joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b7a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 8], 0
test edi, edi
je 0x41b837
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x41b80a
cmp esi, 5
jne 0x41b820
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 4
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41b820
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x41b83c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
jmp 0x41b83c
mov esi, 0x57
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.004d0675
mov esp, ebp
pop ebp
ret

Function at 0x41c9c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f15d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x55fe9c]
lea ecx, [ebp - 0x40]
add eax, 0xc8
push eax
call fcn.00414920
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x41ca11
xor bl, bl
jmp 0x41caac
mov eax, SysReAllocString
sub eax, ecx
cmp eax, 0x11
jb 0x41cafe
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 0x11
cmovae eax, dword [ebp - 0x40]
push str.SetupInstup.exe
push ecx
push eax
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
call fcn.0041ba50
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41ca60
test al, 0x10
jne 0x41ca60
mov bl, 1
jmp 0x41ca62
xor bl, bl
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41ca98
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41ca8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41cb03
push edx
push ecx
call fcn.004d06e3
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x41cae2
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cad8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41cb03
push edx
push ecx
call fcn.004d06e3
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret
call fcn.00414310
call fcn.004ebf29
int3
Function at 0x420650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x10
mov esi, eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x420717
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4206f5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4206f5
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
push eax
push 0x53fc98
push dword [ebp - 0x10]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x420739
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov esi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
mov ecx, edx
shr ecx, 0x10
mov word [edi], cx
mov ecx, esi
shr ecx, 0x10
mov word [edi + 4], cx
mov ecx, dword [ebp - 4]
mov word [edi + 6], si
xor ecx, ebp
mov word [edi + 2], dx
pop edi
pop esi
pop ebx
call fcn.004d0675
mov esp, ebp
pop ebp
ret
push str.Unable_to_load_VERSIONINFO_resource_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x24]
push eax
call fcn.004e81cb
push str.Unable_to_retrieve_VERSIONINFO_resource_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x24]
push eax
call fcn.004e81cb
push str.Unable_to_retrieve_VERSIONINFO_data_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x24]
push eax
call fcn.004e81cb
int3
Function at 0x420870
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f65d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], esi
push eax
push 1
push str.D:P_A__GA___SY__A__GA___BA__
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x42095f
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [0x55fe58], 8
mov dword [ebp - 0x24], eax
mov eax, 0x55fe44
cmovae eax, dword [0x55fe44]
push eax
push 1
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0xc
push eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x420981
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x420925
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [esi], edi
mov dword [ebp - 4], 1
cmp byte [ebp - 0x18], 0
jne 0x420942
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
call fcn.00423f00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret
push str.Unable_to_convert_instance_mutex_security_descriptor_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x40]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
push str.Unable_to_create_instance_mutex_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x40]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
int3

Function at 0x423b50
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50fc6d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x78
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov edx, 0x55fe80
cmp dword [0x55fe94], 8
push ecx
cmovae edx, dword [0x55fe80]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00465310
add esp, 4
test al, al
jne 0x423ea7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x423ec8
jmp 0x423ea7
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.Unable_to_delete_Overseer_registry_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x88]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x88]
push eax
call fcn.004e81cb
int3
Function at 0x429990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510b1c
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
push edi
mov eax, dword [0x55f2b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
push 0x40
mov dword [ebp - 0x10], eax
call fcn.004d06b3
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea edi, [eax + 0xc]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], vtable.std::_Ref_count_obj2_class_asw::projects::overseer::action_download_file_.0
xor eax, eax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x5c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x1c], xmm0
movq qword [ebp - 0x4c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
push 0x34
push str.http:__iavs9x.avg.u.avcdn.net_avg_iavs9x_servers.def
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.00414320
movups xmm0, xmmword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edi], vtable.asw::projects::overseer::action_download_file.0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
movups xmmword [edi + 4], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [edi + 0x14], xmm0
movups xmm0, xmmword [ebp - 0x44]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
movups xmmword [edi + 0x1c], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [edi + 0x2c], xmm0
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x429ac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510b1c
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
push edi
mov eax, dword [0x55f2b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
push 0x40
mov dword [ebp - 0x10], eax
call fcn.004d06b3
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea edi, [eax + 0xc]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], vtable.std::_Ref_count_obj2_class_asw::projects::overseer::action_download_file_.0
xor eax, eax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x5c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x1c], xmm0
movq qword [ebp - 0x4c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
push 0x3d
push str.http:__fallback.iabsra.avg.u.avcdn.net_avg_iabsra_servers.def
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.00414320
movups xmm0, xmmword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [edi], vtable.asw::projects::overseer::action_download_file.0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
movups xmmword [edi + 4], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [edi + 0x14], xmm0
movups xmm0, xmmword [ebp - 0x44]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
movups xmmword [edi + 0x1c], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [edi + 0x2c], xmm0
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x432ac0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xa
lea eax, [ebp - 0x18]
mov word [ebp - 8], 0
push eax
mov esi, ecx
mov byte [ebp - 6], 0
push 0x59
xorps xmm0, xmm0
mov dword [ebp - 0x1c], esi
push 0x800
mov dword [ebp - 0x1c], esi
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jle 0x432b1b
push 0xa
lea ecx, [ebp - 0x18]
mov byte [ebp + eax - 0x19], 0x2d
add eax, ecx
push eax
push 0x5a
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [ebp - 0x18]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432b32
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, esi
call fcn.0041a430
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d0675
mov esp, ebp
pop ebp
ret
Function at 0x4398c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5124dd
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ecx + 0xd8]
add ecx, 0xc8
mov eax, SysReAllocString
sub eax, edx
cmp eax, 0x11
jb 0x439ac6
cmp dword [ecx + 0x14], 8
jb 0x43990d
mov ecx, dword [ecx]
push 0x11
push str.SetupInstup.exe
push edx
push ecx
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.0041ba50
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x439aa0
test al, 0x10
jne 0x439aa0
mov ecx, dword [ebp - 0x1c]
mov eax, 0x22
mov word [ebp - 0x14], ax
cmp ecx, 0x7ffffffe
je 0x439acb
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5c]
call fcn.0041ba50
push 0x21
push str.___instop:check_for_updates__wait
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0041b860
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00457750
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x30]
mov esi, eax
cmp edx, 8
jb 0x439a0a
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439a00
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439ad0
push edx
push ecx
call fcn.004d06e3
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x439a48
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439a3e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439ad0
push edx
push ecx
call fcn.004d06e3
add esp, 8
test esi, esi
jne 0x439ad5
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x439a86
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439a7c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439af1
push edx
push ecx
call fcn.004d06e3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2c]
call fcn.004146e0
push eax
push str.Unable_to_find_file__ls_
push 2
lea ecx, [ebp - 0x40]
call fcn.00416ba0
push 0x55c1ac
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
call fcn.00414310
call fcn.00414310
call fcn.004ebf29
push esi
push str.Unable_to_check_for_updates_with_exit_code_0x_08lx_
lea ecx, [ebp - 0x40]
call fcn.004140c0
push 0x55c1ac
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
call fcn.004ebf29
int3
Function at 0x439b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5124dd
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ecx + 0xd8]
add ecx, 0xc8
mov eax, SysReAllocString
sub eax, edx
cmp eax, 0x11
jb 0x439d1a
cmp dword [ecx + 0x14], 8
jb 0x439b4d
mov ecx, dword [ecx]
push 0x11
push str.SetupInstup.exe
push edx
push ecx
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.0041ba50
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x439cf4
test al, 0x10
jne 0x439cf4
mov ecx, dword [ebp - 0x1c]
mov eax, 0x22
mov word [ebp - 0x14], ax
cmp ecx, 0x7ffffffe
je 0x439d1f
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5c]
call fcn.0041ba50
push 0x1a
push str.___instop:update_vps__wait
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0041b860
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00457750
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x30]
mov esi, eax
cmp edx, 8
jb 0x439c4a
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439c40
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439d24
push edx
push ecx
call fcn.004d06e3
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x439c88
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439c7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439d24
push edx
push ecx
call fcn.004d06e3
add esp, 8
test esi, esi
je 0x439ca2
cmp byte [ebp + 8], 0
jne 0x439d29
cmp esi, 0xa005
jne 0x439d29
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x439cd8
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x439cce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439d45
push edx
push ecx
call fcn.004d06e3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x2c]
call fcn.004146e0
push eax
push str.Unable_to_find_file__ls_
push 2
lea ecx, [ebp - 0x40]
call fcn.00416ba0
push 0x55c1ac
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
call fcn.00414310
call fcn.00414310
call fcn.004ebf29
push esi
push str.Unable_to_update_VPS_with_exit_code_0x_08lx_
lea ecx, [ebp - 0x40]
call fcn.004140c0
push 0x55c1ac
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
call fcn.004ebf29
int3
Function at 0x448fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x55f2b4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [esp + 0xc], esi
call fcn.004490b0
mov ecx, dword [edi + 0x134]
test ecx, ecx
je 0x448ff3
push dword [esp + 0x10]
lea eax, [esi + ebx]
push eax
push ebx
push dword [ecx + 4]
call fcn.0044a570
mov eax, dword [edi + 0x130]
cmp eax, 0xffffffff
je 0x44901c
push 0
lea ecx, [esp + 0x2c]
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x449085
mov eax, esi
cmp eax, dword [esp + 0x28]
jne 0x449085
jmp 0x44901e
mov eax, esi
movq xmm0, qword [edi + 0x138]
lea ecx, [edi + 0x138]
movq qword [esp + 0x28], xmm0
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], esi
mov ebx, edi
mov ecx, esi
add ebx, eax
mov edx, esi
mov esi, dword [esp + 0x10]
mov eax, edi
adc ecx, 0
lock cmpxchg8b qword [esi]
mov esi, dword [esp + 0x28]
cmp eax, edi
jne 0x449063
cmp edx, esi
je 0x449071
mov esi, edx
mov edi, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], esi
jmp 0x449042
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d0675
mov esp, ebp
pop ebp
ret 8
push str.Unable_to_write_data_to_a_file_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x1c]
call fcn.00468e50
push 0x55c1ac
lea eax, [esp + 0x18]
push eax
call fcn.004e81cb
int3
Function at 0x449ca0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51470d
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x55f2b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
push eax
mov eax, dword [edi]
push 0x2712
mov dword [ebp - 0x2c], ecx
push dword [eax]
call fcn.00480cc0
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x449dcb
push ebx
mov ecx, edi
call fcn.00449950
test esi, esi
je 0x449d14
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x449d14
push eax
push esi
mov ecx, edi
call fcn.00449c00
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00449760
mov ecx, dword [edi]
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x134], eax
mov eax, dword [edi]
mov dword [eax + 0x130], 0xffffffff
mov eax, dword [edi]
push dword [eax]
call fcn.0047a3e0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x449d6a
mov esi, dword [edi]
mov ecx, esi
call fcn.004490b0
mov ecx, dword [esi + 0x130]
cmp ecx, 0xffffffff
je 0x449d6a
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x449df3
mov eax, dword [edi]
add eax, 0x114
push eax
call fcn.004ce889
add esp, 4
test al, al
jne 0x449e15
test ebx, ebx
jne 0x449e33
cmp byte [ebp + 0x24], bl
jne 0x449da5
mov eax, dword [edi]
mov eax, dword [eax + 0x11c]
sub eax, 0xc8
cmp eax, 0x64
jae 0x449e5a
mov eax, dword [edi]
mov eax, dword [eax + 0x11c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0675
mov esp, ebp
pop ebp
ret 0x20
push 0x2712
push ecx
mov ecx, edi
call fcn.00431e40
add eax, 0x14
lea ecx, [ebp - 0x40]
push eax
push edx
call fcn.0044a130
push 0x55c410
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
push str.Unable_to_trim_the_file_to_the_current_position_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x40]
call fcn.00468e50
push 0x55c1ac
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
sub esp, 8
mov ecx, edi
mov edx, esp
call fcn.00431e40
add eax, 0x114
mov ecx, edx
push eax
call fcn.004247c0
call fcn.00424780
push str.Unable_to_perform_cURL_request_
mov ecx, edi
call fcn.00431e40
add eax, 0x14
lea ecx, [ebp - 0x40]
push eax
push ebx
call fcn.00449f90
push 0x55c410
lea eax, [ebp - 0x40]
push eax
call fcn.004e81cb
mov ecx, edi
call fcn.00431e40
mov eax, dword [eax + 0x11c]
push eax
lea eax, [ebp - 0x28]
push str.The_HTTP_request_failed_with_response_status__d_
push eax
call fcn.00434dc0
add esp, 0xc
push str.Unable_to_perform_cURL_request_
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004141d0
push eax
push 0x16
lea ecx, [ebp - 0x54]
call fcn.00449f90
push 0x55c410
lea eax, [ebp - 0x54]
push eax
call fcn.004e81cb
int3