joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d3b2
Capabilities:
Read file on windows

Disassembly:
push ebp
sub esp, 0x400
lea ebp, [esp - 4]
mov eax, dword [0x57d074]
xor eax, ebp
mov dword [ebp + 0x400], eax
push 0x14
mov eax, 0x519925
call fcn.004db273
mov edi, edx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], 0x533e78
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x3ff
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49d43f
cmp eax, 0x400
jae 0x49d4e2
mov byte [ebp + eax], bl
mov ecx, edi
lea eax, [ebp]
push eax
call fcn.0047bdf0
jmp 0x49d407
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, 2
jl 0x49d4a6
add eax, 0xfffffffe
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406c2e
mov byte [ebp - 4], 1
mov edx, dword [eax]
mov ebx, dword [edi]
sub ebx, 0x10
lea ecx, [edx - 0x10]
cmp ecx, ebx
je 0x49d499
cmp dword [ebx + 0xc], 0
jl 0x49d48e
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x49d48e
call fcn.00406f9b
mov ecx, ebx
mov esi, eax
call fcn.0040d570
lea eax, [esi + 0x10]
mov esi, dword [ebp - 0x14]
mov dword [edi], eax
jmp 0x49d499
push dword [edx - 0xc]
mov ecx, edi
push edx
call fcn.0040d7d9
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0040d05a
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x533e78
test esi, esi
je 0x49d4bf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.004da696
lea esp, [ebp + 0x404]
pop ebp
ret
call fcn.004daeef
int3
Function at 0x49db45
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0xa8
lea ebp, [esp - 4]
mov eax, dword [0x57d074]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push 8
mov eax, 0x519a1b
call fcn.004db273
mov esi, edx
mov edi, ecx
lea ecx, [ebp - 0x14]
mov dword [ebp + 0x9c], str.http:__www.google.com
mov dword [ebp + 0xa0], str.http:__www.yahoo.com
mov dword [ebp + 0xa4], str.http:__www.example.com
call fcn.0040cd94
xor ebx, ebx
lea ecx, [ebp - 0x10]
push str.tin9999.tmp
mov dword [ebp - 4], ebx
call fcn.0040d859
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00479d00
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0040d05a
push esi
push edi
lea ecx, [ebp]
call fcn.0049dd12
mov byte [ebp - 4], 2
lea edi, [ebp + 0x9c]
mov dword [ebp + 0x78], ebx
push dword [edi]
lea ecx, [ebp - 0x10]
call fcn.0040d859
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp]
call fcn.0049e41f
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
mov esi, eax
call fcn.0040d05a
test esi, esi
je 0x49dc15
add edi, 4
lea eax, [ebp + 0xa8]
cmp edi, eax
jne 0x49dbd6
jmp 0x49dc17
mov bl, 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp]
mov byte [ebp - 4], 0
call fcn.0048d736
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d05a
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa8]
xor ecx, ebp
call fcn.004da696
lea esp, [ebp + 0xac]
pop ebp
ret
Function at 0x49f1a1
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push dword [edi + 0x68]
lea ebx, [edi + 0x38]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ebp, dword [esp + 0x20]
push ebp
push dword [esp + 0x20]
mov byte [edi + 0x41], 0
push dword [esp + 0x20]
mov dword [edi + 0x34], 3
push dword [esp + 0x20]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x49f236
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x49f241
jmp 0x49f218
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x49f21d
push ebx
lea ecx, [edi + 0xc]
call fcn.004a907e
lea ecx, [edi + 0xc]
call fcn.004a9067
test al, al
jne 0x49f22f
push 0xa
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x49f1eb
cmp dword [edi + 0x30], 0
mov eax, dword [edi + 0x2c]
je 0x49f241
test eax, eax
jle 0x49f23f
mov dword [ebp], eax
jmp 0x49f23f
mov eax, 0xe0000008
jmp 0x49f241
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x49f248
Capabilities:
Query remote server for available data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push dword [edi + 0x68]
lea ebx, [edi + 0x38]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ebp, dword [esp + 0x18]
xor eax, eax
push eax
push eax
push ebp
push dword [esp + 0x20]
mov byte [edi + 0x41], al
mov dword [edi + 0x34], 8
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x49f2d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x49f2e3
jmp 0x49f2ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x49f2bf
push ebx
lea ecx, [edi + 0xc]
call fcn.004a907e
lea ecx, [edi + 0xc]
call fcn.004a9067
test al, al
jne 0x49f2d1
push 0xa
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x49f28d
cmp dword [edi + 0x30], 0
mov eax, dword [edi + 0x2c]
je 0x49f2e3
test eax, eax
jle 0x49f2e1
mov dword [ebp], eax
jmp 0x49f2e1
mov eax, 0xe0000008
jmp 0x49f2e3
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x49f4da
Capabilities:
Connect network resource

Disassembly:
push 0x3c
mov eax, 0x519d1d
call fcn.004db273
mov edi, ecx
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x14]
call fcn.0040cd94
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0040cd94
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp + 0x10]
call fcn.00479020
mov byte [ebp - 4], 2
and dword [edi + 8], esi
and dword [edi + 4], esi
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x49f52f
mov eax, dword [ecx]
call dword [eax]
test ebx, ebx
je 0x49f588
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
push 0x20
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
push eax
call fcn.004de4e0
mov eax, dword [ebp - 0x18]
xor ecx, ecx
and dword [ebp - 0x38], 0
inc ecx
add esp, 0xc
mov dword [ebp - 0x44], ecx
cmp dword [eax - 4], ecx
jle 0x49f56c
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
call fcn.0040d588
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x2c], 0
push 0
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov edi, dword [ebp - 0x1c]
mov esi, eax
test esi, esi
jne 0x49f5a5
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x28]
call fcn.0047a6c0
mov esi, eax
pop ecx
test esi, esi
je 0x49f651
cmp esi, 0x52e
je 0x49f5be
cmp esi, 0x56
je 0x49f5be
cmp esi, 0x89a
jne 0x49f659
push str.Local_Network_Server
lea ecx, [ebp + 0x10]
call fcn.0040d859
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0040cd94
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0
lea eax, [ebp + 0x10]
mov ecx, edi
push eax
push dword [ebp + 8]
push 0
call fcn.004a0757
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
mov bl, al
call fcn.0040d05a
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 2
call fcn.0040d05a
test bl, bl
je 0x49f659
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 4], 1
jle 0x49f62b
push dword [ebx - 0xc]
lea ecx, [ebp - 0x14]
call fcn.0040d588
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x14], eax
cmp dword [eax - 4], 1
jle 0x49f52f
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040d588
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x14], eax
jmp 0x49f52f
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor esi, esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0040d05a
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.0040d05a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d05a
mov eax, esi
call fcn.004db23c
ret 0x18
Function at 0x4a0354
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004de4e0
push esi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004de4e0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x3c]
add esp, 0x18
mov dword [ebp - 0x3c], esi
push ecx
push edi
push edi
push dword [eax]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
pop edi
pop esi
test eax, eax
jne 0x4a039c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4a03a6
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x30]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4a0df8
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x57d074]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x519fbc
call fcn.004db273
mov eax, dword [ebp + 0x214]
mov ebx, 0x104
mov esi, dword [ebp + 0x21c]
mov edi, dword [ebp + 0x218]
mov dword [ebp - 0x10], eax
lea eax, [ebp]
push eax
push ebx
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4a0e4f
xor al, al
jmp 0x4a0f21
mov edx, dword [edi]
xor ecx, ecx
inc ecx
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, ebx
or eax, ecx
jge 0x4a0e6a
push ebx
mov ecx, edi
call fcn.0040d637
mov edx, dword [edi]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
push edx
push ebx
push dword [eax]
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4a0e48
push 0xffffffffffffffff
mov ecx, edi
call fcn.00410b95
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2e
push dword [edi]
call fcn.004de987
pop ecx
pop ecx
test eax, eax
je 0x4a0f09
sub eax, dword [edi]
sar eax, 1
js 0x4a0f09
inc eax
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00406c2e
mov dword [ebp - 4], ebx
mov edx, dword [eax]
mov ecx, dword [edi]
sub ecx, 0x10
mov dword [ebp - 0x14], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x10], eax
cmp eax, ecx
je 0x4a0efd
cmp dword [ecx + 0xc], ebx
jl 0x4a0ef2
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x4a0ef2
mov ecx, dword [ebp - 0x10]
call fcn.00406f9b
mov ecx, dword [ebp - 0x14]
mov esi, eax
call fcn.0040d570
lea eax, [esi + 0x10]
mov esi, dword [ebp - 0x18]
mov dword [edi], eax
jmp 0x4a0efd
push dword [edx - 0xc]
mov ecx, edi
push edx
call fcn.0040d7d9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040d05a
test esi, esi
je 0x4a0f16
push esi
call fcn.004e07a4
pop ecx
mov ebx, eax
push ebx
push esi
mov ecx, edi
call fcn.00410e44
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.004da696
lea esp, [ebp + 0x20c]
pop ebp
ret 0xc
Function at 0x4a0f46
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x519fee
call fcn.004db273
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], 0x533e78
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x4a0f86
or esi, eax
jmp 0x4a0fc4
push ebx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], 0xfeff
push eax
push 2
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a0fc4
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push ebx
push edx
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a0fc4
mov bl, 1
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x533e78
test esi, esi
je 0x4a0fde
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
mov al, bl
call fcn.004db23c
ret 8

Function at 0x4a0fe8
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x10
mov eax, 0x51a019
call fcn.004db273
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1c], 0x533e78
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], ebx
cmp edi, 0xffffffff
je 0x4a10a1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x4a109f
xor esi, esi
mov dword [ebp + 8], esi
push ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00495766
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp + 8]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a108e
mov edx, dword [ebp - 0x10]
mov ecx, esi
call fcn.004d5a20
cmp eax, 4
jne 0x4a107a
lea eax, [ebx - 2]
shr eax, 1
push eax
lea eax, [esi + 2]
push eax
jmp 0x4a1083
cmp eax, 5
jne 0x4a108e
shr ebx, 1
push ebx
push esi
mov ecx, dword [ebp - 0x14]
add ecx, 4
call fcn.0040d7d9
xor ebx, ebx
push esi
mov byte [ebp - 4], bl
call fcn.004dadb0
pop ecx
mov dword [ebp + 8], ebx
jmp 0x4a10a1
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x533e78
test edi, edi
je 0x4a10ba
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], ebx
call fcn.004db23c
ret 4
Function at 0x4a10c2
Capabilities:
Read file on windows

Disassembly:
push 0xc
mov eax, 0x519fee
call fcn.004db273
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], 0x533e78
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x4a1108
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or esi, esi
jmp 0x4a1129
push ebx
lea eax, [ebp - 0x10]
push eax
push 4
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a1127
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4a1129
mov edi, ebx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x533e78
test esi, esi
je 0x4a1142
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], ebx
mov eax, edi
call fcn.004db23c
ret 4

Function at 0x4a114c
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x51a044
call fcn.004db273
mov ebx, ecx
lea ecx, [ebp - 0x14]
call fcn.0040cd94
and dword [ebp - 4], 0
mov edi, 0x100
push 0x200
call fcn.004dadc3
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [ebx + 4]
push edi
push esi
push dword [ebp - 0x14]
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 0xff
jne 0x4a11ee
push esi
add edi, edi
mov byte [ebp - 4], 0
call fcn.004dadb0
and dword [ebp - 0x10], 0
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004dadc3
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [ebx + 4]
push edi
push esi
push dword [ebp - 0x14]
push dword [eax]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [edi - 1]
cmp eax, ecx
je 0x4a119e
test esi, esi
jne 0x4a11f6
xor eax, eax
jmp 0x4a11fd
push esi
call fcn.004e07a4
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push esi
call fcn.0040d7d9
push esi
mov byte [ebp - 4], 0
call fcn.004dadb0
and dword [ebp - 0x10], 0
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x14]
call fcn.0040d05a
call fcn.004db23c
ret 0xc
Function at 0x4a122a
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x51a06f
call fcn.004db273
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 0x200
mov esi, 0x100
call fcn.004dadc3
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
and dword [ebp - 4], 0
push dword [ebx + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
cmp ebx, 0xfe
jne 0x4a12b1
or dword [ebp - 4], 0xffffffff
add esi, esi
push edi
call fcn.004dadb0
and dword [ebp - 0x14], 0
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004dadc3
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
lea eax, [esi - 2]
cmp ebx, eax
je 0x4a1269
mov ecx, dword [ebp + 8]
call fcn.00455f07
lea ecx, [ebp - 0x10]
call fcn.0040cd94
mov byte [ebp - 4], 1
xor esi, esi
movzx eax, word [edi + esi*2]
test ax, ax
je 0x4a12db
push eax
lea ecx, [ebp - 0x10]
call fcn.00477370
jmp 0x4a12f8
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4a12f0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00470830
lea ecx, [ebp - 0x10]
call fcn.0040d53b
inc esi
cmp esi, ebx
jbe 0x4a12c7
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.0040d05a
or dword [ebp - 4], 0xffffffff
push edi
call fcn.004dadb0
and dword [ebp - 0x14], 0
pop ecx
call fcn.004db23c
ret 4

Function at 0x4a1417
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51739c
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x57d074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
mov dword [esi], 0x5444bc
cmp dword [eax - 0xc], 0
je 0x4a1453
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x34]
call fcn.0040d05a
lea ecx, [esi + 0x30]
call fcn.0040d05a
lea ecx, [esi + 0x28]
call fcn.0040d05a
lea ecx, [esi + 0x24]
call fcn.0040d05a
lea ecx, [esi + 0x20]
call fcn.0040d05a
lea ecx, [esi + 8]
call fcn.0040d05a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a1570
Capabilities:
Copy file

Disassembly:
push ebp
sub esp, 0x9c
lea ebp, [esp - 4]
mov eax, dword [0x57d074]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0xc
mov eax, 0x51a142
call fcn.004db273
mov esi, ecx
push 0x5441b8
lea ecx, [ebp - 0x10]
call fcn.0040d859
and dword [ebp - 4], 0
lea edx, [esi + 0x20]
lea ecx, [ebp - 0x10]
call fcn.00479d00
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040d05a
lea ebx, [esi + 8]
mov edx, ebx
lea ecx, [ebp - 0x14]
call fcn.00499674
mov dword [ebp - 4], 1
lea edi, [esi + 0x20]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x4a15f7
push 0
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
jmp 0x4a16b5
push 0x57de30
push esi
lea ecx, [ebp]
call fcn.0049dd12
push edi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.0049e41f
mov ecx, dword [esi + 4]
mov edi, eax
mov cl, byte [ecx + 0x39]
test cl, cl
je 0x4a1626
xor bl, bl
jmp 0x4a16a9
test edi, edi
je 0x4a16a6
cmp byte [0x5805ec], 0
je 0x4a16a4
push ecx
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.00476e20
pop ecx
mov esi, eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040cd94
mov ebx, str.Downloading_of_updates_failed._Error:
mov byte [ebp - 4], 4
mov esi, dword [esi]
push ebx
call fcn.004e07a4
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.00410e44
test esi, esi
je 0x4a167e
push esi
call fcn.004e07a4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00410e44
lea eax, [ebp - 0x10]
mov ecx, 0x5805b8
push eax
call fcn.004a24eb
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0040d05a
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0040d05a
test edi, edi
sete bl
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0048d736
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040d05a
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.004da696
lea esp, [ebp + 0xa0]
pop ebp
ret
Function at 0x4a261b
Capabilities:
Write file on windows

Disassembly:
push 0x214
mov eax, 0x51a3c3
call fcn.004db2a7
mov esi, ecx
cmp dword [esi + 0x30], 0
jne 0x4a27a3
lea edi, [esi + 0x24]
xor ebx, ebx
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
jne 0x4a26d3
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4a267c
add eax, eax
cmp eax, 0x208
jae 0x4a27a9
xor ecx, ecx
lea ebx, [ebp - 0x218]
mov word [ebp + eax - 0x218], cx
jmp 0x4a2681
mov ebx, str.Logger
push ebx
call fcn.004e07a4
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.0040d7d9
push 0x2e
push dword [edi]
call fcn.004de987
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4a26ba
mov eax, dword [edi]
sub ecx, eax
sar ecx, 1
test ecx, ecx
jle 0x4a26ba
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
mov ecx, edi
call fcn.00474080
mov ebx, str..log
push ebx
call fcn.004e07a4
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.00410e44
mov eax, dword [edi]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea edi, [esi + 0x2c]
push eax
mov ecx, edi
call fcn.0040df9a
cmp dword [esi + 0x30], 0xffffffff
je 0x4a279b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4a2725
cmp dword [esi + 0x30], 0
je 0x4a27a3
push 2
push ebx
push ebx
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4a2763
test eax, eax
jne 0x4a279b
cmp dword [esi + 0x30], eax
je 0x4a279b
push 2
pop ecx
push ebx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], 0xfeff
push eax
push ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
push eax
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [esi + 0x30], 0
je 0x4a27a3
lea eax, [esi + 0x28]
mov ecx, esi
push eax
call fcn.004a27af
lea ecx, [ebp - 0x21c]
call fcn.004a27de
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.004a27af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.0040d05a
jmp 0x4a27a3
push ebx
mov ecx, edi
call fcn.0040df9a
call fcn.004db251
ret
call fcn.004daeef
int3

Function at 0x4a27af
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
mov esi, ecx
mov edx, dword [eax]
lea eax, [ebp + 8]
push eax
mov eax, dword [edx - 0xc]
add eax, eax
push eax
push edx
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4