joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40ef4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40ef5d
pop dword [ebp - 0xc]
mov eax, 0x464712c0
sub eax, 0x46062363
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x86ba8900
add dword [ebp - 0x1c], 0xc797bc4b
mov dword [ebp - 0x18], 0x9670b27b
sub dword [ebp - 0x18], 0x643d6636
mov dword [ebp - 0x14], 0x21dd5071
add dword [ebp - 0x14], 0x2a6ef3bd
mov dword [ebp - 0x10], 0x46209c10
add dword [ebp - 0x10], 0xb9df63f0
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xa2821ff0
add dword [ebp - 0x1c], 0xd1f04966
mov dword [ebp - 0x18], 0x305507f2
sub dword [ebp - 0x18], 0xeee8a67d
mov dword [ebp - 0x14], 0xdc1adec0
sub dword [ebp - 0x14], 0x78ab7254
mov dword [ebp - 0x10], 0xeed3b23e
add dword [ebp - 0x10], 0x112c4dc2
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x6febceb9
sub eax, 0x6fa99d95
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x42d1e
push 0
call eax
mov ecx, 0xb14986b
sub ecx, 0xb143beb
mov edx, eax
mov ebx, 0xb3459537
add ebx, 0x4cfdaec9
add ebx, dword [ebp - 0xc]
mov esi, 0x1330327d
sub dword [ebp - 8], edi
mov edi, dword [ebx]
xor dword [ebp - 8], 0x8d1a1ab5
sub edi, esi
add dword [ebp - 8], edi
mov dword [edx], edi
sub dword [ebp - 8], 0xa9935123
add edx, 0x721bea66
add edx, 0x8de4159e
add ebx, 4
loop 0x40f074
add eax, 0x2eccbfce
add eax, 0xd134a505
xor ebx, ebx
add ebx, eax
add eax, 0x86a595f7
add eax, 0x795a6a0e
mov ecx, 0x2e03a4d0
sub ecx, 0x2dc3a4d0
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x42ea79
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
pop ss
wait
mov cl, 0x20
lcall 0xf135, 0x2b3abe7d
xor eax, 0xa02c47f1
push 0xd2fd5cd0
sti
mov ah, 0x78
and eax, 0xc914a846
add eax, dword [esi + 0x1661a777]
ja fcn.0042ea61
push ebp
xor al, 1
out 0x9a, al
jo 0x42ea4f
push esi
and ah, bh
out 0x3e, eax
fisubr dword [ecx - 0x15d96d25]

Function at 0x437385
Capabilities:
Encode data using xor

Disassembly:
popfd
aad 0xbd
push ecx
pop ebx
and esp, 0x45
sub eax, 0x8dcc61a0
lea eax, [ecx]
inc ebp
mov dword [0xe0b8fd37], eax
pop eax
std
pop esp
les edx, [edi]
pop ss
in al, 0x2c
jl 0x4373b2
test ecx, esp
mov al, byte [0x9a39c9a0]
lds ecx, [esi]
sub edx, dword [eax + 0x55ba1490]
cmc
push cs
fcmovb st(0), st(4)
stosb byte es:[edi], al
das
mov ecx, 0x592778c5
test dword [eax + 0x5c67c834], edx
cdq
sahf
mov esp, 0xe5b65928
or dword [ecx + 0x19], ebp
mov byte [ebx - 0x43], ch
cld
xor dl, byte [eax + 0x41]
movsd dword es:[edi], dword [esi]
mov eax, 0x40e49368
jge 0x437379
push 0x7d40e493
rcl dword [ecx - 0x16], 0xd5
jecxz 0x437360
push ecx
ljmp 0x997a
bound edi, qword [edx - 0x67]
inc esp
push 0x4b82454
daa
cmp edi, dword [ebx + 0x4ae852e3]
cdq
mov esi, 0x25b82cd2
mov ebx, 0x1c699abc
stosb byte es:[edi], al
pop es
push 0xfffffffffffffff2
mov ebp, 0x99c0b5bc

Function at 0x44e58d
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0xa9bb2e7c
mov dl, 0x88
dec ecx
imul esi, edx, 0xffffffff
sbb eax, 0x60560c7e
add bh, byte [esi]
dec ecx
push edi
sbb ebx, dword [edx]
or cl, byte [edx - 0x53]
and al, 0x9d
rol byte [esi + 0x76], cl
mul dword [eax + 0x50]
fcom qword [edi]
cmp al, 0xae
int1
sub cl, dl
cmp edi, esp
mov ebp, 0x5cef7d6e
sub byte [ebp - 0x7c], 0xc
push es
das
into
sbb eax, 0x8984c51c
pop edx
adc ebp, dword [edi - 0x7ba72e90]
js 0x44e5a5
das
hlt
mov al, byte [edx - 0x163e013]
jns 0x44e534
aas
invalid
movsd dword es:[edi], dword [esi]
cmp al, 0x2c
invalid

Function at 0x466191
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
jo 0x4661c6
or byte [edi + edx*2 + 0x62], dh
and eax, 0x3b9b0996
salc
mov ecx, 0x7758a33
sahf
push ds
sahf
jmp 0x40b40ad5
adc edi, dword [ebp + 0x140f0848]
das
or byte [edi], cl
adc al, 0x2f
aam 0x51
push esp
push ds
js 0x4661d4
iretd
nop
inc esp
mov byte [0x6be1e615], al
dec esp
mov eax, 0xff960bf5
push 0x1a
or al, 0x38
and al, 0x54
xor eax, 0x7b22fe0e
xor byte [edi + esi + 0x1daaee7e], cl
jnp 0x4661c9
out dx, eax
invalid
Function at 0x47c1ed
Capabilities:
Encode data using xor

Disassembly:
dec ebx
pmullw mm3, qword [esi - 0x2c0b7340]
inc edx
fiadd word [ecx + 0x50cbee51]
or dword [ecx + 0x41], esi
and dword [bp + si], edx
or eax, dword [edi + 0x21]
loopne 0x47c23d
adc dword [ebx + 0x7bc40ea3], ebx
sal edi, cl
xchg edx, eax
iretd
inc dword [esi - 0x7bb23bad]
mov esi, 0x7e7c567f
ja 0x47c1aa
adc al, 0xe6
sub bh, byte [ebx + 0x77861e00]
mov bl, 0xff
lahf
xchg edi, eax
xchg ebp, eax
dec ebx
sbb byte [esi + 0xb], bl
mov dl, 0xe6
movsd dword es:[edi], dword cs:[esi]
inc edi
stosb byte es:[edi], al
jp 0x47c1cc
push ds
xor eax, 0xd12cf4f3
fisub word [edi]
stosb byte es:[edi], al
sub byte [edx - 0xdf380fc], bl
lahf
out 0x88, al
inc ebp
sub al, 0xaf
inc esp
aaa
invalid
lahf
xor eax, 0xc17b862b
fucom st(1)
dec edi
mov ebx, 0x57d8cfd0
aaa
in al, 0x18
daa
or al, byte [edi + 0x7c6f44fe]
fbld tbyte [edi + eax + 0x2f7dedd4]
xor al, 0x76
popfd
mov esp, dword [ecx + 0xa5797ca]
push ecx
dec edx
and byte [ecx - 0x1ebd4cd1], al
in al, dx
call 0x44c2d682
not byte [edx + 0x11ef708d]
ja 0x47c222
inc edx
insd dword es:[edi], dx
xchg ebx, eax
je 0x47c281
add al, 0x32
sbb eax, 0xc67ffc9f
xor bl, byte [0xc67ffc9f]
stosb byte es:[edi], al
in eax, 0x89
test byte [0x7a2cfe6], cl
sar byte [edi], 0x16
int3
Function at 0x4015d0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592cce
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x428], 0x62e340
push eax
push 0x61c2f4
mov ecx, 0x62e344
mov byte [0x62e340], 0
mov dword [0x62e358], 7
mov dword [0x62e354], 0
mov word [0x62e344], ax
call fcn.00401d10
mov dword [ebp - 4], 0
push 0x62e388
mov dword [0x62e35c], 0
call fcn.005734ae
push 0x62e388
push 0x62e360
call fcn.005730d2
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0056ebe0
add esp, 0x18
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x424]
push eax
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x401744
lea ecx, [ebp - 0x420]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
setne al
test al, al
je 0x401744
push str.LenovoSLBAgent_
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005733ba
lea edx, [ebp - 0x420]
xor ecx, ecx
call fcn.00425ef0
push dword [0x62e36c]
mov eax, dword [0x62e370]
inc eax
push eax
mov eax, dword [0x62e374]
add eax, 0x76c
push eax
lea eax, [ebp - 0x420]
push eax
push str._s_d_02d_02d.log
push eax
call fcn.00402970
add esp, 0x24
cmp word [ebp - 0x420], 0
jne 0x40171a
xor ecx, ecx
jmp 0x401732
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401723
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
mov ecx, 0x62e344
push eax
call fcn.00401d10
mov eax, 0x62e340
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
Function at 0x402df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592dca
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.00436e1e
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x402eb0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0056c4fc
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x62738c
push eax
call fcn.0056ca8e
push edi
push esi
call fcn.00437166
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4

Function at 0x407920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592ef6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x629070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00438a61
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00437063
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409569
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4095a6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4095a2
nop word [eax + eax]
cmp esi, edx
jae 0x4095a6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x409590
cmp esi, edx
jb 0x4095ad
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a6c0
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x50], 0
jbe 0x40a72b
lea eax, [esi + 0x4c]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040b720
mov eax, dword [ebp - 8]
push 0x1000000
push dword [eax - 0xc]
push eax
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x40a710
call fcn.00409640
mov dword [esi + 0x6c], eax
mov edx, dword [ebp - 8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a72b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4

Function at 0x40a740
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593800
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x58], 0
mov ebx, dword [ebp + 8]
jbe 0x40a813
push str.Cookie:
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.0040dc80
lea eax, [edi + 0x54]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040b810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0040f610
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a7d5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
push 0x1000000
push dword [eax - 0xc]
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x40a7f4
call fcn.00409640
mov dword [edi + 0x6c], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40a813
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4
Function at 0x40abb0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
push edi
push 0
push eax
push 0
push 0
push 0x16
push ebx
mov edi, ecx
mov dword [ebp - 8], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x40ac15
cmp eax, 0x7a
je 0x40ac15
test eax, eax
jle 0x40abff
movzx eax, ax
or eax, 0x80070000
mov dword [edi + 0x6c], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 8]
lea esi, [edi + 0x34]
test edx, edx
js 0x40aca6
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or ecx, eax
jge 0x40ac3e
push edx
mov ecx, esi
call fcn.0040ec20
push 0
lea eax, [ebp - 8]
push eax
push dword [esi]
push 0
push 0x16
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x40ac93
mov ecx, dword [ebp - 8]
cmp ecx, 0xffffffff
jne 0x40ac75
mov eax, dword [esi]
test eax, eax
jne 0x40ac67
xor ecx, ecx
jmp 0x40ac79
push dword [eax - 8]
push eax
call fcn.005739ce
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x40aca6
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x40aca6
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
push esi
mov word [eax + ecx*2], dx
mov ecx, edi
call fcn.0040b0d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004093f0
int3
Function at 0x40acc0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
push edi
push 0
push eax
push 0
push 0
push 0x13
push ebx
mov edi, ecx
mov dword [ebp - 8], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x40ad25
cmp eax, 0x7a
je 0x40ad25
test eax, eax
jle 0x40ad0f
movzx eax, ax
or eax, 0x80070000
mov dword [edi + 0x6c], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 8]
test edx, edx
js 0x40adb1
mov eax, dword [edi + 0x38]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or ecx, eax
jge 0x40ad4d
push edx
lea ecx, [edi + 0x38]
call fcn.0040ec20
