joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 8], ebx
jb 0x404f5f
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x404f81
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x404f70
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebp - 0x10], eax
cmp edx, ebx
jne 0x404fab
mov eax, ebx
jmp 0x404faf
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x405058
cmp dword [edi + 0x14], 0x10
lea ecx, [esi + 8]
mov edx, edi
jb 0x404fc4
mov edx, dword [edi]
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x404fcf
mov ecx, dword [ecx]
cmp edi, dword [ebp - 8]
jne 0x405030
sub edi, 4
jb 0x404ff1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x404ff6
add ecx, 4
add edx, 4
sub edi, 4
jae 0x404fe0
cmp edi, 0xfffffffc
je 0x40502a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x405023
cmp edi, 0xfffffffd
je 0x40502a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x405023
cmp edi, 0xfffffffe
je 0x40502a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x405023
cmp edi, 0xffffffff
je 0x40502a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x40502a
sbb eax, eax
or eax, 1
jmp 0x40502c
xor eax, eax
test eax, eax
je 0x405040
mov esi, dword [esi]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x404fa3
mov edi, dword [ebp + 0xc]
lea eax, [esi + 8]
push eax
push edi
call fcn.00403a80
test al, al
mov ecx, ebx
cmove ecx, esi
mov eax, ecx
jmp 0x40505c
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x4050b2
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
push ecx
push eax
push ecx
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.00405540
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x2aaaaa9
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x4050c4
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00405120
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.004a5262
int3
Function at 0x405490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x4054ac
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4054c8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4054b7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x405501
cmp eax, edi
jne 0x4054f9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x405509
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x405509
cmp eax, edi
jne 0x405509
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00404d50
push 0x60
push edi
call fcn.004a7e9f
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x405f90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, ecx
movss xmm1, dword [eax]
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jp 0x405fb2
mov dword [ebp + 8], 0
jmp 0x405fb7
movss dword [ebp + 8], xmm1
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul ecx, eax, 0x1000193
mov eax, dword [esi + 0x18]
pop esi
and eax, ecx
pop ebp
ret 4

Function at 0x406c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x600c30
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push esi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov edx, str.click_study
mov ecx, str.paySucc
call fcn.004f2160
add esp, 4
lea ecx, [ebp - 0x58]
call fcn.00403450
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0
mov ecx, dword [0x800f60]
push eax
push ecx
call fcn.00402940
test al, al
je 0x406cbb
push 0x629868
lea ecx, [ebp - 0x10]
call fcn.0041d340
add esp, 4
lea edx, [ebp - 0x10]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00418480
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x18]
mov esi, dword [eax]
call fcn.00418480
push 0xa
push 0
push esi
push dword [eax]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x406cbb
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x406cbb
push ecx
call fcn.004a8172
add esp, 4
lea ecx, [ebp - 0x58]
call fcn.00403500
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409d40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 8], ebx
jb 0x409d5f
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x409d81
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x409d70
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebp - 0x10], eax
cmp edx, ebx
jne 0x409dab
mov eax, ebx
jmp 0x409daf
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x409e58
cmp dword [edi + 0x14], 0x10
lea ecx, [esi + 8]
mov edx, edi
jb 0x409dc4
mov edx, dword [edi]
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x409dcf
mov ecx, dword [ecx]
cmp edi, dword [ebp - 8]
jne 0x409e30
sub edi, 4
jb 0x409df1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x409df6
add ecx, 4
add edx, 4
sub edi, 4
jae 0x409de0
cmp edi, 0xfffffffc
je 0x409e2a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x409e23
cmp edi, 0xfffffffd
je 0x409e2a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x409e23
cmp edi, 0xfffffffe
je 0x409e2a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x409e23
cmp edi, 0xffffffff
je 0x409e2a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x409e2a
sbb eax, eax
or eax, 1
jmp 0x409e2c
xor eax, eax
test eax, eax
je 0x409e40
mov esi, dword [esi]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x409da3
mov edi, dword [ebp + 0xc]
lea eax, [esi + 8]
push eax
push edi
call fcn.00403a80
test al, al
mov ecx, ebx
cmove ecx, esi
mov eax, ecx
jmp 0x409e5c
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x409eb2
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
push ecx
push eax
push ecx
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.0040abc0
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x6666665
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x409ec4
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.0040a510
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.004a5262
int3
Function at 0x40ab20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
jb 0x40ab3a
mov esi, dword [esi]
xor edx, edx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x40ab57
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x40ab46
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
pop edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x40ab91
cmp ecx, eax
jne 0x40ab89
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x40ab99
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x40ab99
cmp ecx, eax
jne 0x40ab99
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.004091a0
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40ea20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60144a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.msgbox_OK
lea ecx, [ebp - 0x10]
call fcn.0041d340
add esp, 4
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004f3360
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x7a1354
je 0x40ea96
mov eax, edi
lock xadd dword [ecx], eax
test eax, eax
jne 0x40ea96
push ecx
call fcn.004a8172
add esp, 4
push 0x348
call fcn.004a7e6f
mov dword [ebp - 0x14], eax
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004fac40
mov esi, eax
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
push 0x583670
mov byte [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
push dword [ebp - 0x14]
mov ecx, esi
call fcn.005f16b0
push 1
push dword [ebx + 8]
mov ecx, esi
push 1
call fcn.005f1410
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff8
cmp eax, 0x7a1354
je 0x40eb00
lock xadd dword [eax], edi
test edi, edi
jne 0x40eb00
push eax
call fcn.004a8172
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 4], 0x801378
mov edi, dword [0x801378]
mov ebx, edi
mov esi, dword [0x80137c]
mov eax, edi
xor ebx, dword [ebp + 8]
mov ecx, esi
xor ecx, dword [ebp + 0xc]
mov edx, esi
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
mov esi, dword [ebp - 8]
cmp edi, eax
jne 0x40f980
cmp esi, edx
jne 0x40f980
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414e40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x601d58
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x7f206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x38], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], edi
mov dword [edi], 0x7a135c
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [ebp - 4], 0
movzx eax, word [esi + 0xa]
mov ecx, eax
mov dword [ebp - 0x14], 0xffffffff
movzx eax, al
and ecx, 0xff00
or cx, ax
setne al
mov byte [edi + 0x30], al
movzx eax, word [esi + 0xe]
mov ecx, eax
movzx eax, al
and ecx, 0xff00
or ecx, eax
movzx eax, word [esi + 0xc]
mov edx, eax
movzx eax, al
and edx, 0xff00
or edx, eax
mov eax, ecx
shr eax, 9
add eax, 0x50
mov dword [ebp - 0x20], eax
mov eax, ecx
shr eax, 5
and ecx, 0x1f
and eax, 0xf
mov dword [ebp - 0x28], ecx
dec eax
mov dword [ebp - 0x24], eax
mov eax, edx
shr eax, 0xb
mov dword [ebp - 0x2c], eax
mov eax, edx
shr eax, 5
and edx, 0x1f
and eax, 0x3f
add edx, edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], edx
call fcn.004c4819
add esp, 4
push 0
push 0x3e8
push edx
push eax
call fcn.004a8d60
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov edx, dword [esi + 0x14]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
or ecx, eax
mov dword [edi + 0x2c], 0
