
push 0x1048
push 0
push esi
call fcn.006030b0
add esp, 0xc
push edi
push 0x639712
push 0x823
push esi
call fcn.00405a12
add esp, 0x10
lea esi, [esp + 0x5d120]
push 0x208
push 0
push esi
call fcn.006030b0
add esp, 0xc
lea edi, [esp + 0x62cf8]
push edi
push 0x639712
push 0x103
push esi
call fcn.00405a6e
add esp, 0x10
mov dword [esi - 0x5aa78], 0x3e8
mov esi, esp
mov ecx, esi
call fcn.0048b370
mov ecx, esi
push 0xffffffffffffffff
call fcn.0048b7e0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.0048b2c0
mov ecx, dword [esp + 0x63108]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42911b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
lea esi, [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
push 0x647e9a
call fcn.00469188
lea edi, [ebp - 0x1c]
push edi
call fcn.00428ebc
add esp, 4
movzx eax, byte [edi + 0xb]
test al, al
jns 0x429157
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, esi
push eax
push edi
call fcn.00468fc8
cmp byte [ebp - 0x11], 0
jns 0x429171
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
mov ecx, esi
push 0x647ea2
call fcn.00469188
lea edi, [ebp - 0x1c]
push edi
call fcn.00428f64
add esp, 4
movzx eax, byte [edi + 0xb]
test al, al
jns 0x429197
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, esi
push eax
push edi
call fcn.00468fc8
cmp byte [ebp - 0x11], 0
jns 0x4291b1
push dword [ebp - 0x1c]
call fcn.00517bd6
add esp, 4
movzx ebx, byte [esi + 0xb]
test bl, bl
js 0x4291bd
mov eax, ebx
jmp 0x4291c0
mov eax, dword [esi + 4]
inc eax
xor ecx, ecx
dec ecx
add eax, eax
cmovb eax, ecx
push eax
call fcn.00517c03
add esp, 4
mov edi, eax
test bl, bl
js 0x4291dc
mov eax, esi
jmp 0x4291de
mov eax, dword [esi]
push eax
push edi
call fcn.006207f6
add esp, 8
xor eax, eax
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
push ecx
push eax
push edi
push 0x429100
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esi + 0xb], 0
jns 0x42920f
push dword [esi]
call fcn.00517bd6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret