joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d315
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea esi, [edi + 4]
push dword [esi]
call fcn.0047395a
pop ecx
push esi
call fcn.004181d6
mov eax, dword [edi + 0x28]
push dword [eax]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi]
call ebx
lea eax, [ebp - 4]
push eax
call fcn.004029ba
push 0xdc
lea eax, [ebp - 4]
push eax
call fcn.00405388
push 0x40a
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp - 4]
push eax
call ebx
lea eax, [edi + 0x40]
push eax
mov eax, dword [esi]
call fcn.004860ee
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
lea ecx, [edi + 0x30]
push ecx
push 0x47d39a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 4]
mov dword [edi + 0x38], eax
call fcn.00402964
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x47e80c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x1c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0x4ffac4
test eax, eax
je 0x47e85e
push 0xea60
push eax
mov byte [esi + 0xd], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x47e859
cmp dword [ebp - 4], 0x103
jne 0x47e859
push 0
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1c]
call edi
lea ecx, [esi + 0x78]
call fcn.00402964
mov eax, dword [esi + 0x70]
test eax, eax
je 0x47e874
push eax
call edi
and dword [esi + 0x70], 0
mov eax, dword [esi + 0x68]
test eax, eax
je 0x47e882
push eax
call edi
and dword [esi + 0x68], 0
lea ecx, [esi + 0x50]
call fcn.00402964
lea ecx, [esi + 0x48]
call fcn.00402964
lea ecx, [esi + 0x30]
call fcn.00402964
lea ecx, [esi + 0x2c]
call fcn.00402964
lea ecx, [esi + 0x28]
call fcn.00402964
pop edi
leave
ret

Function at 0x47e8ad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x30]
call fcn.0044607b
mov eax, dword [ebp + 0xc]
lea edi, [esi + 0x2c]
call fcn.0044607b
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
cmp eax, ebx
je 0x47e8e7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 8]
push eax
push ebx
push esi
push 0x47ec7a
push ebx
push ebx
mov dword [esi + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
cmp eax, ebx
jne 0x47e90c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47e91c
cmp byte [ebp + 0x14], bl
je 0x47e91a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
jmp 0x47e91c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x47f52a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, eax
call fcn.00480607
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
and dword [ebp - 4], 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp byte [esi + 0x4c], 0
mov dword [ebp + 0xc], eax
je 0x47f55f
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov edi, esi
mov byte [esi + 0xc], 1
call fcn.0047f4a3
mov ecx, dword [ebp + 0xc]
mov byte [esi + 0xc], 0
test ecx, ecx
jbe 0x47f589
cmp dword [ebp - 4], ecx
je 0x47f589
mov eax, 0x2ee2
test eax, eax
jne 0x47f5a0
mov esi, dword [esi + 0x14]
mov edi, dword [ebp + 0x10]
cmp esi, dword [edi]
je 0x47f59e
call fcn.00480607
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
leave
ret 0x10

Function at 0x47f5a6
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
push dword [edi + 0x68]
lea ebx, [edi + 0x44]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebp + 0x14]
mov byte [edi + 0x4d], 0
push dword [ebp + 0x10]
mov dword [edi + 0x40], 3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x47f63c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x47f63e
jmp 0x47f619
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x47f61e
lea esi, [edi + 4]
push ebx
call fcn.0048cb23
mov eax, esi
call fcn.0048cb0c
test al, al
jne 0x47f629
push 0xa
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x47f5ed
cmp dword [edi + 0x3c], 0
jne 0x47f630
mov eax, dword [edi + 0x38]
jmp 0x47f63e
mov eax, 0xe0000008
jmp 0x47f63e
mov edi, dword [edi + 0x38]
test edi, edi
jle 0x47f63c
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x47f645
Capabilities:
Query remote server for available data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push dword [edi + 0x68]
lea ebx, [edi + 0x44]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push dword [esp + 0x1c]
mov byte [edi + 0x4d], 0
push dword [esp + 0x1c]
mov dword [edi + 0x40], 8
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x47f6d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x47f6db
jmp 0x47f6b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x47f6ba
lea esi, [edi + 4]
push ebx
call fcn.0048cb23
mov eax, esi
call fcn.0048cb0c
test al, al
jne 0x47f6c5
push 0xa
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x47f689
cmp dword [edi + 0x3c], 0
jne 0x47f6cc
mov eax, dword [edi + 0x38]
jmp 0x47f6db
mov eax, 0xe0000008
jmp 0x47f6db
mov edi, dword [edi + 0x38]
test edi, edi
jle 0x47f6d9
mov eax, dword [esp + 0x14]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x480219
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004b3b00
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x480256
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x480279
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 3
je 0x480277
cmp eax, 4
je 0x480277
cmp eax, 1
je 0x480277
cmp eax, 2
je 0x480277
push 2
pop eax
jmp 0x480279
xor eax, eax
leave
ret 8

Function at 0x48126a
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi], ebx
jne 0x481282
xor al, al
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 0xc]
push eax
call fcn.004029ba
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0xc]
push 0x4ffb40
push eax
call fcn.0044bda7
mov esi, dword [esi]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
push esi
call sub.msi.dll_MsiEnumClientsA
test eax, eax
je 0x4812ce
cmp dword [ebp - 4], ebx
je 0x4812c4
push dword [ebp - 4]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea ecx, [ebp - 0xc]
call fcn.00402964
jmp 0x48127a
push ebx
push dword [ebp - 4]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x4812b7
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
je 0x481317
cmp dword [ebp - 8], ebx
je 0x4812fb
push dword [ebp - 8]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 4], ebx
je 0x481308
push dword [ebp - 4]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea ecx, [ebp - 0xc]
call fcn.00402964
mov al, bl
jmp 0x48127c
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0048141c
mov byte [ebp + 0xb], al
cmp dword [ebp - 8], ebx
je 0x481332
push dword [ebp - 8]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 4], ebx
je 0x48133f
push dword [ebp - 4]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov bl, byte [ebp + 0xb]
jmp 0x481308

Function at 0x481628
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0x7d1
push dword [ebp + 4]
lea esi, [ebp + 0x20]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x481668
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
push edi
call fcn.004028cf
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.00402917
pop edi
jmp 0x48166d
call fcn.004053cd
push 1
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_EndDialog]
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x4816ca
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
test ecx, ecx
jne 0x4816eb
xor al, al
jmp 0x48180b
push 2
lea esi, [ebp - 0x408]
pop edi
jmp 0x4816fd
mov word [esi], ax
add ecx, edi
add esi, edi
movzx eax, word [ecx]
test ax, ax
jne 0x4816f6
xor eax, eax
mov word [esi], ax
push 0x5c
xor dl, dl
pop ebx
sub esi, edi
xor al, al
mov byte [ebp - 0x409], dl
cmp word [ebp - 0x408], bx
jne 0x48173b
cmp word [ebp - 0x406], bx
jne 0x48173b
mov byte [ebp - 0x409], 1
cmp word [esi], bx
je 0x481742
inc al
jmp 0x481742
cmp word [esi], bx
jne 0x481742
mov dl, 1
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x410], ecx
cmp word [ebp - 0x404], bx
je 0x481764
add ecx, edi
cmp word [ecx], bx
jne 0x481757
mov dword [ebp - 0x410], ecx
test al, al
jne 0x48176e
test dl, dl
je 0x48177e
jmp 0x481777
add esi, edi
mov eax, ebx
mov word [esi], ax
add esi, edi
xor eax, eax
mov word [esi], ax
sub esi, edi
and dword [ebp - 0x418], 0
and dword [ebp - 0x414], 0
lea eax, [ebp - 0x420]
push eax
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x4817ec
cmp word [esi], bx
jne 0x4817ba
jmp 0x4817b8
cmp word [esi], bx
je 0x4817c4
sub esi, edi
lea eax, [ebp - 0x408]
cmp esi, eax
ja 0x4817b3
cmp esi, dword [ebp - 0x410]
jb 0x4816e4
cmp byte [ebp - 0x409], 0
jne 0x4817e1
cmp esi, dword [ebp - 0x410]
jne 0x4817e3
add esi, edi
xor eax, eax
mov word [esi], ax
sub esi, edi
jmp 0x48178c
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x414]
ja 0x481809
jb 0x481804
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x418]
jae 0x481809
xor eax, eax
inc eax
jmp 0x48180b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b196e
leave
ret

Function at 0x481843
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [esi], bl
je 0x481854
mov al, 1
jmp 0x4818da
mov al, byte [ebp + 8]
push edi
mov byte [esi + 1], al
mov eax, dword [ebp + 0xc]
lea edi, [esi + 4]
mov byte [esi], 1
call fcn.0044607b
push 0x4ffbc0
lea eax, [ebp + 8]
push eax
call fcn.004054af
mov edi, dword [edi]
push dword [edi - 0xc]
lea eax, [ebp + 8]
push edi
call fcn.00446332
pop edi
cmp byte [esi + 1], bl
je 0x4818b2
push ebx
push 0x1388
mov eax, 0x7f90
push eax
push eax
push 0xff
push 6
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 8], eax
cmp byte [esi + 1], bl
jne 0x4818c9
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp dword [esi + 8], 0xffffffff
lea ecx, [ebp + 8]
setne bl
call fcn.00402964
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x481aa1
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp byte [ebp + 0x10], bl
jne 0x481ad3
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x481ad3
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x217
neg eax
sbb eax, eax
inc eax
jne 0x481ad3
cmp byte [esi + 0x11], bl
je 0x481b25
mov eax, dword [esi + 0xc]
push edi
push ebx
lea ecx, [ebp + 0x10]
push ecx
push 0x7f90
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 0xc]
xor edi, edi
shr ecx, 1
mov word [edx + ecx*2], di
pop edi
cmp eax, ebx
je 0x481b25
cmp dword [ebp + 0x10], ebx
je 0x481b25
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.004054af
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0041804a
lea ecx, [ebp - 4]
call fcn.00402964
jmp 0x481b2d
push dword [ebp + 8]
call fcn.004029ba
mov eax, dword [ebp + 8]
pop ebx
leave
ret 0xc

Function at 0x481b35
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xffffffff
jne 0x481b46
push edi
call fcn.004029ba
jmp 0x481b70
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [ebp + 0xc]
push edx
add ecx, ecx
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x481b3e
push 1
push dword [ebp + 8]
push edi
call fcn.00481aa1
mov eax, edi
pop ebp
ret 8

Function at 0x481b76
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [eax]
push 0
lea ecx, [esp + 4]
push ecx
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop ecx
ret
Function at 0x4820d1
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.004b3b00
add esp, 0xc
push 0x64
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x40], esi
mov edi, dword [eax - 0xc]
mov ebx, 0x52702c
push eax
mov ecx, ebx
lea esi, [ebp - 4]
call fcn.0043b146
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x482145
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 4]
call fcn.00402964
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b146
mov edi, dword [ebp + 0x14]
mov eax, esi
call fcn.0044607b
mov ecx, esi
call fcn.00402964
push dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b146
mov edi, dword [ebp + 0x18]
mov eax, esi
call fcn.0044607b
mov ecx, esi
call fcn.00402964
cmp dword [ebp - 0x24], 0
je 0x4821ae
push dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b146
mov edi, dword [ebp + 0x1c]
mov eax, esi
call fcn.0044607b
mov ecx, esi
call fcn.00402964
cmp dword [ebp - 0x1c], 0
je 0x4821d5
push dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b146
mov edi, dword [ebp + 0x20]
mov eax, esi
call fcn.0044607b
mov ecx, esi
call fcn.00402964
cmp dword [ebp - 0xc], 0
je 0x4821fc
push dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov ecx, ebx
lea esi, [ebp + 8]
call fcn.0043b146
mov edi, dword [ebp + 0x24]
mov eax, esi
call fcn.0044607b
mov ecx, esi
call fcn.00402964
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ax, word [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
xor esi, esi
jmp 0x482136
Function at 0x482316
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x52472c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocStringLen
push ecx
mov dword [ebp - 0x90], eax
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x98], esi
cmp esi, 0xffffffff
jne 0x482360
push eax
jmp 0x48239e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x482399
cmp eax, dword [ebp + 0xc]
jbe 0x482399
sub eax, dword [ebp + 0xc]
mov edi, 0x10000
mov dword [ebp - 0x8c], eax
push edi
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], ebx
call fcn.0044445d
cmp dword [ebp - 0x80], ebx
jne 0x4823b5
push ebx
call fcn.004b39a5
pop ecx
cmp esi, ebx
je 0x4823a4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b196e
leave
ret
lea eax, [ebp - 0x78]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x79], bl
call fcn.004ae6f0
jmp 0x4823d4
mov esi, dword [ebp - 0x98]
push ebx
lea eax, [ebp - 0x88]
push eax
push edi
push dword [ebp - 0x80]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x482430
mov esi, dword [ebp - 0x88]
cmp esi, ebx
je 0x482430
mov eax, dword [ebp - 0x84]
lea ecx, [esi + eax]
cmp ecx, dword [ebp - 0x8c]
jbe 0x482418
mov esi, dword [ebp - 0x8c]
sub esi, eax
mov dword [ebp - 0x88], esi
mov byte [ebp - 0x79], 1
push dword [ebp - 0x80]
mov eax, esi
lea ecx, [ebp - 0x78]
call fcn.004ae510
add dword [ebp - 0x84], esi
cmp byte [ebp - 0x79], bl
je 0x4823ce
lea esi, [ebp - 0x78]
call fcn.004ae5d0
mov ebx, dword [ebp - 0x90]
mov eax, esi
call fcn.004ae6a0
push dword [ebp - 0x80]
mov bl, al
call fcn.004b39a5
cmp dword [ebp - 0x98], 0
pop ecx
je 0x482465
push dword [ebp - 0x98]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x4823a6
Function at 0x482804
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [eax + 0x10], ebx
cmp dword [eax + 4], edi
je 0x482896
cmp ebx, edi
je 0x482841
push edi
push edi
push edi
push edi
lea esi, [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.00419873
push dword [esi]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x20]
mov eax, dword [ebp + 8]
xor edi, edi
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push 0x48289f
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp ebx, edi
je 0x482861
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x48288b
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x482887
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x482898
cmp esi, edi
je 0x482896
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x482db0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x2e
mov esi, ebx
mov edi, eax
call fcn.004460e6
test eax, eax
jg 0x482dd2
mov al, 1
jmp 0x482f0f
lea ecx, [ebp - 8]
push ecx
push ebx
mov ecx, eax
call fcn.0043aef2
lea eax, [ebp - 0x14]
push eax
call fcn.004029ba
push dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push dword [ebx]
push dword [eax]
lea eax, [ebp - 0x14]
push str.__verbose___log_file__s____remove_pack_file___s____s_
push eax
call fcn.0044bda7
add esp, 0x14
cmp dword [edi + 0x10], 0
je 0x482e11
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
push 0
push 0x8000008
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.004717ba
add esp, 0x14
lea esi, [ebp - 8]
mov byte [ebp - 1], 1
call fcn.004600e0
test al, al
je 0x482e49
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x482ee0
lea eax, [ebp - 0x10]
push eax
call fcn.004029ba
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00472009
pop ecx
lea eax, [ebp - 0xc]
push eax
call fcn.004029ba
push 0xca
lea esi, [ebp - 0x18]
call fcn.00481de6
mov eax, dword [ebp - 8]
mov ebx, dword [eax - 0xc]
mov eax, dword [ebp - 0x18]
pop ecx
push 0x5c
lea esi, [ebp - 8]
mov dword [ebp - 0x1c], eax
call fcn.004460e6
mov ecx, ebx
sub ecx, eax
lea eax, [ebp - 0x20]
push eax
mov eax, esi
push eax
call fcn.0043ae96
push dword [ebp - 0x10]
push dword [eax]
lea eax, [ebp - 0xc]
push dword [ebp - 0x1c]
push eax
call fcn.0044bda7
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.00402964
push 0
lea esi, [ebp - 0xc]
call fcn.00478331
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 1], 0
call fcn.00402964
mov ecx, esi
call fcn.00402964
lea ecx, [ebp - 0x10]
call fcn.00402964
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x10], 0
je 0x482efc
mov edi, dword [edi + 0x10]
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x18]
lea ecx, [ebp - 0x14]
call fcn.00402964
lea ecx, [ebp - 8]
call fcn.00402964
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x482fe2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebx + 0x10], eax
cmp dword [eax], edi
je 0x483019
push edi
push edi
push edi
push edi
lea esi, [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.00419873
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x48323d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x18], esi
cmp dword [eax], edi
je 0x48306f
mov edi, ebx
call fcn.004830ad
mov ebx, dword [ebx + 4]
mov esi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], edx
call fcn.0046e8b2
add esi, eax
adc dword [ebp - 0xc], edx
mov eax, dword [edi + 0x10]
push dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
call dword [eax]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebp - 0x18]
xor edi, edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x483099
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x483095
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x4830a6
cmp esi, edi
je 0x4830a4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x48359b
Capabilities:
Get geographical location

Disassembly:
push ebp
push esi
push edi
push 0
push 0x4f6cb2
movzx ebx, bx
push 0x1001
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, eax
mov ecx, 0x52702c
lea edi, [ebp - 1]
call fcn.00402987
test edi, edi
jle 0x4835e4
push edi
call fcn.00447212
push edi
push 0x78
push eax
call fcn.004b3b00
add esp, 0xc
mov eax, edi
mov edx, esi
call fcn.00447238
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x4835f8
push dword [eax + 4]
push esi
call fcn.00447339
mov eax, dword [esi]
push ebp
push eax
push 0x1001
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x48360e
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004b3b00
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push edi
push edi
push eax
mov dword [ebp - 0x28], 0x64
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x483652
push ebx
call fcn.004029ba
jmp 0x48365f
push dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov eax, ebx
call fcn.0047255f
mov eax, ebx
pop edi
leave
ret