shl ecx, 8
mov eax, edx
and eax, 0xff000000
or ecx, eax
movzx eax, dl
or ecx, eax
mov dword [edi + 0x28], ecx
mov edx, dword [esi + 0x18]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shl ecx, 8
shr eax, 8
movzx eax, al
or ecx, eax
mov dword [edi + 0xc], 0
shl ecx, 8
mov eax, edx
and eax, 0xff000000
or ecx, eax
movzx eax, dl
or ecx, eax
mov dword [edi + 8], ecx
mov edx, dword [esi + 0x2a]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
or ecx, eax
mov dword [edi + 0x24], 0
mov eax, edx
shl ecx, 8
and eax, 0xff000000
or ecx, eax
movzx eax, dl
or ecx, eax
mov dword [edi + 0x20], ecx
mov ecx, dword [esi + 0x26]
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
shl edx, 8
movzx eax, al
or edx, eax
mov eax, ecx
shl edx, 8
and eax, 0xff000000
or edx, eax
movzx eax, cl
or edx, eax
mov dword [edi + 0x1c], edx
and edx, 0xf0000000
cmp edx, 0xa0000000
sete al
mov byte [edi + 0x18], al
add esi, 0x2e
je 0x415030
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x41501d
push esi
lea ecx, [ebp - 0x38]
call fcn.0041d5b0
mov eax, dword [ebp - 0x38]
add esp, 4
jmp 0x415035
jle 0x415030
add eax, esi
lea ecx, [ebp - 0x38]
push eax
push esi
call fcn.00519cd0
mov eax, dword [ebp - 0x38]
jmp 0x415035
mov eax, 0x7a135c
mov ecx, dword [edi]
mov dword [edi], eax
lea eax, [ecx - 8]
cmp eax, 0x7a1354
je 0x415057
or ecx, 0xffffffff
lock xadd dword [eax], ecx
test ecx, ecx
jne 0x415057
push eax
call fcn.004a8172
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret 8
Function at 0x4154d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x7f206c]
xor eax, esp
mov dword [esp + 0x270], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xc], ecx
push edi
mov edi, dword [ebp + 0x1c]
cmp eax, 0xffffffff
jne 0x415542
mov edx, ecx
lea ecx, [esp + 0x24]
call fcn.00418480
lea ecx, [esp + 0x28]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esp + 0x10]
cmp eax, 0xffffffff
mov dword [ecx + 4], eax
jmp 0x415550
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41556b
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x14]
call fcn.0041d400
mov edx, dword [esp + 0x18]
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [edx]
add ecx, 0xfffffff8
mov dword [edx], eax
cmp ecx, 0x7a1354
je 0x4155a7
or eax, 0xffffffff
lock xadd dword [ecx], eax
test eax, eax
jne 0x4155a7
push ecx
call fcn.004a8172
add esp, 4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
test edx, edx
je 0x4155bc
mov eax, ecx
shr eax, 4
and al, 1
mov byte [edx], al
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x4155cc
mov eax, ecx
shr eax, 1
and al, 1
mov byte [edx], al
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4155d9
and cl, 1
mov byte [eax], cl
test esi, esi
je 0x4155ef
mov ecx, dword [esp + 0x44]
xor eax, eax
add eax, dword [esp + 0x48]
mov dword [esi], eax
adc ecx, 0
mov dword [esi + 4], ecx
test ebx, ebx
je 0x415619
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
add ecx, 0x2ac18000
push 0
push 0x2710
adc eax, 0xfe624e21
push eax
push ecx
call fcn.004a8da0
mov dword [ebx], eax
mov dword [ebx + 4], edx
test edi, edi
je 0x415643
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add ecx, 0x2ac18000
push 0
push 0x2710
adc eax, 0xfe624e21
push eax
push ecx
call fcn.004a8da0
mov dword [edi], eax
mov dword [edi + 4], edx
mov ecx, dword [esp + 0x27c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a7e5e
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x415660
Capabilities:
Connect pipe

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x601df8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0xd], 0
jne 0x415785
cmp dword [esi + 4], 0xffffffff
je 0x4156b4
mov al, 1
jmp 0x4157f8
lea ecx, [ebp - 0x30]
call fcn.00528d90
mov edx, dword [ebx + 8]
sub esp, 8
mov ecx, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov ecx, esp
call fcn.00511580
push edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
call fcn.00510670
lea edi, [esi + 0x10]
add esp, 0x10
mov dword [ebp - 0x1c], edi
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [esi + 4], 0xffffffff
jne 0x415721
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.00418480
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
push edi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi + 4], 0xffffffff
jne 0x4156ad
mov al, byte [esi + 0xe]
test al, al
jne 0x415781
cmp dword [ebx + 8], 0
jl 0x41575f
lea ecx, [ebp - 0x38]
call fcn.00528d90
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 0x24]
jg 0x415781
jl 0x41575f
cmp ecx, dword [ebp - 0x28]
ja 0x415781
mov eax, dword [0x800fec]
push 1
test eax, eax
jne 0x415775
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4156e6
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4156e6
xor al, al
jmp 0x4157f8
mov al, byte [esi + 0xc]
test al, al
jne 0x4157f8
push 0
push 0
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
push 0
movups xmmword [ebp - 0x4c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4157ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x217
je 0x4157e8
sub eax, 1
je 0x4157d5
sub eax, 0x1cd
jne 0x4157ec
push dword [ebx + 8]
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.00415830
mov byte [esi + 0xc], al
jmp 0x4157ec
mov byte [esi + 0xc], 1
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esi + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x415e80
Capabilities:
Create http request
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x601ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x7f206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x801344]
cmp eax, dword [edx + 4]
jg 0x41601e
mov eax, dword [ebx + 0x40]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebx + 0x40], 0
test eax, eax
je 0x415eda
push eax
call esi
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x415eeb
push eax
call esi
mov dword [ebx + 0x3c], 0
cmp dword [0x8013c4], 0
je 0x41600a
push 0x20000
call fcn.004c2f64
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
push 0x1000
mov dword [ebp - 4], 0
call fcn.004c2f64
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
push 0x800
call fcn.004c2f64
add esp, 4
mov dword [ebp - 0x10], eax
push 0x800
call fcn.004c2f64
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
xorps xmm0, xmm0
cmp byte [ebx + 0x5a], 0
mov eax, dword [ebp - 0x10]
movlpd qword [ebp - 0x58], xmm0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x44], 0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x10000
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 0x800
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x400
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 0x400
je 0x415fb1
movzx eax, byte [ebx + 0x59]
lea ecx, [ebx + 8]
push eax
lea eax, [ebx + 0x48]
push eax
lea eax, [ebx + 0x44]
push eax
call fcn.004fd030
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.00418480
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push dword [eax]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x415fe2
push dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
push dword [ebp + 8]
push ecx
push eax
mov ecx, ebx
call fcn.00416070
push dword [ebp - 0x14]
call fcn.004c2bdc
add esp, 4
push dword [ebp - 0x10]
call fcn.004c2bdc
add esp, 4
push edi
call fcn.004c2bdc
add esp, 4
push esi
call fcn.004c2bdc
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x801344
call fcn.004a8317
add esp, 4
cmp dword [0x801344], 0xffffffff
jne 0x415ec3
push 0
push 0
push 0
push 0
push str.juce
call dword [sym.imp.WININET.dll_InternetOpenW]
push 0x801344
mov dword [0x8013c4], eax
call fcn.004a82cd
add esp, 4
jmp 0x415ec3
Function at 0x416340
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ecx + 8]
push ebx
push esi
mov esi, dword [ecx + 4]
mov ebx, dword [eax]
lea eax, [ebp - 0xc]
push edi
mov edi, dword [ecx]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], ecx
push eax
push 0x1f
push dword [edi + 0x40]
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [ebp - 4], 0x3180
lea eax, [ebp - 4]
push 4
push eax
push 0x1f
push dword [edi + 0x40]
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 8
push 0
push esi
push dword [edi + 0x40]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
je 0x416401
mov eax, dword [edi + 0x4c]
xor esi, esi
test eax, eax
jle 0x416401
nop dword [eax]
sub eax, esi
mov dword [ebp - 8], 0
mov ecx, 0x400
cmp eax, ecx
cmovl ecx, eax
test ecx, ecx
je 0x416401
mov eax, dword [edi + 0x48]
lea edx, [ebp - 8]
push edx
push ecx
add eax, esi
push eax
push dword [edi + 0x40]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x416401
add esi, dword [ebp - 8]
test ebx, ebx
je 0x4163fa
push dword [edi + 0x4c]
mov eax, dword [ebx]
mov ecx, ebx
push esi
push dword [edi + 4]
mov eax, dword [eax + 4]
call eax
test al, al
je 0x416401
mov eax, dword [edi + 0x4c]
cmp esi, eax
jl 0x4163b0
mov eax, dword [ebp - 0x10]
push 0
push 0
push 0
mov eax, dword [eax]
push dword [eax + 0x40]
call dword [sym.imp.WININET.dll_HttpEndRequestW]
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret