joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b460
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
push esi
push 0
mov esi, eax
mov eax, dword [esp + 0x20]
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44b509
call fcn.0044b310
test eax, eax
jne 0x44b509
mov eax, 1
test byte [0x4f1904], al
jne 0x44b4d5
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x8e
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0044b180
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x400
push edx
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x44b502
test eax, eax
je 0x44b502
test ecx, 0x1ff
jne 0x44b502
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x44cb30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44cbd4
call fcn.0044cad0
test eax, eax
jne 0x44cbd4
mov eax, 1
test byte [0x4f1904], al
jne 0x44cba3
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x76
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0044ca00
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x44cc07
test ecx, ecx
je 0x44cbcd
test eax, eax
je 0x44cbcd
test ecx, 0x1ff
jne 0x44cbcd
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x44cc20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44ccc7
call fcn.0044cad0
test eax, eax
jne 0x44ccc7
mov eax, 1
test byte [0x4f1904], al
jne 0x44cc93
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x8e
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0044ca00
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x44ccfa
test ecx, ecx
je 0x44ccc0
test eax, eax
je 0x44ccc0
test ecx, 0x1ff
jne 0x44ccc0
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x44edf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44ee94
call fcn.0044ed90
test eax, eax
jne 0x44ee94
mov eax, 1
test byte [0x4f1904], al
jne 0x44ee63
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x76
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0044ecc0
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x44eec7
test ecx, ecx
je 0x44ee8d
test eax, eax
je 0x44ee8d
test ecx, 0x1ff
jne 0x44ee8d
mov eax, 1
pop esi
add esp, 0xc
ret

Function at 0x44eee0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44ef87
call fcn.0044ed90
test eax, eax
jne 0x44ef87
mov eax, 1
test byte [0x4f1904], al
jne 0x44ef53
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x8e
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.0044ecc0
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_WriteSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x44efba
test ecx, ecx
je 0x44ef80
test eax, eax
je 0x44ef80
test ecx, 0x1ff
jne 0x44ef80
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x453910
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4539b4
call fcn.004538b0
test eax, eax
jne 0x4539b4
mov eax, 1
test byte [0x4f1904], al
jne 0x453983
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x76
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.004537e0
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x4539e7
test ecx, ecx
je 0x4539ad
test eax, eax
je 0x4539ad
test ecx, 0x1ff
jne 0x4539ad
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x454520
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push 0
push 0x200
push eax
push ecx
call sub.ntdll.dll__allmul
push 0
mov dword [esp + 0x10], edx
lea edx, [esp + 0x10]
push edx
push eax
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4545c4
call fcn.004544c0
test eax, eax
jne 0x4545c4
mov eax, 1
test byte [0x4f1904], al
jne 0x454593
or dword [0x4f1904], eax
push 0x467ae0
mov dword [0x4f18dc], 0x4dbdb8
mov dword [0x4f18e0], 0xffffffff
call fcn.00462d9a
add esp, 4
mov esi, dword [0x4f18dc]
push 0x76
mov ecx, str.d:workDDCIncludeDiskIO.h
add esi, 8
call fcn.004543f0
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_SetSectorPos_in_ReadSector.
push 0x4f18dc
call eax
add esp, 0xc
xor eax, eax
pop esi
add esp, 0xc
ret
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov edx, esi
shl edx, 9
push edx
push eax
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
or esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
je 0x4545f7
test ecx, ecx
je 0x4545bd
test eax, eax
je 0x4545bd
test ecx, 0x1ff
jne 0x4545bd
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x456480
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4e9028]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x206
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call sub.ntdll.dll_memset
xor ecx, ecx
add esp, 0xc
test edi, edi
setne cl
mov esi, ecx
test esi, esi
jne 0x4564e2
push 0x96
call fcn.00455e40
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00462b77
add esp, 0x20c
ret
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x456500
sub eax, edx
xor ecx, ecx
sar eax, 1
cmp eax, 0x104
setl cl
mov esi, ecx
test esi, esi
jne 0x456544
push 0xa3
call fcn.00455e40
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00462b77
add esp, 0x20c
ret
lea eax, [esp + 4]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x456550
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00462b77
add esp, 0x20c
ret
Function at 0x457b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x457b47
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x457b78
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x457b74
cmp esi, eax
jae 0x457b78
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x457b64
cmp esi, eax
jb 0x457b7e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x457f00
Capabilities:
Access peb ldr_data
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x46715b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4e9028]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [0x4eb310]
mov edx, dword [eax + 0xc]
mov ecx, 0x4eb310
call edx
add eax, 0x10
mov dword [esi + 0x34], eax
mov dword [esp + 0x18], ebx
call fcn.0045a8a0
mov dword [esi + 0x3c], eax
mov byte [eax + 0x19], 1
mov eax, dword [esi + 0x3c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3c]
mov dword [eax], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
xor eax, eax
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
push ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
push ebx
mov dword [esi + 0x24], eax
push ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
push ebx
mov dword [esi + 0x30], eax
push str.Aomei_Backupper_for_Windows
mov dword [esi + 0xc], 0x28
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea ecx, [esp + 0x24]
push ecx
push 2
mov ebx, 0x36ee80
push eax
mov dword [esi], eax
mov dword [esp + 0x30], ebx
call edi
mov eax, dword [esi]
push 4
lea edx, [esp + 0x24]
push edx
push 5
push eax
mov dword [esp + 0x30], ebx
call edi
mov edx, dword [esi]
push 4
lea ecx, [esp + 0x24]
push ecx
push 6
push edx
mov dword [esp + 0x30], ebx
call edi
push 4
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], ebx
push 4
mov ecx, dword [esi]
push ecx
call edi
mov eax, dword [esi]
push 4
lea edx, [esp + 0x24]
push edx
push 3
push eax
mov dword [esp + 0x30], 2
call edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4580f0
Capabilities:
Connect to http server

Disassembly:
push 0xffffffffffffffff
push 0x467128
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4e9028]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x45812d
push eax
call edi
mov dword [esi + 8], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x45813a
push eax
call edi
mov dword [esi + 4], ebx
cmp dword [esi], ebx
je 0x458196
mov eax, dword [0x4eb310]
mov edx, dword [eax + 0xc]
mov ecx, 0x4eb310
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [0x4eb310]
mov edx, dword [eax + 0xc]
mov ecx, 0x4eb310
mov byte [esp + 0x14], bl
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], bx
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x34]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], ebx
call fcn.00457d60
test al, al
jne 0x4581ad
lea esi, [esp + 0x10]
call fcn.00458220
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
push ebx
push ebx
push 3
push ebx
push ebx
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x45818d
cmp byte [esp + 0x14], bl
mov ecx, 0x4480200
je 0x4581dd
mov ecx, 0x4c80200
push ebx
push ecx
mov ecx, dword [esp + 0x28]
push ebx
push ebx
push ebx
push ecx
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
cmp eax, ebx
mov dword [esi + 8], eax
lea esi, [esp + 0x10]
je 0x458191
call fcn.00458220
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x458580
Capabilities:
Send data

Disassembly:
sub esp, 0x10
push ebx
push ebp
push edi
mov edi, dword [esp + 0x24]
mov ebp, dword [edi + 4]
xor ebx, ebx
cmp ebp, ebx
jne 0x4585d7
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4585c4
push ebx
push ebx
push ebx
lea ecx, [esi + 0xc]
push ecx
push eax
mov dword [esi + 0x28], ebx
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
setne al
cmp al, bl
mov byte [esi + 0x44], bl
je 0x4585c4
mov edx, dword [esi + 8]
push ebx
push ebx
push ebx
push edx
call dword [sym.imp.WININET.dll_HttpEndRequestW]
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], 1
pop ebx
add esp, 0x10
ret 0x10
cmp byte [esp + 0x28], bl
je 0x458614
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x458601
push ebx
push ebx
push ebx
lea ecx, [esi + 0xc]
push ecx
push eax
mov dword [esi + 0x28], ebp
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
setne al
cmp al, bl
mov byte [esi + 0x44], bl
jne 0x458614
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], 5
pop ebx
add esp, 0x10
ret 0x10
mov edx, dword [edi]
mov eax, dword [edx + 4]
push 0x2800
mov ecx, edi
call eax
test al, al
jne 0x458639
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], 2
pop ebx
add esp, 0x10
ret 0x10
xor edi, edi
cmp byte [esp + 0x2c], bl
mov byte [esp + 0xc], 1
je 0x45864c
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebx
cmp ebp, ebx
jbe 0x4586e7
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call edx
test al, al
je 0x458709
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4586e7
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x458601
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4586e7
cmp byte [esp + 0x2c], bl
je 0x4586d5
add edi, eax
xor eax, eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x48]
cmp eax, ebx
mov dword [esi + 0x68], edi
mov dword [esi + 0x58], edi
je 0x4586d5
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esi + 0x50]
push edx
call eax
add esp, 8
cmp byte [esp + 0xc], bl
je 0x4586df
mov byte [esp + 0xc], bl
cmp edi, ebp
jb 0x458654
cmp byte [esp + 0x28], bl
je 0x4586fa
mov eax, dword [esi + 8]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpEndRequestW]
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], ebx
pop ebx
add esp, 0x10
ret 0x10
mov eax, dword [esp + 0x20]
pop edi
pop ebp
mov dword [eax], 3
pop ebx
add esp, 0x10
ret 0x10
Function at 0x458790
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi], vtable.FileInStream.0
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], ebx
push eax
mov dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
je 0x458841
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x14], ebx
call edi
mov edx, dword [esp + 0xc]
xor ecx, ecx
xor ebp, ebp
or ecx, eax
or edx, ebp
mov dword [esp + 0x10], edx
jl 0x458817
jg 0x4587fd
cmp ecx, 0x7fffffff
jbe 0x458817
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov dword [esi + 0x10], 0xffffffff
mov eax, esi
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0x10]
push ebx
push ecx
call edi
cmp eax, 1
jb 0x45883f
cmp eax, 0xffffffff
mov byte [esi + 0xc], 1
jbe 0x45882f
or eax, 0xffffffff
mov edx, dword [esi + 0x10]
push ebx
push ebx
push ebx
push edx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
pop ebp
mov eax, esi
pop ebx
add esp, 8
ret

Function at 0x458940
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x458977
mov eax, dword [esi + 8]
test eax, eax
je 0x458977
mov edx, dword [esp + 0xc]
push 0
push edx
push eax
mov eax, dword [esi + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x458977
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 8]
mov dword [edx], ecx
mov al, 1
pop esi
ret 8
xor al, al
pop esi
ret 8

Function at 0x458980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4672c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x4e9028]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
call fcn.00459410
mov esi, dword [esp + 0x2c]
push eax
add esi, 0x10
mov dword [esp + 0x28], 0
call fcn.00459890
lea esi, [esp + 8]
call fcn.00457890
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x458e80
Capabilities:
Check if file exists
Get file size

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
cmp byte [ebp + 0xc], al
push esi
push edi
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], eax
je 0x458f6d
mov esi, dword [ebp + 0x14]
cmp esi, dword [ebp + 0x18]
lea ebx, [ebp + 0x10]
jbe 0x458eb0
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea ebx, [ebx]
mov edi, dword [ebp + 0x18]
cmp dword [ebp + 0x14], edi
jbe 0x458ebe
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
test ebx, ebx
je 0x458ec9
lea eax, [ebp + 0x10]
cmp ebx, eax
je 0x458ecf
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, edi
je 0x458f6d
test ebx, ebx
mov edi, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
jne 0x458ee3
call edi
cmp esi, dword [ebx + 8]
jb 0x458eea
call edi
cmp dword [esi], 1
jne 0x458f55
cmp esi, dword [ebx + 8]
jb 0x458ef6
call edi
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x458f64
cmp esi, dword [ebx + 8]
jb 0x458f0b
call edi
mov eax, dword [esi + 8]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x458f64
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
xor edx, edx
xor edi, edi
or edx, eax
or ecx, edi
add dword [ebp + 0x30], edx
mov edi, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
adc dword [ebp + 0x34], ecx
cmp esi, dword [ebx + 8]
jb 0x458f5c
call edi
add esi, 0x14
jmp 0x458eb0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 4
Function at 0x459410
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4670cc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e9028]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, edx
mov esi, dword [esp + 0x2c]
lea eax, [esi + 4]
push eax
mov ecx, edi
mov dword [esi], 0
call fcn.004596a0
lea ecx, [esi + 8]
push ecx
mov ecx, ebx
mov dword [esp + 0x28], 0
call fcn.004596a0
mov byte [esp + 0x24], 1
mov edx, dword [0x4eb310]
mov eax, dword [edx + 0xc]
mov ecx, 0x4eb310
lea ebp, [esi + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
mov byte [esp + 0x24], 2
mov edx, dword [0x4eb310]
mov eax, dword [edx + 0xc]
mov ecx, 0x4eb310
call eax
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov byte [ecx], 1
mov edx, dword [0x4eb310]
mov eax, dword [edx + 0xc]
mov ecx, 0x4eb310
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x24], 4
mov edx, dword [0x4eb310]
mov eax, dword [edx + 0xc]
mov ecx, 0x4eb310
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
mov ecx, edi
mov byte [esp + 0x28], 5
call fcn.00457c20
mov edx, dword [esp + 0x18]
push edx
push str.Content_Disposition:_form_data__name__s_
lea edi, [esp + 0x3c]
call fcn.0045a9f0
lea eax, [esp + 0x24]
push eax
mov eax, ebp
mov ecx, ebx
call fcn.00457c20
add esp, 0x10
push 4
push str._r_n_r_n
mov ecx, edi
push ecx
call fcn.004595b0
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x45952f
xor eax, eax
jmp 0x45953f
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x459534
sub eax, edx
mov edi, eax
push ebx
lea eax, [esi + 0x10]
call fcn.0045a320
mov byte [esp + 0x24], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45956f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [esp + 0x24], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x459590
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8