joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438a50
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x52ce7b
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x568fd0]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x568fd0]
xor eax, esp
push eax
lea eax, [esp + 0x110]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x28], edi
cmp edi, ebp
je 0x438c01
cmp word [edi], bp
je 0x438c01
lea esi, [esp + 0x44]
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
call fcn.0041ad10
mov ebx, esi
mov dword [esp + 0x118], ebp
call fcn.0041ad80
call fcn.0041ad10
push 0x54e4f4
push edi
call fcn.00502f0c
mov ecx, esi
push ecx
lea edi, [esp + 0x44]
call fcn.0041a4d0
add esp, 0xc
cmp dword [esp + 0x38], ebp
jne 0x438bed
mov ebx, str.UpdateLog
lea eax, [esp + 0x1c]
mov ecx, esi
call fcn.0041a6d0
mov ecx, eax
mov ebx, str.ObsoleteFiles
lea eax, [esp + 0x24]
call fcn.0041a6d0
mov ecx, eax
mov ebx, str.File
lea eax, [esp + 0x18]
call fcn.0041a6d0
mov ebp, dword [esp + 0x18]
mov edx, ebp
neg edx
sbb edx, edx
test edx, fcn.004c8c20
je 0x438bd0
mov edi, ebp
mov ebx, str.File
lea eax, [esp + 0x34]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], edi
call fcn.0041a7b0
mov ebp, dword [eax]
mov ebx, str.path
lea eax, [esp + 0x30]
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebp
call fcn.0041a740
mov eax, dword [eax]
test eax, eax
je 0x438b8e
mov esi, dword [eax + 8]
test esi, esi
je 0x438b8e
cmp word [esi], 0
je 0x438b8e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x438b8e
push eax
push esi
call fcn.005088e6
add esp, 8
test eax, eax
je 0x438bbe
test edi, edi
je 0x438b9f
mov eax, dword [edi + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
jmp 0x438bab
mov dword [esp + 0x24], 0
lea eax, [esp + 0x24]
mov ecx, dword [eax]
lea esi, [esp + 0x20]
lea edi, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call fcn.0041ab70
mov edx, ebp
neg edx
sbb edx, edx
test edx, fcn.004c8c20
jne 0x438b32
mov eax, dword [esp + 0x28]
push 0x54e548
push eax
call fcn.00502f0c
add esp, 8
mov edi, eax
lea ecx, [esp + 0x44]
call fcn.0041a5b0
lea ebx, [esp + 0x44]
mov dword [esp + 0x118], 0xffffffff
call fcn.0041ad80
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.00501b9a
add esp, 0x108
ret
Function at 0x438c30
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x52ce48
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x568fd0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
mov eax, dword [0x568fd0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, edx
test edi, edi
je 0x438c7d
cmp word [edi], 0
je 0x438c7d
push 0
push edi
call fcn.005088e6
add esp, 8
test eax, eax
jne 0x438ca1
test esi, esi
je 0x438d33
push 0
push esi
call fcn.005088e6
add esp, 8
test eax, eax
jne 0x438ca8
call fcn.00438d70
test eax, eax
jne 0x438d33
xor eax, eax
jmp 0x438d4e
push esi
lea ecx, [esp + 0x14]
call fcn.004040b0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x74], 0
call fcn.004daea0
mov bl, 2
mov byte [esp + 0x70], bl
cmp dword [esp + 0x28], 8
jb 0x438ce2
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00501b8f
add esp, 4
lea eax, [esp + 0x2c]
xor edx, edx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], dx
call fcn.004db0d0
push eax
mov byte [esp + 0x74], 3
call fcn.004ec2e0
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], bl
call fcn.004dae70
lea ecx, [esp + 0x48]
mov dword [esp + 0x70], 0xffffffff
call fcn.004dae70
test edi, edi
je 0x438d49
cmp word [edi], 0
je 0x438d49
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x438d4e
mov eax, 1
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00501b9a
add esp, 0x68
ret

Function at 0x438d70
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
sub esp, 0x218
mov eax, dword [0x568fd0]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 4]
push edx
push 0
push str.tmp
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, eax
test edi, edi
je 0x438de0
lea eax, [esp + 4]
push eax
push esi
mov ecx, ebx
call fcn.00438e00
add esp, 8
mov eax, edi
mov ecx, dword [esp + 0x218]
pop edi
xor ecx, esp
call fcn.00501b9a
add esp, 0x218
ret
Function at 0x439510
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x210
mov eax, dword [0x568fd0]
xor eax, esp
mov dword [esp + 0x20c], eax
test esi, esi
je 0x43959e
cmp word [esi], 0
je 0x43959e
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x43957c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea ecx, [esp + 4]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00501b9a
add esp, 0x210
ret
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00501b9a
add esp, 0x210
ret
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov al, 1
call fcn.00501b9a
add esp, 0x210
ret
Function at 0x43b6a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x43b6b1
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x43b6cf
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x43b706
test ecx, ecx
je 0x43b6ff
test esi, esi
ja 0x43b6c0
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x43b720
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x43b731
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x43b74f
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x43b786
test ecx, ecx
je 0x43b77f
test esi, esi
ja 0x43b740
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x43e1e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x56ff20], ecx
inc edx
cmp edx, 0x100
jb 0x43e1e3
cmp edx, 0x800
jae 0x43e2b9
lea ecx, [ecx]
mov eax, dword [edx*4 + 0x56fb20]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x56ff20]
inc edx
mov dword [edx*4 + 0x56ff1c], eax
cmp edx, 0x800
jb 0x43e290
mov dword [0x56dfa8], 0x43ed30
call fcn.0043ef10
test eax, eax
jne 0x43e2d6
mov dword [0x56dfa8], 0x43ede0
pop ecx
ret
Function at 0x43e4d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x568fd0]
xor eax, esp
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0xb4]
push ebx
push ebp
mov ebp, dword [esp + 0xc8]
push esi
push edi
xor ebx, ebx
mov edi, 1
mov esi, edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
cmp dword [eax + 0x14], edi
je 0x43e517
mov eax, edi
jmp 0x43e66d
mov eax, dword [eax + 0x10]
push ecx
movzx ecx, byte [eax]
push ecx
lea ecx, [esp + 0x30]
call fcn.0043efa0
add esp, 8
cmp eax, ebx
jne 0x43e66d
mov edx, dword [esp + 0xd4]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x50], edx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x78], edi
lea ecx, [ecx]
mov eax, 0x40000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
cmp dword [esp + 0xcc], ebx
ja 0x43e5ac
jb 0x43e5a1
cmp dword [esp + 0xc8], eax
jae 0x43e5ac
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push ebp
call eax
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x43e659
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x4c]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0xd8]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
lea esi, [esp + 0x38]
call fcn.0043f190
mov esi, eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x24], eax
add esp, 0x10
sub dword [esp + 0xc8], eax
sbb dword [esp + 0xcc], ebx
cmp esi, ebx
jne 0x43e659
mov ecx, dword [esp + 0x50]
cmp dword [esp + 0x4c], ecx
je 0x43e63e
cmp eax, ebx
jne 0x43e628
cmp edi, dword [esp + 0x4c]
je 0x43e63e
push eax
mov eax, dword [ebp + 4]
push ebp
call eax
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x43e580
jmp 0x43e659
cmp ecx, dword [esp + 0xd4]
jne 0x43e654
cmp dword [esp + 0x14], ebx
jne 0x43e654
cmp dword [esp + 0x20], 1
je 0x43e659
mov esi, 1
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 4]
push ecx
push eax
call edx
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00501b9a
add esp, 0xb0
ret
Function at 0x43f480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push ebp
push esi
mov esi, dword [ecx]
xor ebp, ebp
and esi, 7
cmp eax, 5
jae 0x43f49d
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esp + 0x14]
push ebx
lea ebx, [edx + eax - 4]
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
lea edi, [edx + ebp]
cmp edi, ebx
jae 0x43f4cd
lea ebx, [ebx]
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x43f4cd
inc edi
cmp edi, ebx
jb 0x43f4c0
mov ebp, edi
sub ebp, edx
mov eax, ebp
sub eax, dword [esp + 0x10]
cmp edi, ebx
jae 0x43f5d5
cmp eax, 3
jbe 0x43f500
xor esi, esi
mov al, byte [edi + 4]
mov dword [esp + 0x10], ebp
test al, al
je 0x43f53b
cmp al, 0xff
je 0x43f53b
and esi, 3
add esi, esi
or esi, 1
inc ebp
jmp 0x43f4b3
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x43f4e6
movzx ecx, byte [esi + 0x54e0b8]
mov eax, edi
sub eax, ecx
cmp byte [esi + 0x54e0b0], 0
mov al, byte [eax + 4]
je 0x43f529
test al, al
je 0x43f529
cmp al, 0xff
jne 0x43f4e6
and esi, 3
add esi, esi
mov dword [esp + 0x10], ebp
or esi, 1
inc ebp
jmp 0x43f4b3
movzx ecx, byte [edi + 3]
movzx edx, al
movzx eax, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, eax
shl edx, 8
or edx, ecx
lea esp, [esp]
sub edx, ebp
sub edx, 5
mov eax, edx
test esi, esi
je 0x43f5a7
movzx edx, byte [esi + 0x54e0b8]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x43f58c
cmp bl, 0xff
jne 0x43f5a3
mov ebx, dword [esp + 0x14]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x43f560
mov ebx, dword [esp + 0x14]
mov edx, eax
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, eax
shr edx, 8
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x1c]
mov byte [edi + 3], cl
mov byte [edi + 1], al
add ebp, 5
jmp 0x43f4b3
pop edi
pop ebx
cmp eax, 3
jbe 0x43f5ec
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
lea ecx, [eax - 1]
mov eax, dword [esp + 0x18]
shl esi, cl
and esi, 7
mov dword [eax], esi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
Function at 0x441290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x526f80
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x568fd0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
xor edi, edi
cmp eax, edi
je 0x441444
cmp dword [eax + 0x14], edi
je 0x441444
cmp dword [ebp + 0xc], edi
jle 0x441304
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esi + 0x30], 0
mov ebx, eax
jbe 0x441302
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov ecx, dword [ebp + 0xc]
sub eax, ebx
sub ecx, eax
mov dword [ebp + 0xc], ecx
test ecx, ecx
jg 0x4412e0
xor edi, edi
mov eax, dword [esi + 0x34]
mov edx, dword [eax + 4]
lea ebx, [esi + 0x34]
mov ecx, ebx
mov dword [esp + 0x18], ebx
call edx
mov dword [esp + 0x50], edi
mov eax, dword [esi + 0x2c]
mov eax, dword [eax]
lea edi, [esi + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [edi]
mov dword [esp + 0x1c], eax
jmp 0x441330
mov ecx, dword [edi + 0x18]
mov dword [esp + 0x28], ecx
mov ecx, dword [edi]
test eax, eax
je 0x441341
cmp eax, ecx
je 0x44134a
call fcn.00501daa
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
cmp dword [esp + 0x20], edx
je 0x4413f1
test eax, eax
jne 0x4413ea
call fcn.00501daa
xor eax, eax
mov ecx, dword [esp + 0x20]
cmp ecx, dword [eax + 0x18]
jne 0x441375
call fcn.00501daa
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x442fe0
lea ebx, [esp + 0x34]
mov dword [esp + 0x1c], eax
call fcn.00442030
add esp, 8
mov byte [esp + 0x50], 1
mov edx, dword [esi + 0xc]
mov esi, dword [edx + 0x10]
push eax
call fcn.004d5bc0
push eax
push 0x2c
push str..HttpThread.cpp
push str.HttpThread::Shutdown
lea ecx, [esp + 0x48]
call fcn.004d5ba0
push eax
mov ecx, esi
call fcn.004d7e70
mov ecx, ebx
mov byte [esp + 0x50], 0
call fcn.004d5ab0
lea esi, [esp + 0x1c]
call fcn.0044e400
mov ebx, dword [esp + 0x18]
mov esi, dword [ebp + 8]
mov eax, dword [esp + 0x1c]
jmp 0x441330
mov eax, dword [eax]
jmp 0x441367
mov eax, dword [edi + 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, edi
call fcn.0046d270
mov eax, dword [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], 0
mov dword [eax], eax
mov edi, dword [edi + 0x18]
mov dword [esp + 0x50], 0xffffffff
mov dword [edi + 8], edi
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov ecx, dword [esi + 0xc]
call fcn.004d9af0
mov ecx, dword [esi + 0xc]
xor edi, edi
cmp ecx, edi
je 0x441441
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x442b10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x527833
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x568fd0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x54fad4
mov dword [esp + 0x18], 8
mov eax, dword [esi + 0x30]
test eax, eax
je 0x442b57
push eax
call fcn.00501b8f
add esp, 4
mov eax, dword [esi + 0x80]
test eax, eax
je 0x442b83
lea edi, [eax + 4]
mov ecx, edi
call fcn.004d5b90
test al, al
je 0x442b83
test edi, edi
je 0x442b78
lea eax, [edi - 4]
jmp 0x442b7a
xor eax, eax
push eax
call fcn.004e2bd0
add esp, 4
mov byte [esp + 0x18], 7
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x442b96
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov byte [esp + 0x18], 6
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x442ba9
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov byte [esp + 0x18], 5
mov eax, dword [esi + 0x28]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x442bcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x18], 4
mov eax, dword [esi + 0x24]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x442bf1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x18], 3
mov eax, dword [esi + 0x20]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x442c15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x18], 2
mov eax, dword [esi + 0x1c]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x442c39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x18], 1
mov eax, dword [esi + 0x18]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x442c5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x18], 0
mov eax, dword [esi + 0x14]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x442c81
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
add esi, 0xc
push esi
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
je 0x442ca2
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x442cc0
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x52b538
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push edi
mov eax, dword [0x568fd0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov edi, ecx
xor ecx, ecx
mov dword [esp + 0x18], ecx
lea eax, [esi + 0x14]
cmp edi, ecx
je 0x442d0f
mov ecx, edi
lea ebx, [ecx + 2]
jmp 0x442d00
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x442d00
sub ecx, ebx
sar ecx, 1
push edi
mov ebx, ecx
call fcn.0040aea0
push esi
mov eax, edi
call fcn.00442e20
test al, al
jne 0x442d51
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x442d3a
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ecx, dword [esp + 0x20]
mov edi, ecx
test ecx, ecx
je 0x442d61
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x442d6f
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [esi + 0x38], edi
test ebp, ebp
je 0x442d7f
mov eax, dword [ebp]
mov edx, dword [eax]
mov ecx, ebp
call edx
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x442d8d
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov ebx, dword [esp + 0x24]
mov dword [esi + 0x3c], ebp
lea eax, [esi + 0x24]
test ebx, ebx
jne 0x442d9f
xor ecx, ecx
jmp 0x442db3
mov ecx, ebx
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x442da4
sub ecx, edi
sar ecx, 1
push ebx
mov ebx, ecx
call fcn.0040aea0
mov edx, dword [esp + 0x28]
test edx, edx
je 0x442dd3
cmp word [edx], 0
je 0x442dd3
lea edi, [esi + 0x18]
call fcn.0040ad90
jmp 0x442de5
lea eax, [esi + 0x18]
push str.Mozilla_5.0__Windows_NT_5.1_
mov ebx, 0x1c
call fcn.0040aea0
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x442dfc
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x442e20
Capabilities:
Parse url

Disassembly:
sub esp, 0x3c
push ebx
push ebp
mov ebp, dword [esp + 0x48]
push esi
push edi
push 0x200
mov ebx, eax
call fcn.004f0933
push 0x200
mov esi, eax
push 0
push esi
call fcn.005033b0
push 0x1000
call fcn.004f0933
push 0x1000
mov edi, eax
push 0
push edi
call fcn.005033b0
push 0x38
lea eax, [esp + 0x38]
push 0
push eax
call fcn.005033b0
add esp, 0x2c
lea ecx, [esp + 0x10]
push ecx
push 0
push ebx
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x100
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], 0x800
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x442ec5
push esi
call fcn.00501b8f
push edi
call fcn.00501b8f
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x3c
ret 4
lea eax, [ebp + 0x1c]
test esi, esi
jne 0x442ed0
xor ecx, ecx
jmp 0x442ee4
mov ecx, esi
lea ebx, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x442ed5
sub ecx, ebx
sar ecx, 1
push esi
mov ebx, ecx
call fcn.0040aea0
lea eax, [ebp + 0x20]
test edi, edi
jne 0x442ef7
xor ecx, ecx
jmp 0x442f0f
mov ecx, edi
lea ebx, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x442f00
sub ecx, ebx
sar ecx, 1
push edi
mov ebx, ecx
call fcn.0040aea0
mov dx, word [esp + 0x28]
push esi
mov word [ebp + 0x2c], dx
call fcn.00501b8f
push edi
call fcn.00501b8f
add esp, 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x3c
ret 4

Function at 0x4434e0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov esi, ecx
test ebx, ebx
jne 0x4435bb
cmp dword [esi + 0x10], ebx
je 0x4435c0
mov edi, 2
cmp dword [esi + 0x40], edi
jne 0x443537
mov eax, dword [esi + 0x70]
test eax, eax
jbe 0x4435b9
add dword [esi + 0x48], eax
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push eax
mov eax, dword [esi + 0x30]
push eax
call edx
test al, al
jne 0x443537
mov ebx, 0x2ef1
call fcn.00443170
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ebx, dword [sym.imp.WININET.dll_InternetReadFileExA]
mov dword [esi + 0x40], edi
lea edi, [esi + 0x58]
mov eax, dword [esi + 0x54]
push esi
push 1
push edi
push eax
mov dword [esi + 0x70], 0x800
call ebx
test eax, eax
je 0x44359e
mov eax, dword [esi + 0x70]
test eax, eax
jbe 0x443575
add dword [esi + 0x48], eax
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
push eax
mov eax, dword [esi + 0x30]
push eax
call edx
test al, al
je 0x443526
cmp dword [esi + 0x10], 0
je 0x4435c0
cmp dword [esi + 0x70], 0
ja 0x443543
mov eax, dword [esi + 0x44]
test eax, eax
jle 0x4435b9
cmp dword [esi + 0x48], eax
je 0x4435b9
mov ebx, 0x2ee4
call fcn.00443170
pop edi
pop esi
pop ebx
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4435c0
mov ebx, eax
call fcn.00443170
pop edi
pop esi
pop ebx
pop ecx
ret 4
xor ebx, ebx
call fcn.00443170
pop edi
pop esi
pop ebx
pop ecx
ret 4