joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e224c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
test dl, dl
je 0x4e2263
add esp, 0xfffffff0
call fcn.00403f90
mov byte [ebp - 1], dl
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.0042c348
mov dl, 1
mov eax, dword [0x463980]
call fcn.00465348
mov dword [esi + 0x38], eax
mov byte [esi + 0xb8], 0
mov eax, dword [0x5114f8]
mov eax, dword [eax]
mov edx, dword [eax + 0x88]
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi + 4]
mov edx, dword [0x47f8c8]
call fcn.00403ddc
mov dword [esi + 0x34], eax
mov byte [esi + 0x65], 1
mov dword [esi + 0x3c], 0xff00000f
mov dword [esi + 0x40], 0xff00000f
mov dword [esi + 0x54], 0xff00000d
mov dword [esi + 0x50], 0xff00000d
mov dword [esi + 0x44], 0xff00000f
mov dword [esi + 0x58], 0xff000003
mov dword [esi + 0x4c], 0xff00000f
mov dword [esi + 0x48], 0xff00000d
mov eax, dword [esi + 0x38]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x5c], eax
mov byte [esi + 0xa7], 0xa
mov byte [esi + 0xa8], 0x1e
mov dword [esi + 0x60], 0x18
mov byte [esi + 0x64], 1
mov dx, word [0x4e23d8]
mov eax, esi
call fcn.004e5adc
mov edx, dword [0x4e23dc]
mov eax, esi
call fcn.004e5b34
mov ebx, dword [esi + 0x34]
test ebx, ebx
je 0x4e233d
mov eax, ebx
call fcn.00485ba4
mov edx, eax
mov eax, esi
call fcn.004e49d0
mov byte [esi + 0x66], 0
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
mov byte [esi + 0xb6], 0
mov byte [esi + 0xb5], 0
mov byte [esi + 0xb7], 0
cmp dword [ebp - 0x88], 2
jne 0x4e23ae
mov byte [esi + 0xb7], 1
cmp dword [ebp - 0x94], 5
jne 0x4e2395
cmp dword [ebp - 0x90], 0
jne 0x4e2395
mov byte [esi + 0xb5], 1
cmp dword [ebp - 0x94], 5
jne 0x4e23ae
cmp dword [ebp - 0x90], 1
jne 0x4e23ae
mov byte [esi + 0xb6], 1
test byte [esi + 0x1c], 0x10
jne 0x4e23b9
call fcn.004e21a4
mov eax, esi
cmp byte [ebp - 1], 0
je 0x4e23d0
call fcn.00403fe8
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e6260
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ecx, edx
test ecx, ecx
js 0x4e6276
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x4e626f
mov eax, esp
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov edi, esi
test edi, edi
jl 0x4e62d2
inc edi
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
call fcn.00464f80
mov ecx, eax
mov eax, ecx
and eax, 0xff
cdq
idiv esi
add dword [ebp - 8], eax
mov eax, ecx
and eax, 0xff00
shr eax, 8
cdq
idiv esi
add dword [ebp - 0xc], eax
mov eax, ecx
and eax, 0xff0000
shr eax, 0x10
cdq
idiv esi
add dword [ebp - 0x10], eax
add ebx, 4
dec edi
jne 0x4e6296
mov cl, byte [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov al, byte [ebp - 8]
call fcn.004082cc
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4ef744
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
test dl, dl
je 0x4ef761
add esp, 0xfffffff0
call fcn.00403f90
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00405078
xor eax, eax
push ebp
push 0x4ef883
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00403bfc
cmp dword [ebp - 8], 0
jne 0x4ef796
lea eax, [ebp - 8]
call fcn.004d2ba4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00405088
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
lea edx, [esi + 1]
lea eax, [ebx + 8]
call fcn.00405214
mov eax, dword [ebx + 8]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4ef85d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4ef8ac
mov eax, dword [ebx + 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4ef85d
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004081dc
movzx eax, ax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x4ef8d0
call fcn.0040b7ac
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0xc]
call fcn.00404c00
mov byte [ebx + 4], 1
xor edi, edi
mov esi, 0x5102d8
lea ecx, [ebp - 0x2c]
mov edx, dword [esi]
mov eax, ebx
call fcn.004ef904
mov edx, dword [ebp - 0x2c]
lea eax, [ebx + edi*4 + 0x10]
call fcn.00404c00
inc edi
add esi, 4
cmp edi, 0xa
jne 0x4ef835
mov eax, ebx
call fcn.004efb44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef88a
lea eax, [ebp - 0x2c]
call fcn.00404bac
lea eax, [ebp - 0x18]
call fcn.00404bac
lea eax, [ebp - 8]
call fcn.00404bac
ret

Function at 0x503060
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push esi
mov eax, ebx
call fcn.00405088
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
seta al
pop esi
pop ebx
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x585f7961
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7e1a79e1
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403280
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
push eax
xor ebx, ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x4bc690
push reloc.dsound.dll_DirectSoundCreate
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x403472
mov ax, word [esi + 0x72f04]
cmp ax, bx
jl 0x4032d1
cmp ax, 0x64
jge 0x4032d1
movsx edx, ax
inc edx
mov dword [esp + 0xc], edx
jmp 0x4032d5
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.advapi32.dll_RegSetValueExA]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push ebx
push 0x4bc688
push ecx
call edi
test eax, eax
jne 0x403467
mov ax, word [esi + 0x72f4a]
cmp ax, bx
jl 0x403315
cmp ax, 0xc8
jge 0x403315
movsx eax, ax
inc eax
mov dword [esp + 0xc], eax
jmp 0x403319
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push ebx
push 0x4bc67c
push edx
call edi
test eax, eax
je 0x403345
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ax, word [esi + 0x72f4c]
cmp ax, bx
jl 0x403361
cmp ax, 0xc8
jge 0x403361
movsx ecx, ax
inc ecx
mov dword [esp + 0xc], ecx
jmp 0x403365
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push ebx
push 0x4bc670
push eax
call edi
test eax, eax
je 0x403391
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ax, word [esi + 0x72f4e]
cmp ax, bx
jl 0x4033ad
cmp ax, 0xc8
jge 0x4033ad
movsx edx, ax
inc edx
mov dword [esp + 0xc], edx
jmp 0x4033b1
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push ebx
push 0x4bc664
push ecx
call edi
test eax, eax
jne 0x403467
mov ax, word [esi + 0x72f50]
cmp ax, bx
jl 0x4033eb
cmp ax, 0xc8
jge 0x4033eb
movsx eax, ax
inc eax
mov dword [esp + 0xc], eax
jmp 0x4033ef
mov dword [esp + 0xc], ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push ebx
push 0x4bc658
push edx
call edi
test eax, eax
je 0x40341b
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ax, word [esi + 0x72f52]
cmp ax, bx
jl 0x403437
cmp ax, 0xc8
jge 0x403437
movsx ecx, ax
inc ecx
mov dword [esp + 0xc], ecx
jmp 0x40343b
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push ebx
push 0x4bc64c
push eax
call edi
test eax, eax
je 0x403467
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x409390
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b429b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x28
push ebp
push esi
mov ebp, ecx
push edi
push eax
lea ecx, [esp + 0x1c]
push 0x4bca40
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
xor esi, esi
lea edx, [esp + 0x18]
push esi
push esi
push 3
push esi
push esi
push closesocket
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40948f
push esi
push esi
push 0x14
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
cmp word [esp + 0x4c], si
jle 0x409488
mov edx, dword [esp + 0x48]
push ebx
mov dword [esp + 0x10], esi
lea ebx, [ebp + edx*4 + 0x3812c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jge 0x409473
push 0x54
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x4c], eax
test eax, eax
mov dword [esp + 0x40], 0
je 0x409467
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x48]
push ecx
push esi
lea ecx, [ebp + 0x7f1c]
push edx
push ecx
push edi
mov ecx, eax
call fcn.0049dd60
jmp 0x409469
xor eax, eax
mov dword [esp + 0x40], 0xffffffff
mov dword [ebx], eax
mov edx, dword [esp + 0x10]
inc esi
inc edx
add ebx, 4
cmp si, word [esp + 0x50]
mov dword [esp + 0x10], edx
jl 0x40941e
pop ebx
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x4094b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b42bb
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
push 0x4bca40
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x14]
push 0
push 0
push 3
push 0
push 0
push closesocket
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4095a5
push edi
push 0
push 0
push 0x14
push ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
xor edi, edi
cmp word [esp + 0x4c], di
jle 0x40959d
push ebp
xor ebp, ebp
cmp ebp, dword [esp + 0x10]
jge 0x409593
push 0x54
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x40], 0
je 0x40957b
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
push edx
push edi
lea edx, [esi + 0x7f1c]
push ecx
push edx
push ebx
mov ecx, eax
call fcn.0049dd60
jmp 0x40957d
xor eax, eax
movsx ecx, word [esp + 0x4c]
add ecx, ebp
mov dword [esp + 0x40], 0xffffffff
mov dword [esi + ecx*4 + 0x6dc8c], eax
inc edi
inc ebp
cmp di, word [esp + 0x50]
jl 0x409538
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10

Function at 0x4095c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b42db
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0x18]
push 0x4bca40
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x14]
push 0
push 0
push 3
push 0
push 0
push closesocket
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4096b5
push edi
push 0
push 0
push 0x14
push ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x14]
push 4
push ecx
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
xor edi, edi
cmp word [esp + 0x4c], di
jle 0x4096ad
push ebp
xor ebp, ebp
cmp ebp, dword [esp + 0x10]
jge 0x4096a3
push 0x54
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x40], 0
je 0x40968b
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
push edx
push edi
lea edx, [esi + 0x7f1c]
push ecx
push edx
push ebx
mov ecx, eax
call fcn.0049dd60
jmp 0x40968d
xor eax, eax
movsx ecx, word [esp + 0x4c]
add ecx, ebp
mov dword [esp + 0x40], 0xffffffff
mov dword [esi + ecx*4 + 0x6e5ec], eax
inc edi
inc ebp
cmp di, word [esp + 0x50]
jl 0x409648
pop ebp
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10
Function at 0x416b50
Capabilities:
Get file size

Disassembly:
sub esp, 0x204
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x114]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
movsx eax, byte [esp + 0x218]
push eax
lea ecx, [esp + 0x118]
push 0x4bd894
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
or ecx, 0xffffffff
mov edi, 0x4bd888
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4bd884
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4bd884
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x114]
or ecx, 0xffffffff
push eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
push 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4bd87c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [esp + 0x28]
push closesocket
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp esi, 0xffffffff
mov ebx, eax
je 0x416caf
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esp + 0x14]
push 0x4bd878
push ecx
call fcn.004a7d19
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x416d0c
lea edi, [ebx + 1]
push edi
call fcn.004a71d4
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 1
and ecx, 3
push ebx
rep stosb byte es:[edi], al
push esi
call fcn.004a7d2c
mov ecx, dword [esp + 0x24]
add esp, 0x14
push esi
call fcn.00416d20
push esi
call fcn.004a71c9
push ebp
call fcn.004a7b32
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret 4
Function at 0x418120
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_CreateFileA]
push edi
push 0
push 0
push 3
push 0
push 0
push closesocket
push 0x4bc960
call esi
cmp eax, 0xffffffff
jne 0x418148
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
push eax
call edi
push 0
push 0
push 3
push 0
push 0
push closesocket
push 0x4bc950
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x418173
pop edi
xor eax, eax
pop esi
ret
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0x2ba6
push esi
je 0x41818b
call edi
pop edi
xor eax, eax
pop esi
ret
call edi
pop edi
mov eax, 1
pop esi
ret
Function at 0x43a3a0
Capabilities:
Check http status code

Disassembly:
push ebx
mov bx, word [esp + 8]
push esi
push edi
mov di, word [esp + 0x14]
cmp bx, 0x142
mov esi, ecx
jle 0x43a420
cmp bx, 0x163
jge 0x43a420
cmp di, 0x1b2
jle 0x43a420
cmp di, 0x1db
jge 0x43a420
mov eax, dword [esi + 0x72e0c]
test eax, eax
je 0x43a671
mov eax, dword [esi + 0x72f68]
dec eax
je 0x43a400
dec eax
je 0x43a3f4
dec eax
jne 0x43a411
push 0
push 0
push 0
push 0
push 0x24
jmp 0x43a40a
push 0
push 0
push 0
push 0
push 0x25
jmp 0x43a40a
push 0
push 0
push 0
push 0
push 0x26
mov ecx, esi
call fcn.00438f60
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.00446e60
cmp bx, 0x16a
jle 0x43a468
cmp bx, 0x194
jge 0x43a468
cmp di, 0x1b2
jle 0x43a468
cmp di, 0x1db
jge 0x43a468
push 0
push 0
push 0
push 0
push 0
push 0
push 0xa0b
push 0xfa314dc
mov ecx, esi
call fcn.00405900
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.00446e60
cmp bx, 0x19d
jl 0x43a4be
cmp bx, 0x1be
jg 0x43a4be
cmp di, 0x1b2
jle 0x43a4be
cmp di, 0x1db
jge 0x43a4be
lea ecx, [esi + 0x72adc]
call fcn.004a6fd0
cmp eax, 1
jne 0x43a49e
push eax
mov ecx, esi
call fcn.00439d10
jmp 0x43a4af
push 0
push 0
push 0
push 0
push 1
mov ecx, esi
call fcn.00438f60
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.00446e60
cmp bx, 0x1c5
jl 0x43a515
cmp bx, 0x1e6
jg 0x43a515
cmp di, 0x1b2
jle 0x43a515
cmp di, 0x1db
jge 0x43a515
lea ecx, [esi + 0x72ae8]
call fcn.004a6fd0
cmp eax, 1
jne 0x43a4f5
push 2
mov ecx, esi
call fcn.00439d10
jmp 0x43a506
push 0
push 0
push 0
push 0
push 2
mov ecx, esi
call fcn.00438f60
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.00446e60
cmp bx, 0x1ea
jl 0x43a56c
cmp bx, 0x20a
jg 0x43a56c
cmp di, 0x1b2
jle 0x43a56c
cmp di, 0x1db
jge 0x43a56c
lea ecx, [esi + 0x72af4]
call fcn.004a6fd0
cmp eax, 1
jne 0x43a54c
push 3
mov ecx, esi
call fcn.00439d10
jmp 0x43a55d
push 0
push 0
push 0
push 0
push 3
mov ecx, esi
call fcn.00438f60
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.00446e60
cmp bx, 0x20e
jl 0x43a5c3
cmp bx, 0x228
jg 0x43a5c3
cmp di, 0x1b2
jle 0x43a5c3
cmp di, 0x1db
jge 0x43a5c3
lea ecx, [esi + 0x72b84]
call fcn.004a6fd0
cmp eax, 1
jne 0x43a5a3
push 0xf
mov ecx, esi
call fcn.00439d10
jmp 0x43a5b4
push 0
push 0
push 0
push 0
push 0xf
mov ecx, esi
call fcn.00438f60
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.00446e60
cmp bx, 0x22c
jl 0x43a61a
cmp bx, 0x24b
jg 0x43a61a
cmp di, 0x1b2
jle 0x43a61a
cmp di, 0x1db
jge 0x43a61a
lea ecx, [esi + 0x72b48]
call fcn.004a6fd0
cmp eax, 1
jne 0x43a5fa
push 0xa
mov ecx, esi
call fcn.00439d10
jmp 0x43a60b
push 0
push 0
push 0
push 0
push 0xa
mov ecx, esi
call fcn.00438f60
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.00446e60
cmp bx, 0x24d
jl 0x43a671
cmp bx, 0x26d
jg 0x43a671
cmp di, 0x1b2
jle 0x43a671
cmp di, 0x1db
jge 0x43a671
lea ecx, [esi + 0x72bb4]
call fcn.004a6fd0
cmp eax, 1
jne 0x43a651
push 0x13
mov ecx, esi
call fcn.00439d10
jmp 0x43a662
push 0
push 0
push 0
push 0
push 0x13
mov ecx, esi
call fcn.00438f60
push 0
push 5
push 0xe
push 0x45
mov ecx, esi
call fcn.00446e60
pop edi
pop esi
pop ebx
ret 8