joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207dc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.004189e0
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0041893a
xor esi, esi
test edi, edi
jbe 0x42082e
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.004189b2
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x42081c
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc

Function at 0x4225dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe0
mov eax, dword [esp + 0xe4]
mov ecx, dword [eax]
mov eax, dword [esp + 0xe8]
push ebx
mov ebx, dword [eax]
mov eax, dword [esp + 0xf0]
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
mov edi, dword [eax]
mov eax, ecx
shr eax, 0xb
and eax, 1
mov dword [esp + 0x3c], eax
mov esi, ecx
shr esi, 9
and esi, 1
mov eax, esi
xor eax, 1
mov dword [esp + 0xcc], eax
mov eax, 0xfffffffe
xor edx, edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x38], eax
movsx eax, cl
and eax, 1
shl eax, 8
mov dword [esp + 0x78], eax
mov dword [esp + 0x50], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0xb4], edx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0x5c], edx
mov dword [esp + 0xac], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x60], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0xa8], esi
mov eax, ebx
Function at 0x44d9ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x48]
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edi, ecx
cmp byte [0x4a7cc1], bl
je 0x44db46
mov eax, dword [0x4a7cc4]
cmp eax, ebx
je 0x44db46
mov edx, 3
mov word [eax + 0x38], dx
mov dword [eax + 0x40], ecx
mov word [eax + 0x98], dx
call dword [0x482304]
mov edx, dword [0x4a7cc4]
mov dword [edx + 0xa0], eax
mov eax, 3
mov word [edx + 0xa8], ax
mov ecx, dword [ebp + 0xf4]
push ecx
call fcn.0040d24d
mov dword [edx + 0xb0], eax
cmp esi, ebx
je 0x44dac6
mov ecx, dword [esi + 4]
mov ebx, dword [0x482430]
mov eax, 8
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
push eax
add edx, 0x68
push edx
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x20]
push edx
add eax, 0x58
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x20]
push edx
add eax, 0x78
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, 3
mov word [eax + 0x88], cx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x90], edx
mov word [eax + 0xb8], cx
movzx ecx, word [esi]
test cx, cx
je 0x44dab7
movzx esi, cx
jmp 0x44daba
mov esi, dword [esi + 0x1c]
mov dword [eax + 0xc0], esi
test esi, esi
je 0x44dac6
mov edi, esi
mov eax, dword [esp + 0x50]
test eax, eax
je 0x44dadb
mov edi, eax
lea ebx, [esp + 0x10]
call 0x3e3ed0
jmp 0x44dafa
push edi
lea edx, [esp + 0x34]
push edx
call fcn.0042075c
mov edi, eax
lea esi, [esp + 0x10]
call 0x3e3e40
lea ecx, [esp + 0x30]
call 0x3d7e20
mov eax, dword [0x4a7cc4]
add eax, 0x48
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0044c28a
mov ecx, dword [0x4a7cc4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
add esp, 8
call eax
mov edx, dword [ebp]
mov ecx, dword [esp + 0x48]
mov eax, dword [edx + 4]
push 0
push ecx
add eax, ebp
call 0x3d98e0
lea esi, [esp + 0x10]
call 0x3deac0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x14
mov eax, dword [ebp]
mov eax, dword [eax + 4]
push ebx
push ecx
add eax, ebp
call 0x3d98e0
cmp byte [esp + 0x54], bl
je 0x44db31
lea esi, [esp + 0x10]
call 0x3deac0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret 0x14
Function at 0x65d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0065d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0065d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0065d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0065d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x65dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x65dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x66f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x65dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x65dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0xebcd68
Capabilities:
Encode data using xor

Disassembly:
jmp 0xebcd72
pushal
call 0xebcd78
pop ebp
sub ebp, 0x10
sub ebp, 0xabcd68
jmp 0xebcd8e
mov eax, 0xabcd68
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0x7c48074a
xor byte [eax], dl
inc eax
dec ecx
jne 0xebcda5
jmp 0xebcdb8
rol dword [edi + 0x4a76c3c1], 0x4a
dec edx
retf
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x408320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
call fcn.004017a0
mov eax, dword [0x40c044]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x25], 0x4f4a7863
mov dword [ebp - 0x21], 0x724a7073
