joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430b90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x5c12e8
test esi, esi
jne 0x430baf
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add edi, ecx
sub esi, ecx
add ebx, ecx
test eax, eax
je 0x430be0
test ecx, ecx
je 0x430be0
mov eax, dword [ebp - 4]
test esi, esi
jne 0x430bb2
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431250
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x43131e
cmp word [esi], 0
je 0x43131e
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43129e
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 4
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.005392b0
push esi
push 0x591530
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00541843
add esp, 0x1c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x43131e
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x431303
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.00431250
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 4

Function at 0x431b40
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
lea eax, [ebp - 0x3c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.005392b0
push 0x2454
push 0
push esi
call fcn.005392b0
lea eax, [esi + 8]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], eax
add esp, 0x18
lea eax, [esi + 0x2148]
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x1048]
mov dword [ebp - 8], eax
lea eax, [esi + 0x2348]
mov dword [ebp - 0x20], eax
lea eax, [esi + 0x2048]
mov dword [ebp - 0x18], eax
mov eax, edi
mov dword [ebp - 0x28], 0x100
mov dword [ebp - 0xc], 0x800
mov dword [ebp - 4], 0x800
mov dword [ebp - 0x1c], 0x80
lea edx, [eax + 2]
mov dword [ebp - 0x14], 0x80
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431bd0
lea ecx, [ebp - 0x3c]
sub eax, edx
push ecx
push dword [ebp + 8]
sar eax, 1
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x431c37
mov ecx, dword [ebp - 0x30]
cmp ecx, 3
je 0x431c04
cmp ecx, 4
je 0x431c04
cmp ecx, 1
jne 0x431c37
mov ax, word [ebp - 0x24]
mov word [esi], ax
mov eax, 1
pop edi
mov dword [esi + 0x2448], 0
mov dword [esi + 0x244c], 0
mov dword [esi + 4], ecx
mov dword [esi + 0x2450], 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431c40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
je 0x431c58
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0x5d540]
push str.MetalinkFile
push edi
call fcn.00539bcf
add esp, 8
test eax, eax
je 0x431c87
xor ecx, ecx
mov word [eax], cx
add eax, 0x1a
push eax
call fcn.0053882b
add esp, 4
mov dword [esi + 0x2698], eax
mov ecx, dword [esi + 0x62f00]
mov eax, 0xe1800e19
sub ecx, dword [esi + 0x62efc]
imul ecx
add edx, ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x431cba
push eax
lea edx, [esi + 0x10]
mov ecx, edi
call fcn.00431b40
add esp, 4
test eax, eax
je 0x431c50
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2464], eax
test eax, eax
je 0x431d18
cmp dword [esi + 0x2480], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x5d108], 8
jne 0x431d12
lea eax, [ebp - 4]
push eax
push 0
push esi
push fcn.004320d0
push 0
push 0
call fcn.0053f0a5
mov dword [esi + 0xc], eax
add esp, 0x18
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.004320d0
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432d10
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0x26e8]
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 2
cmp dword [eax + 4], 1
je 0x432d98
cmp dword [edi + 0x2484], 0
je 0x432d73
push dword [esi + 0xc]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2488]
push dword [edi + 0x2484]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x432d7f
