joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
push edi
mov dword [esi + 0x20], 0
lea edi, [esi + 0x5c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x80], 0
test ecx, ecx
je 0x46228c
movzx eax, byte [ecx]
mov byte [edi], al
movzx eax, byte [ecx + 1]
mov byte [esi + 0x5d], al
movzx eax, byte [ecx + 2]
mov byte [esi + 0x5e], al
mov al, byte [ecx + 3]
jmp 0x462297
mov word [esi + 0x5d], 0xffff
or al, 0xff
mov byte [edi], 0xff
mov ecx, dword [esp + 0x14]
mov byte [esi + 0x5f], al
test edi, edi
je 0x4622c4
test ecx, ecx
jne 0x4622c4
cmp byte [edi], 0xff
jne 0x4622bd
cmp byte [edi + 1], 0xff
jne 0x4622bd
cmp byte [edi + 2], 0xff
jne 0x4622bd
cmp byte [edi + 3], 0xff
je 0x4622c4
mov eax, 1
jmp 0x4622c6
xor eax, eax
mov edx, dword [esp + 0xc]
push dword [esp + 0x20]
mov dword [esi + 0x58], eax
mov dword [esi + 4], ecx
mov dword [esi + 0x88], 0
mov dword [esi], 0
mov eax, dword [edx + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov ecx, dword [edx]
mov dword [esi + 0x10], ecx
mov eax, dword [edx + 8]
mov dword [esi + 0x18], eax
lea eax, [ecx + 7]
mov ecx, esi
shr eax, 3
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x20]
neg eax
mov dword [esi + 0x40], eax
call fcn.00462820
cmp dword [esi + 0x58], 0
je 0x4623aa
movsx eax, byte [esi + 0x5e]
mov dword [esi + 0x6c], eax
movsx eax, byte [edi]
xor edi, edi
mov dword [esi + 0x68], eax
push ebx
movsx eax, byte [esi + edi*2 + 0x5c]
test edi, edi
je 0x46233e
add eax, dword [esi + 0x3c]
test eax, eax
js 0x462352
mov ebx, eax
cdq
and edx, 7
and ebx, 7
add eax, edx
sar eax, 3
jmp 0x46236b
not eax
mov ebx, 7
mov ecx, eax
cdq
and edx, 7
and ecx, 7
add eax, edx
sub ebx, ecx
sar eax, 3
not eax
mov dword [esi + edi*4 + 0x68], eax
test edi, edi
jne 0x46237f
mov eax, 0x1c
sub eax, ebx
mov dword [esi + 0x78], eax
jmp 0x462389
mov eax, 0x13
sub eax, ebx
mov dword [esi + 0x7c], eax
inc edi
cmp edi, 2
jb 0x462332
mov al, byte [esi + 0x5d]
neg al
mov byte [esi + 0x5d], al
pop ebx
jne 0x4623aa
cmp dword [esi + 0x68], 0xffffffff
jl 0x4623aa
mov dword [esi + 0x88], 1
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x48], eax
mov eax, esi
pop edi
pop esi
ret 0x18
Function at 0x462820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x63b681
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0x10
test edi, edi
je 0x46293e
mov esi, dword [ebx + 0x3c]
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp + 8], eax
test esi, esi
jns 0x4628d8
neg esi
mov eax, 8
and esi, 7
sub eax, esi
mov dword [ebp - 0x18], eax
add eax, ecx
mov dword [ebp - 0x14], eax
call fcn.004463f0
add esp, 4
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test eax, eax
je 0x462899
push esi
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00455530
jmp 0x46289b
xor eax, eax
push 0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
call fcn.00455740
mov ecx, dword [ebx]
push 4
push 0
push 0
push esi
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
push 0
push esi
push edi
call fcn.00455a60
sub esi, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x3c], esi
mov esi, dword [ebx]
mov dword [ebp + 8], eax
jmp 0x46297c
and esi, 7
lea eax, [esi + ecx]
mov dword [ebp - 0x18], eax
call fcn.004463f0
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x462906
push dword [ebp + 8]
mov ecx, eax
push dword [ebp - 0x18]
call fcn.00455530
jmp 0x462908
xor eax, eax
push 0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], eax
call fcn.00455740
mov ecx, dword [ebx]
push 4
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x10]
push 0
push esi
push edi
call fcn.00455a60
sub dword [ebx + 0x3c], esi
mov eax, dword [ebx + 0x40]
mov esi, dword [ebx]
mov dword [ebp + 8], eax
jmp 0x46297c
call fcn.004463f0
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x462963
push 1
push 1
mov ecx, eax
call fcn.00455530
mov esi, eax
jmp 0x462965
xor esi, esi
mov dword [ebx], esi
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x3c], 0
mov dword [ebp + 8], 0
mov ecx, dword [esi]
mov dword [ebx + 0x2c], ecx
mov eax, dword [esi + 4]
mov dword [ebx + 0x30], eax
mov edi, dword [esi + 0xc]
lea eax, [ecx + 7]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x24], edi
mov esi, dword [esi + 8]
mov dword [ebx + 0x38], esi
imul esi, dword [ebp + 8]
cdq
and edx, 7
add eax, edx
sar eax, 3
add esi, edi
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x28], esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x462a30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63b6b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov eax, ecx
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x465a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00465ba0
add esp, 4
test eax, eax
je 0x465a69
mov eax, 0xfffffffe
pop esi
ret
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov eax, dword [edi + 8]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x14], 0
test eax, eax
jns 0x465aa2
neg eax
mov dword [edi + 0x18], eax
cmp eax, 2
jne 0x465aac
lea ecx, [eax + 0x37]
jmp 0x465ab8
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffffb9
add ecx, 0x71
mov dword [edi + 4], ecx
push 0
push 0
push 0
cmp eax, 2
jne 0x465acd
call fcn.00459df0
jmp 0x465ad2
call fcn.0046a0f0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0
push edi
call fcn.00468c40
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push dword [esi + 0x44]
call fcn.0046a3a0
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x65a092]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x65a090]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x65a094]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x65a096]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
Function at 0x46adc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63b706
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6eed24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x34], 0
call fcn.0046d330
mov dword [esi + 0x28], 1
mov eax, esi
mov dword [esi + 0x2c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46d940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63b8a6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x6eed24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x20], 0
mov eax, ecx
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov byte [ecx + 0x30], 1
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x475200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63bec8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6eed24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push dword [esi + 4]
call fcn.00474f50
test al, al
je 0x475300
mov dword [ebp + 8], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.00474ba0
add esp, 0xc
test al, al
je 0x475300
xor edi, edi
mov bl, 1
cmp dword [esi + 4], edi
jbe 0x475298
mov ecx, dword [esi]
mov dl, byte [ecx + edi]
mov al, dl
xor al, bl
mov bl, dl
xor al, 1
mov byte [ecx + edi], al
inc edi
cmp edi, dword [esi + 4]
jb 0x475282
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.00474ba0
add esp, 0xc
test al, al
je 0x475300
xor edi, edi
mov bl, 1
cmp dword [esi + 4], edi
jbe 0x4752c9
mov ecx, dword [esi]
mov dl, byte [ecx + edi]
mov al, dl
xor al, bl
mov bl, dl
mov byte [ecx + edi], al
inc edi
cmp edi, dword [esi + 4]
jb 0x4752b5
mov ebx, dword [ebp + 8]
inc ebx
mov dword [ebp + 8], ebx
cmp ebx, 4
jb 0x475261
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push ebx
push eax
push esi
call fcn.00474ba0
add esp, 0xc
test al, al
je 0x475300
push ebx
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.00474ba0
add esp, 0xc
test al, al
je 0x475300
mov bl, 1
jmp 0x475302
xor bl, bl
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 1
test eax, eax
je 0x475319
push eax
call fcn.00446420
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476730
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
lea ebx, [esi + 0x18]
mov ecx, ebx
call fcn.004761b0
lea ebp, [esi + 0x24]
mov ecx, ebp
call fcn.004761b0
lea eax, [esp + 0xc]
mov dword [esi + 0x54], 0
push eax
push 0x20119
push 0
push str.SoftwareTracker_SoftwareVault
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4767ef
push dword [esp + 0x20]
mov ecx, esi
push 0
push ebp
push ebx
push eax
call fcn.00476850
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 2
push eax
push 0
push str.KeyProtectionMode
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4767e5
cmp dword [esp + 0x10], 4
jne 0x4767e5
cmp dword [esp + 0x14], 4
jne 0x4767e5
mov eax, dword [esp + 0x18]
cmp eax, 2
jae 0x4767e5
mov dword [esi + 0x54], eax
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x50], 0
jne 0x47683b
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0x20119
push 0
push str.SoftwareTracker_SoftwareVault
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47683b
push dword [esp + 0x20]
mov ecx, esi
push 1
push ebp
push ebx
push eax
call fcn.00476850
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x477540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x63c1c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6eed24]
