joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a034
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 1
pop edi
xor esi, esi
mov dword [ebp - 0xc], ecx
push 0xfffffffffffffff5
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [ebp - 0x28]
or dword [ebp - 8], 0xffffffff
or dword [ebp - 4], 0xffffffff
push esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x41a136
or dword [ebp - 0x18], 0xffffffff
push 2
push esi
lea eax, [ebp - 0x18]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push eax
push dword [ebp - 8]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
mov ecx, dword [ebp - 0xc]
push edi
test eax, eax
lea eax, [ebp - 8]
push edi
push eax
jne 0x41a0bd
call fcn.0041a5df
mov ecx, dword [ebp - 0xc]
push edi
lea eax, [ebp - 4]
push edi
push eax
jmp 0x41a131
call fcn.0041a5df
lea eax, [ebp - 0x28]
or dword [ebp - 0x14], 0xffffffff
or dword [ebp - 0x10], 0xffffffff
push 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x41a136
or dword [ebp - 0x1c], 0xffffffff
push 2
push 0
lea eax, [ebp - 0x1c]
push 0
push eax
call esi
push eax
push dword [ebp - 0x10]
call esi
push eax
call ebx
test eax, eax
push edi
push edi
jne 0x41a13a
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.0041a5df
push edi
lea eax, [ebp - 4]
push edi
push eax
mov ecx, esi
call fcn.0041a5df
push edi
lea eax, [ebp - 0x14]
push edi
push eax
mov ecx, esi
call fcn.0041a5df
push edi
lea eax, [ebp - 0x10]
push edi
push eax
mov ecx, esi
call fcn.0041a5df
xor eax, eax
jmp 0x41a1a6
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0041a5df
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041a1ab
test eax, eax
jne 0x41a15f
xor ebx, ebx
jmp 0x41a170
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041a23e
mov ebx, eax
push edi
lea eax, [ebp - 0x18]
push edi
push eax
mov ecx, esi
call fcn.0041a5df
push edi
lea eax, [ebp - 4]
push edi
push eax
mov ecx, esi
call fcn.0041a5df
push edi
lea eax, [ebp - 0x14]
push edi
push eax
mov ecx, esi
call fcn.0041a5df
push edi
lea eax, [ebp - 0x1c]
push edi
push eax
mov ecx, esi
call fcn.0041a5df
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a1ab
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax], 0xffffffff
je 0x41a235
mov ebx, dword [ebp + 0xc]
cmp dword [ebx], 0xffffffff
je 0x41a235
xor esi, esi
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x44
lea eax, [ebp - 0x54]
pop edi
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
add esp, 0x18
or word [ebp - 0x28], 0x101
mov dword [ebp - 0x54], edi
mov eax, dword [eax]
mov word [ebp - 0x24], si
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push str.ipconfig__all
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, esi
je 0x41a235
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
jmp 0x41a237
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41a689
Capabilities:
Get disk information

Disassembly:
mov eax, 0x43ced7
call fcn.00432e40
sub esp, 0x18
and dword [ebp - 0x20], 0
and dword [ebp - 0x14], 0
push ebx
push esi
push 0x457968
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_1
push 1
lea ecx, [ebp - 0x10]
pop ebx
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
test esi, esi
jne 0x41a6fc
mov ecx, dword [ebp + 8]
push 0xd0
push 0x20
call fcn.004329ec
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
jmp 0x41a7c0
push edi
mov edi, ebx
mov byte [ebp - 0x1c], 0x41
push ebx
lea ecx, [ebp - 0x24]
push dword [ebp - 0x1c]
call fcn.004329ec
push dword [eax]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push str._s:_
push eax
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
and dword [ebp - 0x14], 0
test esi, edi
je 0x41a765
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x41a765
xor eax, eax
lea ecx, [ebp - 0x14]
push eax
push eax
push eax
push eax
push ecx
push eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x41a765
or dword [ebp - 0x14], 0xffffffff
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str._.8X
push eax
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
call sub.MFC42.DLL_CString::operator
add edi, edi
inc byte [ebp - 0x1c]
cmp edi, 0x4000000
jb 0x41a703
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 8]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41bbbf
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3bc
lea eax, [ebp - 0x3bc]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x41bc92
cmp byte [ebp - 0x3bc], 1
jne 0x41bc8c
mov al, byte [ebp - 0x3bb]
cmp al, 1
jne 0x41bc8c
push esi
push edi
xor esi, esi
push 0x12c
lea eax, [ebp - 0x12c]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x22c]
push 0xff
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, esi
je 0x41bc6c
push ebx
lea ebx, [ebp - 0x12c]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x41bc6b
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x41bc6b
push 0x1e
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
inc esi
add ebx, 0x1e
jmp 0x41bc42
pop ebx
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
test esi, esi
pop esi
jle 0x41bc92
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x12c]
push eax
call fcn.004326b6
push 1
pop eax
jmp 0x41bc94
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
leave
ret 4

Function at 0x41cc61
Capabilities:
Get hostname

Disassembly:
mov eax, 0x43d1d3
call fcn.00432e40
sub esp, 0xc
and dword [ebp - 0x18], 0
push esi
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], 0x10
call sub.MFC42.DLL_CString::CString_2
push 1
lea ecx, [ebp - 0x10]
pop esi
push dword [ebp - 0x14]
mov dword [ebp - 4], esi
call sub.MFC42.DLL_CString::GetBuffer
push dword [ebp - 0x14]
mov edi, eax
push 0
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
push 0xf
lea ecx, [ebp - 0x10]
jne 0x41cccf
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [ebp + 8]
push 0x457968
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x18], esi
jmp 0x41cce3
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x18], esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41cd02
Capabilities:
Get session user name

Disassembly:
mov eax, 0x43d1ff
call fcn.00432e40
sub esp, 0xc
push esi
lea ecx, [ebp - 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor eax, eax
push ecx
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
call edi
test eax, eax
je 0x41cd39
mov ecx, dword [ebp + 8]
push 0x457968
call sub.MFC42.DLL_CString::CString_1
jmp 0x41cdb8
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x10], eax
jae 0x41cd44
mov dword [ebp - 0x10], eax
push ebx
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [ebp - 0x10]
push 1
pop esi
inc eax
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call sub.MFC42.DLL_CString::GetBuffer
mov ebx, eax
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
push ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push ebx
call edi
pop ebx
lea ecx, [ebp - 0x14]
push dword [ebp + 0xc]
test eax, eax
jne 0x41cd98
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [ebp + 8]
push 0x457968
call sub.MFC42.DLL_CString::CString_1
jmp 0x41cda9
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::CString_3
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], esi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x41cf6c
Capabilities:
Get file version info

Disassembly:
push esi
mov esi, ecx
call fcn.0041cfde
push dword [esp + 8]
mov ecx, esi
call fcn.0041cf46
push 0
push dword [esi + 0x1c]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esi + 8], eax
je 0x41cfd0
push eax
call sub.MFC42.DLL_operatornew
test eax, eax
pop ecx
mov dword [esi + 0xc], eax
je 0x41cfd0
push eax
push dword [esi + 8]
push 0
push dword [esi + 0x1c]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41cfc9
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 0x10]
push eax
push 0x456120
push dword [esi + 0xc]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x41cfd4
mov ecx, esi
call fcn.0041cfde
xor eax, eax
jmp 0x41cfda
push 1
pop eax
mov dword [esi + 4], eax
pop esi
ret 4
Function at 0x41d588
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x43d2e4
call fcn.00432e40
push ecx
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0041d56d
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp dword [eax - 8], ebx
jne 0x41d5c0
xor esi, esi
jmp 0x41d613
push eax
lea eax, [ebp - 0x10]
push str.Global_s
push eax
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
push dword [ebp - 0x10]
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x41d5fd
push dword [ebp - 0x10]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x41d610
jmp 0x41d5bc
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x41d610
cmp eax, 0x80
jne 0x41d5bc
push 1
pop esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41d715
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x43d324
call fcn.00432e40
push ecx
push ecx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0041d56d
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp dword [eax - 8], 0
jne 0x41d74c
xor esi, esi
jmp 0x41d78f
push eax
lea eax, [ebp - 0x10]
push str.Global2__s
push eax
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
push dword [ebp - 0x10]
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
mov dword [esi + 0x14], eax
je 0x41d748
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41d78c
cmp eax, 0x80
jne 0x41d748
push 1
pop esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41d7db
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x43d340
call fcn.00432e40
push ecx
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0041d56d
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp dword [eax - 8], ebx
jne 0x41d813
xor esi, esi
jmp 0x41d866
push eax
lea eax, [ebp - 0x10]
push str.Global2__s
push eax
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
push dword [ebp - 0x10]
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x41d850
push dword [ebp - 0x10]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x41d863
jmp 0x41d80f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x41d863
cmp eax, 0x80
jne 0x41d80f
push 1
pop esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41d9e0
Capabilities:
Delete file
Get file size

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov ecx, 0x457b60
call fcn.004326b6
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push closesocket
push dword [0x457b60]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41da3a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x80000
jb 0x41da3a
push dword [0x457b60]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
ret

Function at 0x41db47
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x43d394
call fcn.00432e40
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41dbe9
push 2
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [ebp + 0x10]
lea eax, [esi + 0x12]
push eax
mov dword [ebp + 8], eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 8]
push ecx
push eax
push 0x4452cc
push esi
push dword [ebp + 0xc]
call fcn.00424b3d
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x14]
push 4
pop eax
push edi
push ecx
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp + 8]
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push dword [ebp + 8]
push dword [ebp + 0x10]
push ebx
call esi
push dword [ebp + 0x10]
call sub.MFC42.DLL_operatordelete
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x420249
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
pop esi
call fcn.0041ff5c
mov edi, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], 0xe
and dword [ecx + 0x134], 0
and dword [ecx + 0x130], 0
xor dword [ecx + 0x9c], edi
mov eax, dword [ebp + 8]
push 0x25
cdq
pop ebx
add dword [ebp + 8], 0xe
idiv ebx
xor dword [ecx + edx*4 + 0x9c], esi
sub edi, esi
cmp dword [ebp + 8], 0x206
lea eax, [ecx + edx*4 + 0x9c]
mov eax, esi
mov esi, edi
mov edi, eax
jl 0x420277
mov esi, 0x3e8
call fcn.004201c7
dec esi
jne 0x4202a8
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x423d18
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x5c
push 0
push esi
call sub.MSVCRT.dll_memset
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
add esp, 0xc
and dword [esi + 0x58], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret
Function at 0x4249f6
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
bswap eax
mov edx, eax
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
bswap eax
mov edi, dword [ebp + 0xc]
mov esi, eax
lea eax, [ebp - 0x10]
push 4
lea ecx, [ebp - 0x10]
sub edi, eax
pop ebx
mov eax, dword [edi + ecx]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
bswap eax
mov dword [ecx], eax
add ecx, 4
dec ebx
jne 0x424a29
push 0x10
xor eax, eax
pop ecx
mov edi, esi
mov ebx, esi
shr edi, 5
add edi, dword [ebp - 0xc]
sub eax, 0x61c88647
shl ebx, 4
add ebx, dword [ebp - 0x10]
xor edi, ebx
lea ebx, [eax + esi]
xor edi, ebx
add edx, edi
mov edi, edx
mov ebx, edx
shr edi, 5
add edi, dword [ebp - 4]
shl ebx, 4
add ebx, dword [ebp - 8]
xor edi, ebx
lea ebx, [eax + edx]
xor edi, ebx
add esi, edi
dec ecx
jne 0x424a41
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
bswap eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
bswap eax
pop edi
pop esi
mov dword [ecx + 4], eax
pop ebx
leave
ret

Function at 0x424a98
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
bswap eax
mov esi, eax
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
bswap eax
mov edi, dword [ebp + 0xc]
mov edx, eax
lea eax, [ebp - 0x10]
push 4
lea ecx, [ebp - 0x10]
sub edi, eax
pop ebx
mov eax, dword [edi + ecx]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
bswap eax
mov dword [ecx], eax
add ecx, 4
dec ebx
jne 0x424acb
push 0x10
mov eax, 0xe3779b90
pop ecx
mov edi, esi
mov ebx, esi
shr edi, 5
add edi, dword [ebp - 4]
shl ebx, 4
add ebx, dword [ebp - 8]
xor edi, ebx
lea ebx, [eax + esi]
xor edi, ebx
sub edx, edi
mov edi, edx
mov ebx, edx
shr edi, 5
add edi, dword [ebp - 0xc]
shl ebx, 4
add ebx, dword [ebp - 0x10]
xor edi, ebx
lea ebx, [eax + edx]
xor edi, ebx
add eax, 0x61c88647
sub esi, edi
dec ecx
jne 0x424ae6
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 8]
bswap eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
bswap eax
pop edi
pop esi
mov dword [ecx + 4], eax
pop ebx
leave
ret
Function at 0x427e70
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43dadb
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
xor esi, esi
mov ecx, dword [edi + 0x50]
cmp ecx, esi
je 0x427eab
call fcn.004293f0
mov ecx, dword [edi + 0x50]
cmp ecx, esi
je 0x427ea8
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov dword [edi + 0x50], esi
push 0x138
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, esi
mov dword [esp + 0x24], esi
je 0x427ecd
mov ecx, eax
call fcn.00429020
jmp 0x427ecf
xor eax, eax
cmp edi, esi
mov dword [esp + 0x24], 0xffffffff
mov dword [edi + 0x50], eax
je 0x427ee3
lea ecx, [edi + 4]
jmp 0x427ee5
xor ecx, ecx
push ebx
push ebp
push ecx
mov ecx, eax
call fcn.0042ba00
call fcn.00428bc0
lea ecx, [esp + 0x20]
mov esi, eax
push ecx
mov ecx, esi
call fcn.00428d30
mov ebp, dword [eax]
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
mov dword [esp + 0x30], 1
call fcn.00428d00
mov ebx, dword [eax]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.00428c90
mov ecx, dword [eax]
push ebp
mov dword [esp + 0x18], ecx
push ebx
mov ecx, esi
mov byte [esp + 0x34], 3
call fcn.00428cc0
mov edx, dword [esp + 0x1c]
push eax
push edx
mov ecx, esi
call fcn.00428c10
mov ecx, dword [edi + 0x50]
push eax
call fcn.0042ba20
test eax, eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
sete bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
or esi, 0xffffffff
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], esi
call sub.MFC42.DLL_CString::CString
pop ebp
test bl, bl
pop ebx
je 0x427faa
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
push 0
push 3
call dword [eax + 0x14]
pop edi
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
lea ecx, [esp + 8]
push ecx
call fcn.00431270
add esp, 4
push str.QMNTFILE
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 4
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 8]
mov ecx, dword [edi + 0x50]
push 0
push eax
push str.http:__music.qq.com_
call fcn.00429410
test eax, eax
jne 0x427ffc
mov edx, dword [edi + 4]
lea ecx, [edi + 4]
push eax
push 3
call dword [edx + 0x14]
lea ecx, [esp + 8]
mov dword [esp + 0x24], esi
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x429f00
Capabilities:
Create http request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43de80
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x94]
test eax, eax
jne 0x42a047
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 4]
mov ecx, esi
push eax
mov dword [esp + 0x20], 0
call fcn.0042acb0
test eax, eax
jne 0x429f6d
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
xor ecx, ecx
cmp eax, 3
mov edx, dword [esp + 4]
setne cl
dec ecx
push 0x10000000
and ecx, str.127.0.0.1:0
push 0
push ecx
push eax
push edx
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 0x94], eax
jne 0x429fa4
push eax
push eax
call sub.MFC42.DLL_AfxThrowInternetException
mov eax, dword [esi + 0x94]
push 0x42af20
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallback]
cmp eax, 0xffffffff
jne 0x429fc4
push 0
push 0
call sub.MFC42.DLL_AfxThrowInternetException
push 0
push 0x457bbc
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CSingleLock::CSingleLock
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CSingleLock::Lock
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42a006
push esi
mov ecx, 0x457ba0
call sub.MFC42.DLL_CMapPtrToPtr::operator__
lea ecx, [esp + 8]
mov dword [eax], 0
call sub.MFC42.DLL_CSingleLock::Unlock
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CSingleLock::Unlock
mov ecx, esi
call fcn.0042ae70
test eax, eax
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 4]
jne 0x42a042
call sub.MFC42.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret