joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4145e3
Capabilities:
Check if file exists

Disassembly:
push 0x22c
mov eax, 0x5d9e44
call fcn.00593b07
mov esi, ecx
mov dword [ebp - 0x238], esi
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov dword [ebp - 0x238], esi
mov edi, 0x6e5738
mov ecx, dword [eax]
mov eax, dword [0x6e5734]
cmp eax, dword [ecx + 4]
jg 0x414760
push 0x62a4ac
mov ecx, edi
call fcn.0041084d
test al, al
jne 0x414643
push edi
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0040b155
jmp 0x414758
mov edi, 0x62a4ac
lea ecx, [ebp - 0x234]
push edi
call fcn.0040b0d5
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
push str.UninstallString
mov edx, 0x61f2f0
mov ecx, reloc.WS2_32.dll_accept
call fcn.00425d08
pop ecx
pop ecx
test eax, eax
jne 0x414689
push edi
mov ecx, esi
call fcn.0040b0d5
jmp 0x41474d
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.005aa3d0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x234]
add esp, 0xc
cmp dword [ebp - 0x220], 8
cmovae eax, dword [ebp - 0x234]
push eax
lea eax, [ebp - 0x21c]
push eax
call edi
push str.......
lea eax, [ebp - 0x21c]
push eax
call edi
push str.components_sesvc_
lea eax, [ebp - 0x21c]
push eax
call edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41471e
push 0x104
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.....
lea eax, [ebp - 0x21c]
push eax
call edi
push str.sesvc_
lea eax, [ebp - 0x21c]
push eax
call edi
lea eax, [ebp - 0x21c]
push eax
call fcn.005baec0
pop ecx
push eax
lea eax, [ebp - 0x21c]
mov edi, 0x6e5738
push eax
mov ecx, edi
call fcn.0040b566
push edi
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.0040b155
lea ecx, [ebp - 0x234]
call fcn.0040b67e
mov eax, esi
call fcn.00593ab1
ret
push 0x6e5734
call fcn.00592d84
cmp dword [0x6e5734], 0xffffffff
pop ecx
jne 0x414620
push 0x62a4ac
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0040b0d5
push 0x5f4196
call fcn.00592bcf
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x6e5734
call fcn.00592d3a
pop ecx
jmp 0x414620
Function at 0x4148f2
Capabilities:
Check if file exists

Disassembly:
push 0x3c
mov eax, 0x5d9ee5
call fcn.00593b07
xor ebx, ebx
mov edi, reloc.WS2_32.dll_accept
inc ebx
cmp byte [0x6e4dea], 0
jne 0x414938
mov byte [0x6e4dea], bl
call fcn.00414dfd
test al, al
je 0x414938
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push str.wscore
mov edx, str.Software360360huabaocoreusers
mov ecx, edi
call fcn.00426057
pop ecx
pop ecx
xor esi, esi
call fcn.00414dfd
test al, al
jne 0x414961
push 0xd3
push str.huabao_core::IsWeishiCoreModel
push str.__s__d___IsHb360SafeSeCoreModel_CheckSafeDesktopRestSupportedNew_return_false
call fcn.0040a649
add esp, 0xc
xor eax, eax
jmp 0x414a49
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], esi
push eax
push str.install_model
mov edx, str.Software360360huabao
mov ecx, edi
call fcn.00425cdd
cmp dword [ebp - 0x48], 2
pop ecx
pop ecx
jne 0x414a47
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], esi
push eax
push str.wscore
mov edx, str.Software360360huabaocoreusers
mov ecx, edi
call fcn.00425cdd
pop ecx
pop ecx
cmp dword [ebp - 0x44], ebx
jne 0x414a47
lea ecx, [ebp - 0x28]
call fcn.004143ba
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0
je 0x414a3f
mov edi, 0x62b0fc
push edi
call fcn.005baec0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414a3f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x414a3f
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.00426e0a
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
mov edx, str.2.0.0.0
cmovae ecx, dword [ebp - 0x40]
call fcn.004270e4
test eax, eax
lea ecx, [ebp - 0x40]
cmovns esi, ebx
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
mov eax, esi
call fcn.00593ab1
ret

Function at 0x414a4f
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.005aa3d0
add esp, 0xc
lea ecx, [ebp - 0x228]
call fcn.004251b3
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmovae eax, dword [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
push str.360DesktopLiteDTFenceConfig.ini
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414acc
xor esi, esi
inc esi
jmp 0x414aed
lea eax, [ebp - 0x210]
push eax
push 0
push str.EyeRest
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
lea ecx, [ebp - 0x228]
call fcn.0040b67e
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.005926d8
leave
ret
Function at 0x414b07
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x5d9f22
call fcn.00593b07
push 0x62abf0
lea ecx, [ebp - 0x58]
call fcn.0040b0d5
xor esi, esi
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.0041422d
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0040b67e
push str.360secore.exe
lea ecx, [ebp - 0x70]
call fcn.0040b0d5
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.0041422d
lea ecx, [ebp - 0x70]
call fcn.0040b67e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414b8d
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414b8d
inc esi
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x40]
call fcn.0040b67e
mov eax, esi
call fcn.00593ab1
ret

Function at 0x414ca6
Capabilities:
Check if file exists

Disassembly:
push 0x22c
mov eax, 0x5d9f5d
call fcn.00593b07
mov edx, str.UtilsDesktopRestDesktopRest.exe
lea ecx, [ebp - 0x238]
call fcn.0043746a
xor ebx, ebx
mov ecx, eax
push ebx
mov dword [ebp - 4], ebx
call fcn.00413c42
push eax
lea ecx, [ebp - 0x234]
call fcn.0040b0d5
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 2
call fcn.0040a4ed
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
mov esi, str.huabao_core::CheckSafeDesktopRestSupported
cmovae eax, dword [ebp - 0x234]
push eax
push 0x140
push esi
push str.__s__d___HealthMgr::CheckSafeDesktopRestSupported_strPath___s
call fcn.0040a649
add esp, 0x10
lea eax, [ebp - 0x234]
cmp dword [ebp - 0x220], 8
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414dd7
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.005aa3d0
add esp, 0xc
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x220], 8
lea edx, [ebp - 0x21c]
cmovae ecx, dword [ebp - 0x234]
push 0x103
call fcn.0041e401
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
pop ecx
cmovae eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x21c]
push ecx
push eax
push 0x145
push esi
push str.__s__d___HealthMgr::CheckSafeDesktopRestSupported_strPath_s__szVer_s
call fcn.0040a649
add esp, 0x14
lea ecx, [ebp - 0x21c]
mov edx, str.12.0.1000.0
call fcn.004270e4
test eax, eax
js 0x414dd7
call fcn.004147f1
test eax, eax
jne 0x414dd7
push 0x147
push esi
push str.__s__d___HealthMgr::CheckSafeDesktopRestSupported_return_true
call fcn.0040a649
mov bl, 1
jmp 0x414de7
push 0x14b
push esi
push str.__s__d___HealthMgr::CheckSafeDesktopRestSupported_return_false
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.0040b67e
mov al, bl
call fcn.00593ab1
ret
Function at 0x414dfd
Capabilities:
Check if file exists

Disassembly:
push 0x22c
mov eax, 0x5d9f5d
call fcn.00593b07
mov edx, str.UtilsDesktopRestDesktopRest.exe
lea ecx, [ebp - 0x238]
call fcn.0043746a
xor ebx, ebx
mov ecx, eax
push ebx
mov dword [ebp - 4], ebx
call fcn.00413c42
push eax
lea ecx, [ebp - 0x234]
call fcn.0040b0d5
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 2
call fcn.0040a4ed
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
mov esi, str.huabao_core::CheckSafeDesktopRestSupportedNew
cmovae eax, dword [ebp - 0x234]
push eax
push 0x151
push esi
push str.__s__d___HealthMgr::CheckSafeDesktopRestSupportedNew_strPath___s
call fcn.0040a649
add esp, 0x10
lea eax, [ebp - 0x234]
cmp dword [ebp - 0x220], 8
cmovae eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414f2e
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.005aa3d0
add esp, 0xc
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x220], 8
lea edx, [ebp - 0x21c]
cmovae ecx, dword [ebp - 0x234]
push 0x103
call fcn.0041e401
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
pop ecx
cmovae eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x21c]
push ecx
push eax
push 0x156
push esi
push str.__s__d___HealthMgr::CheckSafeDesktopRestSupportedNew_strPath_s__szVer_s
call fcn.0040a649
add esp, 0x14
lea ecx, [ebp - 0x21c]
mov edx, str.13.0.1001.0
call fcn.004270e4
test eax, eax
js 0x414f2e
call fcn.004147f1
test eax, eax
jne 0x414f2e
push 0x158
push esi
push str.__s__d___HealthMgr::CheckSafeDesktopRestSupportedNew_return_true
call fcn.0040a649
mov bl, 1
jmp 0x414f3e
push 0x15c
push esi
push str.__s__d___HealthMgr::CheckSafeDesktopRestSupportedNew_return_false
call fcn.0040a649
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.0040b67e
mov al, bl
call fcn.00593ab1
ret
Function at 0x414f54
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x5d9f9d
call fcn.00593b07
lea eax, [ebp - 0x5c]
mov edi, reloc.WS2_32.dll_accept
push eax
xor esi, esi
mov edx, str.Software360360huabaocoreusers
push str.wscore
mov ecx, edi
mov dword [ebp - 0x5c], esi
call fcn.00425cdd
xor ebx, ebx
pop ecx
inc ebx
cmp byte [0x6e4de9], 0
pop ecx
jne 0x414fd2
mov byte [0x6e4de9], bl
call fcn.00414ca6
test al, al
je 0x414fd2
cmp dword [ebp - 0x5c], ebx
je 0x414fd2
push 0x167
push str.huabao_core::IsHb360SafeSeCoreModel
push str.__s__d___IsHb360SafeSeCoreModel_CheckSafeDesktopRestSupported_write_user
call fcn.0040a649
add esp, 0xc
mov dword [ebp - 0x68], ebx
lea eax, [ebp - 0x68]
mov edx, str.Software360360huabaocoreusers
mov ecx, edi
push eax
push str.360safe
call fcn.00426057
pop ecx
pop ecx
call fcn.00414ca6
test al, al
je 0x41511b
cmp dword [ebp - 0x5c], ebx
je 0x41511b
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], esi
push eax
push str.install_model
mov edx, str.Software360360huabao
mov ecx, edi
call fcn.00425cdd
cmp dword [ebp - 0x60], 2
pop ecx
pop ecx
jne 0x415117
push 0x62a4ac
lea ecx, [ebp - 0x58]
call fcn.0040b0d5
lea eax, [ebp - 0x58]
mov dword [ebp - 4], esi
push eax
push 0x62a5b4
mov edx, str.Software360360huabao
mov ecx, edi
call fcn.00425d08
pop ecx
pop ecx
test eax, eax
je 0x41510f
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], esi
push eax
push str.360safe
mov edx, str.Software360360huabaocoreusers
mov ecx, edi
call fcn.00425cdd
pop ecx
pop ecx
push str.360safe
lea ecx, [ebp - 0x58]
call fcn.0041084d
test al, al
jne 0x41506f
cmp dword [ebp - 0x64], ebx
jne 0x41510f
lea ecx, [ebp - 0x28]
call fcn.004143ba
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 0
je 0x415107
mov edi, 0x62b0fc
push edi
call fcn.005baec0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415107
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x415107
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00426e0a
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
mov edx, str.2.0.0.0
cmovae ecx, dword [ebp - 0x40]
call fcn.004270e4
test eax, eax
lea ecx, [ebp - 0x40]
cmovns esi, ebx
call fcn.0040b67e
lea ecx, [ebp - 0x28]
call fcn.0040b67e
lea ecx, [ebp - 0x58]
call fcn.0040b67e
mov eax, esi
jmp 0x415134
push 0x16e
push str.huabao_core::IsHb360SafeSeCoreModel
push str.__s__d___IsHb360SafeSeCoreModel_CheckSafeDesktopRestSupported_return_false
call fcn.0040a649
add esp, 0xc
xor eax, eax
call fcn.00593ab1
ret
Function at 0x41513a
Capabilities:
Check if file exists

Disassembly:
push 0x3c
mov eax, 0x5d9fd2
call fcn.00593b07
lea eax, [ebp - 0x48]
xor esi, esi
push eax
push str.install_model
mov edx, str.Software360360huabao
mov dword [ebp - 0x48], esi
mov ecx, reloc.WS2_32.dll_accept
call fcn.00425cdd
cmp dword [ebp - 0x48], 2
pop ecx
pop ecx
jne 0x415210
lea ecx, [ebp - 0x2c]
call fcn.004143ba
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], esi
je 0x415208
mov edi, 0x62b0fc
push edi
call fcn.005baec0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040b220
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415208
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004302c7
pop ecx
test eax, eax
je 0x415208
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
xor ebx, ebx
lea edx, [ebp - 0x44]
inc ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00426e0a
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
mov edx, str.2.0.0.0
cmovae ecx, dword [ebp - 0x44]
call fcn.004270e4
test eax, eax
lea ecx, [ebp - 0x44]
cmovns esi, ebx
call fcn.0040b67e
lea ecx, [ebp - 0x2c]
call fcn.0040b67e
mov eax, esi
call fcn.00593ab1
ret

Function at 0x4161d5
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
mov eax, dword [0x6c75ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], ebx
movzx ecx, byte [edx + str.80_]
mov eax, ecx
and ecx, 7
shr eax, 3
mov al, byte [eax + esi]
test byte [ecx*2 + 0x61fb80], al
setne al
mov byte [ebp + edx - 0x3c], al
inc edx
cmp edx, 0x38
jl 0x4161ff
push 0x1e
xor edi, edi
pop esi
cmp ebx, 1
lea eax, [edi + edi]
mov edx, esi
cmovne edx, eax
movzx eax, byte [edi + 0x61f620]
and dword [ebp + edx*4 - 0xf0], 0
and dword [ebp + edx*4 - 0xf4], 0
xor ecx, ecx
cmp eax, 0x1c
jge 0x416259
mov bl, byte [ebp + eax - 0x3c]
jmp 0x41625d
mov bl, byte [ebp + eax - 0x58]
mov byte [ebp + ecx - 0x74], bl
inc ecx
inc eax
cmp ecx, 0x1c
jl 0x41624e
movzx eax, byte [edi + 0x61f620]
push 0x1c
pop ecx
add eax, ecx
cmp eax, 0x38
jge 0x41627f
mov bl, byte [ebp + eax - 0x3c]
jmp 0x416283
mov bl, byte [ebp + eax - 0x58]
mov byte [ebp + ecx - 0x74], bl
inc ecx
inc eax
cmp ecx, 0x38
jl 0x416274
xor ecx, ecx
movzx eax, byte [ecx + 0x61f390]
cmp byte [ebp + eax - 0x74], 0
je 0x4162ac
mov eax, dword [ecx*4 + 0x61f5c0]
or dword [ebp + edx*4 - 0xf4], eax
movzx eax, byte [ecx + 0x61f3a8]
cmp byte [ebp + eax - 0x74], 0
je 0x4162c8
mov eax, dword [ecx*4 + 0x61f5c0]
or dword [ebp + edx*4 - 0xf0], eax
inc ecx
cmp ecx, 0x18
jl 0x416290
mov ebx, dword [ebp - 0xf8]
sub esi, 2
inc edi
cmp esi, 0xfffffffe
jg 0x41622a
mov ecx, dword [ebp - 0xfc]
lea eax, [ebp - 0xf4]
push eax
call fcn.00416304
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005926d8
leave
ret 8
Function at 0x41649b
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
shr eax, 4
xor eax, ecx
mov dword [ebp - 4], 8
and eax, 0xf0f0f0f
xor ecx, eax
shl eax, 4
xor edx, eax
mov eax, edx
shr eax, 0x10
xor eax, ecx
movzx eax, ax
xor ecx, eax
shl eax, 0x10
xor edx, eax
mov eax, ecx
shr eax, 2
xor eax, edx
and eax, 0x33333333
xor edx, eax
shl eax, 2
xor ecx, eax
mov edi, ecx
shr edi, 8
xor edi, edx
and edi, 0xff00ff
xor edx, edi
shl edi, 8
xor edi, ecx
rol edi, 1
mov ebx, edi
xor ebx, edx
and ebx, 0xaaaaaaaa
xor edi, ebx
xor ebx, edx
rol ebx, 1
mov eax, dword [ebp + 0xc]
mov edx, edi
ror edx, 4
xor edx, dword [eax]
add eax, 4
mov dword [ebp + 0xc], eax
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x61f630]
or esi, dword [eax*4 + 0x61f780]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x61f4c0]
or esi, dword [edx*4 + 0x61fa80]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
add eax, 4
mov dword [ebp + 0xc], eax
xor edx, edi
mov ecx, edx
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
and eax, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x61f880]
or ecx, dword [eax*4 + 0x61fb90]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x61f3c0]
or ecx, dword [edx*4 + 0x61f980]
mov eax, dword [ebp + 0xc]
or ecx, esi
xor ebx, ecx
mov edx, ebx
ror edx, 4
xor edx, dword [eax]
add eax, 4
mov dword [ebp + 0xc], eax
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
and ecx, 0x3f
and eax, 0x3f
mov esi, dword [ecx*4 + 0x61f630]
or esi, dword [eax*4 + 0x61f780]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or esi, dword [eax*4 + 0x61f4c0]
mov eax, dword [ebp + 0xc]
or esi, dword [edx*4 + 0x61fa80]
mov edx, dword [eax]
add eax, 4
xor edx, ebx
mov dword [ebp + 0xc], eax
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x61f880]
or ecx, dword [eax*4 + 0x61fb90]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
or ecx, dword [eax*4 + 0x61f3c0]
or ecx, dword [edx*4 + 0x61f980]
or ecx, esi
xor edi, ecx
sub dword [ebp - 4], 1
jne 0x41650e
ror edi, 1
mov edx, edi
mov esi, dword [ebp + 8]
xor edx, ebx
and edx, 0xaaaaaaaa
xor edi, edx
xor edx, ebx
ror edx, 1
mov eax, edx
shr eax, 8
xor eax, edi
and eax, 0xff00ff
xor edi, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, edi
and eax, 0x33333333
xor edi, eax
shl eax, 2
xor edx, eax
mov eax, edi
shr eax, 0x10
xor eax, edx
movzx eax, ax
xor edx, eax
shl eax, 0x10
xor edi, eax
mov ecx, edi
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
mov eax, ecx
shl eax, 4
xor eax, edi
xor ecx, edx
pop edi
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
pop ebx
leave
ret 8
Function at 0x416e86
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
lea eax, [ebp - 0x3c]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.005aa3d0
push 0x2454
push 0
push edi
call fcn.005aa3d0
lea eax, [edi + 8]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], eax
add esp, 0x18
lea eax, [edi + 0x2148]
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x2c], eax
mov ecx, 0x800
lea eax, [edi + 0x48]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x1048]
mov dword [ebp - 8], eax
lea eax, [edi + 0x2348]
mov dword [ebp - 0x20], eax
lea eax, [edi + 0x2048]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, 0x80
push esi
mov dword [ebp - 0x28], 0x100
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
call fcn.005baec0
pop ecx
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x416f59
mov edx, dword [ebp - 0x30]
xor eax, eax
inc eax
cmp edx, 3
je 0x416f38
cmp edx, 4
je 0x416f38
cmp edx, eax
jne 0x416f59
mov cx, word [ebp - 0x24]
and dword [edi + 0x2448], 0
and dword [edi + 0x244c], 0
or dword [edi + 0x2450], 0xffffffff
mov word [edi], cx
mov dword [edi + 4], edx
jmp 0x416f5b
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x416f5f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xc], ebx
jne 0x416ff7
push edi
lea eax, [esi + 0x5d530]
push 0x62cc84
push eax
call fcn.005ab20b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x416fac
xor eax, eax
push 0x62cc84
mov word [edi], ax
call fcn.005baec0
lea eax, [edi + eax*2]
push eax
call fcn.005ba885
pop ecx
pop ecx
mov dword [esi + 0x2694], eax
mov ecx, esi
call fcn.0041a38b
pop edi
test eax, eax
je 0x416ff7
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2464], eax
test eax, eax
je 0x416ff2
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push esi
push 0x4172ad
push ebx
push ebx
mov dword [esi + 0x5d0f8], 8
call fcn.005bb02f
add esp, 0x18
mov dword [esi + 0xc], eax
xor eax, eax
inc eax
jmp 0x416ff9
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x417c90
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
inc ebx
mov eax, dword [edi + 0x26d8]
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 2
cmp dword [eax + 4], ebx
je 0x417d05
cmp dword [edi + 0x2480], 0
je 0x417cf2
push dword [esi + 0xc]
and dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2484]
push dword [edi + 0x2480]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x417cf6
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, ebx
jmp 0x417d29
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x417d27
jmp 0x417cf2
cmp dword [esi], 0
jne 0x417d16
mov eax, dword [esi + 4]
test eax, eax
je 0x417d16
mov dword [esi + 0x18], eax
jmp 0x417cf2
and dword [esi + 0x28], 0
push ebx
push ecx
mov ecx, edi
call fcn.00418f61
test eax, eax
jne 0x417cf2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4