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x10], 0
je 0x47770d
xor ebx, ebx
mov dword [edi + 0x10], 0
xor esi, esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
push 0x20119
push esi
push str.SoftwareMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x477629
xor ecx, ecx
mov dword [ebp - 0x18], 0x80
mov word [ebp], cx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push esi
push str.MachineGuid
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47761b
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x4775fe
cmp eax, 7
jne 0x47761b
lea esi, [ebp]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x477604
sub esi, ecx
sar esi, 1
test esi, esi
jg 0x477693
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x477629
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
test esi, esi
je 0x4776da
mov eax, 0x649aa0
test ebx, ebx
je 0x477649
mov eax, ebx
push edi
push eax
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
jne 0x4776da
xor dword [edi], 0x4e7a1eda
mov eax, 0xacd
xor word [edi + 4], ax
mov eax, 0x4bd9
xor word [edi + 6], ax
xor byte [edi + 8], 0xad
xor byte [edi + 9], 0x2e
xor byte [edi + 0xa], 0x59
xor byte [edi + 0xb], 0xf1
xor byte [edi + 0xc], 0x17
xor byte [edi + 0xd], 0x99
xor byte [edi + 0xe], 0x9a
xor byte [edi + 0xf], 0xbb
jmp 0x4776f9
lea eax, [esi*2 + 2]
push eax
push 0
call fcn.00446560
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x477619
xor ecx, ecx
mov dword [ebp - 0x20], esi
mov word [eax], cx
add esi, esi
push esi
lea ecx, [ebp]
mov ebx, eax
push ecx
push eax
call fcn.004b3b20
mov eax, ebx
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
mov esi, dword [ebp - 0x20]
jmp 0x47761b
mov eax, dword [0x65bae4]
mov dword [edi], eax
mov eax, dword [0x65bae8]
mov dword [edi + 4], eax
mov eax, dword [0x65baec]
mov dword [edi + 8], eax
mov eax, dword [0x65baf0]
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x47770d
push ebx
call fcn.00446420
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.004b2558
lea esp, [ebp + 0x108]
pop ebp
ret
Function at 0x47ac30
Capabilities:
Query remote server for available data

Disassembly:
jmp 0x47bf20
push esi
xor esi, esi
push esi
push esi
push dword [esp + 0x10]
push dword [ecx]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x47bf54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
js 0x47bf54
jne 0x47bf4b
xor esi, esi
mov eax, esi
pop esi
ret 4
movzx esi, si
or esi, 0x83ff0000
mov eax, esi
pop esi
ret 4
Function at 0x47b470
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63c730
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x6eed24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 8]
mov ecx, edx
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0
lea edi, [ecx + 2]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x2c], 1
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b510
lea eax, [ebp - 0x64]
sub ecx, edi
push eax
push 0
sar ecx, 1
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x47b551
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x47b693
je 0x47b551
movzx eax, ax
or eax, 0x83ff0000
test eax, eax
js 0x47b693
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x47b564
push eax
push dword [ebp - 0x48]
lea ecx, [esi + 0x4c]
call fcn.00403940
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x47b577
push eax
push dword [ebp - 0x40]
lea ecx, [esi + 0x58]
call fcn.00403940
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x47b595
push 0x23
push eax
call fcn.004b47e1
add esp, 8
test eax, eax
je 0x47b595
sub eax, dword [ebp - 0x30]
sar eax, 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
push dword [ebp - 0x54]
call fcn.004031a0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
push dword [ebp - 0x38]
call fcn.004031a0
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x47b5f9
push eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1c]
call fcn.004031a0
mov eax, dword [ebp - 0x58]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
sub eax, 1
je 0x47b626
sub eax, 2
je 0x47b61f
sub eax, 1
je 0x47b618
mov esi, 0x80004005
jmp 0x47b66c
mov eax, 2
jmp 0x47b628
mov eax, 1
jmp 0x47b628
xor eax, eax
mov ecx, 0x649aa0
test ebx, ebx
je 0x47b633
mov ecx, ebx
push eax
movzx eax, word [ebp - 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.00478fb0
mov esi, eax
test esi, esi
js 0x47b66c
mov eax, 0x649aa0
test edi, edi
je 0x47b652
mov eax, edi
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push eax
call fcn.0047ae90
mov esi, eax
mov byte [ebp - 4], 2
test edi, edi
je 0x47b67d
push edi
call fcn.00446420
add esp, 4
mov dword [ebp - 4], 3
test ebx, ebx
je 0x47b691
push ebx
call fcn.00446420
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x47c6c0
Capabilities:
Check http status code

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x13
call fcn.0047bf60
test eax, eax
js 0x47c737
mov eax, dword [esp]
cmp eax, 0x12c
jae 0x47c6e5
xor eax, eax
pop ecx
ret
cmp eax, 0x190
jb 0x47c723
cmp eax, 0x1f4
jae 0x47c71c
mov ecx, eax
sub ecx, 0x191
je 0x47c715
sub ecx, 3
je 0x47c70e
sub ecx, 3
jne 0x47c723
mov eax, 0x82211197
pop ecx
ret
mov eax, 0x42211194
pop ecx
ret
mov eax, 0x82211191
pop ecx
ret
cmp eax, 0x258
jae 0x47c732
add eax, 0x1000
movzx eax, ax
or eax, 0x82210000
pop ecx
ret
mov eax, 0x80004005
pop ecx
ret
Function at 0x47cfe0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x41c
mov eax, dword [0x6eed24]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
mov esi, dword [esp + 0x424]
push edi
mov edi, dword [esp + 0x42c]
mov eax, dword [edi]
mov dword [edi + 4], 0
test eax, eax
je 0x47d016
xor ecx, ecx
mov word [eax], cx
cmp esi, 0x400
jge 0x47d07d
push 0x20a
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004b40a0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
mov ecx, edi
push 0xffffffffffffffff
lea eax, [esp + 0xc]
push eax
call fcn.00403940
push 0x5c
push edi
call fcn.00471640
add esp, 8
xor eax, eax
test esi, esi
setns al
pop edi
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.004b2558
add esp, 0x41c
ret
xor eax, eax
nop
cmp dword [eax*8 + 0x664014], esi
je 0x47d0a8
inc eax
cmp eax, 0x10
jb 0x47d080
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.004b2558
add esp, 0x41c
ret
mov eax, dword [eax*8 + 0x664010]
test eax, eax
je 0x47d08f
push 0x104
lea ecx, [esp + 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x47d08f
push 0xffffffffffffffff
lea eax, [esp + 0x218]
mov ecx, edi
push eax
call fcn.00403940
mov ecx, dword [esp + 0x420]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004b2558
add esp, 0x41c
ret
Function at 0x493950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
push ebx
push esi
mov esi, dword [esp + 0x74]
test esi, esi
je 0x493ae1
mov eax, dword [esp + 0x78]
test eax, eax
je 0x493ae1
mov ebx, dword [esp + 0x7c]
test ebx, ebx
je 0x493ae1
mov ecx, dword [esp + 0x80]
test ecx, ecx
je 0x493ae1
cmp word [ebx + 0x40], 0
push ebp
push edi
jne 0x493aca
add eax, 4
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp word [ebx + 0x40], 0
jne 0x493ab9
mov eax, dword [ebx + 0x30]
mov edi, dword [sym.imp.USER32.dll_GetClassInfoExW]
test eax, eax
je 0x493a23
mov ecx, dword [ebx + 8]
mov ebp, dword [ebx + 0x28]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push 0
mov dword [esp + 0x24], 0x30
call edi
test eax, eax
jne 0x493a00
lea eax, [esp + 0x18]
push eax
push dword [ebx + 0x30]
push dword [esi + 4]
call edi
test eax, eax
jne 0x493a00
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret
mov ecx, 0xc
lea esi, [esp + 0x18]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 8]
mov esi, dword [esp + 0x7c]
mov dword [ebx + 0x34], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x28], ebp
mov dword [ebx + 8], eax
jmp 0x493a40
cmp dword [ebx + 0x3c], 0
je 0x493a2d
xor eax, eax
jmp 0x493a30
mov eax, dword [esi + 8]
push dword [ebx + 0x38]
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov ebp, dword [ebx + 0x28]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 4]
and dword [ebx + 4], 0xffffbfff
mov dword [ebx + 0x14], eax
test ebp, ebp
jne 0x493a6b
push ebx
push 0x6541d4
lea ebp, [ebx + 0x42]
push 0x25
push ebp
call fcn.00435b80
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [ebx + 0x28], ebp
mov ecx, 0xc
lea edi, [esp + 0x48]
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x48]
push ecx
push ebp
push eax
call dword [sym.imp.USER32.dll_GetClassInfoExW]
mov word [ebx + 0x40], ax
test ax, ax
jne 0x493ab9
push ebx
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx esi, ax
mov dword [esp + 0x7c], esi
test si, si
je 0x493ab5
mov ecx, dword [esp + 0x80]
lea eax, [esp + 0x7c]
push eax
add ecx, 0x20
call fcn.004941e0
mov word [ebx + 0x40], si
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x88]
cmp dword [ebx + 0x30], 0
je 0x493ad5
mov eax, dword [ebx + 0x34]
mov dword [ecx], eax
mov ax, word [ebx + 0x40]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x68
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret