joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f4d0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x51f51d
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x51f52d
mov dword [esi + 4], 0
jmp 0x51f53f
cmp eax, 0x103
je 0x51f55b
test eax, eax
js 0x51f548
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x59d1c4
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.00517020
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00517180
mov ecx, 7
int 0x29
ud2

Function at 0x522bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x5a1090]
test eax, eax
je 0x522bf8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x522c0e
cmp dword [eax + 4], 0
mov edi, eax
je 0x522c0e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5a1090
call fcn.005380e0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x522be8
mov eax, dword [0x5a1090]
test eax, eax
je 0x522cc2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x522cdc
mov esi, eax
test eax, eax
jne 0x522c89
movzx eax, byte [0x5a11e8]
mov eax, dword [0x5a1188]
test eax, eax
jne 0x522c55
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x522cef
mov dword [0x5a1188], eax
push 0xc
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x522cef
mov dword [eax], 0x5a1090
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5a1090]
test eax, eax
je 0x522ce3
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x522bf3
test ecx, ecx
je 0x522bf3
lock dec dword [ecx]
jne 0x522bf3
call fcn.0040e250
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5a1090
call fcn.005380e0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x522c2c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5a1090
call fcn.005380e0
jmp 0x522c81
mov ecx, 4
mov edx, 0xc
call fcn.00531970
int3
Function at 0x523c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x52e860
mov esi, edx
mov edi, ecx
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x5a11e8]
mov eax, dword [0x5a1188]
test eax, eax
jne 0x523cb3
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x523d6e
mov dword [0x5a1188], eax
push 8
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x523d6e
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x523e00
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x523cf5
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x523d5d
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x523d42
cmp dword [eax + 8], 9
jae 0x523d2d
mov eax, dword [ebp - 0x20]
jmp 0x523d33
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x5a1188]
call dword [sym.imp.kernel32.dll_HeapFree]
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.00531970
ud2
Function at 0x524020
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x52e890
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x52409e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x59d3c4
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x59d3f0
mov dword [esi + 0x2c], fcn.0051e370
mov dword [esi + 0x3c], 1
call fcn.00532c10
ud2
Function at 0x527100
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x5a10a0]
test eax, eax
je 0x5271fb
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x527131
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x5271f6
mov eax, dword [0x5a10a0]
test eax, eax
je 0x52721a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x527234
mov esi, eax
test eax, eax
jne 0x5271b7
movzx eax, byte [0x5a11e8]
mov eax, dword [0x5a1188]
test eax, eax
jne 0x527178
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x52724d
mov dword [0x5a1188], eax
push 0x20
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x52724d
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x5a10a0
mov esi, eax
mov eax, dword [0x5a10a0]
test eax, eax
je 0x52723e
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x5271d7
movaps xmm0, xmmword [esp]
jmp 0x5271e5
lea ecx, [esp + 0x10]
call fcn.00524020
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x527236
mov ecx, 0x5a10a0
call fcn.005380e0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x527124
jmp 0x527131
mov ecx, 0x5a10a0
call fcn.005380e0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x52714f
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x5a10a0
call fcn.005380e0
jmp 0x5271af
mov ecx, 8
mov edx, 0x20
call fcn.00531970
int3
Function at 0x5291a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1018
call fcn.0052eac0
mov eax, dword [edx]
mov ebx, dword [edx + 4]
mov esi, ecx
mov dword [esp + 8], edx
lea edi, [esp + 0x18]
mov ebp, dword [eax]
mov dword [esp + 4], 0x800
push 0x1000
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push 0
push 0
push 0
push 0
push eax
push edi
push ebx
push ebp
call sub.advapi32.dll_RegEnumKeyExW
cmp eax, 0xc0000425
je 0x52922f
cmp eax, 0x103
je 0x52922f
test eax, eax
jne 0x529237
mov eax, dword [esp + 4]
cmp eax, 0x801
jae 0x529286
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push eax
call fcn.00448610
add esp, 4
mov ecx, dword [esp + 0xc]
cmp ecx, 0x80000000
jne 0x529240
mov eax, 9
xor edx, edx
jmp 0x52925b
mov dword [esi], 0x80000001
jmp 0x52927b
mov ecx, 0x80000000
xor edx, edx
jmp 0x52925b
movzx eax, word [esp + 0x11]
movzx edx, byte [esp + 0x10]
mov word [esp], ax
movzx eax, byte [esp + 0x13]
mov byte [esp + 2], al
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 8]
inc ebx
mov dword [esi], ecx
mov byte [esi + 4], dl
movzx edx, byte [esp + 2]
mov dword [edi + 4], ebx
movzx edi, word [esp]
mov byte [esi + 7], dl
mov word [esi + 5], di
mov dword [esi + 8], eax
add esp, 0x1018
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, eax
mov edx, 0x800
push 0x59e308
call fcn.00532d00
int3
Function at 0x52f0c1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x52f100
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52f100
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52f100
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x52f100
cmp dword [ecx + 0x74], 0xe
jbe 0x52f100
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x537000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebp, dword [edx]
mov esi, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
lea edi, [ebp - 1]
cmp edi, 2
jae 0x53702d
cmp dword [edx + 0xc], esi
jbe 0x53709c
mov edx, dword [edx + 8]
cmp byte [edx + esi], 0xc0
setge dl
jmp 0x53709f
mov dword [esp], ecx
mov ecx, dword [edx + 4]
mov edi, dword [edx + 8]
mov ebx, dword [edx + 0x10]
mov dword [esp + 4], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 8], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x14], ecx
mov ecx, dword [edx + 0x14]
movzx edx, byte [edx + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x5c], edi
mov dword [esp + 0x48], ebp
mov ebp, ecx
mov ecx, dword [esp + 4]
cmp ebp, edi
mov dword [esp + 0x4c], ecx
mov byte [esp + 0x60], dl
jae 0x5370b3
mov edx, dword [esp + 0x7c]
cmp ebp, esi
jbe 0x537149
mov ecx, dword [esp + 8]
cmp byte [ecx + esi], 0xbf
jg 0x53714b
jmp 0x53716b
sete dl
movzx edx, dl
mov dword [ecx], edx
mov edx, dword [esp + 0x7c]
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x537163
mov edx, dword [esp + 0x7c]
lea ecx, [edi + 1]
mov dword [esp + 4], ecx
cmp esi, ebp
jae 0x5370e0
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, dword [esp + 8]
cmp byte [ecx + esi], 0xc0
jl 0x5370e2
jmp 0x53714b
je 0x53714b
inc ebx
je 0x53716e
cmp dword [esp + 4], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
jb 0x53718a
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x20]
lea eax, [esp + 0x48]
mov dword [esp + 0x58], ebx
push eax
push dword [esp + 0x8c]
call fcn.00484670
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp ecx, 1
jne 0x537137
mov edx, dword [esp + 0x28]
mov esi, edx
cmp esi, ebp
jae 0x5370e0
jmp 0x5370d0
cmp ecx, 2
jne 0x53715c
mov ecx, dword [esp]
mov dword [ecx + 4], eax
mov eax, 2
jmp 0x537161
jne 0x53716b
mov ecx, dword [esp]
mov dword [ecx], 1
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x537163
mov ecx, dword [esp]
xor eax, eax
mov dword [ecx], eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
inc ebx
jne 0x537182
mov ecx, 0x59e39c
mov edx, 0x2b
push 0x54f75c
call fcn.00532d60
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
lea eax, [esp + 0xc]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], 0x54b7e4
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x447870
mov dword [esp + 0x40], edx
lea ecx, [esp + 0x20]
mov edx, 0x54f7d4
mov dword [esp + 0x44], 0x453930
mov dword [esp + 0x2c], 2
call fcn.00532c10
int3
Function at 0x5371f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, dword [edx]
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
lea edi, [esi - 1]
cmp edi, 2
jae 0x537228
cmp dword [edx + 0xc], ebx
jbe 0x537313
mov edx, dword [edx + 8]
cmp byte [edx + ebx], 0xc0
setge dl
jmp 0x537316
mov dword [esp + 0xc], ebp
mov ebp, dword [edx + 0x10]
mov edi, dword [edx + 8]
mov dword [esp], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x18], ebp
mov dword [esp + 4], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x50], edi
mov dword [esp + 8], edi
mov ebp, dword [edx + 0x14]
movzx edx, byte [edx + 0x18]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x48], esi
mov esi, dword [esp + 4]
mov dword [esp + 4], ecx
mov dword [esp + 0x4c], esi
mov byte [esp + 0x60], dl
lea edx, [ebp - 1]
cmp edx, ecx
jbe 0x5372a0
cmp ecx, ebx
jbe 0x537326
mov ecx, dword [esp + 8]
cmp byte [ecx + ebx], 0xbf
jg 0x537328
jmp 0x537340
cmp ebx, ecx
jae 0x5372b0
mov ecx, dword [esp + 8]
cmp byte [ecx + ebx], 0xc0
jl 0x5372b2
jmp 0x537328
je 0x537328
xor ebx, ebx
test ebp, ebp
je 0x5373c1
lea esi, [ebp - 1]
cmp ebp, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
jb 0x537351
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x20]
lea eax, [esp + 0x48]
mov dword [esp + 0x5c], esi
push eax
push dword [esp + 0x8c]
call fcn.00487c70
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp ecx, 1
jne 0x5373af
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 4]
mov ebp, esi
mov dword [esp + 0xc], ebx
jmp 0x5372a0
sete dl
movzx edx, dl
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebp
jmp 0x5373c6
jne 0x537340
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [ecx], 1
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x5373c6
mov ecx, dword [esp]
xor ebx, ebx
test ebp, ebp
je 0x5373c4
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
mov eax, dword [esp + 4]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], 0x54b7e4
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x3c], 0x447870
mov dword [esp + 0x40], edx
mov edx, 0x54f7d4
mov dword [esp + 0x44], 0x453930
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], 2
mov dword [esp + 0x1c], eax
call fcn.00532c10
cmp ecx, 2
mov ecx, dword [esp]
jne 0x5373c4
mov dword [ecx + 4], eax
mov ebx, 2
jmp 0x5373c4
mov ecx, dword [esp]
mov dword [ecx], ebx
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5380e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x538151
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x538188
cmp dword [esp + 4], 0
je 0x53816f
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x53819b
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x5a1190]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x5a1190], esi
jne 0x538130
mov byte [0x5a118c], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x53817f
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x5381dc
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x538173
mov edi, dword [esp]
jmp 0x53817f
mov edi, dword [esi]
jmp 0x53817e
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00538210
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x59d73c
mov dword [esp + 8], 0x59d704
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str.NoneSome_usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_wmi_0.11.5_src_connection.rs
mov dword [esp + 0x14], 0
call fcn.00532c10
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x59d704
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str.NoneSome_usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_wmi_0.11.5_src_connection.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00538240
int3
Function at 0x402300
Capabilities:
Delete file
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
movaps xmm0, xmmword [0x664d50]
xor ecx, ecx
movups xmmword [esp + 0x18], xmm0
push esi
movaps xmm0, xmmword [0x664cc0]
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x3c], 0x41545145
mov dword [esp + 0x40], 0x67453a50
mov dword [esp + 0x44], 0x6c6d7a
nop dword [eax]
mov al, byte [esp + 0x1c]
xor byte [esp + ecx + 0x1d], al
inc ecx
cmp ecx, 0x2a
jb 0x402340
mov esi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
lea eax, [esp + 0x1d]
push eax
mov byte [esp + 0x4b], 0
call esi
movaps xmm0, xmmword [0x664bf0]
xor ecx, ecx
movups xmmword [esp + 0x1c], xmm0
movaps xmm0, xmmword [0x664c60]
movups xmmword [esp + 0x2c], xmm0
movaps xmm0, xmmword [str.362X_]
movups xmmword [esp + 0x3c], xmm0
mov al, byte [esp + 0x1c]
xor byte [esp + ecx + 0x1d], al
inc ecx
cmp ecx, 0x2e
jb 0x402386
lea eax, [esp + 0x1d]
mov byte [esp + 0x4b], 0
push eax
call esi
movaps xmm0, xmmword [0x664cd0]
xor ecx, ecx
movups xmmword [esp + 0x1c], xmm0
mov word [esp + 0x4c], 0x1d
movaps xmm0, xmmword [0x664d60]
movups xmmword [esp + 0x2c], xmm0
movaps xmm0, xmmword [0x664ce0]
movups xmmword [esp + 0x3c], xmm0
nop dword [eax]
mov al, byte [esp + 0x1c]
xor byte [esp + ecx + 0x1d], al
inc ecx
cmp ecx, 0x30
jb 0x4023d0
lea eax, [esp + 0x1d]
mov byte [esp + 0x4d], 0
push eax
call esi
movaps xmm0, xmmword [0x664c90]
xor ecx, ecx
movups xmmword [esp + 0x1c], xmm0
mov word [esp + 0x4c], 0x6c
movaps xmm0, xmmword [0x664bc0]
movups xmmword [esp + 0x2c], xmm0
movaps xmm0, xmmword [0x664ca0]
movups xmmword [esp + 0x3c], xmm0
mov al, byte [esp + 0x1c]
xor byte [esp + ecx + 0x1d], al
inc ecx
cmp ecx, 0x30
jb 0x402417
lea eax, [esp + 0x1d]
mov byte [esp + 0x4d], 0
push eax
call esi
mov ecx, 0x45
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + 0x664ab0]
xor al, cl
inc ecx
mov byte [esp + edx + 8], al
and ecx, 0x800000ff
jns 0x40245d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x11
jl 0x402440
lea eax, [esp + 8]
mov byte [esp + 0x19], 0
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
xor ecx, ecx
call fcn.00401920
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415ff0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b669b
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x692c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [ebp + 8]
mov byte [esi + 0x2be1], al
test al, al
je 0x416169
push 0x118
lea eax, [ebp - 0x260]
mov byte [esi + 0x2be0], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x260]
call fcn.00403910
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:91.0__Gecko_20100101_Firefox_91.0
lea ecx, [ebp - 0x260]
mov dword [ebp - 4], 0
call fcn.00407900
lea eax, [ebp - 0x260]
mov ecx, esi
push eax
push str.User_Agent
call fcn.00416990
push 0x138
lea eax, [ebp - 0x148]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x148]
call fcn.00449bd0
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 1
push eax
push str.text_html_application_xhtmlxml_application_xml_q0.9_image_webp___q0.8
add esi, 0x1898
push str.Accept
mov ecx, esi
call fcn.004a75c0
lea eax, [ebp - 0x148]
mov ecx, esi
push eax
push str.Accept_Language
call fcn.004a4010
test al, al
jne 0x4160f3
lea eax, [ebp - 0x148]
mov ecx, esi
push eax
push str.en_US_en_q0.5
push str.Accept_Language
call fcn.004a75c0
lea eax, [ebp - 0x148]
mov ecx, esi
push eax
push str.Connection
call fcn.004a4010
test al, al
jne 0x416122
lea eax, [ebp - 0x148]
mov ecx, esi
push eax
push str.keep_alive
push str.Connection
call fcn.004a75c0
lea eax, [ebp - 0x148]
mov ecx, esi
push eax
push str.Upgrade_Insecure_Requests
call fcn.004a4010
test al, al
jne 0x416151
lea eax, [ebp - 0x148]
mov ecx, esi
push eax
push 0x5d3720
push str.Upgrade_Insecure_Requests
call fcn.004a75c0
lea ecx, [ebp - 0x148]
call fcn.00449bf0
lea ecx, [ebp - 0x260]
call fcn.004039a0
jmp 0x41617b
push 1
push str.User_Agent
lea ecx, [esi + 0x1898]
call fcn.004a7520
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b34c8
mov esp, ebp
pop ebp
ret 4
Function at 0x41e0b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b7608
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x692c00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp + 8]
add eax, 0x2bc8
mov edx, dword [ebp + 0x20]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x1c]
push 4
push eax
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x150], edx
call fcn.004082b0
mov ecx, edi
call fcn.00436dd0
mov eax, dword [ebp - 0x14c]
lea ecx, [ebp - 0x14]
push 0
push 0
mov dword [ebp - 0x14], 0
push dword [eax + 0xb88]
push dword [eax + 0xb84]
push esi
call fcn.004a8c00
mov esi, dword [ebp - 0x14c]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00415c70
mov byte [esi + 0x18d4], 1
call sub.KERNEL32.DLL_GetTickCount
push 0x12c
mov dword [ebp - 0x14c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x148]
movlpd qword [ebp - 0x1c], xmm0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.004a93e0
push eax
lea ecx, [ebp - 0x148]
call fcn.0046ea80
push dword [ebp - 0x150]
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x11c], 0
push eax
push edi
lea eax, [esi + 0x1280]
mov ecx, ebx
push eax
push 0
push dword [ebp + 0x10]
call fcn.00406990
mov ecx, dword [ebp - 0x154]
push eax
push esi
lea eax, [esi + 0x1778]
push eax
lea eax, [esi + 0x2a40]
push eax
call fcn.00406990
push eax
push esi
call fcn.00474f10
mov ecx, dword [ebp - 0x11c]
add esp, 0x34
mov dword [esi + 0xc30], ecx
mov bl, al
mov cl, byte [ebp - 0x129]
mov byte [esi + 0x10ab], cl
call sub.KERNEL32.DLL_GetTickCount
mov ecx, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x150]
cmp eax, ecx
jb 0x41e229
sub eax, ecx
mov ecx, edi
push eax
push str.totalElapsedMs
call fcn.00448a10
push edi
test bl, bl
je 0x41e262
lea ecx, [ebp - 0x14]
call fcn.004a9190
push dword [esi + 0x155c]
lea ecx, [esi + 0x908]
push dword [esi + 0x1558]
push str.ContentLength
call fcn.004489a0
cmp dword [esi + 0x1554], 0x190
jl 0x41e26d
xor bl, bl
jmp 0x41e26d
lea ecx, [esi + 0x2a40]
call fcn.004a8960
lea ecx, [ebp - 0x148]
call fcn.0046eb60
lea ecx, [ebp - 0x14]
call fcn.004a8c50
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b34c8
mov esp, ebp
pop ebp
ret 0x1c