joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180264f8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov esi, 0x180fbca8
call fcn.18004003
call fcn.1806dbba
cmp byte [0x180fb940], 0
je 0x1802652a
xor ebx, ebx
lea eax, [ebp - 0xc]
inc ebx
call fcn.1806df16
jmp 0x18026535
push 2
pop ebx
lea eax, [ebp - 8]
call fcn.1806deda
mov eax, dword [eax]
sub eax, 0x10
call fcn.18003d67
mov esi, eax
add esi, 0x10
mov dword [ebp - 4], esi
test bl, 2
je 0x1802655a
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
and ebx, 0xfffffffd
call fcn.18004250
test bl, 1
je 0x1802656a
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.18004250
cmp byte [0x180fb940], 0
je 0x180265d5
cmp dword [esi - 0xc], 0
je 0x180265db
lea eax, [ebp - 4]
push eax
call fcn.18026624
mov edi, eax
pop ecx
test edi, edi
jge 0x180265d2
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x180265c6
push 0xffffffffffffffff
push 4
pop esi
push esi
mov dword [ebp - 0x1c], ecx
call fcn.18001d8a
or dword [ebp - 0x14], 0xffffffff
push edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push str._failed_to_initialize_crash_dir_security__0x_x_
push eax
mov dword [ebp - 0x10], esi
call fcn.18001000
add esp, 0xc
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x180265d5
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], 0
jne 0x18026613
lea eax, [ebp - 0xc]
call fcn.18008a22
lea edi, [ebp - 4]
call fcn.18003d26
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.18004250
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], 0
jne 0x18026613
mov edi, 0x8004fffc
lea eax, [esi - 0x10]
call fcn.18004250
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 4]
mov edi, 0x180fbca8
call fcn.18003d26
xor edi, edi
jmp 0x18026604

Function at 0x18029716
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push edi
mov edi, eax
mov dword [ebp - 4], 0x80004005
call esi
push eax
push edi
lea ebx, [ebp - 4]
call fcn.18029c4c
test al, al
je 0x180297ba
movzx eax, byte [edi + 0x44]
push eax
call fcn.1800485e
pop ecx
test eax, eax
jl 0x180297bd
call fcn.180048f6
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18029790
push 2
push 4
pop ebx
push ebx
mov dword [ebp - 0x14], ecx
call fcn.18001d8a
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push str._Calling_CAtlExeModuleT_GoogleUpdate_::WinMain_
push eax
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], ebx
call fcn.18001000
pop ecx
pop ecx
cmp byte [0x180fc124], 0
je 0x1802979e
or eax, 0xffffffff
jmp 0x180297bd
and dword [ebp - 4], 0
call esi
push eax
push edi
lea ebx, [ebp - 4]
call fcn.18029c4c
cmp al, 1
jne 0x180297ba
call fcn.1802a4b0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1802a46d
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
cmp eax, esi
jne 0x1802a486
xor eax, eax
jmp 0x1802a4ad
push ebx
lea eax, [esp + 8]
push eax
push esi
push edi
push 0x1802bbbb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, esi
jne 0x1802a4aa
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop esi
pop ecx
ret

Function at 0x1802d3e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x180f51f0]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
xor ebx, ebx
xor eax, eax
push 0x206
mov word [esp + 0x2c], ax
lea eax, [esp + 0x2e]
push ebx
mov edi, 0x180c37b4
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.1809d820
add esp, 0xc
push 0x20008
lea esi, [esp + 0x1c]
call fcn.18008607
lea eax, [esp + 0x28]
push eax
push ebx
push dword [esp + 0x24]
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x1802d480
mov esi, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], edi
call fcn.1800865e
mov ecx, dword [esp + 0x234]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1809ccb5
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
call fcn.18003fba
push dword [esp + 0x14]
lea ebx, [esp + 0x14]
call fcn.180045bc
mov esi, eax
mov eax, dword [esp + 0x14]
pop ecx
add eax, 0xfffffff0
call fcn.18004250
jmp 0x1802d45c
Function at 0x1802d4ac
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
and dword [eax], 0
push ebx
push esi
push edi
push 1
call fcn.1806c1dc
mov esi, eax
neg eax
sbb eax, eax
and eax, dword [fcn.1800234b]
pop ecx
mov dword [ebp - 4], esi
jne 0x1802d4e9
test esi, esi
je 0x1802d4df
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x1802d612
mov eax, dword [0x180fa268]
mov ecx, 0x180fa268
call dword [eax + 0xc]
mov edi, eax
add edi, 0x10
push esi
lea ebx, [ebp - 0xc]
mov dword [ebp - 8], edi
call fcn.18022d1e
mov esi, dword [ebp - 0xc]
mov ebx, esi
test esi, esi
jle 0x1802d51c
and ebx, 0xffff
or ebx, 0x80070000
test ebx, ebx
jge 0x1802d54f
cmp esi, 0x80004005
je 0x1802d531
test esi, esi
jne 0x1802d531
call fcn.180043d4
lea eax, [edi - 0x10]
call fcn.18004250
cmp dword [ebp - 4], 0
je 0x1802d548
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1802d612
lea eax, [ebp - 8]
push eax
call fcn.1802d3e0
mov edi, eax
pop ecx
test edi, edi
jge 0x1802d57b
cmp esi, 0x80004005
je 0x1802d570
test esi, esi
jne 0x1802d570
call fcn.180043d4
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
jmp 0x1802d5fc
mov ebx, dword [ebp - 8]
cmp dword [ebx - 0xc], 0
jne 0x1802d598
mov edi, 0x80004005
cmp esi, edi
je 0x1802d5f9
test esi, esi
jne 0x1802d5f9
call fcn.180043d4
jmp 0x1802d5f9
mov edi, dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.1802d291
mov edi, eax
pop ecx
pop ecx
test edi, edi
jge 0x1802d5bb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, 0x80004005
jmp 0x1802d58b
cmp esi, 0x80004005
je 0x1802d5cc
test esi, esi
jne 0x1802d5cc
call fcn.180043d4
push 0xb
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1802d5f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1802d5f0
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebx - 0x10]
call fcn.18004250
cmp dword [ebp - 4], 0
je 0x1802d610
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x18034b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.180346ed
push eax
push esi
push dword [ebp + 8]
call fcn.180346a2
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.180346dd
jp 0x18034b9f
pop ecx
pop es
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
pop esi
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.180346dd
mov byte [0x8d91d59f], al
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x18034c56
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x18034ecc
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x18034c82
cmp dword [eax + 0xc], ebx
je 0x18034d25
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.180346dd
mov dword [0x399fb8da], eax
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
call fcn.180346dd
mov al, 0x7a
jbe 0x18034d97
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x18034d91
add eax, esi
mov ebp, 0xffffff78
Function at 0x18034d87
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x18034d91
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x18034d8c
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x18034d76
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x18034d7e
cmp edx, ebx
jne 0x18034ecc
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x18034d4d
add eax, dword [eax + 4]
jmp 0x18034d3a
mov dword [ebp + 0xc], ebx
jmp 0x18034d9c
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x18034db4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x18034dd2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x18034e30
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x18034e17
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x18034e20
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x18034e2a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x18034e0c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x18034d96
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x18034e7d
dec eax
je 0x18034e74
sub eax, 3
je 0x18034e6b
mov dword [ebp - 4], 0x40
jmp 0x18034e9a
mov dword [ebp - 4], 4
jmp 0x18034e80
mov dword [ebp - 4], 0x20
jmp 0x18034e80
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x18034ecc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
push dword [esi - 0x60]
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.180346dd
mov ah, 0xb
scasb al, byte es:[edi]
and bh, bh
jne 0x18034ed7
push 1
push esi
call edi
mov eax, esi
jmp 0x18034ed8
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18034fa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
invalid
invalid
nop
stc
invalid
Function at 0x18044118
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
xor esi, esi
push dword [ebp + 0x10]
mov ebx, ecx
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.18044067
mov edi, eax
add esp, 0x14
cmp edi, esi
jge 0x18044194
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1804421b
push 0xfffffffffffffffe
pop ebx
push ebx
push 4
pop esi
push esi
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
push edi
push str._0x_08x_
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push str._failed_to_create_CompletePingSender_
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
call fcn.18001000
add esp, 0x10
xor esi, esi
jmp 0x1804421b
push esi
push esi
push dword [ebp - 4]
push 0x180442ac
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
neg eax
sbb eax, eax
and eax, dword [fcn.1800234b]
cmp eax, esi
je 0x180441bc
mov dword [ebp - 4], esi
jmp 0x1804420d
call fcn.1800fc86
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
mov edi, eax
je 0x18044203
push 0xfffffffffffffffe
pop ebx
push ebx
push 4
pop esi
push esi
mov dword [ebp - 0x18], ecx
call fcn.18001d8a
push edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push str._failed_to_start_wait_thread_for_app_command_process_exit__0x_08x_
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
call fcn.18001000
add esp, 0xc
xor esi, esi
mov eax, dword [ebp - 4]
push edi
push esi
call fcn.1804422d
cmp dword [ebp - 8], esi
je 0x1804421b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x18044228
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18048c1f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, eax
push esi
call fcn.1809d315
lea edx, [esi + eax*2]
pop ecx
mov ecx, esi
mov eax, 0x811c9dc5
cmp esi, edx
je 0x18048c48
movzx esi, word [ecx]
imul eax, eax, 0x1000193
xor eax, esi
inc ecx
inc ecx
cmp ecx, edx
jne 0x18048c37
pop esi
ret
Function at 0x1804d5bb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call fcn.1800fcb1
test al, al
jne 0x1804d5e9
xor esi, esi
push esi
push str._DropboxUpdate.exe__NetDiags__only_runs_on_Windows_XP_or_later.
push str.DropboxUpdate.exe
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1804d4f1
test eax, eax
jne 0x1804d5fc
xor esi, esi
push esi
push str.Please_run__DropboxUpdate.exe__NetDiags__from_a_cmd.exe_window.
jmp 0x1804d5d5
push 0x180c394c
call fcn.1804d55e
pop ecx
push 2
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, esi
jge 0x1804d625
push eax
push str.Failed_to_::CoInitialize____0x_x__n
call fcn.1804d55e
pop ecx
pop ecx
jmp 0x1804d5e1
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], esi
call fcn.1804a2bc
add esp, 4
call fcn.1804a45c
cmp eax, esi
jge 0x1804d646
push eax
push str.Failed_to_GetUserNetworkConfig____0x_x__n
jmp 0x1804d61c
mov edi, dword [ebp - 4]
mov ebx, edi
call fcn.18048fa9
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.180167d2
cmp dword [ebp - 4], 3
jne 0x1804d68a
push str.Default_browser_is_Firefox_n
call fcn.1804d55e
pop ecx
push 0x20
call fcn.1809d904
pop ecx
cmp eax, esi
je 0x1804d681
mov ebx, eax
call fcn.180515a3
jmp 0x1804d683
xor eax, eax
push eax
push edi
call fcn.18048f22
push 4
call fcn.1809d904
pop ecx
cmp eax, esi
je 0x1804d69e
mov dword [eax], 0x180d96ec
jmp 0x1804d6a0
xor eax, eax
push eax
push edi
call fcn.18048f22
lea eax, [ebp - 0x1c]
push eax
mov ebx, edi
call fcn.1804933d
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
jne 0x1804d6cf
push str.No_Network_Configurations_to_display_n
call fcn.1804d55e
pop ecx
jmp 0x1804d6f5
lea eax, [ebp - 4]
push eax
lea ebx, [ebp - 0x1c]
call fcn.180494bd
pop ecx
push dword [eax]
push str._Detected_Network_Configurations___n_s__n
call fcn.1804d55e
mov eax, dword [ebp - 4]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.18004250
lea esi, [ebp - 0x1c]
call fcn.1804b41c
push dword [ebp - 0x1c]
call fcn.1809ccaa
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1804d879
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push dword [eax]
push str._nDownload_request_for___s__n
call fcn.1804d55e
and dword [ebp - 8], 0
pop ecx
pop ecx
call fcn.1804a2bc
lea ecx, [ebp - 8]
push ecx
call fcn.1804a45c
test eax, eax
jge 0x1804d8bb
push eax
push str.Failed_to_GetUserNetworkConfig____0x_x__n
call fcn.1804d55e
pop ecx
pop ecx
jmp 0x1804d9db
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea esi, [ebp - 4]
call fcn.1804dafe
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edi + 0x6c], eax
lea eax, [ebp - 8]
mov dword [edi + 0x50], 2
call fcn.18008a22
mov eax, dword [0x180fa268]
mov ecx, 0x180fa268
call dword [eax + 0xc]
add eax, 0x10
push 0x104
lea esi, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.18004129
push eax
push 0
push 0x180d9b54
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, eax
neg ebx
sbb bl, bl
or eax, 0xffffffff
inc bl
call fcn.18003fe5
test bl, bl
je 0x1804d946
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.::GetTempFileName_Failed___d__n
call fcn.1804d55e
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
jmp 0x1804d9c1
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
call fcn.1804dbae
mov edi, dword [edi + 0x5c]
push edi
test eax, eax
jge 0x1804d973
push eax
push str.Download_failed._HRESULT_0x_x___HTTP_Status__d__n
call fcn.1804d55e
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, 0xfffffff0
jmp 0x1804d9c3
push str.HTTP_Status__d__n
call fcn.1804d55e
mov esi, dword [ebp + 8]
push esi
push str.Downloaded_File__s__n
call fcn.1804d55e
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1804d9b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.::DeleteFile_Failed___s___d__n
call fcn.1804d55e
add esp, 0xc
lea eax, [esi - 0x10]
jmp 0x1804d9c3
push esi
push str.Deleted_file___s__n
call fcn.1804d55e
lea eax, [esi - 0x10]
pop ecx
pop ecx
call fcn.18004250
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.18004250
lea eax, [ebp - 4]
call fcn.1804db3f
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1804de57
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebx], 0x180da458
call fcn.1804e013
and dword [ebx + 0x80], 0
cmp byte [ebx + 0x90], 0
jne 0x1804dee2
mov eax, dword [ebx + 0x48]
cmp dword [eax - 0xc], 0
je 0x1804dee2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1804dee2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1804dee2
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x1804dee2
mov esi, dword [ebx + 0x48]
push 0xffffffffffffffff
push 9
pop edi
push edi
mov dword [ebp - 0x10], ecx
call fcn.18001d8a
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
call fcn.1800fc86
push eax
push esi
lea eax, [ebp - 0x10]
push str._SimpleRequest__Failed_to_delete_file:__s__0x_08x_.
push eax
call fcn.18001000
add esp, 0x10
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x1804def3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebx + 0x88]
test edi, edi
je 0x1804df02
call fcn.1804f5fe
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x1804df11
call fcn.1804f5b1
lea esi, [ebx + 0x64]
call fcn.18048ef7
mov eax, dword [ebx + 0x60]
push 0x10
pop esi
sub eax, esi
call fcn.18004250
mov eax, dword [ebx + 0x58]
sub eax, esi
call fcn.18004250
mov eax, dword [ebx + 0x54]
sub eax, esi
call fcn.18004250
mov eax, dword [ebx + 0x48]
sub eax, esi
call fcn.18004250
mov eax, dword [ebx + 0x44]
sub eax, esi
call fcn.18004250
lea ecx, [ebx + 0x24]
call fcn.1800ac8b
lea ecx, [ebx + 4]
call fcn.1800ac8b
pop edi
pop esi
mov dword [ebx], 0x180da3f8
pop ebx
leave
ret
Function at 0x1804e95c
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x88]
xor edi, edi
xor ecx, ecx
cmp dword [eax + 0x3c], edi
mov eax, dword [esi + 0x48]
setne cl
push edi
push 0x80
lea ecx, [ecx + ecx + 2]
push ecx
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1804e9a0
call fcn.1800fc86
jmp 0x1804ea47
mov eax, dword [esi + 0x88]
cmp dword [eax + 0x3c], edi
je 0x1804ea3c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x1804ea2c
cmp eax, 0x7fffffff
ja 0x1804ea2c
mov ebp, dword [esi + 0x88]
cmp eax, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x40]
setg al
cmp dword [esp + 0x10], ecx
push edi
setne dl
or al, dl
je 0x1804ea13
push 0x80
push 2
push edi
push edi
mov dword [ebp + 0x40], edi
mov esi, dword [esi + 0x48]
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp ebx, esi
je 0x1804ea0c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
cmp ebx, 0xffffffff
jne 0x1804ea3f
jmp 0x1804e996
push edi
xor eax, eax
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1804ea3f
call fcn.1800fc86
mov esi, eax
jmp 0x1804ea31
mov esi, 0x80004005
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1804ea47
mov dword [eax + 0x40], edi
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x18057786
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
movzx ecx, byte [0x180fb8f9]
sub esp, 0x24
neg ecx
push ebx
push esi
sbb ecx, ecx
and ecx, 0x180fbba0
push edi
mov esi, eax
je 0x180577d5
push 2
pop edi
xor ebx, ebx
push edi
inc ebx
push ebx
mov dword [esp + 0x18], ecx
call fcn.18001d8a
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push str._ThreadPool::ThreadPool_
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
call fcn.18001000
pop ecx
pop ecx
cmp dword [esi + 4], 0
je 0x18057865
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push dword [esi + 4]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x18057865
jmp 0x1805781c
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [esi + 8]
call edi
xor ecx, ecx
cmp eax, dword [esp + 0xc]
jae 0x18057812
or ecx, 0xffffffff
sub ecx, dword [esp + 0xc]
add ecx, eax
cmp ecx, ebx
jae 0x18057824
mov eax, dword [esi]
test eax, eax
jne 0x180577fa
jmp 0x18057865
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18057865
push 0xfffffffffffffffe
pop ebx
xor edi, edi
push ebx
inc edi
push edi
mov dword [esp + 0x28], ecx
call fcn.18001d8a
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push str._ThreadPool::ThreadPool__timeout_elapsed_
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
call fcn.18001000
pop ecx
pop ecx
mov esi, dword [esi + 4]
test esi, esi
je 0x18057873
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret