joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50a47b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00503137
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x50a4a6
xor eax, eax
jmp 0x50a54a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x50a49f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x50a49f
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004fae94
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x50a4fb
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x50a4ea
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00509279
push edi
mov ebx, eax
call fcn.004faebf
test ebx, ebx
pop ecx
je 0x50a53d
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00509964
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00509a16
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x50b867
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5ab720]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0xc]
jne 0x50b8a4
push 0x55be10
push 4
push eax
call fcn.0052225e
push eax
call fcn.00404920
add esp, 0x10
jmp 0x50b8b6
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x50b921
push edi
call fcn.00523f5d
mov edi, dword [eax]
call fcn.00523f5d
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.005234f8
add esp, 0x18
mov ebx, eax
call fcn.00523f5d
cmp dword [eax], 0
je 0x50b901
call fcn.00523f5d
push dword [eax]
call fcn.004faec9
pop ecx
jmp 0x50b908
call fcn.00523f5d
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x50b921
cmp ebx, esi
jae 0x50b921
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x50b923
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0052151a
leave
ret
Function at 0x50f43c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x50f482
call fcn.00503137
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x50f482
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x50f4c5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x50f4ae
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x50f4ae
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x50f4c2
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x52151a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ab720]
jne 0x521524
repz ret
jmp fcn.00527c0a
Function at 0x526877
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5ab8b0]
je 0x526892
inc edi
cmp edi, 0x17
jb 0x526883
cmp edi, 0x17
jae 0x526a12
push ebp
push 3
call fcn.00530a70
cmp eax, 1
pop ecx
je 0x5269de
push 3
call fcn.00530a70
test eax, eax
pop ecx
jne 0x5268c6
cmp dword [0x5ab678], 1
je 0x5269de
cmp ebx, 0xfc
je 0x526a11
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x5b6198
push ebp
call fcn.00530a0b
add esp, 0xc
test eax, eax
je 0x5268fc
push esi
push esi
push esi
push esi
push esi
call fcn.00522a02
add esp, 0x14
push 0x104
mov esi, 0x5b61b1
push esi
push 0
mov byte [0x5b62b5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x526940
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00530a0b
add esp, 0xc
test eax, eax
je 0x526940
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00522a02
add esp, 0x14
push esi
call fcn.00530980
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x526985
push esi
call fcn.00530980
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x5b64ac
push 0x55e40c
sub ecx, eax
push ecx
push eax
call fcn.005308c3
add esp, 0x14
test eax, eax
je 0x526985
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00522a02
add esp, 0x14
jmp 0x526987
xor esi, esi
push 0x55e408
push ebx
push ebp
call fcn.00530852
add esp, 0xc
test eax, eax
je 0x5269a7
push esi
push esi
push esi
push esi
push esi
call fcn.00522a02
add esp, 0x14
push dword [edi*8 + 0x5ab8b4]
push ebx
push ebp
call fcn.00530852
add esp, 0xc
test eax, eax
je 0x5269c9
push esi
push esi
push esi
push esi
push esi
call fcn.00522a02
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00530695
add esp, 0xc
jmp 0x526a11
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x526a11
cmp ebp, 0xffffffff
je 0x526a11
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5ab8b4]
push dword [esi]
call fcn.00530980
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x530695
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00527427
xor ebx, ebx
cmp dword [0x5b6c9c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x53076b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x53084b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x53084b
push eax
call fcn.005273b9
mov dword [esp], 0x55e8e8
push edi
mov dword [0x5b6c9c], eax
call esi
push eax
call fcn.005273b9
mov dword [esp], 0x55e8d4
push edi
mov dword [0x5b6ca0], eax
call esi
push eax
call fcn.005273b9
mov dword [0x5b6ca4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00525ab4
test eax, eax
pop ecx
pop ecx
je 0x530739
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00522a02
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x53076b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.005273b9
cmp eax, ebx
pop ecx
mov dword [0x5b6cac], eax
je 0x53076b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005273b9
pop ecx
mov dword [0x5b6ca8], eax
mov eax, dword [0x5b6ca8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x5307f0
cmp dword [0x5b6cac], ecx
je 0x5307f0
push eax
call fcn.00527430
push dword [0x5b6cac]
mov esi, eax
call fcn.00527430
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x5307f0
cmp edi, ebx
je 0x5307f0
call esi
cmp eax, ebx
je 0x5307bd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5307bd
test byte [ebp - 0x18], 1
jne 0x5307f0
lea eax, [ebp - 0x10]
push eax
call fcn.00525aeb
test eax, eax
pop ecx
je 0x5307d8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00522a02
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x5307e7
or dword [ebp + 0x10], 0x200000
jmp 0x53082b
or dword [ebp + 0x10], 0x40000
jmp 0x53082b
mov eax, dword [0x5b6ca0]
cmp eax, dword [ebp - 8]
je 0x53082b
push eax
call fcn.00527430
cmp eax, ebx
pop ecx
je 0x53082b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x53082b
mov eax, dword [0x5b6ca4]
cmp eax, dword [ebp - 8]
je 0x53082b
push eax
call fcn.00527430
cmp eax, ebx
pop ecx
je 0x53082b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5b6c9c]
call fcn.00527430
cmp eax, ebx
pop ecx
je 0x53084b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x53084d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x538ce9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5ab720]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00538c28
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00523750
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x538d38
cmp dword [ebp - 0x1c], 5
jb 0x538d50
jmp 0x538d4c
cmp dword [ebp - 0x10], 1
jne 0x538d50
cmp dword [ebp - 0x1c], 4
ja 0x538d4c
jne 0x538d50
cmp dword [ebp - 0x18], 0
jbe 0x538d50
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x560130
call fcn.00538abe
test eax, eax
jge 0x538d71
mov byte [0x5bbd84], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0052151a
add ebp, 0x78
leave
ret
Function at 0x5dad70
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42266e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x42bb54]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], 0x426ae4
lea eax, [esi + 0x64]
mov dword [esp + 0x20], 4
call fcn.005da1e0
cmp dword [0x42fb38], 0
mov dword [esp + 0x10], 0
je 0x5dae3e
mov ecx, dword [0x42669c]
mov edx, dword [0x4266a0]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x4266a4]
mov dword [eax + 4], edx
mov edx, dword [0x4266a8]
push 4
mov dword [eax + 8], ecx
push 2
push 0
lea ecx, [esp + 0x2c]
mov dword [eax + 0xc], edx
call fcn.005db9f0
add esp, 0x1c
cmp dword [0x42fb38], 0
je 0x5dae3e
mov ecx, dword [0x42669c]
mov edx, dword [0x4266a0]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x4266a4]
mov dword [eax + 4], edx
mov edx, dword [0x4266a8]
push 0
mov dword [eax + 8], ecx
push 2
push 2
xor ecx, ecx
mov dword [eax + 0xc], edx
call fcn.005db9f0
add esp, 0x1c
mov edi, dword [esi + 0x53c]
test edi, edi
je 0x5dae77
mov eax, dword [edi]
test eax, eax
mov ebx, dword [fcn.00423264]
je 0x5dae57
push eax
call ebx
mov eax, dword [edi + 0x204]
test eax, eax
je 0x5dae64
push eax
call ebx
push edi
call fcn.005dc07b
add esp, 4
mov dword [esi + 0x53c], 0
mov edi, dword [esi + 0x58]
test edi, edi
je 0x5dae95
mov ebx, edi
call fcn.005d9230
push edi
call fcn.005dc07b
add esp, 4
mov dword [esi + 0x58], 0
cmp dword [esi + 0x548], 0
mov dword [esi + 0x58], 0
je 0x5daeb4
mov eax, dword [esi + 0x544]
push eax
lea ecx, [esi + 0x64]
call fcn.005d9e30
mov byte [esp + 0x20], 3
mov eax, dword [esi + 0x558]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5daedb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x20], 2
mov eax, dword [esi + 0x540]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5daf02
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x401980
push 0x100
lea eax, [esi + 0x138]
push 4
push eax
mov byte [esp + 0x30], 1
call fcn.005e7360
lea eax, [esi + 0x64]
push eax
mov byte [esp + 0x24], 0
call fcn.005d9570
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.005e062f
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40a980
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40aa9f
sub esp, 0x18
xor eax, eax
jmp 0x40a99e
inc eax
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
lea ebp, [ebx + edx]
mov dword [esp + 0x14], ebp
mov dword [esp + 4], ebp
call fcn.00415070
mov eax, dword [esp + 8]
mov ecx, eax
test eax, eax
je 0x40aa74
mov edx, dword [esp + 0x24]
lea ebx, [edx - 1]
test eax, ebx
je 0x40aa64
mov dword [esp + 0x10], eax
mov dword [esp], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
call fcn.00414f50
nop
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
lea eax, [ecx + eax - 1]
neg ecx
and ecx, eax
mov dword [esp + 0x10], ecx
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00415070
mov eax, dword [esp + 8]
mov ecx, eax
mov edx, dword [esp + 0x10]
cmp eax, edx
je 0x40aa54
mov dword [esp], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
call fcn.00414f50
mov eax, dword [esp + 0xc]
cmp eax, 0x63
jne 0x40a99d
jmp 0x40aa88
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
add esp, 0x18
ret
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
add esp, 0x18
ret
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
add esp, 0x18
ret
lea eax, [0x708ab1]
mov dword [esp], eax
mov dword [esp + 4], 0x38
call fcn.00435820
nop
call fcn.00461140
jmp fcn.0040a980
Function at 0x40b740
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b7c5
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x54]
test eax, eax
je 0x40b765
mov eax, dword [eax + 0x30]
jmp 0x40b76b
mov eax, dword [0x92b30c]
test eax, eax
je 0x40b7ae
mov ecx, dword [0x92b290]
cmp ecx, 1
jne 0x40b77e
xor ecx, ecx
jmp 0x40b794
mov dword [esp + 8], eax
mov dword [esp], ecx
call fcn.0040b7d0
mov eax, dword [esp + 4]
mov ecx, eax
mov eax, dword [esp + 8]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.0042ce80
add esp, 0xc
ret
lea eax, [0x708c01]
mov dword [esp], eax
mov dword [esp + 4], 0x38
call fcn.00435820
nop
call fcn.00461140
jmp fcn.0040b740
Function at 0x411250
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x411497
sub esp, 0x1c
call fcn.00437330
call fcn.00437330
lea eax, [0x6f8999]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00437de0
call fcn.004373a0
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x411391
call fcn.00437330
call fcn.00437550
call fcn.004373a0
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x4112f2
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x99], 2
lea eax, [0x7095e5]
mov dword [esp], eax
mov dword [esp + 4], 0x3e
call fcn.00435820
call fcn.00437330
lea eax, [0x6fff15]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f3c08]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f3c3f]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00437f60
call fcn.004373a0
lea eax, [0x6f461b]
mov dword [esp], eax
mov dword [esp + 4], 6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call fcn.0041d360
jmp 0x4112c5
nop
lea ecx, [eax + 0x3b]
mov dword [esp], ecx
call fcn.00401bc0
movzx eax, byte [esp + 4]
mov byte [esp + 0x13], al
cmp al, 1
je 0x411472
call fcn.00437330
lea eax, [0x6f9ce9]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00437f60
call fcn.004373a0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x44]
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], eax
call fcn.00437330
lea eax, [0x6f68d3]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f6147]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f6153]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00437f60
mov dword [esp + 4], 0
movzx eax, byte [esp + 0x13]
movzx eax, al
mov dword [esp], eax
call fcn.00437c00
call fcn.004373a0
jmp 0x4112ae
call fcn.00437330
lea eax, [0x6fca29]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00437f60
call fcn.004373a0
jmp 0x4113cf
call fcn.00461140
jmp fcn.00411250
Function at 0x414160
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41424d
sub esp, 0x10
mov eax, dword [0x90b330]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x24c]
cmp edx, eax
je 0x4141c7
lea ebx, [eax - 2]
cmp edx, ebx
jne 0x4141cb
mov dword [esp], ecx
call fcn.00413f60
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0044c570
mov eax, dword [esp + 0x14]
add eax, 0x24c
mov ecx, dword [0x90b330]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00401e60
add esp, 0x10
ret
add esp, 0x10
ret
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call fcn.00437330
lea eax, [0x6f6c2d]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.00437c00
lea eax, [0x6ff8fd]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00437c00
call fcn.00437550
call fcn.004373a0
lea eax, [0x6f6507]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00414160
Function at 0x4149b0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x414b78
sub esp, 0x18
mov eax, dword [esp + 0x28]
movzx eax, byte [eax]
movzx ecx, byte [esp + 0x2c]
test al, cl
je 0x414a4c
mov eax, dword [0x90b37c]
test byte [eax], al
nop
mov ecx, dword [esp + 0x1c]
mov edx, ecx
shr ecx, 0x16
mov dword [esp + 0x10], ecx
mov eax, dword [eax + ecx*4]
test byte [eax], al
mov eax, dword [eax + 0x408c0]
test byte [eax], al
shr edx, 0x19
and edx, 0x1ffff
add eax, edx
mov dword [esp + 0x14], eax
mov dword [esp], eax
call fcn.00401bc0
mov ecx, dword [esp + 0x10]
and ecx, 7
mov eax, 1
shl eax, cl
movzx ecx, byte [esp + 4]
test cl, al
je 0x414a33
mov byte [esp + 0x34], 1
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
mov byte [esp + 4], al
call fcn.00401ee0
mov byte [esp + 0x34], 0
add esp, 0x18
ret
call fcn.00437330
call fcn.00437330
lea eax, [0x708d1b]
mov dword [esp], eax
mov dword [esp + 4], 0x39
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00437de0
call fcn.00437550
call fcn.004373a0
call fcn.00437330
lea eax, [0x6fc8c0]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f3c08]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00437f60
mov dword [esp + 4], 0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00437de0
lea eax, [0x6f3c3f]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00437f60
call fcn.004373a0
lea eax, [0x6f405a]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
call fcn.0041d360
lea eax, [0x6f3edb]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.0041d360
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x99], 2
lea eax, [0x700380]
mov dword [esp], eax
mov dword [esp + 4], 0x1f
call fcn.00435820
nop
call fcn.00461140
jmp fcn.004149b0
Function at 0x415150
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x415364
sub esp, 0x18
mov eax, dword [0x92b2f8]
test eax, eax
jne 0x41534d
nop
lea eax, [0x92b2e0]
mov dword [esp], eax
call fcn.00409600
mov eax, dword [0x92b2e4]
test eax, eax
je 0x415199
cmp dword [eax + 8], 0xcc
jne 0x41520f
mov edx, dword [0x92b2d8]
test edx, edx
jne 0x4151f1
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x92f698]
mov dword [esp + 8], eax
call fcn.0040baf0
mov eax, dword [esp + 0xc]
mov dword [0x92b2d8], eax
mov ecx, dword [0x92b294]
mov dword [eax], ecx
mov eax, dword [0x92b2d8]
mov dword [0x92b294], eax
movzx eax, byte [0x92b8a0]
test al, al
jne 0x4151f1
xor eax, eax
jmp 0x4152f9
mov edx, dword [0x92b2d8]
mov ebx, dword [edx + 4]
mov dword [0x92b2d8], ebx
mov ebx, dword [0x92b2e4]
mov dword [edx + 4], ebx
mov dword [0x92b2e4], edx
mov edx, dword [0x92b2e4]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x4152e1
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401da0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x92b5b0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x41526d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x41527a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00462510
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x92b5b0]
test edx, edx
jne 0x4152a6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x4152c7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00462510
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00462510
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00462510
mov byte [0x92b237], 1
nop
lea eax, [0x92b2e0]
mov dword [esp], eax
call fcn.00409800
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004625a0
lea esi, [0x92b8a0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x4151f1
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x415343
lea edx, [0x8cd274]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x4152eb
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00462590
mov ecx, 5
call fcn.00462590
lea eax, [0x6fc7e8]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00435820
nop
call fcn.00461140
jmp fcn.00415150