joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c070
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
push 0x58a
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x449e60
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40c0a8
mov al, 1
jmp 0x40c15a
mov ecx, dword [ebp - 4]
call fcn.0042bdc0
test eax, eax
jne 0x40c0df
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
push edx
push 0x58a
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x449eb0
push 0x14
call fcn.0040e570
push eax
call fcn.0041ff60
add esp, 0x18
mov al, 1
jmp 0x40c15a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
push edx
push str.UPDATE_color_pen_SET_PenColor___d__UseCount__UseCount__1__LastTime__now___WHERE_UserSN___u
mov eax, dword [ebp - 4]
push eax
call fcn.0042bbc0
add esp, 0x10
movzx ecx, al
test ecx, ecx
jne 0x40c108
mov al, 1
jmp 0x40c15a
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.INSERT_INTO_color_pen_log__UserSN__PenColor__LastTime___VALUES___u___d__now____
mov eax, dword [ebp - 4]
push eax
call fcn.0042bbc0
add esp, 0x10
movzx ecx, al
test ecx, ecx
jne 0x40c131
mov al, 1
jmp 0x40c15a
push 0x58a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0x449fb8
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40c158
mov al, 1
jmp 0x40c15a
xor al, al
add esp, 4
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 8

Function at 0x40c5c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x44a350
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40c606
mov al, 2
jmp 0x40c658
mov ecx, dword [ebp - 4]
call fcn.0042bd10
movzx ecx, al
test ecx, ecx
jne 0x40c619
mov al, 2
jmp 0x40c658
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040f000
cmp dword [ebp - 0xc], 0
jle 0x40c652
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x44a3a0
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40c650
mov al, 2
jmp 0x40c658
jmp 0x40c656
mov al, 1
jmp 0x40c658
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x40c679]
call fcn.0042c4c0
pop eax
pop edx
add esp, 0x10
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 8
Function at 0x40c6a0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.UPDATE_avatar_inventory_items_SET_RemainCount__RemainCount___1_WHERE_UserSN___u_AND_ItemID___d_AND_RemainCount___0
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40c6e8
mov al, 1
jmp 0x40c7c9
mov ecx, dword [ebp - 4]
call fcn.0042bdf0
test eax, eax
je 0x40c779
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.SELECT_RemainCount_FROM_avatar_inventory_items_WHERE_UserSN___u_AND_ItemID___d
mov eax, dword [ebp - 4]
push eax
call fcn.0042bbc0
add esp, 0x10
movzx ecx, al
test ecx, ecx
jne 0x40c71f
mov al, 1
jmp 0x40c7c9
mov ecx, dword [ebp - 4]
call fcn.0042bd10
movzx edx, al
test edx, edx
jne 0x40c735
mov al, 1
jmp 0x40c7c9
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040f000
cmp dword [ebp + 0xc], 0xbe3
jne 0x40c751
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.INSERT_INTO_game_item_use_info_VALUES__NULL___u___d___d__now____
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x14
movzx edx, al
test edx, edx
jne 0x40c779
mov al, 1
jmp 0x40c7c9
cmp dword [ebp - 0xc], 0
jne 0x40c7c7
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x44a508
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40c7a3
mov al, 1
jmp 0x40c7c9
mov ecx, dword [ebp + 0xc]
push ecx
push 0x44a550
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x40c7c3
mov al, 1
jmp 0x40c7c9
mov al, 1
jmp 0x40c7c9
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x40c7ea]
call fcn.0042c4c0
pop eax
pop edx
add esp, 0x10
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 8
Function at 0x40c810
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x40c85e
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.INSERT_INTO_couple_item_use_info__UserSN__CoupleSN__UseTime___VALUES___u___u__now____
mov eax, dword [ebp - 4]
push eax
call fcn.0042bbc0
add esp, 0x10
movzx ecx, al
test ecx, ecx
jne 0x40c859
mov al, 1
jmp 0x40c91d
jmp 0x40c91b
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.SELECT_InfoSN_FROM_couple_item_use_info_WHERE_UserSN___u_AND_CoupleSN___u_AND_Confirm__0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40c885
mov al, 1
jmp 0x40c91d
mov ecx, dword [ebp - 4]
call fcn.0042bdc0
test eax, eax
je 0x40c8d2
mov ecx, dword [ebp - 4]
call fcn.0042bd10
movzx eax, al
test eax, eax
jne 0x40c8a4
mov al, 1
jmp 0x40c91d
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040f000
mov edx, dword [ebp - 0xc]
push edx
push str.UPDATE_couple_item_use_info_SET_Confirm__1_WHERE_InfoSN___u
mov eax, dword [ebp - 4]
push eax
call fcn.0042bbc0
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x40c8d0
mov al, 1
jmp 0x40c91d
jmp 0x40c8f6
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.INSERT_INTO_couple_item_use_info__UserSN__CoupleSN__UseTime__Confirm___VALUES___u___u__now____1__
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40c8f6
mov al, 1
jmp 0x40c91d
push 0x711
mov eax, dword [ebp + 8]
push eax
push 0x44a6f8
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40c91b
or al, 0xff
jmp 0x40c91d
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x40c93e]
call fcn.0042c4c0
pop eax
pop edx
add esp, 0x10
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c960
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push str.SELECT_UserSN_FROM_battleparty_inititem_use_info_WHERE_UserSN___u
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0xc
movzx edx, al
test edx, edx
jne 0x40c98e
mov al, 1
jmp 0x40ca06
mov ecx, dword [ebp - 4]
call fcn.0042bdc0
test eax, eax
jle 0x40c99e
mov al, 2
jmp 0x40ca06
mov eax, dword [ebp + 8]
push eax
push str.INSERT_INTO_battleparty_inititem_use_info__UserSN__UseTime___VALUES___u__now____
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0xc
movzx edx, al
test edx, edx
jne 0x40c9be
mov al, 1
jmp 0x40ca06
movzx eax, word [ebp + 0xc]
push eax
push str.UPDATE_iteminfo_SET_ItemOwnCount__ItemOwnCount___1_WHERE_ItemID___d
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0xc
movzx edx, al
test edx, edx
jne 0x40c9df
mov al, 1
jmp 0x40ca06
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x44a828
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40ca04
mov al, 1
jmp 0x40ca06
xor al, al
add esp, 4
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 8

Function at 0x40ca20
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.SELECT_BuyNick__ExpiredDate_FROM_avatar_inventory_items_WHERE_UserSN___u_AND_ItemID___d
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40ca56
mov al, 1
jmp 0x40cae1
mov ecx, dword [ebp - 4]
call fcn.0042bdc0
test eax, eax
jle 0x40cadb
mov ecx, dword [ebp - 4]
call fcn.0042bd10
movzx ecx, al
test ecx, ecx
jne 0x40ca75
mov al, 1
jmp 0x40cae1
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040e4b0
mov ecx, eax
call fcn.0040e4b0
mov ecx, dword [ebp + 0x14]
call fcn.00426bb0
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00426bb0
push eax
push str.SELECT__TO_DAYS__s____TO_DAYS_NOW______24__DATE_FORMAT__s____H____DATE_FORMAT_now______H_
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40caba
mov al, 1
jmp 0x40cae1
mov ecx, dword [ebp - 4]
call fcn.0042bd10
movzx eax, al
test eax, eax
jne 0x40cacd
mov al, 1
jmp 0x40cae1
mov ecx, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040f000
jmp 0x40cadf
mov al, 1
jmp 0x40cae1
xor al, al
add esp, 4
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40d6f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
push 0xaa1
mov eax, dword [ebp + 8]
push eax
push 0x44af78
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40d736
or al, 0xff
jmp 0x40d78e
mov ecx, dword [ebp - 4]
call fcn.0042bdc0
test eax, eax
jle 0x40d78c
mov ecx, dword [ebp - 4]
call fcn.0042bd10
movzx eax, al
test eax, eax
jne 0x40d755
or al, 0xff
jmp 0x40d78e
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040f000
cmp dword [ebp - 0xc], 0
je 0x40d78c
push 0xaa1
mov edx, dword [ebp + 8]
push edx
push 0x44afc8
mov eax, dword [ebp - 4]
push eax
call fcn.0042bbc0
add esp, 0x10
movzx ecx, al
test ecx, ecx
jne 0x40d78c
mov al, 1
jmp 0x40d78e
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x40d7af]
call fcn.0042c4c0
pop eax
pop edx
add esp, 0x10
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 4

Function at 0x40d7d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0xbe3
mov eax, dword [ebp + 8]
push eax
push str.SELECT_ItemID_FROM_avatar_inventory_items_WHERE_UserSN___u_AND_ItemID___d
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40d824
mov al, 1
jmp 0x40d8a8
mov ecx, dword [ebp - 4]
call fcn.0042bdc0
test eax, eax
jne 0x40d852
push 0xbe3
mov eax, dword [ebp + 8]
push eax
push 0x44b05c
push 0x14
call fcn.0040e570
push eax
call fcn.0041ff60
add esp, 0x14
mov al, 1
jmp 0x40d8a8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xa8c0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.INSERT_INTO_viproomitem_info_VALUES___u___d__now____
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40d881
mov al, 1
jmp 0x40d8a8
push 0xbe3
mov ecx, dword [ebp + 8]
push ecx
push str.UPDATE_avatar_inventory_items_SET_UseItem__1_WHERE_UserSN___u_AND_ItemID___d
mov edx, dword [ebp - 4]
push edx
call fcn.0042bbc0
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x40d8a6
mov al, 1
jmp 0x40d8a8
xor al, al
add esp, 0xc
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 8
Function at 0x40e210
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
push 0x1258
mov eax, dword [ebp + 8]
push eax
push str.SELECT_COUNT_1__FROM_avatar_inventory_items_WHERE_UserSN___u_AND_ItemID___d
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042bbc0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x40e256
or al, 0xff
jmp 0x40e2ae
mov ecx, dword [ebp - 4]
call fcn.0042bdc0
test eax, eax
jle 0x40e2ac
mov ecx, dword [ebp - 4]
call fcn.0042bd10
movzx eax, al
test eax, eax
jne 0x40e275
or al, 0xff
jmp 0x40e2ae
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040f000
cmp dword [ebp - 0xc], 0
je 0x40e2ac
push 0x1258
mov edx, dword [ebp + 8]
push edx
push str.DELETE_FROM_avatar_inventory_items_WHERE_UserSN___u_AND_ItemID___d
mov eax, dword [ebp - 4]
push eax
call fcn.0042bbc0
add esp, 0x10
movzx ecx, al
test ecx, ecx
jne 0x40e2ac
mov al, 1
jmp 0x40e2ae
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x40e2cf]
call fcn.0042c4c0
pop eax
pop edx
add esp, 0x10
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 4
Function at 0x4121d0
Capabilities:
Print debug messages
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0x44b5a8
mov esi, esp
push 0
push 0x4400000
lea eax, [ebp - 0xc]
push eax
push 0x44b5ac
push 0x44b5b0
mov ecx, dword [ebp + 8]
push ecx
push 0x44b5bc
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.wininet.dll_HttpOpenRequestA]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
jne 0x4122ba
mov esi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
mov esi, esp
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push 0x400
mov edi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp edi, esp
call fcn.0042c490
push eax
push 0
push 0x1100
call dword [sym.imp.kernel32.dll_FormatMessageA]
cmp esi, esp
call fcn.0042c490
mov dword [ebp - 0x20], eax
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.0042c490
mov esi, esp
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.kernel32.dll_LocalFree]
cmp esi, esp
call fcn.0042c490
xor eax, eax
jmp 0x412345
mov esi, esp
push 0x80000000
push 0x44b5c0
call fcn.0042dc40
add esp, 4
push eax
push 0x44b5d0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.wininet.dll_HttpAddRequestHeadersA]
cmp esi, esp
call fcn.0042c490
test eax, eax
jne 0x412305
mov esi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
xor eax, eax
jmp 0x412345
mov esi, esp
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.wininet.dll_HttpSendRequestA]
cmp esi, esp
call fcn.0042c490
test eax, eax
jne 0x412340
mov esi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
xor eax, eax
jmp 0x412345
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x412368]
call fcn.0042c4c0
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 4
Function at 0x4123b0
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0042cf80
push esi
push edi
push ecx
lea edi, [ebp - 0x1024]
mov ecx, 0x409
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x457e80]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x44b5e0
mov al, byte [0x44b5e4]
mov byte [ebp - 0x1018], al
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1017]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x1020], str.Content_Type:_application_x_www_form_urlencoded_r
push 0xfff
lea ecx, [ebp - 0x1018]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00412d90
mov dword [ebp - 0x1024], eax
mov esi, esp
push 0
push 0x4400040
lea edx, [ebp - 0x10]
push edx
push 0x44b619
push 0x44b61c
mov eax, dword [ebp + 8]
push eax
push 0x44b628
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.wininet.dll_HttpOpenRequestA]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x28], 0
jne 0x412485
mov esi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x2c], eax
xor eax, eax
jmp 0x412536
mov esi, esp
push 0x80000000
push 0x44b630
call fcn.0042dc40
add esp, 4
push eax
push 0x44b640
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.wininet.dll_HttpAddRequestHeadersA]
cmp esi, esp
call fcn.0042c490
test eax, eax
jne 0x4124d0
mov esi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x2c], eax
xor eax, eax
jmp 0x412536
lea edx, [ebp - 0x1018]
push edx
call fcn.0042dc40
add esp, 4
mov esi, esp
push eax
lea eax, [ebp - 0x1018]
push eax
mov ecx, dword [ebp - 0x1020]
push ecx
call fcn.0042dc40
add esp, 4
push eax
mov edx, dword [ebp - 0x1020]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.wininet.dll_HttpSendRequestA]
cmp esi, esp
call fcn.0042c490
test eax, eax
jne 0x412531
mov esi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, esp
call fcn.0042c490
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], eax
xor eax, eax
jmp 0x412536
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x412564]
call fcn.0042c4c0
pop eax
pop edx
mov ecx, dword [ebp - 4]
call fcn.0042c800
pop edi
pop esi
add esp, 0x1024
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 4
Function at 0x412990
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4129c1
mov esi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
xor eax, eax
jmp 0x412a18
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0042cf20
add esp, 0xc
mov esi, esp
push 0x458e34
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.wininet.dll_InternetReadFile]
cmp esi, esp
call fcn.0042c490
test eax, eax
jne 0x412a13
mov esi, esp
call dword [sym.imp.kernel32.dll_GetLastError]
cmp esi, esp
call fcn.0042c490
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
xor eax, eax
jmp 0x412a18
mov eax, dword [0x458e34]
pop esi
add esp, 4
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 8
Function at 0x4133a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xc]
call fcn.00413c80
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00413bc0
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
jmp 0x4133f7
lea ecx, [ebp - 0xc]
call fcn.00413ce0
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004260e0
push eax
lea ecx, [ebp - 0xc]
call fcn.00413d10
movzx eax, al
test eax, eax
je 0x4134b3
lea ecx, [ebp - 0xc]
call fcn.00413cb0
mov ecx, dword [eax + 0x1100]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 1
je 0x413439
cmp dword [ebp - 0x24], 2
je 0x413447
jmp 0x4134ae
mov edx, dword [ebp - 0x14]
add edx, 0x4000
mov dword [ebp - 0x14], edx
jmp 0x4134ae
mov esi, esp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0xc]
call fcn.00413cb0
add eax, 0x100
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp esi, esp
call fcn.0042c490
mov dword [ebp - 0x18], eax
mov esi, esp
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp esi, esp
call fcn.0042c490
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax + 0x3000]
mov dword [ebp - 0x14], edx
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp esi, esp
call fcn.0042c490
jmp 0x4133ef
mov eax, dword [ebp - 0x14]
push edx
mov ecx, ebp
push eax
lea edx, [0x4134d6]
call fcn.0042c4c0
pop eax
pop edx
pop esi
add esp, 0x24
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret
Function at 0x413500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0x400
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0042dc40
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x413552
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jbe 0x413576
push 1
push 0x44b7c8
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x14]
push edx
call fcn.00413b00
add esp, 0xc
test eax, eax
jne 0x413574
jmp 0x413576
jmp 0x413549
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov esi, esp
lea ecx, [ebp - 0x1c]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x24]
push edx
push 0x80000000
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
cmp esi, esp
call fcn.0042c490
test eax, eax
jne 0x413601
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0x458e38
push 0
push 0
push str.Content_Type
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.0042c490
test eax, eax
je 0x4135ec
push 0x44b7dc
call fcn.0042dc40
add esp, 4
push eax
push 0x44b7f8
push 0x458e38
call fcn.00413ae0
add esp, 0xc
mov esi, esp
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, esp
call fcn.0042c490
jmp 0x413621
push 0x44b814
call fcn.0042dc40
add esp, 4
push eax
push str.application_octet_stream
push 0x458e38
call fcn.00413ae0
add esp, 0xc
mov eax, 0x458e38
push edx
mov ecx, ebp
push eax
lea edx, [0x413648]
call fcn.0042c4c0
pop eax
pop edx
pop esi
add esp, 0x24
cmp ebp, esp
call fcn.0042c490
mov esp, ebp
pop ebp
ret 4