joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d110
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2494
call fcn.00517f10
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x26d8]
mov ebx, dword [eax + edi*4]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 3
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x48d2a1
lea edi, [esi + 0x5f5c0]
lea eax, [esi + 0x5d530]
cmp word [esi + 0x5f5c0], 0
cmove edi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x2494], xmm0
lea eax, [ebp - 0x2464]
push 0x2454
push 0
push eax
call fcn.006030b0
add esp, 0xc
mov dword [ebp - 0x24a0], 0x3c
lea eax, [ebp - 0x245c]
mov dword [ebp - 0x249c], eax
mov dword [ebp - 0x2498], 0x20
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x2490], eax
mov dword [ebp - 0x248c], 0x100
lea eax, [ebp - 0x241c]
mov dword [ebp - 0x2474], eax
mov dword [ebp - 0x2470], 0x800
lea eax, [ebp - 0x141c]
mov dword [ebp - 0x246c], eax
mov dword [ebp - 0x2468], 0x800
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x2484], eax
mov dword [ebp - 0x2480], 0x80
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x247c], eax
mov dword [ebp - 0x2478], 0x80
push edi
call fcn.006208d5
add esp, 4
lea ecx, [ebp - 0x24a0]
push ecx
push 0x10000000
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x48d2c1
mov eax, dword [ebp - 0x2494]
cmp eax, 4
ja 0x48d2c1
mov ecx, 0x1a
bt ecx, eax
jae 0x48d2c1
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
movzx ecx, word [ebp - 0x2488]
mov word [ebp - 0x2464], cx
mov dword [ebp - 0x2460], eax
mov dword [ebp - 0x14], 0xffffffff
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
push SysReAllocStringLen
lea eax, [ebp - 0x241c]
push eax
push dword [ebx + 0x18]
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov dword [ebx + 0x1c], eax
test eax, eax
mov edi, dword [ebp + 8]
jne 0x48d2b4
jmp 0x48d2c4
push 0
push 0
push 0
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_HttpEndRequestW]
test eax, eax
je 0x48d2c4
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov bl, 1
jmp 0x48d2dd
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, 1
cmp eax, 0x3e5
je 0x48d2dd
mov ecx, esi
push edi
call fcn.0048e7f0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x2494
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x48db60
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x26d8]
mov edi, dword [eax + ebx*4]
mov dword [edi + 0x28], 6
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 1
jne 0x48dbb5
cmp dword [edi], 0
je 0x48dbf6
mov dword [edi + 0x28], 4
mov ecx, esi
push 1
push ebx
call fcn.0048e8c0
test al, al
jne 0x48dc00
mov ecx, esi
push ebx
call fcn.0048e7f0
jmp 0x48dc00
cmp dword [esi + 0x2480], 0
je 0x48dc00
mov dword [ebp - 0x14], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x2484]
push dword [esi + 0x2480]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x48dc16
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x48dc00
mov eax, dword [edi + 4]
test eax, eax
je 0x48db96
mov dword [edi + 0x18], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov al, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
jmp 0x48dc0c
Function at 0x48dc40
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2494
call fcn.00517f10
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x26d8]
mov ebx, dword [eax + edi*4]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 7
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x48ddd1
lea edi, [esi + 0x5f5c0]
lea eax, [esi + 0x5d530]
cmp word [esi + 0x5f5c0], 0
cmove edi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x2494], xmm0
lea eax, [ebp - 0x2464]
push 0x2454
push 0
push eax
call fcn.006030b0
add esp, 0xc
mov dword [ebp - 0x24a0], 0x3c
lea eax, [ebp - 0x245c]
mov dword [ebp - 0x249c], eax
mov dword [ebp - 0x2498], 0x20
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x2490], eax
mov dword [ebp - 0x248c], 0x100
lea eax, [ebp - 0x241c]
mov dword [ebp - 0x2474], eax
mov dword [ebp - 0x2470], 0x800
lea eax, [ebp - 0x141c]
mov dword [ebp - 0x246c], eax
mov dword [ebp - 0x2468], 0x800
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x2484], eax
mov dword [ebp - 0x2480], 0x80
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x247c], eax
mov dword [ebp - 0x2478], 0x80
push edi
call fcn.006208d5
add esp, 4
lea ecx, [ebp - 0x24a0]
push ecx
push 0x10000000
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x48ddf1
mov eax, dword [ebp - 0x2494]
cmp eax, 4
ja 0x48ddf1
mov ecx, 0x1a
bt ecx, eax
jae 0x48ddf1
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
movzx ecx, word [ebp - 0x2488]
