joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448345
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x5724d9
call fcn.004fb864
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x58a704
lea edi, [esi + 0x168]
mov dword [ebp - 4], 0x10
mov ecx, edi
mov dword [edi], 0x586908
call fcn.004dda10
mov ecx, edi
call fcn.004dd960
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 0xf
call fcn.00435f7e
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 0xe
call fcn.005527e1
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 0xd
call fcn.005527e1
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xc
call fcn.005527e1
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 0xb
call fcn.005527e1
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 0xa
call fcn.005527e1
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 9
call fcn.005527e1
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 8
call fcn.005527e1
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 7
call fcn.005527e1
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 6
call fcn.005527e1
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 5
call fcn.005527e1
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.005527e1
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 3
call fcn.005527e1
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 2
call fcn.005527e1
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.005527e1
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.005527e1
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.005527e1
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4490e4
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5727e4
call fcn.004fb864
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x4491c5
xor ebx, ebx
mov esi, 0x3e8
push dword [ebp + 0xc]
call fcn.00410df3
cmp eax, 0xffffffff
pop ecx
jne 0x4491c5
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x4491c5
push dword [ebp + 0x10]
push esi
call fcn.00413e66
pop ecx
test eax, eax
pop ecx
jne 0x449144
add ebx, esi
cmp ebx, 0x1388
jl 0x44910c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x449191
push str.If_you_are_previewing_the_downloading_video_audio__please_stop_previewing__then_click_OK_button.
lea ecx, [ebp - 0x10]
call fcn.00552855
push 0x31
push 0x5c5570
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x449185
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.005527e1
push 1
pop eax
jmp 0x4491cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.005527e1
xor ebx, ebx
push dword [ebp + 0xc]
call fcn.00410df3
cmp eax, 0xffffffff
pop ecx
jne 0x4491c5
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x4491c5
push dword [ebp + 0x10]
push esi
call fcn.00413e66
pop ecx
test eax, eax
pop ecx
jne 0x4491c9
add ebx, esi
cmp ebx, 0x2710
jge 0x4491c9
jmp 0x449193
xor eax, eax
jmp 0x4491cc
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4491db
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x449257
push dword [ebp + 0x10]
call esi
xor ebx, ebx
test eax, eax
je 0x449215
cmp dword [ebp + 0x14], ebx
je 0x44925c
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004490e4
add esp, 0xc
test eax, eax
jl 0x44925c
mov edi, 0x3e8
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00410e17
add esp, 0xc
cmp eax, 0xffffffff
jne 0x449253
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x449257
push dword [ebp + 0x18]
push edi
call fcn.00413e66
pop ecx
test eax, eax
pop ecx
jne 0x44925c
add ebx, edi
cmp ebx, 0x1388
jge 0x44925c
jmp 0x44921a
xor eax, eax
jmp 0x44925f
push 0xfffffffffffffffe
pop eax
jmp 0x44925f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44f5b1
Capabilities:
Check if file exists

Disassembly:
push dword [0x65d190]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44f5d6
push 0
push 0x414
push dword [0x65d190]
call fcn.00410d76
add esp, 0xc
ret

Function at 0x450911
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x572cc8
call fcn.004fb864
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
push esi
lea ecx, [ebp - 0x20]
call fcn.0044ed7c
xor edi, edi
push 0x65d130
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
call fcn.00552855
xor ebx, ebx
cmp dword [esi + 0x14], edi
mov byte [ebp - 4], 1
jle 0x4509aa
jmp 0x450942
xor edi, edi
cmp ebx, edi
jl 0x450951
cmp ebx, dword [esi + 0x14]
jge 0x450951
mov eax, dword [esi + 0x10]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x4509a2
mov ecx, edi
call fcn.00450a17
test eax, eax
je 0x4509a2
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x450976
push 0x5c5fdc
lea ecx, [ebp - 0x10]
call fcn.00552bd2
push 0x5c5de4
lea ecx, [ebp - 0x10]
call fcn.00552bd2
add edi, 0x6a4
lea ecx, [ebp - 0x10]
push edi
call fcn.00552c0e
push 0x5c5de4
lea ecx, [ebp - 0x10]
call fcn.00552bd2
inc dword [ebp - 0x18]
inc ebx
cmp ebx, dword [esi + 0x14]
jl 0x450940
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x4509ed
lea eax, [ebp - 0x14]
push eax
call fcn.004036f3
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push 1
push edi
je 0x4509d5
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
jmp 0x4509de
push edi
push dword [ebp - 0x10]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.005527e1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.005527e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0044edab
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4556cc
Capabilities:
Resume thread

Disassembly:
mov eax, 0x573411
call fcn.004fb864
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 0x70
call fcn.00552dd0
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x4556fd
push dword [edi]
call fcn.004555eb
mov esi, eax
jmp 0x4556ff
xor esi, esi
or eax, 0xffffffff
cmp esi, ebx
mov dword [ebp - 4], eax
je 0x45574d
push ebx
push ebx
push 4
mov ecx, esi
call fcn.00556af7
test eax, eax
jne 0x455726
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or eax, 0xffffffff
jmp 0x45574d
mov ecx, dword [edi]
push ebx
push 0x64
push ebx
mov eax, dword [ecx]
push ebx
call dword [eax + 0x128]
push ebx
mov dword [edi + 4], esi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4559f2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x573559
call fcn.004fb864
push ecx
mov eax, dword [0x655358]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [ecx], eax
mov eax, dword [0x655358]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], eax
mov eax, dword [0x655358]
mov dword [esi + 0x1c], eax
mov eax, dword [0x655358]
mov dword [esi + 0x3c], eax
mov eax, dword [0x655358]
mov dword [esi + 0x40], eax
mov eax, dword [0x655358]
mov dword [esi + 0x44], eax
mov eax, dword [0x655358]
mov dword [esi + 0x48], eax
mov edi, 0x65d130
mov byte [ebp - 4], 6
push edi
mov dword [esi], ebx
mov dword [esi + 4], 1
call fcn.00552978
push edi
lea ecx, [esi + 0xc]
call fcn.00552978
push edi
lea ecx, [esi + 0x1c]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call fcn.00552978
push edi
lea ecx, [esi + 0x3c]
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 0x14
call fcn.00552978
push edi
lea ecx, [esi + 0x40]
call fcn.00552978
push edi
lea ecx, [esi + 0x44]
call fcn.00552978
push edi
lea ecx, [esi + 0x48]
call fcn.00552978
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x458704
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5739b2
call fcn.004fb864
sub esp, 0x2a0
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00419e8e
pop ecx
mov eax, dword [eax]
push 1
xor edi, edi
push 1
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.004108a6
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.005527e1
lea ecx, [ebp - 0xe4]
call fcn.00458499
push dword [ebp + 0x2c]
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 3
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.0045808c
mov esi, eax
cmp esi, edi
je 0x45879e
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.005527e1
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x58c8b8
call fcn.0045b8c4
jmp 0x4588c7
push dword [ebp - 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4587d4
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.005527e1
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x58c8b8
call fcn.0045b8c4
or esi, 0xffffffff
jmp 0x4588c7
push edi
lea ecx, [ebp - 0x2ac]
call fcn.004dd940
push 3
lea ecx, [ebp - 0x2ac]
push dword [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.004deab0
test al, al
jne 0x458828
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 0x586908
call fcn.004dda10
lea ecx, [ebp - 0x2ac]
call fcn.004dd960
mov byte [ebp - 4], 7
or esi, 0xffffffff
jmp 0x4588aa
cmp dword [ebp + 0x24], edi
jle 0x458870
cmp dword [ebp + 0x20], edi
jle 0x458870
lea ecx, [ebp - 0x2ac]
call fcn.004dc8e0
lea ecx, [ebp - 0x2ac]
mov esi, eax
call fcn.004dc8d0
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
lea eax, [ebp + 0x18]
push esi
push eax
call fcn.0045a1ef
push dword [ebp + 0x1c]
lea eax, [ebp - 0x2ac]
push dword [ebp + 0x18]
push eax
call fcn.004129f8
add esp, 0x20
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2ac]
push edi
push eax
call fcn.004ddf60
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2ac], 0x586908
call fcn.004dda10
lea ecx, [ebp - 0x2ac]
call fcn.004dd960
mov byte [ebp - 4], 8
xor esi, esi
lea ecx, [ebp - 0x74]
call fcn.005527e1
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x58731c
call fcn.00424cdc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00410913
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4588e3
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5739e8
call fcn.004fb864
sub esp, 0xc0
push esi
lea ecx, [ebp - 0xcc]
call fcn.00458499
push dword [ebp + 0x14]
xor esi, esi
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00458374
cmp eax, esi
je 0x45892a
mov dword [ebp - 4], 1
mov esi, eax
jmp 0x45894a
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x458943
mov dword [ebp - 4], 2
or esi, 0xffffffff
jmp 0x45894a
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.005527e1
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0x58731c
call fcn.00424cdc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x45a252
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x573bbc
call fcn.004fb864
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, 0x65d14c
push str._sMediaProbe.exe
push edi
call fcn.0054fb09
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [0x65d14c]
call esi
test eax, eax
jne 0x45a296
push str.MediaProbe.exe
mov ecx, edi
call fcn.00552978
push ebx
mov edi, 0x65d150
push str._sMediaEncode.exe
push edi
call fcn.0054fb09
add esp, 0xc
push dword [0x65d150]
call esi
test eax, eax
jne 0x45a2c2
push str.MediaEncode.exe
mov ecx, edi
call fcn.00552978
push dword [0x65d150]
lea eax, [ebp - 0x14]
push eax
call fcn.00411816
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0x5d79d8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00552a86
push eax
mov ecx, 0x65d154
mov byte [ebp - 4], 1
call fcn.00552928
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.005527e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.005527e1
push ebx
mov edi, 0x65d158
push str._sMediaPlay.exe
push edi
call fcn.0054fb09
add esp, 0xc
push dword [0x65d158]
call esi
test eax, eax
jne 0x45a339
push str.MediaPlay.exe
mov ecx, edi
call fcn.00552978
cmp dword [0x65d15c], 0
jne 0x45a43d
mov eax, dword [0x655358]
mov dword [ebp + 8], eax
push 2
lea eax, [ebp + 8]
pop edi
push ebx
push str._s_avcodec_60.dll
push eax
mov dword [ebp - 4], edi
call fcn.0054fb09
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a379
mov dword [0x65d15c], 6
cmp dword [0x65d15c], 0
jne 0x45a431
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_59.dll
push eax
call fcn.0054fb09
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a3ab
mov dword [0x65d15c], 5
cmp dword [0x65d15c], 0
jne 0x45a431
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_58.dll
push eax
call fcn.0054fb09
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a3d9
mov dword [0x65d15c], 4
cmp dword [0x65d15c], 0
jne 0x45a431
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_57.dll
push eax
call fcn.0054fb09
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a407
mov dword [0x65d15c], 3
cmp dword [0x65d15c], 0
jne 0x45a431
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_56.dll
push eax
call fcn.0054fb09
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x45a431
mov dword [0x65d15c], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.005527e1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x65d160], 1
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45a458
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [0x65d158]
call esi
test eax, eax
je 0x45a478
xor eax, eax
push eax
push eax
push eax
push dword [0x65d158]
jmp 0x45a4a8
push dword [0x65d150]
call esi
test eax, eax
je 0x45a491
xor eax, eax
push eax
push eax
push eax
push dword [0x65d150]
jmp 0x45a4a8
push dword [0x65d14c]
call esi
test eax, eax
je 0x45a4b0
xor eax, eax
push eax
push eax
push eax
push dword [0x65d14c]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop esi
ret

Function at 0x45a715
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x573c18
call fcn.004fb864
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a753
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00411816
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.005527e1
lea eax, [ebp - 0x14]
push eax
call fcn.00419e8e
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.004108a6
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.005527e1
push dword [ebp + 8]
lea edi, [esi + 0x70]
mov ecx, edi
call fcn.00552978
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 0x68]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0045a4d5
test eax, eax
je 0x45a7aa
mov esi, eax
jmp 0x45a7df
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x28]
test eax, eax
je 0x45a7c4
or esi, 0xffffffff
jmp 0x45a7df
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x2c]
or esi, 0xffffffff
cmp eax, esi
je 0x45a7df
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00410913
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x460aaa
Capabilities:
Resume thread

Disassembly:
mov eax, 0x5749d5
call fcn.004fb864
push ecx
push esi
mov esi, ecx
push 0x74
call fcn.00552dd0
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x460acf
push dword [ebp + 8]
push esi
call fcn.00461de5
mov esi, eax
jmp 0x460ad1
xor esi, esi
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x460af3
push 0
push 0
push 4
mov ecx, esi
call fcn.00556af7
test eax, eax
jne 0x460af7
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
xor eax, eax
jmp 0x460b0d
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x464594
Capabilities:
Parse url

Disassembly:
mov eax, 0x574a8c
call fcn.004fb864
mov eax, 0x4048
call fcn.004fc4a0
push ebx
push esi
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00552855
xor ebx, ebx
push 0x23
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00552cc0
or esi, 0xffffffff
cmp eax, esi
je 0x4645f0
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.0054f6fb
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00552928
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.005527e1
mov eax, dword [ebp + 8]
cmp dword [eax - 8], ebx
je 0x46469b
mov ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x65d130
push esi
mov dword [edi], ebx
call fcn.00552978
mov ecx, dword [ebp + 0x14]
push esi
call fcn.00552978
mov eax, dword [ebp + 0x18]
push 0x3c
pop esi
mov dword [eax], ebx
push esi
lea eax, [ebp - 0x4c]
push ebx
push eax
call fcn.004fb890
mov eax, 0x1000
add esp, 0xc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x4054]
lea ecx, [ebp - 0x2050]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push ebx
mov dword [ebp - 0x4c], esi
push dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov esi, eax
cmp esi, ebx
je 0x464672
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp + 0x18]
mov dword [edi], eax
movzx eax, word [ebp - 0x34]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x2050]
push eax
call fcn.00552978
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x4054]
push eax
call fcn.00552978
xor eax, eax
cmp esi, ebx
setne al
dec eax
pop edi
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.005527e1
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x464810
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x65d130
mov dword [edi], esi
call fcn.00552978
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
push 1
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4648f1
cmp dword [ebp + 8], esi
je 0x4648f1
push ebx
push 4
pop eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ProxyEnable
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x464890
cmp dword [ebp - 0xc], esi
setne al
mov dword [edi], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x80a]
mov word [ebp - 0x80c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 4]
push eax
push esi
push str.ProxyServer
mov dword [ebp - 8], 0x400
push dword [ebp + 8]
call ebx
test eax, eax
pop ebx
jne 0x4648e4
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x80c]
push eax
call fcn.00552978
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4648f4
or eax, 0xffffffff
pop edi
pop esi
leave
ret 8
Function at 0x46531f
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x574c88
call fcn.004fb864
push ecx
mov eax, dword [0x655358]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push str._sNIO_curl.exe
push eax
call fcn.0054fb09
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x46536a
lea eax, [ebp - 0x10]
lea ecx, [esi + 8]
push eax
call fcn.00552928
cmp dword [esi + 4], 0
push 2
pop ebx
jne 0x465382
push dword [esi + 8]
call edi
neg eax
sbb eax, eax
and eax, ebx
dec eax
mov dword [esi + 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._sNIO_wget.exe
push eax
call fcn.0054fb09
add esp, 0xc
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4653ab
lea eax, [ebp - 0x10]
lea ecx, [esi + 0x10]
push eax
call fcn.00552928
cmp dword [esi + 0xc], 0
jne 0x4653c0
push dword [esi + 0x10]
call edi
neg eax
sbb eax, eax
and eax, ebx
dec eax
mov dword [esi + 0xc], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._sNIO_msdl.exe
push eax
call fcn.0054fb09
add esp, 0xc
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4653e9
lea eax, [ebp - 0x10]
lea ecx, [esi + 0x18]
push eax
call fcn.00552928
cmp dword [esi + 0x14], 0
jne 0x4653fe
push dword [esi + 0x18]
call edi
neg eax
sbb eax, eax
and eax, ebx
dec eax
mov dword [esi + 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push str._sNIO_rtmp.exe
push eax
call fcn.0054fb09
add esp, 0xc
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x465427
lea eax, [ebp - 0x10]
lea ecx, [esi + 0x20]
push eax
call fcn.00552928
cmp dword [esi + 0x1c], 0
jne 0x46543c
push dword [esi + 0x20]
call edi
neg eax
sbb eax, eax
and eax, ebx
dec eax
mov dword [esi + 0x1c], eax
push str.ca_bundle.crt
mov ebx, 0x5c514c
push dword [ebp + 8]
add esi, 0x24
push ebx
push esi
call fcn.0054fb09
add esp, 0x10
push dword [esi]
call edi
test eax, eax
jne 0x465470
push str.ca_bundle.trust.crt
push dword [ebp + 8]
push ebx
push esi
call fcn.0054fb09
add esp, 0x10
push dword [esi]
call edi
test eax, eax
jne 0x46548a
push str.curl_ca_bundle.crt
push dword [ebp + 8]
push ebx
push esi
call fcn.0054fb09
add esp, 0x10
push dword [esi]
call edi
test eax, eax
jne 0x4654a4
push str.ca_bundle.crt
push dword [ebp + 8]
push ebx
push esi
call fcn.0054fb09
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.005527e1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 8