joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4a62
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
cmp esi, 0x7ff80000
push edi
mov ebx, 0x10000
jbe 0x4b4a85
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x4b4a88
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x4b4a9b
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x4b4aa2
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x534e94]
test eax, eax
mov ecx, dword [0x534e90]
jne 0x4b4abc
test ecx, ecx
je 0x4b4ad1
mov eax, ecx
mov dword [0x534e94], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x4b4ad1
cmp edx, dword [ebp - 4]
jb 0x4b4ad1
cmp edx, dword [ebp - 8]
jbe 0x4b4ba5
mov eax, ecx
test ecx, ecx
jmp 0x4b4af5
test eax, eax
je 0x4b4af0
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4b4af0
cmp ecx, dword [ebp - 4]
jb 0x4b4af0
cmp ecx, dword [ebp - 8]
jbe 0x4b4ba5
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x534e94], eax
jne 0x4b4ad7
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp - 4]
mov edi, esi
jbe 0x4b4c40
cmp edi, 0x70000000
jb 0x4b4b25
cmp edi, 0x80000000
ja 0x4b4b25
mov edi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [0x4eb1e4]
test eax, eax
je 0x4b4c40
cmp dword [ebp - 0x30], ebx
jne 0x4b4b44
cmp dword [ebp - 0x34], ebx
jae 0x4b4b57
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x4b4b10
jmp 0x4b4c40
push 0x40
push 0x3000
push ebx
push edi
call dword [0x4eb1c0]
test eax, eax
mov dword [0x534e94], eax
je 0x4b4c40
mov ecx, dword [0x534e90]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x534e90], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x4b4b97
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x4b4c45
cmp esi, dword [ebp - 8]
ja 0x4b4c45
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.004d3556
add esp, 0xc
mov eax, esi
jmp 0x4b4c47
cmp esi, 0x70000000
jb 0x4b4be9
cmp esi, 0x80000000
ja 0x4b4be9
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [0x4eb1e4]
test eax, eax
je 0x4b4c45
cmp dword [ebp - 0x14], ebx
jne 0x4b4c37
cmp dword [ebp - 0x18], ebx
jb 0x4b4c37
mov ecx, esi
and ecx, 0xffff
je 0x4b4c1b
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [0x4eb1c0]
test eax, eax
mov dword [0x534e94], eax
jne 0x4b4b73
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 8]
jb 0x4b4bd4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b4c6d
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x501620
call fcn.004d3604
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [0x4eb1e4]
test eax, eax
je 0x4b4cc8
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x4b4cc4
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x4b4cc4
cmp word [eax + 0x14], 0
jne 0x4b4cb9
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x4b4cca
mov eax, ecx
jmp 0x4b4cb3
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.004d363f
ret
Function at 0x4d40a3
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x4d4dd9
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52e480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
je 0x4d4f09
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4d4f08
cmp edi, 0x40
jbe 0x4d4e23
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
call fcn.004d4c88
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
pop edi
mov dword [ebp - 0x18], eax
push ebx
push 0x40
lea eax, [esi + 0x58]
push 0x36
push eax
call fcn.004d3556
push 0x40
lea ebx, [esi + 0x98]
push 0x5c
push ebx
call fcn.004d3556
add esp, 0x18
test edi, edi
jbe 0x4d4e5b
mov ecx, dword [ebp - 0x18]
mov eax, ebx
mov dl, byte [ecx]
xor byte [eax - 0x40], dl
mov dl, byte [ecx]
xor byte [eax], dl
inc ecx
inc eax
dec edi
jne 0x4d4e4d
push esi
call fcn.004d40a3
add esp, 4
lea eax, [esi + 0x58]
test eax, eax
push 0x40
pop ebx
mov dword [ebp - 0x18], eax
je 0x4d4ef7
mov ecx, dword [esi]
mov edi, ecx
push ebx
and edi, 0x3f
pop eax
add ecx, ebx
sub eax, edi
cmp ecx, ebx
mov dword [ebp - 0x1c], eax
mov dword [esi], ecx
jae 0x4d4e8e
inc dword [esi + 4]
test edi, edi
je 0x4d4ec4
cmp eax, 0x40
ja 0x4d4ec4
push eax
push dword [ebp - 0x18]
lea eax, [edi + esi + 0x18]
push eax
call fcn.004d3562
add esp, 0xc
lea eax, [esi + 0x18]
mov ecx, esi
call fcn.004d40cb
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
push 0x40
pop ebx
sub ebx, eax
xor edi, edi
cmp ebx, 0x40
jb 0x4d4ee2
mov eax, ebx
shr eax, 6
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, esi
call fcn.004d40cb
add dword [ebp - 0x18], 0x40
sub ebx, 0x40
dec dword [ebp - 0x1c]
jne 0x4d4ecc
test ebx, ebx
jbe 0x4d4ef7
push ebx
push dword [ebp - 0x18]
lea eax, [edi + esi + 0x18]
push eax
call fcn.004d3562
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004d3556
add esp, 0xc
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d34f7
leave
ret
Function at 0x4d8de8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x52e480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
je 0x4d8f18
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4d8f17
cmp edi, 0x40
jbe 0x4d8e32
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
call fcn.004d8d7f
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
pop edi
mov dword [ebp - 0x18], eax
push ebx
push 0x40
lea eax, [esi + 0x58]
push 0x36
push eax
call fcn.004d3556
push 0x40
lea ebx, [esi + 0x98]
push 0x5c
push ebx
call fcn.004d3556
add esp, 0x18
test edi, edi
jbe 0x4d8e6a
mov ecx, dword [ebp - 0x18]
mov eax, ebx
mov dl, byte [ecx]
xor byte [eax - 0x40], dl
mov dl, byte [ecx]
xor byte [eax], dl
inc ecx
inc eax
dec edi
jne 0x4d8e5c
push esi
call fcn.004d40a3
add esp, 4
lea eax, [esi + 0x58]
test eax, eax
push 0x40
pop ebx
mov dword [ebp - 0x18], eax
je 0x4d8f06
mov ecx, dword [esi]
mov edi, ecx
push ebx
and edi, 0x3f
pop eax
add ecx, ebx
sub eax, edi
cmp ecx, ebx
mov dword [ebp - 0x1c], eax
mov dword [esi], ecx
jae 0x4d8e9d
inc dword [esi + 4]
test edi, edi
je 0x4d8ed3
cmp eax, 0x40
ja 0x4d8ed3
push eax
push dword [ebp - 0x18]
lea eax, [edi + esi + 0x18]
push eax
call fcn.004d3562
add esp, 0xc
lea eax, [esi + 0x18]
mov ecx, esi
call fcn.004d8392
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
push 0x40
pop ebx
sub ebx, eax
xor edi, edi
cmp ebx, 0x40
jb 0x4d8ef1
mov eax, ebx
shr eax, 6
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, esi
call fcn.004d8392
add dword [ebp - 0x18], 0x40
sub ebx, 0x40
dec dword [ebp - 0x1c]
jne 0x4d8edb
test ebx, ebx
jbe 0x4d8f06
push ebx
push dword [ebp - 0x18]
lea eax, [edi + esi + 0x18]
push eax
call fcn.004d3562
add esp, 0xc
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004d3556
add esp, 0xc
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d34f7
leave
ret

Function at 0x4d9121
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x4dad6c
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x52e480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
je 0x4dae9c
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4dae9b
cmp edi, 0x40
jbe 0x4dadb6
lea ecx, [ebp - 0x18]
push ecx
push edi
push eax
call fcn.004dad03
add esp, 0xc
push 0x14
lea eax, [ebp - 0x18]
pop edi
mov dword [ebp - 0x1c], eax
push ebx
push 0x40
lea eax, [esi + 0x5c]
push 0x36
push eax
call fcn.004d3556
push 0x40
lea ebx, [esi + 0x9c]
push 0x5c
push ebx
call fcn.004d3556
add esp, 0x18
test edi, edi
jbe 0x4dadee
mov ecx, dword [ebp - 0x1c]
mov eax, ebx
mov dl, byte [ecx]
xor byte [eax - 0x40], dl
mov dl, byte [ecx]
xor byte [eax], dl
inc ecx
inc eax
dec edi
jne 0x4dade0
push esi
call fcn.004d9121
add esp, 4
lea eax, [esi + 0x5c]
test eax, eax
push 0x40
pop ebx
mov dword [ebp - 0x1c], eax
je 0x4dae8a
mov ecx, dword [esi]
mov edi, ecx
push ebx
and edi, 0x3f
pop eax
add ecx, ebx
sub eax, edi
cmp ecx, ebx
mov dword [ebp - 0x20], eax
mov dword [esi], ecx
jae 0x4dae21
inc dword [esi + 4]
test edi, edi
je 0x4dae57
cmp eax, 0x40
ja 0x4dae57
push eax
push dword [ebp - 0x1c]
lea eax, [edi + esi + 0x1c]
push eax
call fcn.004d3562
add esp, 0xc
lea eax, [esi + 0x1c]
mov ecx, esi
call fcn.004d9150
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x1c], eax
push 0x40
pop ebx
sub ebx, eax
xor edi, edi
cmp ebx, 0x40
jb 0x4dae75
mov eax, ebx
shr eax, 6
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov ecx, esi
call fcn.004d9150
add dword [ebp - 0x1c], 0x40
sub ebx, 0x40
dec dword [ebp - 0x20]
jne 0x4dae5f
test ebx, ebx
jbe 0x4dae8a
push ebx
push dword [ebp - 0x1c]
lea eax, [edi + esi + 0x1c]
push eax
call fcn.004d3562
add esp, 0xc
push 0x14
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.004d3556
add esp, 0xc
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d34f7
leave
ret
Function at 0x40112e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov ebx, ecx
push edi
xor edx, edx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
mov word [ebp - 0x208], dx
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
push 0x1a
push eax
push edx
call dword [0x40d244]
lea eax, [ebp - 0x208]
lea edi, [ebx + 0x1c]
push eax
push str._s360se
push edi
call fcn.00401546
add esp, 0xc
lea esi, [ebx + 0x20]
mov ecx, esi
push edi
call fcn.004014f6
push 0
push dword [esi]
call dword [0x40d174]
mov edi, str.wdtc
mov eax, edi
test eax, eax
je 0x4011a6
push edi
call dword [0x40d178]
push edi
push eax
mov ecx, esi
call fcn.00401aa7
push 0
push dword [esi]
call dword [0x40d174]
mov ecx, ebx
call fcn.004011c5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4011c5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x120c
call fcn.0040cbe0
push ebx
push esi
push edi
lea ebx, [ecx + 0x24]
push dword [ecx + 0x20]
xor esi, esi
mov dword [ebp - 4], esi
push str._s_se_wdtc.ini
push ebx
call fcn.00401546
mov dx, word [0x41543c]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
mov word [ebp - 0x20c], dx
mov word [ebp - 0x120c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x120a]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [0x40d16c]
push eax
push str.http:__seupdate.360safe.com_se_wdtc.ini__d
lea eax, [ebp - 0x120c]
push 0x7ff
push eax
call dword [0x40d21c]
lea eax, [ebp - 0x20c]
push esi
push eax
push esi
push esi
push esi
push 0x2710
push 1
push esi
push 1
push esi
lea eax, [ebp - 0x120c]
push esi
push eax
call fcn.004064aa
add esp, 0x40
cmp word [ebp - 0x20c], si
je 0x401297
lea eax, [ebp - 0x20c]
push eax
call dword [0x40d258]
test eax, eax
je 0x401297
mov ebx, dword [ebx]
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [0x40d170]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40129f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x120c
call fcn.0040cbe0
push ebx
push esi
mov ebx, ecx
push edi
xor esi, esi
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x120a]
push dword [ebx + 0x24]
mov word [ebp - 0x120c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x120c]
push 0x800
push eax
push 0x41543c
push dword [ebp + 8]
push str.main
call dword [0x40d168]
lea eax, [ebp - 0x120c]
push eax
call dword [0x40d214]
lea edi, [ebx + 0x28]
pop ecx
test eax, eax
mov dword [ebp - 4], edi
jbe 0x401325
lea eax, [ebp - 0x120c]
test eax, eax
je 0x40131c
lea eax, [ebp - 0x120c]
push eax
call dword [0x40d178]
lea ecx, [ebp - 0x120c]
push ecx
jmp 0x40133a
cmp dword [ebp + 0xc], esi
jne 0x40132e
xor eax, eax
jmp 0x401337
push dword [ebp + 0xc]
call dword [0x40d178]
push dword [ebp + 0xc]
push eax
mov ecx, edi
call fcn.00401a68
push 0x4111f0
push dword [ebp + 8]
call dword [0x40d218]
pop ecx
test eax, eax
pop ecx
je 0x4013ec
push dword [ebp + 8]
push dword [ebx + 0x20]
push str._s_s.png
push dword [ebp - 4]
call fcn.00401546
mov ax, word [0x41543c]
mov ecx, 0x81
mov word [ebp - 0x20c], ax
xor eax, eax
lea edi, [ebp - 0x20a]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push esi
push 0x2710
push 1
push esi
push 1
push esi
lea eax, [ebp - 0x120c]
push esi
push eax
call fcn.004064aa
add esp, 0x40
cmp word [ebp - 0x20c], si
mov edi, eax
je 0x4013e3
lea eax, [ebp - 0x20c]
push eax
call dword [0x40d258]
test eax, eax
je 0x4013e3
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [0x40d170]
mov edi, eax
cmp edi, esi
jne 0x4013ec
mov eax, dword [ebp + 0xc]
jmp 0x4013f1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x401445
Capabilities:
Set registry value

Disassembly:
push dword [esp + 8]
call dword [0x40d214]
pop ecx
shl eax, 1
push eax
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
push str.Software_se_wdtc
push 0x80000001
call dword [0x40d254]
ret 8
Function at 0x401f7b
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0040cc54
mov esi, dword [ebp + 0xc]
push 0x2454
push 0
push esi
call fcn.0040cc54
lea eax, [esi + 8]
add esp, 0x18
mov dword [ebp - 0x38], eax
lea eax, [esi + 0x2148]
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], eax
mov eax, 0x800
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x2348]
lea ecx, [esi + 0x1048]
mov dword [ebp - 0x20], eax
mov eax, 0x80
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 8], ecx
push eax
lea ecx, [esi + 0x2048]
push dword [ebp + 0x10]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x28], 0x100
push dword [ebp + 8]
mov dword [ebp - 0x18], ecx
call dword [0x40d214]
pop ecx
push eax
push dword [ebp + 8]
call dword [0x40d3d0]
test eax, eax
je 0x402052
mov eax, dword [ebp - 0x30]
cmp eax, 3
je 0x40202e
cmp eax, 4
je 0x40202e
cmp eax, 1
jne 0x402052
mov cx, word [ebp - 0x24]
and dword [esi + 0x2448], 0
and dword [esi + 0x244c], 0
or dword [esi + 0x2450], 0xffffffff
push 1
mov dword [esi + 4], eax
mov word [esi], cx
pop eax
jmp 0x402054
xor eax, eax
pop esi
leave
ret

Function at 0x402057
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
jne 0x4020aa
push ebx
mov ebx, str.MetalinkFile
lea eax, [esi + 0x5d538]
push ebx
push eax
call dword [0x40d218]
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x40209e
and word [edi], 0
push ebx
call dword [0x40d214]
lea edi, [edi + eax*2]
push edi
call dword [0x40d1f8]
pop ecx
mov dword [esi + 0x2694], eax
pop ecx
mov ecx, esi
call fcn.004056e5
test eax, eax
pop ebx
jne 0x4020ae
xor eax, eax
jmp 0x4020ee
xor edi, edi
push edi
push edi
push 1
push edi
call dword [0x40d14c]
cmp eax, edi
mov dword [esi + 0x2464], eax
je 0x4020eb
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push esi
push 0x402131
push edi
push edi
mov dword [esi + 0x5d100], 8
call dword [0x40d1fc]
add esp, 0x18
mov dword [esi + 0xc], eax
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x4035bd
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x26e0]
push ebx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax + ecx*4]
push 0x28
pop ebx
lea edi, [esi + 0x8044]
push ebx
push 0
push edi
call fcn.0040cc54
mov dword [edi], ebx
mov edi, 0x8000
lea ebx, [esi + 0x40]
push edi
push 0
push ebx
call fcn.0040cc54
mov eax, dword [esi + 0x8040]
mov dword [esi + 0x8058], ebx
lea ebx, [esi + 0x805c]
add esp, 0x18
test eax, eax
mov dword [ebx], edi
je 0x403642
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
sub ecx, dword [eax + 0x18]
sbb edx, dword [eax + 0x1c]
sub ecx, dword [eax + 8]
sbb edx, dword [eax + 0xc]
add ecx, 1
mov eax, edx
adc eax, 0
ja 0x403635
cmp ecx, edi
jbe 0x40363b
and dword [ebp - 8], 0
jmp 0x403677
mov edi, ecx
mov dword [ebp - 8], eax
jmp 0x403677
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5d108]
mov edx, dword [eax + 0x5d10c]
cmp ecx, 0xffffffff
jne 0x40365a
cmp edx, ecx
je 0x403679
sub ecx, dword [eax + 0x5d118]
sbb edx, dword [eax + 0x5d11c]
ja 0x40366c
cmp ecx, edi
jbe 0x403672
and dword [ebp - 8], 0
jmp 0x403677
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebx], edi
push dword [esi + 0xc]
call dword [0x40d11c]
mov eax, dword [esi + 0x20]
push 1
pop edi
mov dword [esi + 0x28], 9
cmp dword [eax + 4], edi
je 0x4036b5
push esi
lea eax, [esi + 0x8044]
push edi
push eax
push dword [esi + 0x1c]
call dword [0x40d3ac]
test eax, eax
je 0x4036c9
push dword [esi + 0xc]
call dword [0x40d148]
jmp 0x4036d6
push ebx
push dword [ebx]
push dword [esi + 0x8058]
push dword [esi + 0x1c]
call dword [0x40d3b0]
jmp 0x4036a6
call dword [0x40d120]
cmp eax, 0x3e5
jne 0x4036da
mov eax, edi
jmp 0x4036e7
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00403a2d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x403b3e
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push ebx
lea eax, [ecx + 0x61858]
xor ebx, ebx
push esi
cmp word [eax], bx
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
je 0x403b65
mov dword [ebp - 4], eax
jmp 0x403c14
cmp word [0x415478], bx
jne 0x403c0d
mov al, byte [0x4164c0]
mov ecx, 0x208
mov byte [ebp - 0x83c], al
xor eax, eax
lea edi, [ebp - 0x83b]
mov dword [ebp - 8], 0x823
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x83c]
push eax
push ebx
call fcn.0040986f
add esp, 0xc
test eax, eax
jne 0x403c04
lea eax, [ebp - 0x83c]
test eax, eax
jne 0x403bbc
xor esi, esi
jmp 0x403bf1
lea eax, [ebp - 0x83c]
push eax
call dword [0x40d15c]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0040cbe0
mov esi, esp
push edi
push esi
lea eax, [ebp - 0x83c]
push 0xffffffffffffffff
push eax
push ebx
push ebx
mov word [esi], bx
call dword [0x40d134]
push 0x824
push 0x415478
push esi
call fcn.00409772
add esp, 0xc
cmp word [0x415478], bx
je 0x403c14
mov dword [ebp - 4], 0x415478
push 0x10000000
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [0x40d398]
mov esi, dword [ebp + 8]
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x403d4b
mov edx, dword [esi + 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 8], 3
cmp word [edx + 0x2348], bx
lea ecx, [edx + 0x2348]
je 0x403c55
mov dword [ebp - 4], ecx
cmp word [edx + 0x2048], bx
lea ecx, [edx + 0x2048]
je 0x403c67
mov dword [ebp + 8], ecx
cmp dword [ebp - 4], ebx
mov edi, dword [ebp - 0xc]
jne 0x403c81
cmp word [edi + 0x60610], bx
lea ecx, [edi + 0x60610]
je 0x403c81
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
jne 0x403c98
cmp word [edi + 0x60710], bx
lea ecx, [edi + 0x60710]
je 0x403c98
mov dword [ebp + 8], ecx
push 1
pop ecx
cmp dword [edx + 4], ecx
jne 0x403ca3
mov dword [ebp - 8], ecx
push 0x402213
push eax
call dword [0x40d3a4]
push esi
mov eax, dword [esi + 0x20]
push dword [edi + 0x26d8]
mov cx, word [eax]
add eax, 0x2148
push dword [ebp - 8]
push dword [ebp + 8]
push dword [ebp - 4]
push ecx
push eax
push dword [esi + 0x14]
call dword [0x40d39c]
cmp eax, ebx
mov dword [esi + 0x18], eax
je 0x403d4b
cmp word [edi + 0x60810], bx
lea eax, [edi + 0x60810]
mov dword [ebp - 8], eax
je 0x403d46
push 3
cmp eax, ebx
pop edi
mov dword [ebp - 0x18], edi
jne 0x403cfd
mov dword [ebp - 0x14], ebx
jmp 0x403d2e
push eax
call dword [0x40d178]
lea eax, [eax + eax + 2]
mov dword [ebp + 8], eax
add eax, edi
and al, 0xfc
call fcn.0040cbe0
mov edi, esp
push ebx
push ebx
push dword [ebp + 8]
mov byte [edi], bl
push edi
push 0xffffffffffffffff
push dword [ebp - 8]
push ebx
push ebx
call dword [0x40d110]
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push 0xc
push eax
push 0x26
push dword [esi + 0x14]
mov dword [ebp - 0x10], 0x4164c0
call dword [0x40d3a0]
push 1
pop eax
jmp 0x403d4d
xor eax, eax
lea esp, [ebp - 0x848]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x403d5a
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x103c
call fcn.0040cbe0
push ebx
mov ebx, ecx
xor eax, eax
push esi
cmp dword [ebx + 0x2480], eax
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 0x411384
je 0x403d87
mov dword [ebp - 4], str.POST
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov ax, word [0x41543c]
mov esi, dword [ebp + 8]
mov word [ebp - 0x103c], ax
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x103a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x14], 0x411370
lea ecx, [eax + 0x1048]
add eax, 0x48
push ecx
push eax
push 0x411364
lea eax, [ebp - 0x103c]
push 0x7ff
push eax
call dword [0x40d21c]
add esp, 0x14
cmp dword [ebx + 0x62cbc], 0
mov eax, 0x8400c300
je 0x403df0
mov eax, 0x8408c300
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 4], 4
jne 0x403dfe
or eax, 0x803000
push esi
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x103c]
push str.HTTP_1.1
push eax
push dword [ebp - 4]
push dword [esi + 0x18]
call dword [0x40d390]
test eax, eax
mov dword [esi + 0x1c], eax
je 0x403eca
mov edi, dword [0x40d3cc]
lea ecx, [ebp + 8]
push 4
push ecx
push 2
push eax
mov dword [ebp + 8], 0x3a98
call edi
lea eax, [ebp - 4]
push 4
push eax
push 0x41
push dword [esi + 0x1c]
mov dword [ebp - 4], 1
call edi
push 0x28
mov dword [ebp - 8], eax
pop edi
lea eax, [ebp - 0x3c]
push edi
push 0
push eax
call fcn.0040cc54
mov dword [ebp - 0x3c], edi
mov edi, 0xa2d0
push edi
call fcn.0040cc4e
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x403eaa
push edi
push 0
push ebx
call fcn.0040cc54
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push dword [ebp - 8]
push 0xa2cf
push ebx
push esi
call fcn.00403fa1
push ebx
mov dword [ebp - 0x34], ebx
call dword [0x40d214]
pop ecx
mov dword [ebp - 0x30], eax
push esi
push 1
lea eax, [ebp - 0x3c]
push 0
push eax
push dword [esi + 0x1c]
call dword [0x40d394]
test ebx, ebx
mov dword [ebp - 8], eax
je 0x403eca
push ebx
call fcn.0040b296
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4