mov dword [ebp - 0x1d], 0x6d745267
mov dword [ebp - 0x19], 0x634a5769
mov dword [ebp - 0x15], 0x506b5350
mov dword [ebp - 0x11], 0x6c6c642e
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x25]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x4083ab
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_load_DLL._Error_code:__d_n
call fcn.00408434
mov eax, 1
jmp 0x40841a
mov dword [esp + 4], str.UsAQVrGRNWsuGTUJKPLV
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x408400
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_get_function_address._Error_code:__d_n
call fcn.00408434
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call eax
sub esp, 4
mov eax, 1
jmp 0x40841a
mov eax, dword [ebp - 0x34]
call eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call eax
sub esp, 4
mov eax, 0
mov edx, dword [ebp - 0xc]
sub edx, dword [0x40c044]
je 0x40842a
call fcn.004016b0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x402426
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x402375
push 0x10
push 0x2c
call fcn.00402c52
push 0
push 0
push 8
mov dword [0x405598], eax
call fcn.00402adf
cmp word [0x405590], 0
mov dword [0x405604], eax
jne 0x40250b
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x40247e
mov word [0x405590], di
jmp 0x402486
xor eax, eax
mov word [0x405590], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4055ac], eax
test eax, eax
je 0x40250a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x4055ac]
mov dword [0x40559c], eax
call esi
push str.getnameinfo
push dword [0x4055ac]
mov dword [0x4055a0], eax
call esi
push str.WSAStringToAddressA
push dword [0x4055ac]
mov dword [0x4055a4], eax
call esi
cmp dword [0x40559c], 0
mov dword [0x4055a8], eax
pop esi
je 0x40250a
cmp dword [0x4055a0], 0
je 0x40250a
cmp dword [0x4055a4], 0
je 0x40250a
test eax, eax
je 0x40250a
mov dword [0x405594], edi
pop edi
add esp, 0x190
ret
Function at 0x402adf
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
push edi
and ecx, 3
je 0x402af5
push 4
pop eax
sub eax, ecx
add esi, eax
mov eax, dword [0x4055c8]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x402b2c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
push 8
push dword [0x405574]
mov dword [0x4055cc], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x4055cc]
call ebx
mov eax, dword [0x4055c8]
mov edi, eax
add eax, esi
push eax
push dword [0x4055cc]
mov dword [0x4055c8], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x405574]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x4055cc]
call ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jne 0x402b6c
test ebx, ebx
je 0x402b8d
push 0x14
push 0x4055c4
call fcn.00402d53
pop ecx
pop ecx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
test esi, esi
je 0x402b8d
lea ecx, [edi + ebp]
push ecx
call esi
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x402e10
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4055d0], 0
jne 0x402e1e
call fcn.00402d90
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x4055d4]
call esi
test eax, eax
jne 0x402e41
call fcn.00402d90
push dword [0x4055d4]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x402e50
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x402eb0
mov ebx, 0x10
test edi, edi
jns 0x402eb9
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x402e82
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x402ed0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4055d0], 0
jne 0x402ede
call fcn.00402d90
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x4055d4]
call esi
mov edx, eax
test edx, edx
jne 0x402f05
call fcn.00402d90
push dword [0x4055d4]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x402f38
mov ebx, 0x10
test esi, esi
jns 0x402f41
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x402f50
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x403110
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x40504c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x403134
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
lea eax, [ecx + edx*2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
sub edx, 4
cmp dword [ebp - 8], edx
jl 0x403184
mov eax, dword [ebp - 8]
add eax, 0x4000
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x405608]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4031cc
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0x100000
jle 0x4031cc
cmp dword [ebp - 8], 0x100000
jge 0x4031a0
mov dword [ebp - 8], 0x100000
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
add eax, 0xa
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x405608]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*2]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4031f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x40504c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
shl ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
sub eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x403350
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40504c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x419100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 0x14], edx
mov esi, ecx
call fcn.004c09e4
xor ecx, ecx
xor edi, edi
xorps xmm1, xmm1
mov dword [ebp - 4], ecx
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
movzx eax, byte [esi]
test byte [eax + 0x1228d9], 8
je 0x41915e
movzx eax, byte [esi + 1]
inc esi
test byte [eax + 0x1228d9], 8
jne 0x419150
mov cl, byte [esi]
cmp cl, 0x2d
jne 0x41916f
inc esi
mov dword [ebp - 0x18], 1
jmp 0x41917d
lea eax, [esi + 1]
mov dword [ebp - 0x18], edi
cmp cl, 0x2b
cmovne eax, esi
mov esi, eax
cmp byte [esi], 0x30
jne 0x4192c0
mov al, byte [esi + 1]
cmp al, 0x78
je 0x419195
cmp al, 0x58
jne 0x4192c0
movsd xmm2, qword [0x131988]
add esi, 2
mov eax, dword [ebp - 0xc]
mov dl, byte [esi]
movsx ecx, dl
mov dword [ebp - 0x1c], esi
cmp ecx, eax
jne 0x4191bf
cmp dword [ebp - 8], 0
jne 0x419219
mov dword [ebp - 8], 1
inc esi
jmp 0x4191a3
movzx eax, dl
test byte [eax + 0x1228d9], 0x10
je 0x419219
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4191dc
cmp dl, 0x30
jne 0x4191dc
inc dword [ebp - 4]
jmp 0x41920c
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1e
jg 0x41920b
test byte [ecx + 0x1228d9], 2
je 0x4191f3
add ecx, 0xffffffd0
jmp 0x4191f9
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x41920c
inc edi
cmp dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
je 0x419216
dec edi
inc esi
jmp 0x4191a3
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
je 0x4192c0
mov eax, dword [ebp - 0x14]
shl edi, 2
mov dword [eax], esi
mov al, byte [esi]
cmp al, 0x70
je 0x419237
cmp al, 0x50
jne 0x419291
mov al, byte [esi + 1]
inc esi
xor ecx, ecx
cmp al, 0x2d
jne 0x41924a
mov dword [ebp - 4], 1
jmp 0x419253
cmp al, 0x2b
mov dword [ebp - 4], ecx
cmovne esi, dword [ebp - 0x1c]
movzx eax, byte [esi + 1]
inc esi
test byte [eax + 0x1228d9], 2
je 0x4192c0
mov dl, byte [esi]
movsx eax, dl
lea ecx, [ecx + ecx*4]
mov dl, byte [esi + 1]
lea ecx, [ecx - 0x18]
inc esi
lea ecx, [eax + ecx*2]
movzx eax, dl
test byte [eax + 0x1228d9], 2
jne 0x419263
mov eax, ecx
neg eax
cmp dword [ebp - 4], 0
cmove eax, ecx
add edi, eax
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
cmp dword [ebp - 0x18], 0
je 0x41929e
xorps xmm1, xmmword [0x131a20]
push edi
sub esp, 8
movsd qword [esp], xmm1
call fcn.004c0a0e
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xorps xmm0, xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x419500
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
mov eax, dword [0x146120]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
mov ebx, edx
lea edx, [esp + 8]
push esi
push edi
mov dword [esp + 0x1c], ebx
mov edi, ecx
call fcn.00419360
mov esi, eax
test esi, esi
je 0x41955f
mov ecx, dword [esp + 0x10]
sub esi, edi
mov dword [ebx], ecx
mov ecx, dword [esp + 0x14]
mov dword [ebx + 4], ecx
mov byte [ebx + 8], 3
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.004b1753
mov esp, ebp
pop ebp
ret
push 0x12c518
push edi
call fcn.004bc240
add esp, 8
test eax, eax
je 0x419593
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x419595
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.004b1753
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push ebx
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.004192d0
mov esi, eax
add esp, 4
test esi, esi
jne 0x419629
push 0x2e
push edi
call fcn.004b3bd0
mov esi, eax
add esp, 8
test esi, esi
je 0x41957c
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4195c0
sub ecx, edx
cmp ecx, 0xc8
ja 0x41957c
lea edx, [esp + 0x20]
mov ecx, edi
sub edx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4195e0
call fcn.004c09e4
sub esi, edi
lea edx, [esp + 0x10]
push ebx
lea ecx, [esp + 0x24]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x24], al
call fcn.004192d0
mov esi, eax
add esp, 4
test esi, esi
je 0x41957c
mov eax, edi
lea ecx, [esp + 0x20]
sub eax, ecx
add esi, eax
test esi, esi
je 0x41957c
mov eax, dword [esp + 0x1c]
sub esi, edi
movsd xmm0, qword [esp + 0x10]
mov ecx, dword [esp + 0xf4]
pop edi
movsd qword [eax], xmm0
mov byte [eax + 8], 0x13
lea eax, [esi + 1]
pop esi
pop ebx
xor ecx, esp
call fcn.004b1753
mov esp, ebp
pop ebp
ret