joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e3b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43e3e3
push esi
call fcn.004414c0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43e3dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43e469
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43e452
mov eax, dword [esi + 8]
test eax, eax
je 0x43e407
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43e44e
cmp eax, 2
je 0x43e452
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43e3fa
cmp eax, 3
je 0x43e42d
cmp eax, 1
jne 0x43e3fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43e3fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43e3fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043e490
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43e478
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043e490
add esp, 4
pop esi
ret

Function at 0x44ac80
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x48a2dc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x44ac93
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x44acd4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x48a384]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x44ad06
mov bl, byte [esp + ecx + 0x4c]
jmp 0x44ad0a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x44acfb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x44ad28
mov bl, byte [esp + ecx + 0x4c]
jmp 0x44ad2c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x44ad1d
xor ecx, ecx
mov eax, 0x48a2ec
xor ebx, ebx
mov bl, byte [ecx + 0x48a394]
cmp byte [esp + ebx + 0x14], 0
je 0x44ad57
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x48a3ac]
cmp byte [esp + ebx + 0x14], 0
je 0x44ad6e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x44ad3e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x44acc7
lea edx, [esp + 0x84]
push edx
call fcn.0044adb0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x45ff15
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45ff4d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045dfcc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045dfa4
jmp 0x45ff59
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x461603
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x461645
call fcn.004670ba
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x461645
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x46163c
xor eax, eax
jmp 0x46164d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00461653
pop edi
pop esi
pop ebx
ret 4

Function at 0x4675ea
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x467618
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x467636
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00467550
jmp 0x467636
mov eax, dword [esi + 0x14]
test eax, eax
je 0x467636
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00467550
test edi, edi
mov eax, edi
jne 0x467620
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402c20
Capabilities:
Encode data using base64

Disassembly:
inc eax
add byte [esi + 0x435c00], bh
push 0x400
add eax, 0x3e8
push esi
push ebx
mov dword [0x42eb6c], eax
call dword [0x407094]
push 3
push 0x80000000
push esi
call fcn.004055c0
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
mov dword [0x409010], edi
jne 0x402c65
mov eax, 0x4090fc
jmp 0x402e3d
push esi
mov esi, 0x434c00
push esi
call fcn.004058e9
push esi
call fcn.00405423
push eax
push 0x436000
call fcn.004058e9
push ebx
push edi
call dword [0x407090]
cmp eax, ebx
mov dword [0x428b88], eax
mov esi, eax
jle 0x402d80
mov ebx, 0x420b88
mov eax, dword [0x42eb74]
mov edi, esi
neg eax
sbb eax, eax
and eax, 0x7e00
add eax, 0x200
cmp esi, eax
jl 0x402cb9
mov edi, eax
push edi
push ebx
call fcn.00403066
test eax, eax
je 0x402dea
cmp dword [0x42eb74], 0
jne 0x402d4b
push 0x1c
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00405581
mov eax, dword [ebp - 0x28]
test eax, 0xfffffff0
jne 0x402d59
cmp dword [ebp - 0x24], 0xdeadbeef
jne 0x402d59
cmp dword [ebp - 0x18], 0x74736e49
jae 0x402d6b
jne 0x402d59
cmp dword [ebp - 0x1c], 0x74666f73
jne 0x402d59
cmp dword [ebp - 0x20], 0x6c6c754e
jne 0x402d59
or dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [0x414b78]
and eax, 2
or dword [0x42ec00], eax
mov eax, dword [ebp - 0x10]
cmp eax, esi
mov dword [0x42eb74], ecx
jg 0x402de3
pop ebp
sub eax, edi
push ds
jmp 0x402cf5
push es
stosb byte es:[edi], al
pop ebp
popfd
push ecx
mov edi, 0xebbe6dd6
invalid
fidivr dword [esi]
sbb al, 0xa4
div dword [ebp + eax*8 - 0x4426334a]
pop ebp
mov dword [esi + 0x1f1f71ff], esi
push dword [ecx + 0x1f]
pop ds
jle 0x402d40
mov cl, byte [ebx - 0x1a]
int 0xb1
push edx
mov edx, 0x3574ec39
wait
wait
push esi
not byte [esi - 0x70cdb961]
invalid
cld
or al, 0x98
arpl word [edi - 0x5c5c5d32], bp
invalid
add byte [edi], cl
mov es, word [edx + 0x1020000]
inc edi
or dword [eax], eax
invalid
add dword [edi + 9], eax
inc eax
add byte [edi + 0x208c2b69], cl
add byte [eax + esi], cl
pop ss
imul ebp, dword [ebx], 0xc00208c
xor byte [edi], dl
dec esp
fcom qword [ecx + ecx*4]
invalid
dec esi
invalid
invalid
Function at 0x402a90
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4119fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov al, byte [esp + 7]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x14], esi
mov byte [esi + 4], al
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x124], ebx
call fcn.00410d50
lea ecx, [esi + 0x1c]
mov byte [esp + 0x124], 1
call fcn.00410d50
lea ecx, [esi + 0x20]
mov byte [esp + 0x124], 2
call fcn.00410d50
lea ecx, [esi + 0x24]
mov byte [esp + 0x124], 3
call fcn.00410d50
lea ecx, [esi + 0x28]
mov byte [esp + 0x124], 4
call fcn.00410d50
lea ecx, [esi + 0x7c]
mov byte [esp + 0x124], 5
call fcn.00410d50
lea ecx, [esi + 0x80]
mov byte [esp + 0x124], 6
call fcn.00410d50
lea ecx, [esi + 0x84]
mov byte [esp + 0x124], 7
call fcn.00410d50
lea ecx, [esi + 0x88]
mov byte [esp + 0x124], 8
call fcn.00410d50
lea ecx, [esi + 0x8c]
mov byte [esp + 0x124], 9
call fcn.00410d50
lea ecx, [esi + 0x90]
mov byte [esp + 0x124], 0xa
call fcn.00410d50
lea ecx, [esi + 0xa0]
mov byte [esp + 0x124], 0xb
call fcn.00410d50
mov edi, dword [0x413090]
push str.VdDiagCheckUpdateEvent
push 1
push 1
push ebx
mov byte [esp + 0x134], 0xc
mov dword [esi], 0x4135e0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call edi
push str.VdDiagGetPlaylistEvent
push 1
mov dword [esi + 0x4c], eax
push 1
push ebx
call edi
push str.VdDiagAnalyzeVideoEvent
push 1
push 1
push ebx
mov dword [esi + 0x50], eax
call edi
push str.VdDiagDownloadVideoEvent
push 1
push 1
push ebx
mov dword [esi + 0x54], eax
call edi
push str.VdDiagTestNetworkEvent
push 1
push 1
push ebx
mov dword [esi + 0x60], eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
push ebx
mov dword [esi + 0x58], eax
call dword [0x413094]
lea edx, [esp + 0x18]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
cmp eax, ebx
je 0x402cf3
mov byte [eax + 1], bl
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
push eax
mov ecx, 0x419854
mov byte [esp + 0x128], 0xd
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 0xc
call sub.MFC42.DLL_CString::CString
mov ecx, dword [0x419854]
push ecx
push str._sconfig.ini
push 0x419850
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0xc]
push 0x4197b0
push 0x419854
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
mov ecx, 0x419948
push eax
mov byte [esp + 0x128], 0xe
call fcn.00407bb0
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 0xc
call sub.MFC42.DLL_CString::CString
mov eax, dword [0x419850]
mov dword [0x419960], 1
push eax
push 2
push str.diaglevel
push 0x4185b4
mov dword [0x41995c], 1
call dword [0x413098]
mov dword [0x41994c], eax
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x4061f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x412071
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x30]
call fcn.00410d50
lea edi, [esi + 0x34]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.00410d50
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 1
call fcn.00410d50
mov eax, dword [esp + 0x20]
mov ecx, edi
push eax
mov byte [esp + 0x1c], 2
mov dword [esi], 0x413a68
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esi + 8]
push ecx
call dword [0x413068]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x20], ebx
mov dword [esi + 4], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x407590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4121c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x38], 0
mov eax, dword [esi + 8]
push eax
call dword [0x413038]
push 1
mov ecx, esi
mov dword [esp + 0x44], eax
call sub.MFC42.DLL_CDC::SetBkMode
mov ebx, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov al, byte [esp + 0x50]
test al, al
je 0x407671
mov edi, dword [0x413518]
push ebp
mov ebp, dword [esi]
push 0x14
call edi
push eax
mov ecx, esi
call dword [ebp + 0x38]
mov eax, dword [esp + 0x50]
mov edx, ebx
mov ebp, dword [edx]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ebp
mov ebp, dword [edx + 4]
push eax
mov dword [esp + 0x1c], ebp
lea eax, [esp + 0x18]
mov ebp, dword [edx + 8]
push ecx
push eax
mov dword [esp + 0x28], ebp
mov edx, dword [edx + 0xc]
mov dword [esp + 0x2c], edx
call dword [0x41351c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x28], edx
mov edx, dword [esi]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
lea ebp, [esp + 0x24]
push 0x8024
push ebp
push ecx
push eax
mov ecx, esi
call dword [edx + 0x70]
mov ebp, dword [esi]
push 0x10
call edi
push eax
mov ecx, esi
call dword [ebp + 0x38]
pop ebp
jmp 0x407681
mov edi, dword [esi]
push 0x12
call dword [0x413518]
push eax
mov ecx, esi
call dword [edi + 0x38]
mov eax, dword [esp + 0x44]
mov edx, dword [esi]
push 0x8024
push ebx
mov ecx, dword [eax - 8]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x70]
mov ecx, dword [esp + 0x40]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x38]
mov edx, dword [esp + 0xc]
mov ecx, esi
push edx
call sub.MFC42.DLL_CDC::SetBkMode
lea ecx, [esp + 0x44]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x4076e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4121e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
xor eax, eax
mov ecx, 0xa
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax - 8]
lea edi, [esp + 8]
push 0x520
mov esi, dword [ecx]
push edi
push edx
push eax
call dword [esi + 0x70]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
mov esi, dword [esp + 0x28]
sub ecx, edx
mov dword [esp + 0x20], 0xffffffff
mov dword [esi], ecx
lea ecx, [esp + 0x30]
mov dword [esi + 4], eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x407d10
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x4122f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea ebx, [esi + 8]
mov ecx, ebx
call fcn.00410d50
lea ebp, [esi + 0xc]
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x20], edi
call fcn.00410d50
lea ecx, [esi + 0x10]
mov byte [esp + 0x20], 1
call fcn.00410d50
lea ecx, [esi + 0x14]
mov byte [esp + 0x20], 2
call fcn.00410d50
lea ecx, [esi + 0x18]
mov byte [esp + 0x20], 3
call fcn.00410d50
lea ecx, [esi + 0x1c]
mov byte [esp + 0x20], 4
call fcn.00410d50
lea ecx, [esi + 0x20]
mov byte [esp + 0x20], 5
call fcn.00410d50
lea ecx, [esi + 0x24]
mov byte [esp + 0x20], 6
call fcn.00410d50
lea ecx, [esi + 0x358]
mov byte [esp + 0x20], 7
call fcn.00410d50
mov al, byte [esp + 0x13]
mov dword [esi + 0x368], edi
mov byte [esi + 0x364], al
mov dword [esi + 0x36c], edi
mov dword [esi + 0x370], edi
push str.Mozilla_5.0__Windows__U__Windows_NT_6.1__en_US_
mov ecx, ebx
mov byte [esp + 0x24], 9
mov dword [esi], 0x413c04
mov dword [esi + 0x350], edi
mov dword [esi + 0x34c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
call sub.MFC42.DLL_CString::operator_1
mov ecx, ebp
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x10]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x14]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x1c]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x20]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x24]
call sub.MFC42.DLL_CString::Empty
mov dword [esi + 0x390], edi
mov dword [esi + 0x398], edi
mov dword [esi + 0x394], edi
mov dword [esi + 0x39c], edi
mov dword [esi + 0x380], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x3a0], edi
mov dword [esi + 0x3a4], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4085f8
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
sub esp, 0x400
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x34c]
test eax, eax
jne 0x408623
mov eax, dword [esi + 8]
push 0
push 0x419858
push 0x419858
push 1
push eax
call dword [0x413588]
jmp 0x4086b1
cmp eax, 1
jne 0x408642
mov eax, dword [esi + 8]
push 0
push 0x419858
push 0x419858
push 0
push eax
call dword [0x413588]
jmp 0x4086b1
mov eax, dword [esi + 0x248]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esi + 0x24c]
push eax
push edi
lea ecx, [esp + 0x18]
push str.httphttp:___s:_d
push ecx
call ebx
mov eax, dword [esi + 8]
mov ebp, dword [0x413588]
add esp, 0x10
lea edx, [esp + 0x10]
push 0
push 0x419858
push edx
push 3
push eax
call ebp
test eax, eax
mov dword [esi + 0x3c], eax
jne 0x4086b4
mov eax, dword [esi + 0x248]
lea ecx, [esp + 0x10]
push eax
push edi
push str.socks_s:_d
push ecx
call ebx
mov eax, dword [esi + 8]
add esp, 0x10
lea edx, [esp + 0x10]
push 0
push 0x419858
push edx
push 3
push eax
call ebp
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x4086d0
call dword [0x413074]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret 8
mov ecx, dword [esp + 0x418]
mov edx, dword [esp + 0x414]
push 0
push 0x400000
push 3
push 0
push 0
push ecx
push edx
push eax
call dword [0x413584]
mov edx, eax
test edx, edx
mov dword [esi + 0x40], edx
jne 0x408719
call dword [0x413074]
mov ecx, esi
call fcn.004087d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret 8
mov eax, dword [esi + 0x350]
mov ebp, dword [0x413580]
test eax, eax
je 0x408754
lea ebx, [esi + 0x48]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x408754
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push ebx
push 0x2b
push edx
call ebp
test eax, eax
jne 0x408754
call dword [0x413074]
mov eax, dword [esi + 0x350]
test eax, eax
je 0x40878f
lea edx, [esi + 0x148]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40878f
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x40]
not ecx
push ecx
push edx
push 0x2c
push eax
call ebp
test eax, eax
jne 0x40878f
call dword [0x413074]
push 0
call dword [0x41357c]
test eax, eax
je 0x4087b7
call dword [0x413074]
mov ecx, esi
call fcn.004087d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x400
ret 8
Function at 0x408b7e
Capabilities:
Check http status code
Send data
Send http request

Disassembly:
push 0xffffffffffffffff
push 0x412398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
mov edx, dword [esp + 0x5c]
push ebp
push esi
mov esi, ecx
push edi
push 0
lea ecx, [esp + 0x14]
mov eax, dword [esi + 0x10]
push 0x400040
push ecx
push eax
mov eax, dword [esi + 0x40]
push str.HTTP_1.0
push edx
push str.POST
push eax
mov ebp, 1
mov dword [esp + 0x30], 0x418e54
call dword [0x413598]
mov edx, eax
test edx, edx
mov dword [esi + 0x44], edx
jne 0x408bca
call dword [0x413074]
xor eax, eax
jmp 0x408d5b
mov edi, str.Accept:___r_n
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [0x413594]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x80000000
push ecx
push str.Accept:___r_n
push edx
call ebx
test eax, eax
jne 0x408bfe
call dword [0x413074]
xor eax, eax
jmp 0x408d5b
mov edi, str.Accept_Language:_zh_cn_zh_q0.5
or ecx, 0xffffffff
xor eax, eax
push 0x20000000
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 0x44]
push str.Accept_Language:_zh_cn_zh_q0.5
push ecx
call ebx
test eax, eax
jne 0x408c2f
call dword [0x413074]
xor eax, eax
jmp 0x408d5b
mov edi, str.Keep_Alive:_300
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi + 0x44]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x20000000
push ecx
push str.Keep_Alive:_300
push edx
call ebx
test eax, eax
jne 0x408c60
call dword [0x413074]
xor eax, eax
jmp 0x408d5b
mov eax, dword [esi + 0x20]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x408c88
push 0x10000000
push ecx
push eax
mov eax, dword [esi + 0x44]
push eax
call ebx
test eax, eax
jne 0x408c88
call dword [0x413074]
xor eax, eax
jmp 0x408d5b
mov eax, dword [esi + 0x24]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x408cb0
push 0x10000000
push ecx
mov ecx, dword [esi + 0x44]
push eax
push ecx
call ebx
test eax, eax
jne 0x408cb0
call dword [0x413074]
xor eax, eax
jmp 0x408d5b
push str.Content_Type:_application_x_www_form_urlencoded_r_n
lea ecx, [esp + 0x6c]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x68]
push edx
mov edx, dword [esp + 0x70]
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov eax, dword [esi + 0x44]
push eax
call dword [0x413590]
mov edi, dword [0x413074]
test eax, eax
jne 0x408ce9
call edi
xor ebp, ebp
mov eax, dword [esi + 0x44]
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x13
push eax
mov dword [esp + 0x28], 0x40
call dword [0x413578]
test eax, eax
jne 0x408d24
call edi
lea ecx, [esp + 0x68]
mov dword [esp + 0x60], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x408d5b
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
cmp eax, 0xc8
mov dword [esi + 0x38c], eax
mov dword [esp + 0x60], 0xffffffff
lea ecx, [esp + 0x68]
je 0x408d54
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x408d5b
call sub.MFC42.DLL_CString::CString
mov eax, ebp
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 0xc
Function at 0x408d70
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x44]
test eax, eax
jne 0x408d86
call dword [0x413074]
xor eax, eax
pop ebx
ret 0xc
mov edx, dword [esp + 0xc]
push ebp
mov ecx, edx
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
push edi
xor eax, eax
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
push edx
mov dword [eax], 0
mov eax, dword [ebx + 0x44]
push esi
push eax
call dword [0x41359c]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x408dcf
call dword [0x413074]
xor eax, eax
pop ebx
ret 0xc
mov eax, 1
pop ebx
ret 0xc
Function at 0x40a590
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [section..rdata]
mov esi, eax
test esi, esi
jne 0x40a5f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [0x413004]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [0x4130f0]
mov edx, dword [esp + 4]
push edx
call dword [0x413008]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc

Function at 0x40a800
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [0x4134c0]
mov esi, eax
cmp esi, 0x20
ja 0x40a8f2
lea ecx, [esp + 0x10]
push ecx
push str..htm
push 0x80000000
mov ecx, edi
call fcn.0040a590
test eax, eax
jne 0x40a8f2
mov ebx, dword [0x4130fc]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x80000000
mov ecx, edi
call fcn.0040a590
test eax, eax
jne 0x40a8f2
mov edi, dword [sym.imp.MSVCRT.dll__mbsstr]
lea edx, [esp + 0x10]
push str.__1_
push edx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a8c3
lea eax, [esp + 0x10]
push 0x4192a8
push eax
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a8c3
lea ecx, [esp + 0x10]
push ecx
call dword [0x4130f4]
lea esi, [esp + eax + 0xf]
jmp 0x40a8c6
mov byte [esi], 0
push 0x4181dc
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [0x4130f8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8