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x432dc8
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp dword [esi], 0
jne 0x432db3
mov eax, dword [esi + 4]
test eax, eax
je 0x432db3
mov dword [esi + 0x18], eax
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
push 1
push ecx
mov ecx, edi
mov dword [esi + 0x28], 0
call fcn.004344e0
test eax, eax
jne 0x432d73
pop edi
xor eax, eax
pop esi
pop ecx
pop ebp
ret 4
Function at 0x4335b0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x26e8]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 6
cmp dword [eax + 4], 1
je 0x43363c
cmp dword [edi + 0x2484], 0
je 0x433672
push dword [esi + 0xc]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2488]
push dword [edi + 0x2484]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x433623
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x3e5
sete cl
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp dword [esi], 0
jne 0x433657
mov eax, dword [esi + 4]
test eax, eax
je 0x433657
mov dword [esi + 0x18], eax
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 1
push ebx
mov dword [esi + 0x28], 4
call fcn.004344e0
test eax, eax
jne 0x433672
push ebx
mov ecx, edi
call fcn.00433f20
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x4337a0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x26e8]
mov edi, dword [eax + ebx*4]
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 1
je 0x433941
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x433801
lea ecx, [ebp - 4]
mov dword [ebp + 8], 0
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 8], 4
push ecx
push 0x20000013
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x433801
mov eax, dword [ebp + 8]
jmp 0x433803
xor eax, eax
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x433810
mov dword [ecx + 0x2450], eax
cmp dword [edi], 0
jne 0x4338cc
cmp eax, 0xce
jne 0x4338cc
cmp dword [esi + 0x5d110], 0xffffffff
jne 0x43383a
cmp dword [esi + 0x5d114], 0xffffffff
je 0x4338e8
push edi
mov ecx, esi
call fcn.00434c30
test eax, eax
je 0x4338f9
cmp dword [edi + 0x38], 0xffffffff
mov edx, dword [edi + 0x3c]
jne 0x43385c
cmp edx, 0xffffffff
je 0x4338f9
mov eax, dword [edi + 0x8040]
mov ecx, dword [eax + 8]
add ecx, dword [edi + 0x38]
mov eax, dword [eax + 0xc]
adc eax, edx
cmp dword [esi + 0x5d118], 0
mov edx, dword [esi + 0x5d11c]
jne 0x433880
test edx, edx
je 0x43388c
cmp dword [esi + 0x5d118], ecx
jne 0x4338a1
cmp edx, eax
jne 0x4338a1
cmp dword [esi + 0x5d110], ecx
jne 0x4338f9
cmp dword [esi + 0x5d114], eax
jne 0x4338f9
jmp 0x433950
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4338b2
mov dword [eax + 0x244c], 1
push ebx
mov ecx, esi
call fcn.00433f20
push 4
mov ecx, esi
call fcn.00432670
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x1f4
jne 0x43390f
mov ecx, esi
push 1
push ebx
mov dword [edi + 0x28], 4
call fcn.004344e0
test eax, eax
jne 0x433901
cmp dword [esi + 0x2700], 0
je 0x4338f9
push ecx
mov ecx, esi
call fcn.004361e0
push ebx
mov ecx, esi
call fcn.00433f20
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x194
jne 0x4338e8
mov eax, dword [edi + 0x20]
test eax, eax
je 0x433927
mov dword [eax + 0x244c], 1
push ebx
mov ecx, esi
call fcn.00433f20
push 4
mov ecx, esi
call fcn.00432670
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
jne 0x4338d5
mov eax, dword [edi + 4]
test eax, eax
je 0x4338d5
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x20]
cmp dword [eax + 0x2448], 0xffffffff
jne 0x43396e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x20]
sub eax, dword [edi + 8]
mov dword [ecx + 0x2448], eax
cmp dword [esi + 0x2700], 0
je 0x43398f
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x4e20
push eax
push 6
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [edi + 0x8040]
cmp dword [eax + 4], 0
jne 0x4338f9
mov dword [eax + 4], 1
mov eax, 1
mov dword [edi + 0x28], 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4339c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xorps xmm0, xmm0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push 0x8000
mov eax, dword [ebx + 0x26e8]
push 0
mov edi, dword [eax + edi*4]
movdqu xmmword [edi + 0x8044], xmm0
lea esi, [edi + 0x40]
movdqu xmmword [edi + 0x8054], xmm0
push esi
movq qword [edi + 0x8064], xmm0
mov dword [edi + 0x8044], 0x28
call fcn.005392b0
mov edx, dword [edi + 0x8040]
add esp, 0xc
mov dword [edi + 0x8058], esi
lea esi, [edi + 0x805c]
mov dword [esi], 0x8000
test edx, edx
je 0x433a63
mov eax, dword [edx + 0x10]
sub eax, dword [edx + 0x18]
mov ecx, dword [edx + 0x14]
sbb ecx, dword [edx + 0x1c]
sub eax, dword [edx + 8]
sbb ecx, dword [edx + 0xc]
add eax, 1
adc ecx, 0
test ecx, ecx
jb 0x433a5e
ja 0x433a50
cmp eax, 0x8000
jbe 0x433a5e
mov eax, 0x8000
mov dword [ebp - 4], 0
jmp 0x433aa2
mov dword [ebp - 4], ecx
jmp 0x433aa2
mov eax, dword [ebx + 0x5d110]
mov ecx, dword [ebx + 0x5d114]
cmp eax, 0xffffffff
jne 0x433a78
cmp ecx, eax
je 0x433aa4
sub eax, dword [ebx + 0x5d120]
sbb ecx, dword [ebx + 0x5d124]
test ecx, ecx
jb 0x433a9f
ja 0x433a91
cmp eax, 0x8000
jbe 0x433a9f
mov eax, 0x8000
mov dword [ebp - 4], 0
jmp 0x433aa2
mov dword [ebp - 4], ecx
mov dword [esi], eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [edi + 0x20]
mov dword [edi + 0x28], 9
cmp dword [eax + 4], 1
je 0x433b06
push edi
push 1
lea eax, [edi + 0x8044]
push eax
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
je 0x433aeb
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x433b29
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push dword [esi]
push dword [edi + 0x8058]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x433ad4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x433add
push dword [ebp + 8]
mov ecx, ebx
call fcn.00433f20
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x434050
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x868], esi
cmp cx, word [ebx + 0x61a68]
je 0x434089
lea edi, [ebx + 0x61a68]
jmp 0x434167
xor eax, eax
cmp ax, word [0x5bf840]
jne 0x434162
push 0x823
push eax
mov byte [ebp - 0x834], al
lea eax, [ebp - 0x833]
push eax
call fcn.005392b0
add esp, 0xc
mov dword [ebp - 0x86c], 0x823
lea eax, [ebp - 0x86c]
lea edx, [ebp - 0x834]
push eax
call fcn.00431400
add esp, 4
test eax, eax
jne 0x434157
lea edx, [ebp - 0x834]
lea ecx, [ebp - 0x84c]
call fcn.004145d0
cmp dword [ebp - 0x838], 8
lea esi, [ebp - 0x84c]
mov ecx, 0x5bf840
mov edx, 0x824
cmovae esi, dword [ebp - 0x84c]
sub esi, ecx
jmp 0x434110
lea eax, [edx + 0x7ffff7da]
test eax, eax
je 0x43412e
movzx eax, word [esi + ecx]
test ax, ax
je 0x43412e
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x434110
jmp 0x434132
test edx, edx
jne 0x434135
sub ecx, 2
xor eax, eax
cmp dword [ebp - 0x838], 8
mov word [ecx], ax
jb 0x434151
push dword [ebp - 0x84c]
call fcn.005385cc
add esp, 4
mov esi, dword [ebp - 0x868]
xor eax, eax
cmp ax, word [0x5bf840]
je 0x434167
mov edi, 0x5bf840
push 0x10000000
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, eax
mov dword [esi + 0x14], ecx
test ecx, ecx
je 0x4342c8
mov eax, dword [ebp - 0x868]
xor esi, esi
xor edi, edi
mov edx, dword [eax + 0x20]
cmp word [edx + 0x2348], si
lea eax, [edx + 0x2348]
cmovne edi, eax
cmp word [edx + 0x2048], si
lea eax, [edx + 0x2048]
cmovne esi, eax
test edi, edi
jne 0x4341c7
cmp word [ebx + 0x60618], di
lea eax, [ebx + 0x60618]
cmovne edi, eax
test esi, esi
jne 0x4341db
cmp word [ebx + 0x60718], si
lea eax, [ebx + 0x60718]
cmovne esi, eax
cmp dword [edx + 4], 1
mov eax, 3
mov edx, 1
push 0x4321f0
cmove eax, edx
push ecx
mov dword [ebp - 0x86c], eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov edx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x86c]
push edx
push dword [ebx + 0x26e4]
mov ecx, dword [edx + 0x20]
push eax
push esi
push edi
movzx eax, word [ecx]
push eax
lea eax, [ecx + 0x2148]
push eax
push dword [edx + 0x14]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, dword [ebp - 0x868]
mov dword [esi + 0x18], eax
test eax, eax
je 0x4342c8
cmp word [ebx + 0x60a20], 0
lea edx, [ebx + 0x60a20]
je 0x4342b0
lea ecx, [ebp - 0x864]
call fcn.00414370
cmp dword [ebp - 0x850], 0x10
lea eax, [ebp - 0x864]
push 0xc
cmovae eax, dword [ebp - 0x864]
mov dword [ebp - 0x83c], eax
lea eax, [ebp - 0x840]
push eax
push 0x26
push dword [esi + 0x14]
mov dword [ebp - 0x840], 3
mov dword [ebp - 0x838], 0x58bbed
call dword [sym.imp.WININET.dll_InternetSetOptionA]
cmp dword [ebp - 0x850], 0x10
jb 0x4342b0
push dword [ebp - 0x864]
call fcn.005385cc
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 4
Function at 0x4342e0
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0053af40
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x1020], 0x595560
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x59554c
cmp dword [ebx + 0x2484], 0
mov esi, str.POST
push 0xffe
cmove esi, eax
mov dword [ebp - 0x101c], 0
xor eax, eax
push eax
mov word [ebp - 0x100c], ax
lea eax, [ebp - 0x100a]
push eax
call fcn.005392b0
mov ecx, dword [edi + 0x20]
add esp, 0xc
lea eax, [ecx + 0x1048]
push eax
lea eax, [ecx + 0x48]
push eax
push 0x595568
lea eax, [ebp - 0x100c]
push 0x7ff
push eax
call fcn.00541843
add esp, 0x14
mov eax, 0x8408c300
cmp dword [ebx + 0x62ecc], 0
mov ecx, 0x8400c300
cmovne ecx, eax
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 4
jne 0x43438f
or ecx, 0x803000
push edi
push ecx
lea eax, [ebp - 0x1020]
push eax
push 0
push str.HTTP_1.1
lea eax, [ebp - 0x100c]
push eax
push esi
push dword [edi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x4344be
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
lea ecx, [ebp - 0x1018]
push 4
push ecx
push 2
push eax
mov dword [ebp - 0x1018], 0x3a98
call esi
push 4
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], 1
push eax
push 0x41
push dword [edi + 0x1c]
call esi
mov dword [ebp - 0x1010], eax
xor ecx, ecx
mov eax, 0x5168
mov edx, 2
mul edx
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x1048], xmm0
movdqu xmmword [ebp - 0x1038], xmm0
mov dword [ebp - 0x1048], 0x28
movq qword [ebp - 0x1028], xmm0
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0051d4c8
mov esi, eax
add esp, 4
test esi, esi
je 0x434485
push 0xa2d0
push 0
push esi
call fcn.005392b0
add esp, 0xc
push dword [ebp - 0x1010]
push ecx
push esi
push edi
mov ecx, ebx
call fcn.004345e0
mov ecx, esi
mov dword [ebp - 0x1040], esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434470
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x103c], ecx
push edi
push 1
push 0
lea eax, [ebp - 0x1048]
push eax
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov edi, eax
test esi, esi
je 0x4344a9
push esi
call fcn.00538881
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret 4
Function at 0x434f40
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
jne 0x4350c9
xorps xmm0, xmm0
lea edi, [esi + 0x5d130]
push edi
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
mov dword [ebp - 0xa], 0x5c003a
mov word [ebp - 0xc], ax
xor eax, eax
push eax
push eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4350f4
mov ecx, dword [esi + 0x5d110]
mov eax, dword [esi + 0x5d114]
cmp ecx, 0xffffffff
jne 0x434fb4
cmp eax, ecx
je 0x434fdc
cmp dword [ebp - 0x1c], eax
ja 0x434fdc
jb 0x434fc0
cmp dword [ebp - 0x20], ecx
ja 0x434fdc
mov dword [esi + 0x2470], 2
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
push 0
push 0x20
push 4
push 0
push 1
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x4350de
cmp dword [esi + 0x2700], 0
je 0x4350c9
mov eax, dword [esi + 0x26f4]
mov ecx, esi
mov dword [esi + 0x26f8], eax
call fcn.004353d0
test eax, eax
jne 0x4350c9
cmp dword [esi + 0x2468], eax
ja 0x435038
mov dword [esi + 0x2468], 5
cmp dword [esi + 0x2468], 0xa
jbe 0x43504b
mov dword [esi + 0x2468], 0xa
mov dword [esi + 0x5cfd0], 0
lea ecx, [esi + 0x26f4]
mov dword [esi + 0x5cfd4], 0
mov edx, dword [esi + 0x5d110]
mov eax, dword [esi + 0x5d114]
add edx, 0xffffffff
mov dword [esi + 0x5cfd8], edx
adc eax, 0xffffffff
mov dword [esi + 0x5cfdc], eax
lea eax, [esi + 0x5cfc8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00436f50
mov eax, dword [esi + 0x5d110]
mov cl, 0x20
mov edx, dword [esi + 0x5d114]
call fcn.0056cf80
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x5d110]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x2470], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x2474], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret
Function at 0x4351d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5b8250]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 0x210], 0
push 0x206
push eax
mov word [ebp - 0x20c], ax
mov esi, ecx
lea eax, [ebp - 0x20a]
mov dword [ebp - 0x214], 0
push eax
call fcn.005392b0
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xc
push 2
push 0
push 0xffffff4a
push dword [esi + 8]
call edi
push 0
lea eax, [ebp - 0x210]
push eax
push 0xb6
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x210], 0xb6
jne 0x4352de
mov ecx, str._JZSTART_1E222D06_2CB2_4220_AF52_E0B7E800F5C1_CBA04DEF_39E0_45e4_854F_B3EA272DE745_JZEND_
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43528c
test dx, dx
je 0x435288
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43528c
add eax, 4
add ecx, 4
test dx, dx
jne 0x435266
xor eax, eax
jmp 0x435291
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4352de
push 1
push eax
push 0xffffff46
push dword [esi + 8]
call edi
push 0
lea eax, [ebp - 0x210]
push eax
push 4
lea eax, [ebp - 0x214]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x210]
push 1
push 0
neg eax
push eax
push dword [esi + 8]
call edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0053aa3c
mov esp, ebp
pop ebp
ret

Function at 0x4352f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push 2
push 0
push 0
mov eax, dword [esi + 0x26f8]
sub eax, dword [esi + 0x26f4]
push dword [esi + 8]
sar eax, 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 4], 0
je 0x4353c2
push ebx
push edi
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26f8]
xor edi, edi
sub eax, dword [esi + 0x26f4]
mov ebx, 4
sar eax, 2
test eax, eax
je 0x435391
lea esp, [esp]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x26f4]
push 0x20
push dword [eax + edi*4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26f8]
inc edi
sub eax, dword [esi + 0x26f4]
add ebx, 0x20
sar eax, 2
cmp edi, eax
jb 0x435360
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call ebx
push 0
lea eax, [ebp - 8]
push eax
push 0xb6
push str._JZSTART_1E222D06_2CB2_4220_AF52_E0B7E800F5C1_CBA04DEF_39E0_45e4_854F_B3EA272DE745_JZEND_
push dword [esi + 8]
call ebx
pop edi
pop ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
mov esp, ebp
pop ebp
ret