joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414ebf
Capabilities:
Create directory

Disassembly:
push 0x90
mov eax, 0x64a41c
call fcn.005b47af
mov esi, dword [ebp + 8]
push esi
call fcn.00414df1
pop ecx
test al, al
jne 0x41505b
xor ebx, ebx
lea ecx, [ebp - 0x9c]
push ebx
push ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.00413b35
mov edi, eax
mov dword [ebp - 0x9c], edi
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.004112d3
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
je 0x414f64
lea eax, [ebp - 0x34]
push eax
push dword [edi]
lea ecx, [ebp - 0x9c]
call fcn.0041242e
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x34]
call fcn.00411b9c
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.0041135f
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00409ec4
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00409de7
mov edi, dword [ebp - 0x9c]
jmp 0x414f13
mov esi, dword [edi]
jmp 0x415023
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.004112d3
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x94]
call fcn.004120c0
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.00411307
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 5
push eax
call fcn.00414df1
mov bl, al
pop ecx
neg bl
lea ecx, [ebp - 0x40]
sbb bl, bl
call fcn.00409ec4
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.00409de7
add bl, 1
je 0x415005
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x94]
call fcn.004120c0
cmp dword [eax + 0x14], 8
jb 0x414fee
mov eax, dword [eax]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00409de7
jmp 0x415007
xor ebx, ebx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 1
call fcn.00409ec4
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.00409de7
mov esi, dword [esi]
cmp esi, edi
jne 0x414f6b
lea ecx, [ebp - 0x1c]
call fcn.00409ec4
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00409de7
lea ecx, [ebp - 0x9c]
call fcn.00413d69
push 0x2c
push 1
push dword [ebp - 0x9c]
call fcn.00408f9c
add esp, 0xc
mov al, 1
call fcn.005b4759
ret
Function at 0x415353
Capabilities:
Delete directory

Disassembly:
push 0x558
mov eax, 0x64a554
call fcn.005b47af
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x1c]
jne 0x415374
xor al, al
jmp 0x41557a
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.0040cff1
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00414c5a
mov ecx, eax
call fcn.004cbcc7
mov bl, al
lea ecx, [ebp - 0x4c]
neg bl
push edi
sbb bl, bl
or dword [ebp - 4], 0xffffffff
push 1
call fcn.00409de7
add bl, 1
je 0x41542a
xor ebx, ebx
lea ecx, [ebp - 0x564]
inc ebx
push ebx
push 3
call fcn.004078ff
lea eax, [ebp - 0x4c]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.0040cff1
push eax
lea eax, [ebp - 0x554]
mov byte [ebp - 4], 2
push str.____Removing_system_folder:
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.00410ade
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00409de7
lea eax, [ebp - 0x564]
push eax
push str.FileSystem::removeDir
push 0x18e
push str.D:_build6c589d3ff8507062_srccommonFileSystem.cpp
push edi
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x564]
call fcn.0040843a
jmp 0x41536d
push 0x5c
pop eax
mov word [ebp - 0x58], ax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], edi
push 8
pop ebx
mov dword [ebp - 4], 3
cmp dword [esi + 0x14], ebx
jb 0x41544a
mov eax, dword [esi]
jmp 0x41544c
mov eax, esi
push eax
lea ecx, [ebp - 0x4b0]
call fcn.004131a8
test eax, eax
je 0x415484
cmp dword [ebp - 0x50], 0
je 0x415470
mov eax, dword [ebp - 0x4b0]
shr eax, 4
and eax, 1
jmp 0x415472
mov eax, edi
test eax, eax
jne 0x415484
push esi
call fcn.00415580
pop ecx
mov bl, al
jmp 0x41556d
push 0x686be0
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00411736
cmp dword [ebp - 0x20], ebx
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 4
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.004131a8
mov edi, dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x415532
call fcn.00413631
lea ecx, [ebp - 0x4b0]
test eax, eax
jne 0x41552d
lea eax, [ebp - 0x4b4]
push eax
call fcn.004133d5
push dword [eax]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.0041139b
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 4], 4
call fcn.0041292c
cmp dword [ebp - 0x50], 0
je 0x415502
mov eax, dword [ebp - 0x4b0]
shr eax, 4
and eax, 1
jmp 0x415504
xor eax, eax
test eax, eax
lea eax, [ebp - 0x34]
push eax
je 0x415521
call fcn.00415353
cmp dword [ebp - 0x20], ebx
lea eax, [ebp - 0x34]
pop ecx
cmovae eax, dword [ebp - 0x34]
push eax
call edi
jmp 0x415527
call fcn.00415580
pop ecx
lea ecx, [ebp - 0x4b0]
call fcn.0041326a
test eax, eax
lea ecx, [ebp - 0x4b0]
setne al
test al, al
jne 0x4154b6
call fcn.00412f01
cmp dword [esi + 0x14], ebx
jb 0x415551
mov esi, dword [esi]
push esi
call edi
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.00409ec4
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00409de7
lea ecx, [ebp - 0x4b0]
call fcn.00412f01
mov al, bl
call fcn.005b4759
ret
Function at 0x416eef
Capabilities:
Read .ini file

Disassembly:
push 0x3c
mov eax, 0x64a8a9
call fcn.005b47af
mov edi, ecx
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], esi
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
push ecx
xor ebx, ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], 7
push 0xa000
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], ebx
mov word [ebp - 0x28], ax
call fcn.0040a29e
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x416f42
mov edi, dword [edi]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionNamesW]
mov ebx, eax
mov dword [ebp - 0x2c], 7
xor eax, eax
xor edi, edi
mov dword [ebp - 0x30], edi
mov word [ebp - 0x40], ax
cmp word [0x684590], ax
je 0x416f80
push 0x684590
call fcn.005ff18e
pop ecx
push eax
push 0x684590
lea ecx, [ebp - 0x40]
call fcn.0040a315
mov byte [ebp - 4], 2
test ebx, ebx
je 0x416ffa
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x40]
cmovae eax, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
push eax
push 1
call fcn.00416e8d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
cmp word [eax + edi*2], cx
jne 0x416ff5
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.00411fb2
cmp word [0x684590], 0
jne 0x416fdc
xor eax, eax
jmp 0x416fe7
push 0x684590
call fcn.005ff18e
pop ecx
push eax
push 0x684590
lea ecx, [ebp - 0x40]
call fcn.0040a315
inc edi
cmp edi, ebx
jb 0x416f96
xor ebx, ebx
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00409de7
mov eax, esi
call fcn.005b4759
ret 4
Function at 0x41701c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64a8e4
mov eax, dword fs:[0]
push eax
mov eax, 0x4038
call fcn.005b4b80
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
cmp dword [ecx + 0x14], 8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x4044], edi
jb 0x417066
mov ecx, dword [ecx]
cmp dword [edx + 0x14], 8
jb 0x41706e
mov edx, dword [edx]
cmp dword [eax + 0x14], 8
jb 0x417076
mov eax, dword [eax]
push ecx
push 0x2000
lea ecx, [ebp - 0x4010]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
xor eax, eax
mov dword [ebp - 0x4014], 7
mov dword [ebp - 0x4018], edi
mov word [ebp - 0x4028], ax
cmp word [ebp - 0x4010], ax
je 0x4170bb
lea eax, [ebp - 0x4010]
push eax
call fcn.005ff18e
pop ecx
push eax
lea eax, [ebp - 0x4010]
push eax
lea ecx, [ebp - 0x4028]
call fcn.0040a315
lea eax, [ebp - 0x4028]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x4040]
push eax
call fcn.00410890
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x4028]
mov byte [ebp - 4], 2
call fcn.00409de7
lea eax, [ebp - 0x4040]
push eax
push esi
call fcn.0040d08b
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x4040]
call fcn.00409d92
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b4733
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41875b
Capabilities:
Print debug messages

Disassembly:
push 0xf0
mov eax, 0x64abbf
call fcn.005b47af
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
dec eax
test eax, eax
jle 0x4187a8
lea ecx, [ebx + eax*2]
movzx edx, word [ecx]
cmp edx, 0x2f
je 0x4187a5
cmp edx, 0x5c
je 0x4187a5
dec eax
sub ecx, 2
test eax, eax
jg 0x41878e
jmp 0x4187a8
lea ebx, [ecx + 2]
push 1
push 3
lea ecx, [ebp - 0xfc]
call fcn.004078ff
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.00410f89
mov esi, eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.00417dd8
mov edi, eax
mov dword [esp], 0x6871e0
push esi
mov esi, dword [ebp - 0x4c]
mov ecx, esi
push 0x6871e8
push dword [ebp - 0x44]
mov byte [ebp - 4], 2
push 0x6871dc
push ebx
push 0x6871ec
push dword [ebp - 0x48]
call fcn.00417e4e
movzx eax, ax
push eax
push 0x6871f0
push edi
lea eax, [ebp - 0xec]
push 0x6871f8
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.00410ade
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.00417ad4
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.0040819d
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.00410ade
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00409de7
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00410f89
cmp dword [eax + 0x14], 8
jb 0x4188a1
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00409de7
cmp dword [esi + 0x24], ebx
je 0x418917
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00410f89
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.0040d0f1
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00409de7
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ebx
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [esi + 0x24]
push eax
call fcn.00413b02
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
test eax, eax
jne 0x41890c
call fcn.00412e32
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00409d92
lea ecx, [ebp - 0xfc]
call fcn.0040843a
call fcn.005b4759
ret 0x14

Function at 0x418af2
Capabilities:
Create process on windows

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x418afa
mov ecx, dword [ecx]
push 5
xor eax, eax
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x4200c8
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x42022e
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x42022d
cmp eax, 0x29
jne 0x420100
cmp dword [esi + 0x10], 0
jne 0x42022d
test dword [esi + 0x50], edx
je 0x42023a
cmp eax, 0x2e
jne 0x42011b
push 5
lea ecx, [esi + 0x24]
call fcn.00423863
mov ecx, esi
call fcn.004238e3
jmp 0x420218
cmp eax, 0x5c
jne 0x420176
mov ecx, esi
call fcn.004238e3
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x42014d
cmp byte [esi + 0x48], 0x62
jne 0x42014d
push 4
lea ecx, [esi + 0x24]
call fcn.00423863
mov ecx, esi
call fcn.004238e3
jmp 0x42021f
test eax, eax
je 0x42016a
cmp byte [esi + 0x48], 0x42
jne 0x42016a
push 4
lea ecx, [esi + 0x24]
call fcn.00423863
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x420141
mov ecx, esi
call fcn.004203c2
jmp 0x420218
cmp eax, 0x5b
jne 0x420196
mov ecx, esi
call fcn.004238e3
mov ecx, esi
call fcn.00420cf0
cmp dword [esi + 0x4c], 0x5d
je 0x42010f
push 4
jmp 0x42023c
cmp eax, 0x28
jne 0x4201be
mov ecx, esi
call fcn.004238e3
mov ecx, esi
call fcn.004248b0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x42023a
mov ecx, esi
call fcn.004238e3
jmp 0x420214
cmp eax, 0x5e
jne 0x4201ca
push 2
jmp 0x420139
cmp eax, 0x24
jne 0x4201d6
push 3
jmp 0x420139
cmp eax, 0x2a
je 0x420236
cmp eax, 0x2b
je 0x420236
cmp eax, 0x3f
je 0x420236
cmp eax, 0x7b
je 0x420236
cmp eax, 0x7d
jne 0x4201f4
test dword [esi + 0x50], edx
je 0x420232
cmp eax, 0x5d
jne 0x4201fe
test dword [esi + 0x50], edx
je 0x42018f
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041f417
mov ecx, esi
call fcn.004238e3
mov bl, 1
test bl, bl
je 0x42021f
mov ecx, esi
call fcn.00423937
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x4200da
pop ebx
mov al, cl
pop esi
ret
push 6
jmp 0x42023c
push 0xa
jmp 0x42023c
push 5
call fcn.0059cef5
int3
Function at 0x420242
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4203ae
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4203ad
cmp eax, 0x29
jne 0x42027a
cmp dword [esi + 0x10], 0
jne 0x4203ad
test dword [esi + 0x50], edx
je 0x4203ba
cmp eax, 0x2e
jne 0x420295
push 5
lea ecx, [esi + 0x24]
call fcn.004238a3
mov ecx, esi
call fcn.0042390c
jmp 0x420398
cmp eax, 0x5c
jne 0x4202f2
mov ecx, esi
call fcn.0042390c
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4202c8
cmp word [esi + 0x48], 0x62
jne 0x4202c8
push 4
lea ecx, [esi + 0x24]
call fcn.004238a3
mov ecx, esi
call fcn.0042390c
jmp 0x42039f
test eax, eax
je 0x4202e6
cmp word [esi + 0x48], 0x42
jne 0x4202e6
push 4
lea ecx, [esi + 0x24]
call fcn.004238a3
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4202bc
mov ecx, esi
call fcn.0042046f
jmp 0x420398
cmp eax, 0x5b
jne 0x420316
mov ecx, esi
call fcn.0042390c
mov ecx, esi
call fcn.00420d39
cmp dword [esi + 0x4c], 0x5d
je 0x420289
push 4
jmp 0x4203bc
cmp eax, 0x28
jne 0x42033e
mov ecx, esi
call fcn.0042390c
mov ecx, esi
call fcn.00424931
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4203ba
mov ecx, esi
call fcn.0042390c
jmp 0x420394
cmp eax, 0x5e
jne 0x42034a
push 2
jmp 0x4202b4
cmp eax, 0x24
jne 0x420356
push 3
jmp 0x4202b4
cmp eax, 0x2a
je 0x4203b6
cmp eax, 0x2b
je 0x4203b6
cmp eax, 0x3f
je 0x4203b6
cmp eax, 0x7b
je 0x4203b6
cmp eax, 0x7d
jne 0x420374
test dword [esi + 0x50], edx
je 0x4203b2
cmp eax, 0x5d
jne 0x42037e
test dword [esi + 0x50], edx
je 0x42030f
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041f474
mov ecx, esi
call fcn.0042390c
mov bl, 1
test bl, bl
je 0x42039f
mov ecx, esi
call fcn.004239e7
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x420254
pop ebx
mov al, cl
pop esi
ret
push 6
jmp 0x4203bc
push 0xa
jmp 0x4203bc
push 5
call fcn.0059cef5
int3
Function at 0x428e97
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x38c
mov eax, 0x64c4b3
call fcn.005b47af
mov esi, dword [ebp + 8]
xor eax, eax
mov edi, dword [ebp + 0xc]
mov ebx, str.___test
and dword [ebp - 0x238], 0
push ebx
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
call fcn.005ff18e
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x248]
call fcn.0040a315
and dword [ebp - 4], 0
lea eax, [ebp - 0x290]
push eax
mov ecx, esi
call fcn.004120c0
mov esi, eax
and dword [ebp - 0x220], 0
xor eax, eax
mov ebx, 0x687d7c
mov byte [ebp - 4], 1
push ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
call fcn.005ff18e
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x230]
call fcn.0040a315
push esi
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.00417c9a
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 3
push ecx
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00417c9a
add esp, 0x18
xor ebx, ebx
lea ecx, [ebp - 0x278]
xor esi, esi
push ebx
inc esi
push esi
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x230]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x290]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 8
call fcn.00409de7
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x2e8]
push ebx
push eax
call fcn.005f3980
push 0x10
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2e8], esi
push ebx
push eax
call fcn.005f3980
add esp, 0x18
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2e8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x429046
push 0x7530
push dword [ebp - 0x2a4]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x2a4]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [ebp - 0x294], 0x40
mov dword [edi], eax
sete bl
jmp 0x4290c6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 1
push 3
lea ecx, [ebp - 0x398]
mov dword [edi], eax
call fcn.004078ff
push edi
push str._last_error:
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x388]
push str.Cant_start_process
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.00410ade
pop ecx
pop ecx
push eax
call fcn.00412133
pop ecx
pop ecx
mov ecx, eax
call fcn.004279d4
lea eax, [ebp - 0x398]
push eax
push str.Update::testDownloadedExe
push 0xfe
push str.D:_build6c589d3ff8507062_srccommonUpdate.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x398]
call fcn.0040843a
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.00409de7
mov al, bl
call fcn.005b4759
ret
Function at 0x42b057
Capabilities:
Initialize winsock library

Disassembly:
push 0x2fc
mov eax, 0x64cc7f
call fcn.005b47af
mov esi, ecx
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x1a8], esi
call fcn.00503470
xor ebx, ebx
mov dword [esi], vtable.Http.0
mov dword [esi + 0xc], ebx
xor eax, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov word [esi + 0x18], ax
mov byte [esi + 0x1a], 1
mov dword [ebp - 4], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x5c], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x60], ebx
call fcn.0042e343
lea eax, [esi + 0xc0]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ebx
cmp dword [eax + 0x14], 8
jb 0x42b0d3
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 5
mov word [esi + 0xd8], 0x100
cmp byte [0x734de8], cl
jne 0x42b1c0
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov edi, eax
push 1
push 3
test edi, edi
je 0x42b15e
lea ecx, [ebp - 0x258]
call fcn.004078ff
push edi
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 6
push 0x688428
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.0040819d
lea eax, [ebp - 0x258]
push eax
push str.Http::Http
push 0x22
push str.D:_build6c589d3ff8507062_srccommonNetworkHttp.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x258]
jmp 0x42b1b4
lea ecx, [ebp - 0x308]
call fcn.004078ff
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x2f8]
mov byte [ebp - 4], 7
push str.WinSock_init_ok__version
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.0042b3c4
lea eax, [ebp - 0x308]
push eax
push str.Http::Http
push 0x24
push str.D:_build6c589d3ff8507062_srccommonNetworkHttp.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x308]
call fcn.0040843a
mov byte [0x734de8], 1
mov eax, esi
call fcn.005b4759
ret
Function at 0x42b7a0
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x64cd7a
call fcn.005b47af
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x42b8a0
cmp byte [ebx + 0x3d], 0
je 0x42b8a0
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x42b7da
xor al, al
jmp 0x42b8a2
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.0040ea58
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x42b838
sub eax, 1
je 0x42b83c
dec eax
sub eax, 1
je 0x42b88e
xor bl, bl
jmp 0x42b890
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x42b874
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00619411
add esp, 0x10
cmp esi, eax
jne 0x42b834
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x42b88e
test esi, esi
jne 0x42b7fe
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00409fa6
jmp 0x42b7f8
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00409d92
mov al, bl
jmp 0x42b8a2
mov al, 1
call fcn.005b4759
ret
Function at 0x42c146
Capabilities:
Read http header

Disassembly:
push 0x28
mov eax, 0x64ceec
call fcn.005b47af
mov esi, ecx
mov dword [ebp - 0x30], esi
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], ax
cmp word [0x684590], ax
je 0x42c186
push 0x684590
call fcn.005ff18e
pop ecx
push eax
push 0x684590
lea ecx, [ebp - 0x28]
call fcn.0040a315
xor edx, edx
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], edx
jb 0x42c1a6
mov eax, dword [edi]
jmp 0x42c1a8
mov eax, edi
lea ecx, [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push edx
push eax
push 0xffff
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x42c252
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x42c252
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005b485c
cmp dword [edi + 0x14], 8
mov esi, eax
pop ecx
jb 0x42c1f6
mov edi, dword [edi]
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push esi
push edi
push 0xffff
push dword [eax + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x42c224
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.0040bd4b
xor edi, edi
jmp 0x42c25f
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
xor edi, edi
mov word [esi + eax*2], cx
cmp word [esi], di
jne 0x42c238
mov eax, edi
jmp 0x42c23f
push esi
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040a315
push esi
call fcn.005b4857
pop ecx
jmp 0x42c254
xor edi, edi
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.0040bd4b
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00409de7
mov eax, ebx
call fcn.005b4759
ret 0xc