push 0
lea eax, [ebp - 8]
push eax
push dword [edi + 0x38]
push 0
push 0x13
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x40ad9e
mov ecx, dword [ebp - 8]
cmp ecx, 0xffffffff
jne 0x40ad86
mov eax, dword [edi + 0x38]
test eax, eax
jne 0x40ad78
xor ecx, ecx
jmp 0x40ad8a
push dword [eax - 8]
push eax
call fcn.005739ce
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x40adb1
mov eax, dword [edi + 0x38]
cmp ecx, dword [eax - 8]
jg 0x40adb1
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi + 0x38]
mov word [eax + ecx*2], dx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004093f0
int3
Function at 0x40adc0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [edi + 0x24]
lea esi, [edi + 0x24]
mov dword [ebp - 0x10], edi
test eax, eax
je 0x40adf7
push eax
call fcn.005734f0
add esp, 4
mov dword [esi], 0
lea eax, [ebp - 8]
mov dword [esi + 4], 0
push eax
push ebx
mov dword [esi + 8], 0
mov dword [ebp - 8], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x40af0b
nop
mov eax, dword [ebp - 8]
test eax, eax
je 0x40af13
mov ebx, dword [edi + 0x28]
lea edi, [ebx + eax]
test edi, edi
jne 0x40ae56
mov eax, dword [esi]
test eax, eax
je 0x40ae46
push eax
call fcn.005734f0
add esp, 4
mov dword [esi], edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x40ae76
cmp edi, dword [esi + 8]
ja 0x40ae62
cmp edi, dword [esi + 4]
jbe 0x40ae73
jmp 0x40ae6e
push edi
mov ecx, esi
call fcn.0040fea0
test al, al
je 0x40ae76
call fcn.00401bb0
mov dword [esi + 4], edi
mov dword [ebp - 0xc], 0
cmp ebx, dword [esi + 4]
jae 0x40af44
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 8]
add eax, ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x40af26
mov edi, dword [ebp - 0xc]
add edi, ebx
jne 0x40aecb
mov eax, dword [esi]
test eax, eax
je 0x40aebb
push eax
call fcn.005734f0
add esp, 4
mov dword [esi], edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x40aeeb
cmp edi, dword [esi + 8]
ja 0x40aed7
cmp edi, dword [esi + 4]
jbe 0x40aee8
jmp 0x40aee3
push edi
mov ecx, esi
call fcn.0040fea0
test al, al
je 0x40aeeb
call fcn.00401bb0
mov dword [esi + 4], edi
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x40ae20
call fcn.00409640
mov dword [edi + 0x6c], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4
call fcn.00409640
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [ecx + 0x6c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004093f0
int3
Function at 0x416be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592ef6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x629070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00438a61
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00437063
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b340
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x629070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41b371
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004387fb
mov esp, ebp
pop ebp
ret
push 0x34
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0xaac56b
movups xmmword [ebp - 0x24], xmm0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x10], 0x11d0cd44
push 0
push eax
mov dword [ebp - 0xc], 0xc000c28c
mov dword [ebp - 8], 0xee95c24f
mov dword [ebp - 0x24], 0x10
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.0056ebe0
add esp, 0xc
mov dword [ebp - 0x58], 0x34
mov ecx, 0x1000
mov dword [ebp - 0x54], 0
test edi, edi
mov dword [ebp - 0x4c], 2
mov eax, 0x100
mov dword [ebp - 0x48], 0
cmovne eax, ecx
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x3c], 0
push eax
push 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.004387fb
mov esp, ebp
pop ebp
ret