joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e9d0
Capabilities:
Prepare http request

Disassembly:
push 0xffffffffffffffff
push 0x420548
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov esi, ecx
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x40ea12
push eax
call edi
mov dword [esi + 8], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40ea1f
push eax
call edi
mov dword [esi + 4], ebx
cmp dword [esi], ebx
je 0x40eadb
mov eax, dword [0x4281ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x4281ac
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [0x4281ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x4281ac
mov byte [esp + 0x1c], bl
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov word [esp + 0x24], bx
mov dword [esp + 0x28], ebx
push ebp
lea eax, [esp + 0x1c]
mov dword [esp + 0x38], ebx
call fcn.0040e610
test al, al
jne 0x40eae2
push ebp
push 0x423620
push 2
push 0xe0
push str.CHttpUtil::OpenRequest
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
mov dword [esp + 0x48], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eabb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eadb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x40eb99
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esi]
push ebx
push ecx
push edx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x40eb31
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x423668
push 2
push 0xe8
push str.CHttpUtil::OpenRequest
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
lea esi, [esp + 0x18]
call fcn.0040ebb0
xor al, al
jmp 0x40eb99
xor ecx, ecx
cmp byte [esp + 0x1c], bl
je 0x40eb3e
mov ecx, 0x800000
push ecx
mov ecx, dword [esp + 0x2c]
push ebx
push ebx
push ebx
push ecx
push str.POST
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
cmp eax, ebx
mov dword [esi + 8], eax
jne 0x40eb8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x423680
push 2
push 0xf5
push str.CHttpUtil::OpenRequest
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
lea esi, [esp + 0x18]
call fcn.0040ebb0
xor al, al
jmp 0x40eb99
lea esi, [esp + 0x18]
call fcn.0040ebb0
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x40ebf0
Capabilities:
Set http header

Disassembly:
push 0xffffffffffffffff
push 0x41f7d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 8], 0
jne 0x40ec33
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
mov eax, dword [0x4281ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x4281ac
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push str._s:__s
lea edi, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00411870
mov esi, dword [esp + 0x1c]
mov edx, dword [ebx + 8]
add esp, 0xc
push 0xa0000000
push 0xffffffffffffffff
push esi
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
lea eax, [esi - 0x10]
setne bl
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ecab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8

Function at 0x40ee90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x420638
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 8]
push ecx
call fcn.0040f290
mov eax, dword [esp + 0x30]
push 1
push 0
lea edx, [esp + 0xc]
push edx
push esi
mov dword [esp + 0x38], 0
call fcn.0040ef20
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
mov dword [esp + 4], vtable.FileInStream.0
je 0x40eefd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x1c]
push eax
call fcn.004127aa
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret 8
Function at 0x40ef20
Capabilities:
Receive http response

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, dword [ebp + 4]
xor ebx, ebx
cmp edi, ebx
mov esi, eax
mov dword [esp + 0x20], edi
jne 0x40ef64
xor ecx, ecx
call fcn.0040f120
test al, al
je 0x40ef50
mov eax, dword [esi + 8]
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov eax, dword [esp + 0x28]
mov dword [eax], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
cmp byte [esp + 0x30], bl
je 0x40ef79
mov ecx, edi
call fcn.0040f120
test al, al
je 0x40f0fe
mov edx, dword [ebp]
mov eax, dword [edx + 4]
push 0x2800
mov ecx, ebp
call eax
test al, al
jne 0x40efa0
mov eax, dword [esp + 0x28]
mov dword [eax], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor ebp, ebp
cmp byte [esp + 0x34], bl
mov byte [esp + 0x10], 1
je 0x40efb3
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], ebx
cmp edi, ebx
jbe 0x40f080
jmp 0x40efc0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call edx
test al, al
je 0x40f0a1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40f0b5
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
je 0x40f0d7
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40f080
add ebp, eax
cmp byte [esp + 0x34], bl
je 0x40f06e
xor edi, edi
mov ecx, edi
push ecx
mov edx, ebp
push edx
push str.SIZE:__d
push ebx
push 0x1ea
push str.CHttpUtil::SendWithStream
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], edi
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
mov eax, dword [esi + 0x28]
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], edi
je 0x40f06a
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esi + 0x30]
push edx
call eax
add esp, 8
mov edi, dword [esp + 0x20]
cmp byte [esp + 0x10], bl
je 0x40f078
mov byte [esp + 0x10], bl
cmp ebp, edi
jb 0x40efc0
cmp byte [esp + 0x30], bl
je 0x40f091
mov eax, dword [esi + 8]
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x28]
mov dword [eax], 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
push 0x423738
push 1
push 0x1d5
push str.CHttpUtil::SendWithStream
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x10
jmp 0x40f080
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetWriteFile:_error:_d
push 2
push 0x1dd
push str.CHttpUtil::SendWithStream
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword [eax], 5
pop ebx
add esp, 0x14
ret 0x10
Function at 0x40f1a0
Capabilities:
Read http header

Disassembly:
push ecx
mov dword [ecx], 0
mov eax, dword [eax + 8]
test eax, eax
je 0x40f1f7
push 0
lea edx, [esp + 4]
push edx
push ecx
push 0
push 0x20000013
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x40f1fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42382c
push 1
push 0x21a
push str.CHttpUtil::GetStatusCode
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
xor al, al
pop ecx
ret
mov al, 1
pop ecx
ret

Function at 0x40f290
Capabilities:
Access peb ldr_data
Get file size
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x420523
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esp + 0x28], ebx
mov dword [esi], vtable.FileInStream.0
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push edi
mov byte [esp + 0x44], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x10], eax
jne 0x40f327
push edi
push 0x423880
push 2
push 0x33e
push str.FileInStream::FileInStream
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
jmp 0x40f3dd
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x1c], ebx
call edi
mov edx, dword [esp + 0x14]
xor ecx, ecx
xor ebp, ebp
or ecx, eax
or edx, ebp
mov dword [esp + 0x18], edx
jl 0x40f38d
jg 0x40f355
cmp ecx, 0x7fffffff
jbe 0x40f38d
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x34]
push ecx
push 0x4238d0
push 2
push 0x346
push str.FileInStream::FileInStream
mov dword [esi + 0x10], 0xffffffff
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
jmp 0x40f3dd
mov edx, dword [esi + 0x10]
push ebx
push edx
call edi
cmp eax, 1
jae 0x40f3c1
mov eax, dword [esp + 0x34]
push ebx
push eax
push 0x4238ec
push 2
push 0x34e
push str.FileInStream::FileInStream
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x18
jmp 0x40f3dd
cmp eax, 0xffffffff
mov byte [esi + 0xc], 1
jbe 0x40f3cd
or eax, 0xffffffff
mov ecx, dword [esi + 0x10]
push ebx
push ebx
push ebx
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x40f4e0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x40f52f
mov eax, dword [esi + 8]
test eax, eax
je 0x40f52f
mov edx, dword [esp + 0xc]
push 0
push edx
push eax
mov eax, dword [esi + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f535
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x423924
push 2
push 0x37a
push str.FileInStream::Read
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
xor al, al
pop esi
ret 8
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 8]
mov dword [edx], ecx
mov al, 1
pop esi
ret 8

Function at 0x40f550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41fca8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
call fcn.00410090
mov esi, dword [esp + 0x2c]
push eax
add esi, 0x10
mov dword [esp + 0x28], 0
call fcn.00410520
lea esi, [esp + 8]
call fcn.0040af00
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
Function at 0x40f8b0
Capabilities:
Receive http response

Disassembly:
push 0xffffffffffffffff
push 0x420730
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x4281ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x4281ac
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], 0
mov eax, dword [0x4281ac]
mov edx, dword [eax + 0xc]
mov ecx, 0x4281ac
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov ebx, dword [esp + 0x2c]
add ebx, 0x10
mov byte [esp + 0x24], 1
mov esi, dword [ebx + 4]
cmp esi, dword [ebx + 8]
jbe 0x40f924
call fcn.00412b4f
mov ebp, dword [ebx + 8]
cmp dword [ebx + 4], ebp
jbe 0x40f931
call fcn.00412b4f
test ebx, ebx
je 0x40f939
cmp ebx, ebx
je 0x40f93e
call fcn.00412b4f
cmp esi, ebp
je 0x40f9cb
test ebx, ebx
jne 0x40f94f
call fcn.00412b4f
cmp esi, dword [ebx + 8]
jb 0x40f959
call fcn.00412b4f
cmp dword [esi], 0
jne 0x40f9b9
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x40f979
push 1
push 0x423a3c
lea ecx, [esp + 0x1c]
push ecx
call fcn.004106b0
cmp esi, dword [ebx + 8]
jb 0x40f983
call fcn.00412b4f
cmp esi, dword [ebx + 8]
mov edi, dword [esi + 8]
jb 0x40f990
call fcn.00412b4f
mov edx, dword [esi + 4]
push edi
push edx
push 0x423a40
lea edi, [esp + 0x24]
call fcn.00411870
mov edi, dword [esp + 0x24]
mov eax, dword [edi - 0xc]
add esp, 0xc
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
call fcn.004106b0
cmp esi, dword [ebx + 8]
jb 0x40f9c3
call fcn.00412b4f
add esi, 0x14
jmp 0x40f924
mov ebx, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
mov edx, dword [esp + 0x34]
jne 0x40f9f5
push eax
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov esi, dword [esp + 0x30]
mov dword [esi], 0
jmp 0x40fa06
mov ecx, dword [esp + 0x30]
push 1
push ecx
push edx
call fcn.0040ed80
mov esi, dword [esp + 0x30]
lea eax, [edi - 0x10]
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fa27
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fa4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x40fa70
Capabilities:
Check if file exists
Get file size

Disassembly:
sub esp, 8
push ebx
xor eax, eax
cmp byte [edi + 0xc], al
push ebp
push esi
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
je 0x40fbbe
mov esi, dword [edi + 0x14]
cmp esi, dword [edi + 0x18]
lea ebx, [edi + 0x10]
jbe 0x40fa97
call fcn.00412b4f
mov ebp, dword [edi + 0x18]
cmp dword [edi + 0x14], ebp
jbe 0x40faa4
call fcn.00412b4f
test ebx, ebx
je 0x40faaf
lea eax, [edi + 0x10]
cmp ebx, eax
je 0x40fab4
call fcn.00412b4f
cmp esi, ebp
je 0x40fbbe
test ebx, ebx
jne 0x40fac5
call fcn.00412b4f
cmp esi, dword [ebx + 8]
jb 0x40facf
call fcn.00412b4f
cmp dword [esi], 1
jne 0x40fb3e
cmp esi, dword [ebx + 8]
jb 0x40fade
call fcn.00412b4f
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fb87
cmp esi, dword [ebx + 8]
jb 0x40fafa
call fcn.00412b4f
mov eax, dword [esi + 8]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40fb50
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x10]
xor edx, edx
xor ebp, ebp
or edx, eax
or ecx, ebp
add dword [edi + 0x30], edx
adc dword [edi + 0x34], ecx
cmp esi, dword [ebx + 8]
jb 0x40fb48
call fcn.00412b4f
add esi, 0x14
jmp 0x40fa97
cmp esi, dword [ebx + 8]
jb 0x40fb5a
call fcn.00412b4f
mov esi, dword [esi + 8]
push esi
push 0x423880
push 2
push 0x493
push str.CHttpPostForm::CheckAllFilesExist
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
xor al, al
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp esi, dword [ebx + 8]
jb 0x40fb91
call fcn.00412b4f
mov esi, dword [esi + 8]
push esi
push 0x423a94
push 2
push 0x49b
push str.CHttpPostForm::CheckAllFilesExist
call fcn.00411890
mov ecx, eax
call fcn.0040dee0
add esp, 0x14
xor al, al
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
Function at 0x410090
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x41f9ac
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x427040]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, edx
mov esi, dword [esp + 0x2c]
lea eax, [esi + 4]
push eax
mov ecx, edi
mov dword [esi], 0
call fcn.00410320
lea ecx, [esi + 8]
push ecx
mov ecx, ebx
mov dword [esp + 0x28], 0
call fcn.00410320
mov byte [esp + 0x24], 1
mov edx, dword [0x4281ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x4281ac
lea ebp, [esi + 0xc]
call eax
add eax, 0x10
mov dword [ebp], eax
mov byte [esp + 0x24], 2
mov edx, dword [0x4281ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x4281ac
call eax
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [esp + 0x24], 3
mov ecx, dword [esp + 0x30]
mov byte [ecx], 1
mov edx, dword [0x4281ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x4281ac
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x24], 4
mov edx, dword [0x4281ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x4281ac
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x18]
mov ecx, edi
mov byte [esp + 0x28], 5
call fcn.0040dc20
mov edx, dword [esp + 0x18]
push edx
push str.Content_Disposition:_form_data__name__s_
lea edi, [esp + 0x3c]
call fcn.00411850
lea eax, [esp + 0x24]
push eax
mov eax, ebp
mov ecx, ebx
call fcn.0040dc20
add esp, 0x10
push 4
push str._r_n_r_n
mov ecx, edi
push ecx
call fcn.00410230
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x4101af
xor eax, eax
jmp 0x4101bf
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4101b4
sub eax, edx
mov edi, eax
push ebx
lea eax, [esi + 0x10]
call fcn.00411180
mov byte [esp + 0x24], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4101ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [esp + 0x24], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410210
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x412675
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x427040]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004125b4
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00413e90
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4126c4
cmp dword [ebp - 0x1c], 5
jb 0x4126dc
jmp 0x4126d8
cmp dword [ebp - 0x10], 1
jne 0x4126dc
cmp dword [ebp - 0x1c], 4
ja 0x4126d8
jne 0x4126dc
cmp dword [ebp - 0x18], 0
jbe 0x4126dc
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x421334
call fcn.00412467
test eax, eax
jge 0x4126fd
mov byte [0x428d00], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041288d
add ebp, 0x78
leave
ret

Function at 0x41288d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427040]
jne 0x412897
repz ret
jmp fcn.00414bb8
Function at 0x415d9c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4271e8]
je 0x415db7
inc edi
cmp edi, 0x17
jb 0x415da8
cmp edi, 0x17
jae 0x415f37
push ebp
push 3
call fcn.0041ca92
cmp eax, 1
pop ecx
je 0x415f03
push 3
call fcn.0041ca92
test eax, eax
pop ecx
jne 0x415deb
cmp dword [0x427030], 1
je 0x415f03
cmp ebx, 0xfc
je 0x415f36
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4285e0
push ebp
call fcn.004150a4
add esp, 0xc
test eax, eax
je 0x415e21
push esi
push esi
push esi
push esi
push esi
call fcn.00412a2f
add esp, 0x14
push 0x104
mov esi, 0x4285f9
push esi
push 0
mov byte [0x4286fd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x415e65
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004150a4
add esp, 0xc
test eax, eax
je 0x415e65
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00412a2f
add esp, 0x14
push esi
call fcn.00414330
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x415eaa
push esi
call fcn.00414330
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4288f4
push 0x4219f4
sub ecx, eax
push ecx
push eax
call fcn.0041c9df
add esp, 0x14
test eax, eax
je 0x415eaa
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00412a2f
add esp, 0x14
jmp 0x415eac
xor esi, esi
push 0x4219f0
push ebx
push ebp
call fcn.0041c96e
add esp, 0xc
test eax, eax
je 0x415ecc
push esi
push esi
push esi
push esi
push esi
call fcn.00412a2f
add esp, 0x14
push dword [edi*8 + 0x4271ec]
push ebx
push ebp
call fcn.0041c96e
add esp, 0xc
test eax, eax
je 0x415eee
push esi
push esi
push esi
push esi
push esi
call fcn.00412a2f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0041c7b1
add esp, 0xc
jmp 0x415f36
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x415f36
cmp ebp, 0xffffffff
je 0x415f36
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4271ec]
push dword [esi]
call fcn.00414330
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret