joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4202b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f9458
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x80
mov eax, dword [0x672494]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], edx
push 0
call fcn.00578cfa
push eax
call fcn.005793d2
add esp, 8
mov dword [ebp - 0x70], 0x33323130
mov dword [ebp - 0x6c], 0x37363534
mov dword [ebp - 0x68], 0x42413938
mov dword [ebp - 0x64], 0x46454443
mov dword [ebp - 0x60], 0x4a494847
mov dword [ebp - 0x5c], 0x4e4d4c4b
mov dword [ebp - 0x58], 0x5251504f
mov dword [ebp - 0x54], 0x56555453
mov dword [ebp - 0x50], 0x5a595857
mov dword [ebp - 0x4c], 0x64636261
mov dword [ebp - 0x48], 0x68676665
mov dword [ebp - 0x44], 0x6c6b6a69
mov dword [ebp - 0x40], 0x706f6e6d
mov dword [ebp - 0x3c], 0x74737271
mov dword [ebp - 0x38], 0x78777675
mov word [ebp - 0x34], 0x7a79
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov esi, 0x10
mov dword [ebp - 4], 0
lea edi, [esi + 0x2e]
call fcn.005793b1
cdq
idiv edi
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov dl, byte [ebp + edx - 0x70]
mov byte [ebp - 0x30], dl
cmp ecx, edi
jae 0x4203c7
lea eax, [ecx + 1]
cmp edi, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x4203da
push dword [ebp - 0x30]
mov byte [ebp - 0x74], 0
push dword [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040d870
mov edi, 0x3e
sub esi, 1
jne 0x420394
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
lea edi, [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
add eax, edx
mov dword [ebp - 0x80], 0
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x74], eax
cmovae edi, dword [ebp - 0x2c]
xor ecx, ecx
sub eax, edi
mov word [ebp - 0x90], cx
push eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x7c], 7
call fcn.00410f30
push dword [ebp - 0x78]
lea ecx, [ebp - 0x90]
push dword [ebp - 0x74]
push edi
call fcn.00410fd0
mov esi, dword [ebp - 0x78]
lea eax, [ebp - 0x90]
cmp esi, eax
je 0x420478
mov ecx, esi
call fcn.0040f8c0
movups xmm0, xmmword [ebp - 0x90]
xor eax, eax
mov word [ebp - 0x90], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x80]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
lea ecx, [ebp - 0x90]
call fcn.0040f8c0
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x4204b3
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4204a9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4204d1
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0056efe9
int3
Function at 0x423380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4233ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00428400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4233cd
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4233cf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x423453
jg 0x4233e4
test esi, esi
je 0x423453
test ecx, ecx
jl 0x42342d
jg 0x4233ee
test eax, eax
je 0x42342d
cmp edi, ecx
jg 0x423402
jl 0x4233f8
cmp esi, eax
jae 0x423402
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.0056bc50
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x423430
mov edx, dword [ebp + 8]
test edi, edi
jl 0x423453
jg 0x42343a
test esi, esi
je 0x423453
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x423453
push eax
push esi
push 1
push edx
call fcn.00575508
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x423470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x42349b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00428320
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4234bd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4234bf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x42355e
jg 0x4234dc
test esi, esi
je 0x42355e
test ecx, ecx
jl 0x423529
jg 0x4234e6
test eax, eax
je 0x423529
cmp ebx, ecx
jg 0x4234fa
jl 0x4234f0
cmp esi, eax
jae 0x4234fa
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.0056bc50
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x423530
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x42355e
jg 0x42353a
test esi, esi
je 0x42355e
cmp dword [edi + 0x4c], 0
je 0x42355e
mov ecx, edi
call fcn.004241d0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.00579f22
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4238b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x672494]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4238e0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x42391c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x42391c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x423a01
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x423944
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x423977
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0057a2a3
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x423a01
cmp eax, 1
jle 0x4239d4
cmp eax, 3
jne 0x423a01
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004264d0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4239f1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00575508
add esp, 0x10
cmp edi, eax
jne 0x423a01
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x423907
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 4
Function at 0x4293e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp - 0x10], edx
test edx, edx
je 0x429452
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, eax
jne 0x429420
mov eax, dword [ebp - 8]
cmp ecx, 0xc0323159
je 0x429456
mov eax, dword [eax]
jmp 0x4293f8
mov esi, dword [0x67f490]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x10], edx
test esi, esi
jne 0x4294ed
test edx, edx
je 0x4294e5
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4294e5
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4294e5
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4294d6
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4294a5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xf1a78bf8
je 0x429516
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x429495
xor esi, esi
mov dword [0x67f490], esi
mov ecx, dword [ebp - 0x14]
call fcn.004eb790
push eax
call esi
pop edi
pop esi
pop ebx
test eax, eax
je 0x429508
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
xor eax, eax
cmp dword [ebp + 8], eax
sete al
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
jmp 0x4294e7
Function at 0x42a060
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp eax, 0xf060
jne 0x42a1c2
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0x82
mov dword [eax], 1
call fcn.00512c30
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp + 0xc], edx
test edx, edx
je 0x42a0f4
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp + 8]
imul ecx, ecx, 0x1000193
mov dword [ebp + 8], ecx
cmp ebx, eax
jne 0x42a0c2
mov eax, dword [ebp + 0x10]
cmp ecx, 0xc0323159
je 0x42a0f8
mov eax, dword [eax]
jmp 0x42a09a
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f4a8]
mov dword [ebp + 0xc], edx
test eax, eax
jne 0x42a187
test edx, edx
je 0x42a180
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
lea eax, [ecx + edx]
mov dword [ebp + 0x10], eax
cmp eax, edx
je 0x42a180
xor ecx, ecx
mov dword [ebp + 8], ecx
cmp dword [eax + 0x18], ecx
je 0x42a180
mov edi, dword [eax + 0x20]
add edi, edx
nop
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x42a171
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x42a140
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp esi, 0x3f007617
je 0x42a196
mov eax, dword [ebp + 0x10]
inc ecx
add edi, 4
mov dword [ebp + 8], ecx
cmp ecx, dword [eax + 0x18]
jne 0x42a130
xor eax, eax
mov dword [0x67f4a8], eax
push 0
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp + 0x10]
push 0
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x67f4a8], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push eax
push 0x112
call fcn.00512a60
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42cd30
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
xor eax, eax
movzx ecx, word [edx]
test cx, cx
je 0x42cd60
push esi
mov esi, ecx
nop
movzx ecx, si
lea edx, [edx + 2]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x42cd40
pop esi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x439e00
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa0a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x672494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x14], 0
push dword [edi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x439ec2
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [esi + 0x10], 0
jb 0x439e68
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 0x10]
shr eax, 1
cmp eax, ecx
ja 0x439e8e
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x439e86
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x439e9a
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00431ea0
cmp dword [esi + 0x14], 8
jb 0x439ea2
mov esi, dword [esi]
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x439ec2
call fcn.0043aff0
jmp 0x439ec4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43a5c0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x672494]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x82]
push 0x7e
push 0
push eax
mov esi, ecx
mov dword [edi], 0xffffffff
mov dword [edi + 4], 0xffffffff
call fcn.0056c1d0
add esp, 0xc
mov dword [ebp - 0x88], 0x80
xor eax, eax
mov word [ebp - 0x84], ax
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 5
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x43a64a
call fcn.0043aff0
mov esi, eax
test esi, esi
jns 0x43a64c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 4
xor esi, esi
lea eax, [ebp - 0x84]
push eax
call fcn.0057527c
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [edi], eax
xor ecx, ebp
mov dword [edi + 4], edx
mov eax, esi
pop edi
pop esi
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 4

Function at 0x43aba0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.0043aa10
cmp dword [ebp + 8], 0
je 0x43abee
push edi
lea edi, [esi + 0x1b0]
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esi + 0x150], 0
je 0x43abe6
add esi, 0x140
cmp dword [esi + 0x14], 8
jb 0x43abd6
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x43abe6
call fcn.0043aff0
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x14
Function at 0x43add0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fa188
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x672494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [esi + 0x1b0]
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [ebp - 0x1c], 1
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ebx
add dword [esi + 0x1e8], ecx
mov eax, dword [esi + 0x184]
adc dword [esi + 0x1ec], ebx
test eax, eax
je 0x43ae5a
push ebx
lea edx, [ebp - 0x14]
push edx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x43ae56
call fcn.0043aff0
mov ebx, eax
jmp 0x43aebc
xor ebx, ebx
jmp 0x43aebc
mov eax, dword [esi + 0x15c]
lea edi, [esi + 0x158]
mov edx, dword [edi]
sub eax, edx
jne 0x43aea2
mov ecx, dword [esi + 0x1d0]
mov eax, ecx
and eax, dword [esi + 0x1d4]
cmp eax, 0xffffffff
mov eax, dword [edi + 8]
je 0x43ae92
sub eax, edx
cmp ecx, eax
jbe 0x43aea2
cmp ecx, 0x7fffffff
ja 0x43aef0
jmp 0x43ae9a
mov ecx, dword [esi + 0x180]
jmp 0x43ae82
push ecx
mov ecx, edi
call fcn.0043ad10
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
add eax, ecx
push eax
push ecx
push dword [esi + 0x15c]
mov ecx, edi
call fcn.0040faf0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
lea eax, [esi + 0x1b0]
push eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 8
call fcn.0040c6a0
int3
Function at 0x43b010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x672494]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1b0]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esi + 0x194]
test eax, eax
je 0x43b0d0
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
push dword [esi + 0x190]
push dword [esi + 0x18c]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x43b079
call fcn.0043aff0
mov edi, eax
test edi, edi
js 0x43b100
push 0
push dword [esp + 0x14]
push dword [esi + 0x18c]
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
jne 0x43b09d
call fcn.0043aff0
mov edi, eax
test edi, edi
js 0x43b100
mov eax, dword [esp + 0x10]
add dword [esi + 0x1a8], eax
mov ecx, dword [esi + 0x1a8]
adc dword [esi + 0x1ac], 0
mov eax, dword [esi + 0x1ac]
cmp eax, dword [esi + 0x1a4]
jb 0x43b0cc
ja 0x43b0fb
cmp ecx, dword [esi + 0x1a0]
jae 0x43b0fb
xor edi, edi
jmp 0x43b100
mov eax, dword [esi + 0x168]
test eax, eax
je 0x43b0fb
push 0
push eax
push dword [esi + 0x164]
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
jne 0x43b0fb
call fcn.0043aff0
mov edi, eax
test edi, edi
js 0x43b100
mov edi, 1
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret
Function at 0x43b3a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp - 0x10], edx
test edx, edx
je 0x43b412
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, eax
jne 0x43b3e0
mov eax, dword [ebp - 8]
cmp ecx, 0xc0323159
je 0x43b416
mov eax, dword [eax]
jmp 0x43b3b8
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f4bc]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x43b4ab
test edx, edx
je 0x43b4a4
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x43b4a4
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x43b4a4
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x43b495
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x43b464
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xfad26938
je 0x43b4c6
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x43b454
xor eax, eax
mov dword [0x67f4bc], eax
mov ecx, dword [ebp - 0x14]
push 0
push 0xc8
push 0x483
push dword [ecx + 4]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x43b4a6