joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63e2f3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6eed24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, word [ebp + 8]
mov esi, dword [0x6f8c64]
push 0x666750
push eax
push esi
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x494fd4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x494fd4
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x494e85
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x494fd4
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
jne 0x494e79
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.004b3b20
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x494ee7
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 4], 1
jmp 0x494fc7
push 0x50
call fcn.004463f0
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x494f07
mov ecx, eax
call fcn.00557560
mov esi, eax
jmp 0x494f09
xor esi, esi
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], esi
test esi, esi
je 0x494f1a
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov byte [ebp - 4], 4
test esi, esi
jne 0x494f2e
mov dword [ebp - 4], 6
jmp 0x494fc7
mov eax, dword [esi]
push 0
push dword [ebp + 8]
push esi
call dword [eax + 0x14]
cmp dword [esi + 0xc], 0
jne 0x494f52
mov eax, dword [esi]
push esi
mov byte [ebp - 4], 7
call dword [eax + 8]
mov dword [ebp - 4], 8
jmp 0x494fc7
mov dword [ebp - 0x10], 0
push 0
push 1
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 9
push eax
push 0
mov ecx, esi
call fcn.00558210
test eax, eax
jne 0x494f96
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x494f83
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
push esi
mov byte [ebp - 4], 0xb
call dword [eax + 8]
mov dword [ebp - 4], 0xc
jmp 0x494fc7
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.00551410
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x494fb6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
push esi
mov byte [ebp - 4], 0xe
call dword [eax + 8]
mov dword [ebp - 4], 0xf
mov eax, dword [ebp + 8]
test eax, eax
je 0x494fd4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495260
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2c4
mov eax, dword [0x6eed24]
xor eax, esp
mov dword [esp + 0x2c0], eax
mov eax, dword [esp + 0x2d4]
push ebx
push ebp
push esi
mov ebx, ecx
mov dword [esp + 0x10], eax
push edi
push str.BreadcrumbBarComposited::BreadcrumbBar
lea ecx, [ebx + 0x24]
call fcn.00498320
mov edx, dword [0x6ee038]
mov esi, dword [0x6ee030]
sub edx, esi
mov eax, dword [0x6ee034]
mov ecx, dword [0x6ee02c]
sub eax, ecx
push 0
push dword [0x6f8c60]
push 0
push dword [ebx + 4]
push edx
push eax
push esi
push ecx
push 0x5601f84d
push str.Address:_C:Temp
push str.ToolbarWindow32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0
push 0x454
push eax
mov dword [ebx + 0x40], eax
call ebp
push 0xffffffffffffffec
push dword [ebx + 0x40]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x80
cmp eax, ecx
je 0x49530d
push ecx
push 0xffffffffffffffec
push dword [ebx + 0x40]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
push 0x42f
push dword [ebx + 0x40]
call ebp
push 0
push 0x14
push 0x41e
push dword [ebx + 0x40]
call ebp
push 0x100001
push 0
push 0x420
push dword [ebx + 0x40]
call ebp
push 0x100001
push 0
push 0x41f
push dword [ebx + 0x40]
call ebp
mov eax, dword [ebx + 4]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0
push 0x31
push dword [ebx + 0x40]
mov esi, eax
mov dword [esp + 0x20], esi
call ebp
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push esi
call edi
lea ecx, [ebx + 0x54]
mov esi, eax
push ecx
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
push esi
mov esi, dword [esp + 0x14]
push esi
call edi
push 0x2b4
lea eax, [esp + 0x20]
push 0
push eax
call fcn.004b40a0
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0x28]
add esp, 0xc
push 0x111
push 0x2b4
push eax
push 0x10
push str.C:MyFolder
call edi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4953d4
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [esp + 0x10]
push 0x4011
push 0x2b4
mov dword [ebx + 0x48], eax
lea eax, [esp + 0x24]
push eax
push 0x10
push str.C:MyFolder
call edi
push str.BBComposited
push 0
push 0x200b
mov dword [ebx + 0x44], eax
push dword [ebx + 0x40]
call ebp
mov eax, dword [esp + 0x14]
push esi
push dword [esp + 0x1c]
mov dword [eax], 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x2d0]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b2558
add esp, 0x2c4
ret 0x10
Function at 0x498660
Capabilities:
Create http request
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63e672
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6eed24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [esi], 0x666808
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows__U__Windows_NT_5.1__en_US__WebDAV
mov byte [ebp - 4], 5
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x498713
call ebx
test eax, eax
js 0x49874f
je 0x498713
movzx eax, ax
or eax, 0x83ff0000
test eax, eax
js 0x49874f
push dword [ebp - 0x10]
lea ecx, [esi + 4]
call fcn.0047bcd0
test eax, eax
jne 0x498738
call ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0x4d
lea ecx, [esi + 4]
call fcn.0047c600
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499bf0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63e889
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x6eed24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x18]
mov dword [ebx + 0x10], 0x664708
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea eax, [ebx + 0x34]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [ebp + 8], eax
mov dword [ebx + 0x30], edi
lea eax, [ebx + 0x40]
mov dword [ebp - 4], 2
push 0xfa0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov ecx, dword [ebx + 4]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x499c95
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x499ca2
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49a950
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ea06
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6eed24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x49a9b2
mov eax, dword [ecx]
lea edx, [ebp + 0x1c]
push edx
push ecx
mov dword [ebp + 0x1c], 0
call dword [eax + 0x1c]
cmp word [ebp + 0x1c], 0
je 0x49a9b2
mov eax, 0x821804c7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea esi, [ebx + 0x40]
push esi
mov dword [ebp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x38
xor edi, edi
mov dword [ebp - 4], 0
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], 0x3c
push edi
push eax
call fcn.004b40a0
add esp, 0xc
mov dword [ebp - 0x4c], 1
lea eax, [ebp - 0x54]
mov dword [ebp - 0x40], 1
push eax
push edi
push edi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x49aa26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
js 0x49aafe
jne 0x49aa15
xor edi, edi
jmp 0x49aa26
movzx edi, di
or edi, 0x83ff0000
test edi, edi
js 0x49aafe
mov eax, dword [ebp - 0x48]
cmp eax, 1
je 0x49aa64
add eax, 0xfffffffd
cmp eax, 1
ja 0x49aa54
push 0x1c
call fcn.004463f0
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x49aa82
mov ecx, eax
call fcn.004a9b20
jmp 0x49aa84
mov dword [ebx], 0
mov edi, 0x82181075
jmp 0x49aafe
push 0x1c
call fcn.004463f0
add esp, 4
mov dword [ebp + 8], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x49aa82
mov ecx, eax
call fcn.004a9970
jmp 0x49aa84
xor eax, eax
mov dword [ebx], eax
mov byte [ebp - 4], 0
test eax, eax
je 0x49aafe
push dword [ebp - 0x40]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push dword [ebp - 0x44]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.00403940
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test eax, eax
jne 0x49aac1
mov eax, 0x649aa0
push dword [ebp + 0x14]
mov ecx, dword [ebx]
push dword [ebp + 0x10]
push dword [ebp - 0x3c]
push eax
call fcn.004a8d80
mov edi, eax
test edi, edi
jns 0x49aaea
mov ecx, dword [ebx]
test ecx, ecx
je 0x49aaea
mov dword [ebx], 0
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 4
test eax, eax
je 0x49aafe
push eax
call fcn.00446420
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x49ef20
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x118]
sub esp, 0x118
push 0xffffffffffffffff
push 0x63edde
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x6eed24]
xor eax, ebp
mov dword [ebp + 0x114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], esi
lea eax, [esi + 4]
mov dword [esi], 0x666ce0
mov dword [ebp - 0x10], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
push 0x54
lea eax, [esi + 0x4c]
push 0
push eax
call fcn.004b40a0
xor eax, eax
mov dword [ebp], 0x114
mov word [esi + 0x2a4], ax
lea edi, [esi + 0x2a4]
mov word [esi + 0xa4], ax
lea ebx, [esi + 0xa4]
push 0x110
push eax
lea eax, [ebp + 4]
mov dword [esi + 0xa0], 1
push eax
mov dword [esi + 0x48], 0x58
call fcn.004b40a0
add esp, 0x18
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x49f040
mov eax, dword [ebp + 4]
cmp eax, 5
jae 0x49f047
cmp eax, 4
jne 0x49f040
cmp dword [ebp + 8], 0x5a
jae 0x49f047
mov dword [esi + 0x48], 0x4c
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], 0x104
mov dword [esi + 0x84], 0
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], 0x100
mov dword [esi + 0x7c], 0x880026
mov dword [esi + 0x54], 0
mov eax, dword [0x6f8c64]
mov dword [esi + 0x50], eax
mov eax, esi
mov dword [esi + 0x8c], 0x407f70
mov dword [esi + 0x4c], 0
mov dword [esi], 0x666da8
mov dword [esi + 0x28], 0x666db4
mov dword [esi + 0x4ac], 0
mov dword [esi + 0x4b0], 0
mov dword [esi + 0x4b4], 0
mov dword [esi + 0x4b8], 0
mov dword [esi + 0x4bc], 0
mov dword [esi + 0x4c0], 0
mov dword [esi + 0x4c4], 0
mov dword [esi + 0x4c8], 0
mov dword [esi + 0x4cc], 0
mov dword [esi + 0x4d4], 0
mov dword [esi + 0x4d8], 0
mov dword [esi + 0x4dc], 0
mov dword [esi + 0x4e0], 0
mov dword [esi + 0x4d0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.004b2558
lea esp, [ebp + 0x118]
pop ebp
ret
Function at 0x4a5cf0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63f3f0
mov eax, dword fs:[0]
push eax
sub esp, 0x2e4
mov eax, dword [0x6eed24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00413ef0
test al, al
je 0x4a5d39
push 0
push 0x64e3dc
push dword [edi + 4]
call dword [sym.imp.UxTheme.dll_SetWindowTheme]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x200000
push 0x200000
push 0x1036
push dword [edi + 4]
call ebx
push 0x10
push 0x10
push 0x1036
push dword [edi + 4]
call ebx
push 0x20
push 0x20
push 0x1036
push dword [edi + 4]
call ebx
push 0x400
push 0x400
push 0x1036
push dword [edi + 4]
call ebx
push 0x800
push 0x800
push 0x1036
push dword [edi + 4]
call ebx
push 0x4000
push 0x4000
push 0x1036
push dword [edi + 4]
call ebx
push 0x10000
push 0x10000
push 0x1036
push dword [edi + 4]
call ebx
push 0x1000000
push 0x1000000
push 0x1036
push dword [edi + 4]
call ebx
push 0x2000000
push 0x2000000
push 0x1036
push dword [edi + 4]
call ebx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0x10a2
push dword [edi + 4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x38], 0x28
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x24], 3
call ebx
push 0x2b4
lea eax, [ebp - 0x2ec]
push 0
push eax
call fcn.004b40a0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0x2ec]
add esp, 0xc
push 0x4011
push 0x2b4
push eax
push 0x80
push 0x666ea0
call esi
push eax
push 1
push 0x1003
push dword [edi + 4]
call ebx
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2ec]
push eax
push 0x80
push 0x666ea0
call esi
mov esi, eax
push esi
push 0
push 0x1003
push dword [edi + 4]
call ebx
lea eax, [ebp - 0x2f0]
mov dword [edi + 0x60], esi
push eax
push 0x6582c4
push 2
mov dword [ebp - 0x2f0], 0
call dword [sym.imp.SHELL32.dll_SHGetImageList]
test eax, eax
jns 0x4a5ee9
mov eax, dword [edi + 0x60]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 4], 0
jmp 0x4a5ef9
mov eax, dword [ebp - 0x2f0]
mov dword [edi + 0x5c], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4a5f03
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [edi + 0x5c]
push 0
push 0x1003
push dword [edi + 4]
call ebx
push 0
push 4
push 0x108e
push dword [edi + 4]
call ebx
mov ecx, edi
mov dword [edi + 0x54], 4
call fcn.004a5f50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b2558
mov esp, ebp
pop ebp
ret
Function at 0x4a8ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a8b40
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4a8b40
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4a8b32
lea ebx, [ebx]
cmp esi, edx
jae 0x4a8b40
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4a8b20
cmp esi, edx
jae 0x4a8b40
cmp word [esi], 0
je 0x4a8b40
mov eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4a8d80
Capabilities:
Connect to http server
Create http request
Reference http user-agent string

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea ecx, [ebx + 0xc]
call fcn.0047bd10
lea ecx, [ebx + 4]
call fcn.0047bd10
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows__U__Windows_NT_5.1__en_US__WebDAV
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebp, ebp
jne 0x4a8dce
call edi
test eax, eax
js 0x4a8df3
je 0x4a8dce
movzx eax, ax
or eax, 0x83ff0000
test eax, eax
js 0x4a8f5a
push ebp
lea ecx, [ebx + 4]
call fcn.0047bcd0
test eax, eax
jne 0x4a8dff
call edi
test eax, eax
js 0x4a8f5a
jne 0x4a8deb
xor eax, eax
jmp 0x4a8df3
movzx eax, ax
or eax, 0x83ff0000
test eax, eax
jns 0x4a8e18
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 0x4d
lea ecx, [ebx + 4]
call fcn.0047c600
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov ebp, dword [esp + 0x18]
mov ecx, eax
test ebp, ebp
jne 0x4a8e38
mov edi, 0x80070057
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
lea eax, [ebx + 0xc]
push eax
lea eax, [ecx - 1]
neg eax
sbb eax, eax
and eax, 0xf8000000
add eax, 0x8000000
push eax
xor eax, eax
cmp ecx, 1
setne al
lea eax, [eax*2 + 1]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebp
push dword [ebx + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
push eax
lea ecx, [ebx + 0xc]
call fcn.0047bcd0
test eax, eax
jne 0x4a8eaa
call edi
mov edi, eax
test edi, edi
js 0x4a8f58
jne 0x4a8e93
xor edi, edi
jmp 0x4a8e9c
movzx edi, di
or edi, 0x83ff0000
test edi, edi
jns 0x4a8eac
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
xor edi, edi
mov esi, ebp
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4a8eb1
sub esi, ecx
mov ecx, dword [ebx + 0x10]
sar esi, 1
test esi, esi
jg 0x4a8ef3
test ecx, ecx
je 0x4a8ed4
push ecx
call fcn.00446420
add esp, 4
mov eax, edi
mov dword [ebx + 0x10], 0
pop edi
pop esi
pop ebp
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
pop ebx
pop ecx
ret 0x10
cmp ebp, ecx
je 0x4a8f4a
lea eax, [esi*2 + 2]
push eax
push ecx
call fcn.00446560
mov edx, eax
add esp, 8
test edx, edx
je 0x4a8f58
cmp dword [ebx + 0x10], 0
jne 0x4a8f1d
mov ecx, dword [ebx + 0x14]
xor eax, eax
mov word [edx + ecx*2], ax
lea eax, [esi + esi]
mov dword [ebx + 0x10], edx
push eax
push ebp
push edx
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x14], esi
call fcn.004b3b20
mov eax, dword [ebx + 0x10]
add esp, 0xc
mov ecx, dword [ebx + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
cmp esi, dword [ebx + 0x14]
jae 0x4a8f58
xor eax, eax
mov word [ecx + esi*2], ax
mov dword [ebx + 0x14], esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4a9ef0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor edi, edi
test ebp, ebp
je 0x4a9f63
push ebx
push esi
mov edi, edi
movzx eax, word [ecx + 0xc]
mov edx, dword [ecx + 4]
or eax, 2
mov esi, dword [ecx]
mov ebx, eax
xor ebx, 1
imul ebx, eax
mov eax, dword [esp + 0x14]
shr ebx, 8
xor bl, byte [edi + eax]
movzx eax, bl
xor eax, edx
shr edx, 8
movzx eax, al
mov eax, dword [esi + eax*4]
xor eax, edx
mov edx, dword [ecx + 0xc]
mov dword [ecx + 4], eax
movzx eax, al
add eax, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [esi + eax*4]
mov eax, dword [esp + 0x14]
mov dword [ecx + 0xc], edx
mov byte [edi + eax], bl
inc edi
cmp edi, ebp
jb 0x4a9f00
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
ret 8

Function at 0x4a9f70
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
xor ebp, ebp
cmp dword [esp + 0xc], ebp
jbe 0x4a9fe8
push ebx
push esi
push edi
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov edx, dword [ecx + 4]
mov esi, dword [ecx]
movzx edi, word [ecx + 0xc]
mov bl, byte [eax + ebp]
or edi, 2
movzx eax, bl
xor eax, edx
shr edx, 8
movzx eax, al
mov eax, dword [esi + eax*4]
xor eax, edx
mov edx, dword [ecx + 0xc]
mov dword [ecx + 4], eax
movzx eax, al
add eax, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 8], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [esi + eax*4]
mov eax, edi
xor eax, 1
mov dword [ecx + 0xc], edx
mov edx, dword [esp + 0x14]
imul eax, edi
shr eax, 8
xor al, bl
mov byte [edx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x4a9f80
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
ret 8

Function at 0x4aa000
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00459ee0
mov ecx, dword [esp + 0x10]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], 0x12345678
mov dword [esi + 8], 0x23456789
mov dword [esi + 0xc], 0x34567890
test ecx, ecx
je 0x4aa097
push ebx
push ebp
push edi
mov dword [esp + 0x10], eax
mov ebx, 0x12345678
mov ebp, 0x23456789
mov edi, 0x34567890
mov ecx, dword [esp + 0x18]
movzx eax, byte [eax + ecx]
mov ecx, ebx
xor eax, ebx
shr ecx, 8
movzx edx, al
mov eax, dword [esi]
mov ebx, dword [eax + edx*4]
xor ebx, ecx
movzx eax, bl
add eax, ebp
mov dword [esi + 4], ebx
imul ebp, eax, 0x8088405
inc ebp
mov eax, ebp
mov dword [esi + 8], ebp
shr eax, 0x18
xor eax, edi
shr edi, 8
movzx ecx, al
mov eax, dword [esi]
xor edi, dword [eax + ecx*4]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esi + 0xc], edi
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x1c]
jb 0x4aa040
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret 8
Function at 0x4aad60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
mov dword [esp], ecx
mov eax, 0xcccccccd
mov ecx, dword [esp + 8]
push ebx
push esi
push edi
mov ebx, dword [ecx + 4]
xor edi, edi
and ebx, 0x7fffffff
mov esi, 0x811c9dc5
mul ebx
shr edx, 3
inc edx
test ebx, ebx
je 0x4aada4
mov ecx, dword [ecx]
push ebp
lea ebp, [edx + edx]
movzx eax, word [ecx]
add edi, edx
imul esi, esi, 0x1000193
add ecx, ebp
xor esi, eax
cmp edi, ebx
jb 0x4aad90
pop ebp
mov eax, dword [esp + 0xc]
pop edi
mov eax, dword [eax + 0x18]
and eax, esi
pop esi
pop ebx
pop ecx
ret 4