joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417c57
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov ecx, 0x20000004
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x417ce2
lea eax, [ebp - 4]
push eax
push 0x1a
call fcn.00417baa
mov esi, eax
cmp esi, edi
jge 0x417c8d
push str.Failed_to_allocate_administrator_SID.
jmp 0x417cd3
push 2
push 8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x417cdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x417cb3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x417cbe
mov esi, 0x80004005
push esi
push 0x5dd
push str.cache.cpp
call fcn.00432f68
push str.Failed_to_initialize_ACL.
push esi
call fcn.004300f7
pop ecx
pop ecx
jmp 0x417d0d
mov ecx, 0x20000005
push 0x7d0
push 3
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push ecx
push 1
push dword [ebp + 0xc]
call fcn.0043010b
push 0x80
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 4], edi
je 0x417d1a
push dword [ebp - 4]
call fcn.00432b10
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x418e6e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x456130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x250
lea eax, [ebp - 0x254]
push ebx
push eax
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], ebx
call fcn.004284a0
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push str..unverified
push dword [ebp + 8]
call fcn.004188ab
test eax, eax
js 0x418ed4
push 7
push dword [ebp - 0x258]
call fcn.00436d15
cmp dword [ebp + 8], ebx
jne 0x418fbe
push edi
lea edi, [ebp - 0x258]
mov ecx, esi
call fcn.004178ca
pop edi
test eax, eax
js 0x418fbe
lea eax, [ebp - 0x260]
push eax
push 0x448b38
push dword [ebp - 0x258]
call fcn.00432639
test eax, eax
js 0x418fbe
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x418fbe
test byte [ebp - 0x254], 0x10
jne 0x418fa1
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jbe 0x418f79
push 0x2e
add eax, eax
pop ecx
cmp cx, word [ebp + eax - 0x22c]
jne 0x418f79
movzx eax, word [ebp + eax - 0x22a]
push 0x52
pop ecx
cmp cx, ax
je 0x418fa1
push 0x72
pop ecx
cmp cx, ax
je 0x418fa1
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x258]
call fcn.00432639
test eax, eax
js 0x418fa1
push dword [ebp - 0x25c]
call fcn.0043622f
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x418f31
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x25c], ebx
je 0x418fd1
push dword [ebp - 0x25c]
call fcn.00430858
cmp dword [ebp - 0x260], ebx
je 0x418fe4
push dword [ebp - 0x260]
call fcn.00430858
cmp dword [ebp - 0x258], ebx
pop esi
pop ebx
je 0x418ff9
push dword [ebp - 0x258]
call fcn.00430858
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042851a
leave
ret 8
Function at 0x41ee11
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x456130]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 1
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x41ee7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41ee54
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x41ee5f
mov esi, 0x80004005
push esi
push 0x1ef
push str.msuengine.cpp
call fcn.00432f68
push str.Failed_to_stop_wusa_service.
push esi
call fcn.004300f7
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042851a
leave
ret
Function at 0x42227a
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov edi, 0x43b5f8
cmp eax, ebx
je 0x422298
mov ecx, dword [eax]
jmp 0x4222a5
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x4222a3
mov ecx, dword [ecx]
jmp 0x4222a5
mov ecx, edi
mov edx, dword [esi + 0xc]
test edx, edx
je 0x4222ae
mov edi, dword [edx]
test eax, eax
je 0x4222c0
xor eax, eax
test edx, edx
setne al
add eax, 0x20000150
jmp 0x4222cf
mov eax, dword [esi + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [ebp + 8]
push str.copy
push edi
push ecx
push eax
push 2
call fcn.00401566
add esp, 0x18
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.00435d81
test eax, eax
je 0x422353
test byte [ebp - 4], 1
je 0x422353
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x422353
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x422322
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x42232d
mov ebx, 0x80004005
push ebx
push 0x547
push str.apply.cpp
call fcn.00432f68
push dword [ebp + 0xc]
push str.Failed_to_clear_readonly_bit_on_payload_destination_path:__ls
push ebx
call fcn.004300f7
add esp, 0xc
jmp 0x4223db
push 0
lea edi, [esi + 0x20]
push edi
push esi
push fcn.00421a9d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x4223db
cmp dword [edi], ebx
je 0x422398
mov esi, 0x80070642
push esi
push 0x551
push str.apply.cpp
mov ebx, esi
call fcn.00432f68
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.BA_aborted_copy_of_payload_from:__ls_to:__ls.
push esi
jmp 0x4223d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4223ac
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x4223b7
mov ebx, 0x80004005
push ebx
push 0x555
push str.apply.cpp
call fcn.00432f68
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Failed_attempt_to_copy_payload_from:__ls_to:__ls.
push ebx
call fcn.004300f7
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4223e4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
mov esi, eax
mov ecx, dword [esi + 4]
push edi
mov edi, 0x43b5f8
test ecx, ecx
je 0x422403
mov eax, dword [ecx]
jmp 0x42240c
mov eax, dword [esi + 8]
test eax, eax
je 0x422411
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x422414
mov dword [ebp - 8], edi
mov edx, dword [esi + 0xc]
test edx, edx
je 0x422422
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
jmp 0x422425
mov dword [ebp - 0xc], edi
lea ebx, [ecx + 0x2c]
test ecx, ecx
jne 0x422455
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x14]
lea ebx, [edx + 0x40]
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
je 0x422460
xor eax, eax
test edx, edx
setne al
add eax, 0x20000150
jmp 0x42246f
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x1c]
jmp 0x422438
mov eax, dword [esi + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [ebx]
push str.download
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
push 2
call fcn.00401566
mov edi, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push edi
call fcn.00435d81
test eax, eax
je 0x4224f3
test byte [ebp - 4], 1
je 0x4224f3
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4224f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4224c4
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x4224cf
mov esi, 0x80004005
push esi
push 0x576
push str.apply.cpp
call fcn.00432f68
push edi
push str.Failed_to_clear_readonly_bit_on_payload_destination_path:__ls
push esi
call fcn.004300f7
add esp, 0xc
jmp 0x422583
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], fcn.00421a9d
mov dword [ebp - 0x18], esi
mov eax, dword [ebx]
push 0x62
pop ecx
cmp cx, word [eax]
jne 0x422553
push 0x69
pop ecx
cmp cx, word [eax + 2]
jne 0x422553
push 0x74
pop ecx
cmp cx, word [eax + 4]
jne 0x422553
push 0x73
pop ecx
cmp cx, word [eax + 6]
jne 0x422553
movzx ecx, word [eax + 8]
push 0x3a
pop edx
cmp dx, cx
je 0x422543
push 0x73
pop edx
cmp dx, cx
jne 0x422553
push 0x3a
pop ecx
cmp cx, word [eax + 0xa]
jne 0x422553
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push edi
push ebx
push eax
call fcn.0042808b
jmp 0x42256c
push edi
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
push dword [esi]
call fcn.00427847
mov esi, eax
test esi, esi
jns 0x422583
push edi
push dword [ebx]
push str.Failed_attempt_to_download_URL:__ls_to:__ls
push esi
call fcn.004300f7
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x426aaa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
or dword [esi + 0x3c], 0xffffffff
push edi
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
lea eax, [esi + 0x1c]
push eax
call fcn.0043178b
mov edi, eax
cmp edi, ebx
jge 0x426ad6
push str.Failed_to_copy_file_name.
jmp 0x426bc4
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
jne 0x426b23
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x426afe
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x426b09
mov edi, 0x80004005
push edi
push 0x94
push str.cabextract.cpp
call fcn.00432f68
push str.Failed_to_create_begin_operation_event.
jmp 0x426bc4
push ebx
push ebx
push 1
push ebx
call edi
mov dword [esi + 0x28], eax
cmp eax, ebx
jne 0x426b67
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x426b45
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x426b50
mov edi, 0x80004005
push edi
push 0x97
push str.cabextract.cpp
call fcn.00432f68
push str.Failed_to_create_operation_complete_event.
jmp 0x426bc4
push ebx
push ebx
push esi
push 0x426864
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x426bb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x426b92
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x426b9d
mov edi, 0x80004005
push edi
push 0x9b
push str.cabextract.cpp
call fcn.00432f68
push str.Failed_to_create_extraction_thread.
jmp 0x426bc4
call fcn.004261e6
mov edi, eax
cmp edi, ebx
jge 0x426bcc
push str.Failed_to_wait_for_operation_complete.
push edi
call fcn.004300f7
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x426e84
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0041770c
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x426ebf
push dword [ebp + 8]
push str.Failed_to_calculate_resume_path_from_working_path:__ls
push eax
call fcn.004300f7
add esp, 0xc
jmp 0x426f73
mov eax, dword [ebp + 0xc]
push ebx
push 0x80
push 4
push ebx
push 4
push 0xc0000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x426f25
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x426ef6
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x426f04
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd0
push str.downloadengine.cpp
call fcn.00432f68
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.Failed_to_create_resume_file:__ls
push dword [ebp - 4]
jmp 0x426eb2
push ebx
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [edi + esi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x426f7c
add edi, dword [ebp - 8]
cmp dword [ebp - 8], ebx
je 0x426f4e
cmp edi, 8
jb 0x426f25
cmp edi, 8
je 0x426f58
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
or dword [ebp + 8], 0xffffffff
mov dword [eax], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x426f73
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x426f90
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x426f9e
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd7
push str.downloadengine.cpp
call fcn.00432f68
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.Failed_to_read_resume_file:__ls
push dword [ebp - 4]
call fcn.004300f7
add esp, 0xc
jmp 0x426f64
Function at 0x426fc7
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebx
push ebx
push dword [esi + 4]
mov dword [ebp - 8], ebx
push dword [esi]
push dword [ebp + 0xc]
call fcn.00435cb1
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x426ffb
push str.Failed_to_seek_to_start_point_in_file.
push eax
call fcn.004300f7
pop ecx
pop ecx
jmp 0x427168
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4270e1
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x427167
xor edi, edi
mov dword [ebp - 0xc], ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
sub eax, edi
push eax
mov eax, dword [ebp + 0x1c]
add eax, edi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42711f
add edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], ebx
je 0x427055
cmp edi, eax
jb 0x427027
add dword [esi], edi
adc dword [esi + 4], ebx
cmp dword [ebp + 0x10], 0xffffffff
je 0x4270a9
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x10], ebx
call fcn.00435cb1
cmp eax, ebx
jge 0x427084
push str.Failed_to_seek_to_start_point_in_file.
push eax
call fcn.004300f7
pop ecx
pop ecx
jmp 0x4270a9
push ebx
lea eax, [ebp - 0x10]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [esi + edi*8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
je 0x4270a9
cmp edi, 8
jb 0x427084
mov eax, dword [ebp + 0x24]
cmp eax, ebx
je 0x4270d3
cmp dword [eax], ebx
je 0x4270d3
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [esi + 4]
push dword [esi]
push eax
call fcn.0041773d
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42715a
cmp dword [ebp - 8], ebx
jne 0x426ffc
jmp 0x427167
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4270f5
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x427103
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1ad
push str.downloadengine.cpp
call fcn.00432f68
push str.Failed_while_reading_from_internet.
push dword [ebp - 4]
jmp 0x427160
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x427133
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x427141
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x1b9
push str.downloadengine.cpp
call fcn.00432f68
push str.Failed_to_write_data_from_internet.
jmp 0x42711a
push str.UX_aborted_on_cache_progress.
push eax
call fcn.004300f7
pop ecx
pop ecx
pop edi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0x20
Function at 0x42733e
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 7
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
je 0x42736c
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x427379
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor esi, esi
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x14]
push dword [eax]
call fcn.00438556
mov edi, eax
cmp edi, ebx
jl 0x4274a8
mov ebx, dword [ebp + 0x24]
xor edx, edx
cmp ebx, edx
je 0x4273a1
mov ecx, ebx
cmp word [ebx], dx
jne 0x4273a4
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp + 0x20]
cmp edi, edx
je 0x4273b2
mov eax, edi
cmp word [edi], dx
jne 0x4273b5
mov eax, dword [ebp - 0x18]
push edx
push edx
xor edx, edx
cmp dword [ebp - 0x24], 1
setne dl
lea edx, [edx + edx + 1]
push edx
push ecx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, eax
test esi, esi
je 0x4274b7
test edi, edi
je 0x42741c
cmp word [edi], 0
je 0x42741c
test ebx, ebx
je 0x42741c
cmp word [ebx], 0
je 0x42741c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call ebx
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0x2b
push esi
call edi
test eax, eax
je 0x42741c
push dword [ebp + 0x24]
call ebx
push eax
push dword [ebp + 0x24]
push 0x2c
push esi
call edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp + 0x18]
push esi
call fcn.00426c5d
mov edi, eax
test edi, edi
js 0x4274f2
push dword [ebp + 0x30]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00427170
mov edi, eax
test edi, edi
js 0x4274fe
cmp dword [ebp - 8], 0
jne 0x427356
mov eax, dword [ebp + 0x28]
mov dword [eax], esi
mov eax, dword [ebp + 0x2c]
xor esi, esi
and dword [ebp - 4], esi
mov ecx, ebx
mov dword [eax], ecx
lea eax, [ebp - 0x24]
push eax
call fcn.004382a5
cmp dword [ebp - 4], 0
pop ebx
je 0x427495
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
je 0x4274a0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret 0x2c
push str.Failed_to_break_URL_into_server_and_resource_parts.
push edi
call fcn.004300f7
pop ecx
pop ecx
jmp 0x42747c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4274cb
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x4274d6
mov edi, 0x80004005
push edi
push 0x213
push str.downloadengine.cpp
call fcn.00432f68
mov eax, dword [ebp + 0x14]
push dword [eax]
push str.Failed_to_connect_to_URL:__ls
jmp 0x427508
mov eax, dword [ebp + 0x14]
push dword [eax]
push str.Failed_to_open_internet_URL:__ls
jmp 0x427508
mov eax, dword [ebp + 0x14]
push dword [eax]
push str.Failed_to_send_request_to_URL:__ls
push edi
call fcn.004300f7
add esp, 0xc
jmp 0x42747c
Function at 0x42851a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x456130]
jne 0x428524
repz ret
jmp fcn.0042a504

Function at 0x42c27b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456130]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00429d12
and dword [ebp - 0x14], 0
cmp dword [0x457d9c], 0
mov dword [ebp - 0x18], eax
jne 0x42c32e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42c3d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x450be4
push ebx
call edi
test eax, eax
je 0x42c3d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x457d9c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x457da0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x457da4], eax
call edi
push eax
call esi
mov dword [0x457dac], eax
test eax, eax
je 0x42c32e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x457da8], eax
mov eax, dword [0x457da8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42c387
cmp dword [0x457dac], ecx
je 0x42c387
push eax
call esi
push dword [0x457dac]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42c387
test ebx, ebx
je 0x42c387
call edi
test eax, eax
je 0x42c37e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42c37e
test byte [ebp - 8], 1
jne 0x42c387
or dword [ebp + 0x10], 0x200000
jmp 0x42c3ba
mov eax, dword [0x457da0]
cmp eax, dword [ebp - 0x18]
je 0x42c3ba
push eax
call esi
test eax, eax
je 0x42c3ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42c3ba
mov eax, dword [0x457da4]
cmp eax, dword [ebp - 0x18]
je 0x42c3ba
push eax
call esi
test eax, eax
je 0x42c3ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x457d9c]
call esi
test eax, eax
je 0x42c3d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42c3d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042851a
leave
ret