mov word [ebp - 0x2464], cx
mov dword [ebp - 0x2460], eax
mov dword [ebp - 0x14], 0xffffffff
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
push SysReAllocStringLen
lea eax, [ebp - 0x241c]
push eax
push dword [ebx + 0x18]
call dword [sym.imp.WININET.dll_FtpOpenFileW]
mov dword [ebx + 0x1c], eax
test eax, eax
mov edi, dword [ebp + 8]
jne 0x48dde4
jmp 0x48ddf4
push 0
push 0
push 0
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_HttpEndRequestW]
test eax, eax
je 0x48ddf4
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov bl, 1
jmp 0x48de0d
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, 1
cmp eax, 0x3e5
je 0x48de0d
mov ecx, esi
push edi
call fcn.0048e7f0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x2494
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x48e190
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x26d8]
mov ebx, dword [eax + ecx*4]
xorps xmm0, xmm0
movups xmmword [ebx + 0x8058], xmm0
movups xmmword [ebx + 0x8048], xmm0
mov dword [ebx + 0x8068], 0
mov dword [ebx + 0x8044], 0x28
lea edi, [ebx + 0x40]
push 0x8000
push 0
push edi
call fcn.006030b0
add esp, 0xc
mov dword [ebx + 0x8058], edi
lea edi, [ebx + 0x805c]
mov dword [ebx + 0x805c], 0x8000
mov ecx, dword [ebx + 0x8040]
test ecx, ecx
je 0x48e20a
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 8]
sub eax, dword [ecx + 0x18]
add eax, 1
jmp 0x48e223
mov eax, dword [esi + 0x5d100]
mov ecx, dword [esi + 0x5d104]
and ecx, eax
cmp ecx, 0xffffffff
je 0x48e232
sub eax, dword [esi + 0x5d110]
cmp eax, 0x8000
mov ecx, 0x8000
cmovl ecx, eax
mov dword [edi], ecx
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 9
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
jne 0x48e272
push edi
push dword [ebx + 0x805c]
push dword [ebx + 0x8058]
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x48e289
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
jmp 0x48e2a7
lea eax, [ebx + 0x8044]
push ebx
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x48e265
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov al, 1
cmp ecx, 0x3e5
je 0x48e2a7
mov ecx, esi
push dword [ebp + 8]
call fcn.0048e7f0
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x48e620
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1040
call fcn.00517f10
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x2480], 0
mov eax, 0x647dba
mov edi, str.POST
cmove edi, eax
movsd xmm0, qword [0x653150]
movsd qword [ebp - 0x1018], xmm0
lea eax, [ebp - 0x1010]
push 0x1000
push 0
push eax
call fcn.006030b0
add esp, 0xc
mov eax, dword [ebx + 0x20]
lea ecx, [eax + 0x1048]
add eax, 0x48
push ecx
push eax
push str._s_s
push 0x7ff
lea eax, [ebp - 0x1010]
push eax
call fcn.0048f030
add esp, 0x14
xor eax, eax
mov dword [ebp - 0x104c], esi
cmp dword [esi + 0x62cb4], 0
setne al
shl eax, 0x13
lea ecx, [eax - 0x7bff3d00]
mov edx, dword [ebx + 0x20]
or eax, 0x8480f300
cmp dword [edx + 4], 4
cmovne eax, ecx
lea ecx, [ebp - 0x1018]
push ebx
push eax
push ecx
push 0
push str.HTTP_1.1
lea eax, [ebp - 0x1010]
push eax
push edi
push dword [ebx + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x48e7cd
mov dword [ebp - 0x101c], 0x3a98
lea ecx, [ebp - 0x101c]
mov edi, ebx
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
push ecx
push 2
push eax
call esi
mov dword [ebp - 0x1020], 1
lea eax, [ebp - 0x1020]
push 4
push eax
push 0x41
push dword [ebx + 0x1c]
call esi
mov esi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1034], xmm0
movups xmmword [ebp - 0x1044], xmm0
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1048], 0x28
push 0xa2d0
call fcn.00517c03
add esp, 4
mov edi, eax
xor ebx, ebx
test esi, esi
setne bl
push 0xa2d0
push 0
push eax
call fcn.006030b0
add esp, 0xc
mov ecx, dword [ebp - 0x104c]
push ebx
push 0x5167
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.0048f090
mov dword [ebp - 0x1040], edi
push edi
call fcn.006208d5
add esp, 4
mov dword [ebp - 0x103c], eax
lea eax, [ebp - 0x1048]
push esi
push 1
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
setne bl
push edi
call fcn.00517c15
add esp, 4
jmp 0x48e7cf
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x1040
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x48eeb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x805c]
mov edx, dword [edi + 0x20]
cmp dword [edx + 4], 1
cmove eax, edi
mov esi, ecx
mov ebx, dword [eax]
cmp byte [ecx + 0x26f0], 0
je 0x48ef6d
mov ecx, esi
call fcn.0048f6b0
mov edi, dword [edi + 0x8040]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
add eax, dword [edi + 8]
adc ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x48efab
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
add eax, 0x40
lea ecx, [ebp - 0x18]
push 0
push ecx
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48efb9
cmp dword [ebp - 0x18], ebx
jne 0x48efb9
add dword [edi + 0x18], ebx
adc dword [edi + 0x1c], 0
add dword [esi + 0x5d110], ebx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push ebx
push dword [ebp + 8]
call fcn.0048f8a0
mov ecx, esi
call fcn.0048f7a0
mov bl, 1
jmp 0x48efbb
mov dword [ebp - 0x14], 0
lea eax, [edi + 0x40]
lea ecx, [ebp - 0x14]
push 0
push ecx
push ebx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x48efb9
cmp dword [ebp - 0x14], ebx
jne 0x48efb9
add dword [esi + 0x5d110], ebx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push ebx
push edi
call fcn.0048f8a0
mov bl, 1
jmp 0x48efbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x48ef1c
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x48f6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
lea ebx, [ebp - 0x218]
push 0x208
push 0
push ebx
call fcn.006030b0
add esp, 0xc
push 2
push 0
push 0xffffffffffffff96
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edi, [ebp - 0x21c]
push 0
push edi
push 0x6a
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x21c], 0x6a
jne 0x48f782
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push ebx
call fcn.006207b6
add esp, 8
test eax, eax
jne 0x48f782
mov eax, 0xfffffffc
sub eax, dword [ebp - 0x21c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push eax
push dword [esi + 8]
call ebx
lea eax, [ebp - 0x220]
push 0
push edi
push 4
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x220]
add eax, dword [ebp - 0x21c]
neg eax
push 1
push 0
push eax
push dword [esi + 8]
call ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48f7a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov edi, dword [ecx + 0x26e8]
sub edi, dword [ecx + 0x26e4]
mov eax, edi
sar eax, 2
mov dword [ebp - 0x18], eax
push 2
push 0
push 0
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x48f878
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push 0
push eax
push 4
push ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26e4]
mov ebx, 4
cmp dword [esi + 0x26e8], eax
je 0x48f84f
mov ebx, 4
xor edi, edi
nop word cs:[eax + eax]
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x20
push dword [eax + edi*4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, 0x20
add edi, 1
mov eax, dword [esi + 0x26e4]
mov ecx, dword [esi + 0x26e8]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jb 0x48f820
mov dword [ebp - 0x18], ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ebx, [ebp - 0x14]
push ebx
push 4
lea eax, [ebp - 0x18]
push eax
push dword [esi + 8]
call edi
push 0
push ebx
push 0x6a
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push dword [esi + 8]
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x48fb00
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x44ec
call fcn.00517f10
mov esi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
call fcn.006208d5
add esp, 4
mov dword [ebp - 0x44f8], eax
push str.filename
push esi
call fcn.0060384c
add esp, 8
test eax, eax
je 0x48fd32
mov edi, eax
cmp word [eax + 0x12], 0x22
jne 0x48fb55
add edi, 0x14
push 0x63acd4
jmp 0x48fb5d
add edi, 0x12
push 0x642bac
push edi
call fcn.0060384c
add esp, 8
test eax, eax
je 0x48fb72
mov ebx, eax
sub ebx, edi
sar ebx, 1
jmp 0x48fb7d
push edi
call fcn.006208d5
add esp, 4
mov ebx, eax
push ebx
push edi
push dword [ebp - 0x44f8]
push esi
call fcn.00620e3e
add esp, 0x10
mov word [esi + ebx*2], 0
lea edi, [ebp - 0x2464]
push 0x2454
push 0
push edi
call fcn.006030b0
add esp, 0xc
lea ebx, [ebp - 0x34ac]
push 0x1048
push 0
push ebx
call fcn.006030b0
add esp, 0xc
push esi
push str.http:__127.0.0.1__s
push 0x823
push ebx
call fcn.00405a12
add esp, 0x10
xorps xmm0, xmm0
movups xmmword [ebp - 0x44e8], xmm0
push 0x2454
push 0
push edi
call fcn.006030b0
add esp, 0xc
mov dword [ebp - 0x44f4], 0x3c
lea eax, [ebp - 0x245c]
mov dword [ebp - 0x44f0], eax
mov dword [ebp - 0x44ec], 0x20
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x44e4], eax
mov dword [ebp - 0x44e0], 0x100
lea eax, [ebp - 0x241c]
mov dword [ebp - 0x44c8], eax
mov dword [ebp - 0x44c4], 0x800
lea eax, [ebp - 0x141c]
mov dword [ebp - 0x44c0], eax
mov dword [ebp - 0x44bc], 0x800
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x44d8], eax
mov dword [ebp - 0x44d4], 0x80
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x44d0], eax
mov dword [ebp - 0x44cc], 0x80
push ebx
call fcn.006208d5
add esp, 4
lea edi, [ebp - 0x44f4]
push edi
push 0x10000000
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x48fd32
mov eax, dword [ebp - 0x44e8]
cmp eax, 4
ja 0x48fd32
mov ecx, 0x1a
bt ecx, eax
jae 0x48fd32
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
movzx ecx, word [ebp - 0x44dc]
mov word [ebp - 0x2464], cx
mov dword [ebp - 0x2460], eax
mov dword [ebp - 0x14], 0xffffffff
mov ebx, dword [ebp - 0x44f8]
push ebx
push 0
push esi
call fcn.006030b0
add esp, 0xc
push 0x1048
push 0
push edi
call fcn.006030b0
add esp, 0xc
lea eax, [ebp - 0x241a]
lea ecx, [ebp - 0x141c]
push ecx
push eax
push str._s_s
push 0x823
push edi
call fcn.00405a12
add esp, 0x14
push edi
push ebx
push esi
call fcn.00620818
add esp, 0xc
mov bl, 1
jmp 0x48fd34
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
mov eax, ebx
add esp, 0x44ec
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x490f00
Capabilities:
Check if file exists
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x420
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea esi, [ebp - 0x214]
push 0x208
push 0
push esi
call fcn.006030b0
add esp, 0xc
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x424], 0x208
lea edi, [ebp - 0x41c]
push 0x208
push 0
push edi
call fcn.006030b0
add esp, 0xc
push 0
push 0x26
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
push str._sInternet_Exploreriexplore.exe
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x490fb5
lea eax, [ebp - 0x424]
lea ecx, [ebp - 0x420]
push eax
push esi
push ecx
push 0x6390a0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x490fb5
mov word [ebp - 0x214], 0
push esi
call fcn.006208d5
add esp, 4
mov esi, 1
test eax, eax
jne 0x491007
mov dword [ebp - 0x428], 0
lea eax, [ebp - 0x428]
push eax
push 0x689eb4
push 0x15
push 0
push 0x689ec4
call dword [sym.imp.ole32.dll_CoCreateInstance]
xor esi, esi
test eax, eax
js 0x491007
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x491007
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
add esp, 0x420
pop esi
pop edi
pop ebp
ret
Function at 0x491020
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x450
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x448], eax
xor esi, esi
test edi, edi
je 0x491116
cmp word [edi], 0
je 0x491116
lea esi, [esp + 0x240]
push 0x208
push 0
push esi
call fcn.006030b0
add esp, 0xc
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], 0x208
lea ebx, [esp + 0x38]
push 0x208
push 0
push ebx
call fcn.006030b0
add esp, 0xc
push 0
push 0x26
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
push str._sInternet_Exploreriexplore.exe
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4910ec
lea eax, [esp + 0x30]
lea ecx, [esp + 0x34]
push eax
push esi
push ecx
push 0x6390a0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4910ec
mov word [esp + 0x240], 0
push esi
call fcn.006208d5
add esp, 4
test eax, eax
je 0x49112e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xa
push 0
push edi
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 1
mov ecx, dword [esp + 0x448]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x2c]
push eax
push 0x689eb4
push 0x15
push 0
push 0x689ec4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4911dd
mov eax, dword [esp + 0x2c]
mov esi, 1
test eax, eax
je 0x491116
mov dword [esp + 0x14], 0
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x94]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x491195
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov word [esp + 0x18], 0
mov word [esp], 8
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
mov ebx, esp
push edx
push edx
push edx
push edx
push ebx
push eax
call dword [ecx + 0xd0]
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x491116
xor esi, esi
jmp 0x491116
Function at 0x491f80
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x58], eax
mov ebx, esp
push 0x59
push str..._.._base_system_sys_info_win.cc
push str.AmountOfFreeDiskSpace
push ebx
call fcn.00472ef0
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push ebx
call fcn.0047d4a0
cmp byte [edi + 0xb], 0
jns 0x491fc5
mov edi, dword [edi]
lea eax, [esp + 0x48]
lea ecx, [esp + 0x50]
push eax
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [esp]
mov edx, dword [esp + 4]
cmp ecx, 0xffffffff
mov edi, edx
sbb edi, 0x7fffffff
mov esi, SysReAllocString
cmovb esi, edx
mov edi, 0xffffffff
cmovb edi, ecx
xor ebx, ebx
cmp eax, 1
sbb ebx, ebx
or edi, ebx
or ebx, esi
lea ecx, [esp + 0x10]
call fcn.0047d5c0
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00517c1a
mov eax, edi
mov edx, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret