joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40113b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 2
test eax, eax
jle 0x40117a
push esi
movzx esi, byte [ecx]
xor ebx, ebx
dec eax
inc ecx
mov bh, byte [ecx]
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or esi, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or esi, ebx
inc ecx
xor edx, esi
test eax, eax
jg 0x401155
pop esi
and edi, 3
xor eax, eax
dec edi
je 0x401196
dec edi
je 0x40118f
dec edi
jne 0x40119b
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
xor eax, edx
pop ebx
pop ebp
ret 0xc

Function at 0x406412
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
and dword [eax], 0
push edi
push ecx
mov dword [ebp - 4], edx
mov byte [ebx], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x406492
cmp word [esi + 8], 2
jne 0x406474
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x406474
mov edi, dword [esi + 0xc]
jmp 0x40646e
push dword [eax]
mov edx, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
call fcn.004063a9
mov ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
test ecx, ecx
je 0x40648d
lea eax, [ecx + 0x1c]
add edi, 4
mov dword [ebp + 0x14], eax
mov eax, dword [edi]
test eax, eax
jne 0x40644a
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.004256f4
add esp, 0x10
xor eax, eax
jmp 0x4064aa
push 8
pop eax
jmp 0x4064aa
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x4064a8
dec eax
je 0x4064ba
dec eax
je 0x4064b3
dec eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x2afb
jmp 0x4064aa
mov eax, 0x2afa
jmp 0x4064aa
Function at 0x406ab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [0x4cb7e4], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], str.getaddrinfo
mov dword [ebp - 0x14], 0x406628
mov dword [ebp - 0x10], str.getnameinfo
mov dword [ebp - 0xc], 0x4068e4
mov dword [ebp - 8], str.freeaddrinfo
mov dword [ebp - 4], fcn.004065ea
jne 0x406c0f
push 0x104
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x406c05
lea eax, [ebp - 0x230]
mov ebx, 0x10c
push eax
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.0042528b
push str.ws2_32
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.00425691
add esp, 0x18
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
xor edi, edi
test esi, esi
je 0x406b6f
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x406b6b
push esi
call ebx
mov esi, edi
test esi, esi
jne 0x406bc9
lea eax, [ebp - 0x230]
mov esi, 0x10c
push eax
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.0042528b
push str.wship6
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.00425691
add esp, 0x18
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x406c05
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x406bc5
push esi
call ebx
mov esi, edi
test esi, esi
je 0x406c05
mov ebx, edi
push dword [ebp + ebx*8 - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + ebx*8 - 0x14], eax
test eax, eax
je 0x406be6
inc ebx
cmp ebx, 3
jl 0x406bcb
jmp 0x406bef
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, edi
test esi, esi
je 0x406c05
mov eax, dword [ebp + edi - 0x14]
mov dword [edi + 0x4b86c4], eax
add edi, 8
cmp edi, 0x18
jl 0x406bf3
mov dword [0x4cb7e4], 1
mov eax, dword [0x4b86c4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406e03
Capabilities:
Hash data using rshash

Disassembly:
push esi
push edi
mov esi, edx
mov edi, 0xf8c9
xor edx, edx
jmp 0x406e1f
imul edx, edi
movsx eax, al
imul edi, edi, 0x5c6b7
add edx, eax
inc ecx
mov al, byte [ecx]
test al, al
jne 0x406e10
test esi, esi
je 0x406e2f
mov eax, edx
xor edx, edx
div esi
pop edi
mov eax, edx
pop esi
ret

Function at 0x407942
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push ecx
call dword [sym.imp.ole32.dll_StringFromIID]
push dword [ebp - 4]
mov esi, 0x4cb7e8
push 0x4a6380
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x800
push eax
push esi
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
mov ecx, 0x4cb7fc
cmovne esi, ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ab10
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [ebp - 4], ecx
mov esi, ebx
push edi
mov cl, byte [ebx]
mov edi, 0xf8c9
test cl, cl
je 0x40ab47
mov al, cl
mov edi, edi
imul edx, edi
lea esi, [esi + 1]
movsx eax, al
imul edi, edi, 0x5c6b7
add edx, eax
mov al, byte [esi]
test al, al
jne 0x40ab30
mov esi, dword [ebp - 4]
cmp dword [esi + 4], 0
je 0x40ab57
mov eax, edx
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
mov edi, dword [eax + edx*4]
lea esi, [eax + edx*4]
mov dword [ebp - 4], esi
test edi, edi
je 0x40aba5
lea eax, [edi + 8]
mov esi, ebx
test eax, eax
je 0x40ab92
test cl, cl
je 0x40ab88
mov dl, cl
movsx ecx, byte [eax]
movsx edx, dl
sub edx, ecx
jne 0x40ab88
mov dl, byte [esi + 1]
inc esi
inc eax
test dl, dl
jne 0x40ab75
movsx ecx, byte [esi]
movsx eax, byte [eax]
sub ecx, eax
jmp 0x40ab94
mov ecx, ebx
test ecx, ecx
je 0x40abf5
mov cl, byte [ebx]
mov esi, edi
mov dword [ebp - 4], edi
mov edi, dword [esi]
test edi, edi
jne 0x40ab66
mov edi, dword [esi]
mov eax, ebx
test cl, cl
je 0x40abb6
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x40abb0
sub eax, ebx
add eax, 9
push eax
call fcn.0040627a
mov dword [esi], eax
add esp, 4
lea ecx, [eax + 8]
mov al, byte [ebx]
mov byte [ecx], al
test al, al
je 0x40abe0
sub ebx, ecx
mov al, byte [ebx + ecx + 1]
lea ecx, [ecx + 1]
mov byte [ecx], al
test al, al
jne 0x40abd3
mov eax, dword [esi]
mov dword [eax], edi
mov ecx, dword [esi]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx + 4], eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40ac10
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [ebp - 4], ecx
mov esi, ebx
push edi
mov cl, byte [ebx]
mov edi, 0xf8c9
test cl, cl
je 0x40ac47
mov al, cl
mov edi, edi
imul edx, edi
lea esi, [esi + 1]
movsx eax, al
imul edi, edi, 0x5c6b7
add edx, eax
mov al, byte [esi]
test al, al
jne 0x40ac30
mov esi, dword [ebp - 4]
cmp dword [esi + 4], 0
je 0x40ac57
mov eax, edx
xor edx, edx
div dword [esi + 4]
mov eax, dword [esi]
mov edi, dword [eax + edx*4]
test edi, edi
je 0x40ac9b
lea eax, [edi + 8]
mov esi, ebx
test eax, eax
je 0x40ac8d
test cl, cl
je 0x40ac83
mov dl, cl
nop
movsx ecx, byte [eax]
movsx edx, dl
sub edx, ecx
jne 0x40ac83
mov dl, byte [esi + 1]
inc esi
inc eax
test dl, dl
jne 0x40ac70
movsx ecx, byte [esi]
movsx eax, byte [eax]
sub ecx, eax
jmp 0x40ac8f
mov ecx, ebx
test ecx, ecx
je 0x40aca6
mov edi, dword [edi]
mov cl, byte [ebx]
test edi, edi
jne 0x40ac60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x40acb2
mov eax, dword [edi + 4]
mov dword [ecx], eax
lea eax, [edi + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b220
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b73f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b25f
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042932e
mov esp, ebp
pop ebp
ret
push ebx
push esi
xor esi, esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x40b2b8
xor edx, edx
mov ecx, ebx
add ecx, 1
setb dl
neg edx
or edx, ecx
push edx
call fcn.004249e8
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push 0
push eax
push ebx
push esi
push edi
mov byte [esi + ebx], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0xc
mov edx, ebx
mov ecx, esi
call fcn.0040b110
push esi
mov dword [ebp - 0xc], eax
call fcn.004249b0
mov esi, dword [ebp - 0xc]
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0042932e
mov esp, ebp
pop ebp
ret

Function at 0x40b330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b73f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
jmp 0x40b350
test eax, eax
mov ebx, 0x4a513e
cmovne ebx, eax
mov esi, ebx
cmp byte [ebx], 0
je 0x40b367
inc esi
cmp byte [esi], 0
jne 0x40b361
mov eax, 0x1000
sub esi, ebx
sub eax, dword [edi + 4]
mov ecx, esi
cmp esi, eax
cmovg ecx, eax
mov eax, dword [edi + 4]
push ecx
add eax, 8
mov dword [ebp - 0xc], ecx
add eax, edi
push ebx
push eax
call fcn.0042a2c0
mov eax, dword [ebp - 0xc]
add esp, 0xc
add dword [edi + 4], eax
cmp dword [edi + 4], 0x1000
jne 0x40b3c5
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1000
lea eax, [edi + 8]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], 0
sub esi, eax
je 0x40b3cd
add eax, ebx
jmp 0x40b350
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042932e
mov esp, ebp
pop ebp
ret 4
Function at 0x40b3f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4974eb
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.00433a00
mov eax, dword [0x4b73f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1020]
push 0x1008
push 0
push eax
call fcn.0042a910
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1020], eax
mov dword [ebp - 0x101c], 0
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
jne 0x40b47b
xor esi, esi
jmp 0x40b5cd
mov eax, 0x18
call fcn.00433a00
mov eax, esp
xor esi, esi
mov ecx, eax
mov dword [ebp - 0x14], eax
sub ecx, edi
mov dword [ebp - 0x1024], ecx
cmp word [edi + 2], 0
jne 0x40b4a1
mov eax, dword [edi]
jmp 0x40b4b0
mov eax, dword [ebx]
mov ecx, ebx
push dword [edi]
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x1024]
mov dword [ecx + edi], eax
test esi, esi
je 0x40b4c7
push 0x4a6048
lea ecx, [ebp - 0x1020]
call fcn.0040b330
push dword [edi]
lea ecx, [ebp - 0x1020]
call fcn.0040b330
mov ecx, dword [ebp - 0x1024]
inc esi
add edi, 4
cmp esi, 5
jl 0x40b496
mov eax, dword [ebp - 0x14]
mov ecx, ebx
push 0
push 0
push 1
mov dword [eax], 0
mov eax, dword [ebx]
call dword [eax + 0x18]
mov edi, eax
test edi, edi
je 0x40b587
mov esi, 1
mov dword [ebp - 0x1024], esi
mov edi, edi
push 0x4a5204
lea ecx, [ebp - 0x1020]
call fcn.0040b330
push edi
lea ecx, [ebp - 0x1020]
call fcn.0040b330
mov edi, 1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx]
push 0
push dword [ecx + edi*4]
mov ecx, ebx
push esi
call dword [eax + 0x18]
push 0x4a6048
lea ecx, [ebp - 0x1020]
mov esi, eax
call fcn.0040b330
push esi
lea ecx, [ebp - 0x1020]
call fcn.0040b330
mov esi, dword [ebp - 0x1024]
inc edi
cmp edi, 5
jl 0x40b531
mov ecx, dword [ebp - 0x14]
inc esi
mov eax, dword [ebx]
push 0
mov dword [ebp - 0x1024], esi
push dword [ecx]
mov ecx, ebx
push esi
call dword [eax + 0x18]
mov edi, eax
test edi, edi
jne 0x40b510
push 0x4a5204
lea ecx, [ebp - 0x1020]
call fcn.0040b330
mov eax, dword [ebp - 0x101c]
mov esi, 1
test eax, eax
je 0x40b5c7
push 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push eax
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x1020]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x1020]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
lea esp, [ebp - 0x1038]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042932e
mov esp, ebp
pop ebp
ret
Function at 0x40ba90
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea eax, [esi + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
test eax, eax
je 0x40babb
lea ebx, [ebx]
mov ebx, eax
mov dword [ebp - 0xc], ebx
mov eax, dword [ebx]
test eax, eax
jne 0x40bab0
mov eax, dword [esi + 0x1c]
lea eax, [eax*4 + 8]
push eax
call fcn.0040627a
xor edx, edx
mov dword [ebp - 8], eax
add esp, 4
mov dword [eax], 0
cmp dword [esi + 0x1c], edx
jbe 0x40baf0
lea ecx, [eax + 4]
mov dword [ecx], 0
lea ecx, [ecx + 4]
inc edx
cmp edx, dword [esi + 0x1c]
jb 0x40bae1
mov ebx, dword [ebp + 8]
xor edx, edx
mov ecx, dword [esi + 0x18]
mov edi, ebx
mov dword [ebp - 0x14], ecx
mov al, byte [ebx]
mov byte [ebp - 1], al
test al, al
je 0x40bb42
mov bl, al
mov esi, 0xf8c9
lea ecx, [ecx]
lea eax, [ebx - 0x41]
mov cl, 0x19
cmp cl, al
lea edi, [edi + 1]
sbb eax, eax
imul edx, esi
inc eax
imul esi, esi, 0x5c6b7
shl al, 5
movsx ecx, al
movsx eax, bl
mov bl, byte [edi]
or ecx, eax
add edx, ecx
test bl, bl
jne 0x40bb10
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x40bb4c
mov eax, edx
xor edx, edx
div ecx
mov eax, dword [esi + 0x14]
mov esi, dword [eax + edx*4]
lea edi, [eax + edx*4]
test esi, esi
je 0x40bb76
lea esp, [esp]
lea edx, [esi + 8]
mov ecx, ebx
call fcn.0040a860
test eax, eax
je 0x40bbb4
mov edi, esi
mov esi, dword [edi]
test esi, esi
jne 0x40bb60
cmp byte [ebp - 1], 0
mov eax, ebx
mov esi, dword [edi]
je 0x40bb86
inc eax
cmp byte [eax], 0
jne 0x40bb80
sub eax, ebx
add eax, 9
push eax
call fcn.0040627a
mov dword [edi], eax
add esp, 4
lea ecx, [eax + 8]
mov al, byte [ebx]
mov byte [ecx], al
test al, al
je 0x40bbb0
sub ebx, ecx
mov al, byte [ebx + ecx + 1]
lea ecx, [ecx + 1]
mov byte [ecx], al
test al, al
jne 0x40bba3
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [edi]
add eax, 8
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x416180
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x74
call fcn.0042493a
mov esi, eax
add esp, 4
test esi, esi
je 0x4161ea
push 0x74
push 0
push esi
call fcn.0042a910
mov ecx, dword [ebp + 8]
add esp, 0xc
xorps xmm0, xmm0
mov eax, esi
movdqu xmmword [esi + 4], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x14], 0x67452301
mov dword [esi + 0x18], 0xefcdab89
mov dword [esi + 0x1c], 0x98badcfe
mov dword [esi + 0x20], 0x10325476
mov byte [esi + 0x6c], 0
mov dword [esi], vtable.MD5HashProxyStream.0
mov dword [esi + 0x70], ecx
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x41c6e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498e3a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4b73f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.004433f5
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x41c786
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.0042a17a
push 0x4b2b68
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.0042a9d3
push edi
push esi
call fcn.004432c8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042932e
mov esp, ebp
pop ebp
ret 4

Function at 0x41dcc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49910e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4b73f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
lea ecx, [edi + 4]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.0041dff0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
lea ecx, [edi + 0x24]
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.0041dff0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x41ddd4
test dl, 0x10
jne 0x41ddd4
mov eax, 1
jmp 0x41ddd6
xor eax, eax
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [esi + 0x18]
call fcn.0041de70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x41f4b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41f4e1
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41f4d0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x423fb0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4b73f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push eax
push dword [esi + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x424055
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xc000
movzx edi, ax
mov eax, dword [0x4cb380]
test eax, eax
jne 0x42401d
push 4
call fcn.0042493a
add esp, 4
test eax, eax
je 0x424016
mov dword [eax], 0
mov dword [eax], 0
jmp 0x424018
xor eax, eax
mov dword [0x4cb380], eax
mov edx, dword [eax]
test edx, edx
je 0x424040
cmp dword [esi + 0x20], 0x10
lea ecx, [esi + 0xc]
jb 0x42402e
mov ecx, dword [ecx]
mov eax, dword [edx]
push ecx
push edi
push 0x8a
push str.QDownloadLibdownload_stream.cpp
mov ecx, edx
call dword [eax]
mov eax, dword [ebp - 8]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042932e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0042932e
mov esp, ebp
pop ebp
ret 8
Function at 0x4245e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4995eb
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x4b73f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
xorps xmm0, xmm0
mov edx, dword [esi + 8]
movdqu xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xd0]
push eax
movdqu xmmword [ebp - 0xd0], xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0xd0], 0x4ab770
push 0x4a5574
push eax
mov dword [ebp - 0xcc], vtable.DataBuffer.0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xb4], edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], 0
push eax
push 0xffffffffffffffff
push 0x424330
push 0x424370
push 0x424350
push 0x424310
push 0x424390
xorps xmm0, xmm0
push 0x424300
push 0x4242f0
movq qword [ebp - 0xd8], xmm0
call fcn.004011a3
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xe0], eax
push 0
push 0x4243f0
push 0
push 0x4a513e
push ecx
push eax
call fcn.00402173
mov esi, eax
add esp, 0x4c
test esi, esi
jne 0x42472e
push 0x7f
push eax
mov byte [ebp - 0xb0], al
lea eax, [ebp - 0xaf]
push eax
call fcn.0042a910
mov ecx, dword [ebp - 0xdc]
call fcn.00424550
push eax
push ecx
lea eax, [ebp - 0xb0]
push str.FDICopy_failed_with_error_code__d:__s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp - 0xe0]
call fcn.00401c48
xor ecx, ecx
mov dword [ebp - 0xd0], 0x4ab770
add esp, 4
mov eax, 0x8002
test esi, esi
cmovne eax, ecx
movzx esi, ax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xbc]
push 0
mov edx, dword [ecx]
call dword [edx + 0xc]
push dword [ebp - 0xc8]
mov dword [ebp - 0xcc], vtable.DataBuffer.0
call fcn.00406283
add esp, 4
mov ax, si
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042932e
mov esp, ebp
pop ebp
ret