joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67c2c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x34]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
add eax, edx
lea ecx, [esp + 0x18]
mov esi, 0xa
mov ebx, dword [esp + 0x50]
xor edx, edx
mov dl, byte [eax]
add eax, ebx
mov dword [ecx], edx
add ecx, 4
dec esi
jne 0x67c2f6
xor edi, edi
xor esi, esi
lea ecx, [esp + 0x18]
mov ebx, 4
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
sub eax, edx
add ecx, 4
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ecx + 0x14]
add esi, eax
mov eax, dword [ecx + 0x10]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
add edi, eax
dec ebx
jne 0x67c315
mov eax, dword [esp + 0x5c]
xor ecx, ecx
cmp esi, 0xff
lea edx, [esi - 0xff]
setl cl
neg ecx
and ecx, edx
mov edx, dword [eax]
add ecx, 0xff
add edx, ecx
xor ecx, ecx
cmp edi, 0xff
mov dword [eax], edx
mov eax, dword [esp + 0x60]
lea edx, [edi - 0xff]
setl cl
neg ecx
and ecx, edx
mov edx, dword [eax]
add ecx, 0xff
add edx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x58]
cmp esi, eax
jge 0x67c483
cmp edi, eax
jge 0x67c483
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x54]
mov ecx, edi
sub ecx, esi
cmp ecx, eax
jge 0x67c483
mov edx, esi
sub edx, edi
cmp edx, eax
jge 0x67c483
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], 4
lea ecx, [eax + edx]
lea ecx, [ecx + eax*2]
lea ebx, [ecx + ebp*2 + 4]
mov ecx, dword [esp + 0x20]
add ebx, ecx
mov ecx, dword [esp + 0x44]
add ebx, esi
sar ebx, 3
mov byte [ecx], bl
mov ebx, dword [esp + 0x48]
add ecx, ebx
mov ebx, dword [esp + 0x20]
add ebx, eax
lea eax, [esp + 0x28]
lea edx, [edx + ebx*2 + 4]
add edx, ebp
mov ebp, dword [esp + 0x48]
add edx, esi
add edx, edi
sar edx, 3
mov byte [ecx], dl
add ecx, ebp
mov edx, dword [eax - 4]
mov ebx, dword [eax - 0x10]
add eax, 4
lea edx, [ebx + edx*2 + 4]
mov ebx, dword [eax - 0x10]
add edx, ebx
mov ebx, dword [eax - 0xc]
add edx, ebx
mov ebx, dword [eax + 4]
add edx, ebx
mov ebx, dword [eax - 4]
add edx, ebx
mov ebx, dword [eax]
add edx, ebx
sar edx, 3
mov byte [ecx], dl
mov edx, dword [esp + 0x14]
add ecx, ebp
dec edx
mov dword [esp + 0x14], edx
jne 0x67c40e
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
add edx, eax
lea ebx, [ebx + edx*2 + 4]
mov edx, dword [esp + 0x30]
add ebx, edx
add ebx, esi
mov esi, dword [esp + 0x34]
add esi, eax
add ebx, edi
sar ebx, 3
lea eax, [esi + eax*2]
mov esi, dword [esp + 0x38]
mov byte [ecx], bl
lea eax, [eax + esi*2 + 4]
add eax, edx
add eax, edi
sar eax, 3
mov byte [ecx + ebp], al
jmp 0x67c4a0
lea eax, [esp + 0x1c]
mov esi, 8
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
add eax, 4
mov byte [ecx], dl
add ecx, ebp
dec esi
mov dword [esp + 0x14], ecx
jne 0x67c48c
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
inc esi
inc eax
cmp eax, 8
mov dword [esp + 0x44], esi
mov dword [esp + 0x10], eax
jl 0x67c2db
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x67c4d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
push edi
lea ebp, [eax - 1]
mov dword [esp + 0x10], 8
xor eax, eax
lea ecx, [esp + 0x14]
xor edx, edx
add ecx, 4
mov dl, byte [eax + ebp]
inc eax
mov dword [ecx - 4], edx
cmp eax, 0xa
jl 0x67c4ec
xor edi, edi
xor esi, esi
lea ecx, [esp + 0x14]
mov ebx, 4
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
sub eax, edx
add ecx, 4
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ecx + 0x14]
add esi, eax
mov eax, dword [ecx + 0x10]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
add edi, eax
dec ebx
jne 0x67c50a
mov eax, dword [esp + 0x50]
xor ecx, ecx
cmp esi, 0xff
lea edx, [esi - 0xff]
setl cl
neg ecx
and ecx, edx
mov edx, dword [eax]
add ecx, 0xff
add edx, ecx
xor ecx, ecx
cmp edi, 0xff
mov dword [eax], edx
setl cl
neg ecx
lea edx, [edi - 0xff]
and ecx, edx
mov edx, dword [eax + 4]
add ecx, 0xff
add edx, ecx
mov dword [eax + 4], edx
mov eax, dword [esp + 0x4c]
cmp esi, eax
jge 0x67c668
cmp edi, eax
jge 0x67c668
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x48]
mov ecx, edi
sub ecx, esi
cmp ecx, eax
jge 0x67c668
mov edx, esi
sub edx, edi
cmp edx, eax
jge 0x67c668
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x40], 4
lea edx, [eax + ecx]
lea edx, [edx + eax*2]
lea ebx, [edx + ebx*2 + 4]
mov edx, dword [esp + 0x1c]
add ebx, edx
add edx, eax
add ebx, esi
lea eax, [ecx + edx*2 + 4]
mov ecx, dword [esp + 0x18]
add eax, ecx
lea ecx, [ebp + 3]
add eax, esi
add eax, edi
sar ebx, 3
sar eax, 3
mov byte [ebp + 1], bl
mov byte [ebp + 2], al
lea eax, [esp + 0x24]
mov edx, dword [eax - 4]
mov ebx, dword [eax - 0x10]
add eax, 4
lea edx, [ebx + edx*2 + 4]
mov ebx, dword [eax - 0x10]
add edx, ebx
mov ebx, dword [eax - 0xc]
add edx, ebx
mov ebx, dword [eax + 4]
add edx, ebx
mov ebx, dword [eax - 4]
add edx, ebx
mov ebx, dword [eax]
add edx, ebx
sar edx, 3
mov byte [ecx], dl
mov edx, dword [esp + 0x40]
inc ecx
dec edx
mov dword [esp + 0x40], edx
jne 0x67c5f6
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
add edx, eax
lea ebx, [ebx + edx*2 + 4]
mov edx, dword [esp + 0x2c]
add ebx, edx
add ebx, esi
mov esi, dword [esp + 0x30]
add esi, eax
add ebx, edi
sar ebx, 3
lea eax, [esi + eax*2]
mov esi, dword [esp + 0x34]
mov byte [ecx], bl
lea eax, [eax + esi*2 + 4]
add eax, edx
add eax, edi
sar eax, 3
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
add ebp, ecx
dec eax
mov dword [esp + 0x10], eax
jne 0x67c4e6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x68c480
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x38]
push ebx
push ebp
push esi
fld dword [eax + 8]
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
fsub dword [edi + 0xc]
lea esi, [edi + 4]
fstp dword [esp + 0x48]
fld dword [eax + 4]
fsub dword [esi + 4]
fstp dword [esp + 0x10]
fld dword [eax]
fsub dword [esi]
lea eax, [esp + 0x48]
push eax
push ecx
push edx
lea ecx, [esp + 0x3c]
fstp dword [esp + 0x24]
call fcn.0053e5d0
lea eax, [edi + 0x24]
lea ecx, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.0053e650
fld dword [esp + 0x2c]
add esp, 0xc
call fcn.00681ef4
fld dword [esp + 0x24]
mov bx, ax
and ebx, 0xfffe
call fcn.00681ef4
fld dword [esp + 0x28]
mov bp, ax
and ebp, 0xfffe
call fcn.00681ef4
mov edx, dword [esp + 0x4c]
and eax, 0xfffe
mov word [esp + 0x14], ax
lea eax, [edi + 0x24]
push eax
push esi
lea eax, [esp + 0x38]
push edx
push eax
call fcn.0053e680
add esp, 0xc
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0053e650
fld dword [esp + 0x2c]
fadd dword [0x6a7764]
add esp, 0xc
call fcn.00681ef4
fld dword [esp + 0x24]
fadd dword [0x6a7764]
or al, 1
mov word [esp + 0x18], ax
call fcn.00681ef4
fld dword [esp + 0x28]
fadd dword [0x6a7764]
or al, 1
mov word [esp + 0x1a], ax
call fcn.00681ef4
mov ecx, dword [edi + 0x98]
mov dx, ax
xor eax, eax
or edx, 1
cmp ecx, eax
mov word [esp + 0x1c], dx
mov dword [esp + 0x48], eax
jle 0x68c66e
mov dword [esp + 0x4c], eax
mov esi, dword [esp + 0x4c]
mov eax, dword [edi + 0xa0]
add esi, eax
mov ax, word [esp + 0x14]
cmp word [esi + 0xa], ax
sbb eax, eax
inc eax
cmp word [esi + 8], bp
sbb ecx, ecx
inc ecx
and eax, ecx
mov cx, word [esp + 0x1a]
cmp cx, word [esi + 2]
sbb ecx, ecx
inc ecx
and eax, ecx
cmp word [esi + 6], bx
sbb ecx, ecx
inc ecx
and eax, ecx
cmp dx, word [esi + 4]
sbb ecx, ecx
inc ecx
and eax, ecx
mov cx, word [esp + 0x18]
cmp cx, word [esi]
sbb ecx, ecx
inc ecx
and eax, ecx
mov ecx, eax
neg ecx
or ecx, eax
sar ecx, 0x1f
test cl, 1
je 0x68c64c
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov edx, dword [esp + 0x48]
add ecx, eax
push edx
mov edx, dword [esp + 0x48]
push ecx
push eax
push edx
mov ecx, edi
call fcn.0068c680
mov eax, dword [esi + 0xc]
mov ecx, dword [edi + 0x88]
shl eax, 4
add eax, ecx
mov cx, word [eax]
mov word [esi], cx
mov dx, word [eax + 2]
mov word [esi + 2], dx
mov cx, word [eax + 4]
mov word [esi + 4], cx
mov dx, word [eax + 6]
mov word [esi + 6], dx
mov cx, word [eax + 8]
mov word [esi + 8], cx
mov dx, word [eax + 0xa]
mov word [esi + 0xa], dx
mov dx, word [esp + 0x1c]
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
mov ecx, dword [edi + 0x98]
inc eax
add esi, 0x20
cmp eax, ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], esi
jl 0x68c594
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4030c0
push 0x401d80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x1a8], bl
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x1a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.ConfMain.exe_info
push str._s__d
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 5
push ebx
lea eax, [ebp - 0x1a8]
push eax
push str.rtTraceSpy.exe
push str.Open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 0x120], bl
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x104
push edi
push ebx
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x120]
push eax
push ebx
call fcn.00401215
push str.rtDiagnose.dll
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x1c
lea eax, [ebp - 0x120]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
mov dword [ebp - 0x1c], eax
push edi
push ebx
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x120]
push eax
push ebx
call fcn.00401215
push str.rtConfClient.dll
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x1c
lea eax, [ebp - 0x120]
push eax
call esi
mov dword [ebp - 0x128], eax
cmp eax, ebx
je 0x401202
push str.LaunchConf
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x1ac], eax
cmp eax, ebx
je 0x4011f6
push str.ILDebugOption
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x1d4], eax
push str.ILDebugStart
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x1b4], eax
push str.ILDebugDestory
push dword [ebp - 0x1c]
call esi
mov dword [ebp - 0x1b0], eax
push 6
pop ecx
mov esi, str.http:__192.168.1.92:8080
lea edi, [ebp - 0x1d0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x1d0]
push eax
push 1
call dword [ebp - 0x1d4]
pop ecx
pop ecx
call dword [ebp - 0x1b4]
lea ecx, [ebp - 0x20c]
call fcn.00401289
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [ebp - 0x1ac]
add esp, 0xc
jmp 0x4011d8
or dword [ebp - 4], 0xffffffff
call dword [ebp - 0x1b0]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x20c]
call fcn.00401458
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x422c55e8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6c6e6ffa
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40a840
Capabilities:
Get system information on windows

Disassembly:
push 0x3c
push 0x44a428
call fcn.0042dc90
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
mov edi, eax
mov dword [ebp - 0x20], edi
mov ebx, dword [ebp + 8]
and dword [ebx], 0
push 4
push 0x2000
shl eax, 0xa
push eax
push 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call esi
test eax, eax
je 0x40a8e2
mov dword [ebp - 0x24], edi
push 4
push 0x1000
push edi
push eax
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x40a8e2
and dword [ebp - 4], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0042e5c2
add esp, 0xc
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
mov dword [ebx], esi
jmp 0x40a8e4
xor eax, eax
call fcn.0042dccb
ret

Function at 0x40a9f8
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x44ecf8]
push ebx
push esi
push edi
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x20000005
push dword [ebp + 0xc]
mov esi, SysReAllocString
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x74], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x40aa37
mov dword [ebp - 0x70], esi
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
and dword [ebp + 0xc], 0
call ebx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x74]
cmp eax, 0x64
jb 0x40aa51
push 0x64
pop eax
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
push 0xea60
push eax
lea ecx, [ebp - 0x6c]
call fcn.00403071
mov esi, eax
test esi, esi
jbe 0x40aa85
mov edi, dword [ebp + 0x10]
cmp dword [edi], 0
jne 0x40aa7a
call ebx
sub eax, dword [ebp - 0x78]
mov dword [edi], eax
add dword [ebp + 0xc], esi
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x70]
jb 0x40aa46
call ebx
sub eax, dword [ebp - 0x78]
mov ecx, dword [ebp + 0x14]
pop edi
test esi, esi
pop esi
mov dword [ecx], eax
pop ebx
jne 0x40aaa3
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x70]
jae 0x40aaa3
or eax, 0xffffffff
jmp 0x40aaa6
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
call fcn.0042dc80
leave
ret 0x14
Function at 0x40aab2
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0042de00
mov eax, dword [0x44ecf8]
and dword [ebp - 0x1014], 0
push ebx
push esi
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x100c]
push eax
push 0x20000005
push dword [ebp + 0x10]
mov esi, SysReAllocString
mov dword [ebp - 0x100c], esi
mov dword [ebp - 0x1010], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x40ab0d
mov dword [ebp - 0x100c], esi
mov eax, dword [0x453170]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x100c]
cmp eax, esi
je 0x40ab22
inc eax
jmp 0x40ab27
mov eax, 0x2000
push eax
lea ecx, [ebp + 0x10]
call fcn.00401e78
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.00401ead
mov ebx, dword [ebp + 0x10]
push edi
mov eax, 0x1000
cmp dword [ebp - 0x1010], eax
jae 0x40ab51
mov eax, dword [ebp - 0x1010]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
push 0xea60
push eax
lea ecx, [ebp - 0x1008]
call fcn.00403071
test eax, eax
jbe 0x40ab91
mov byte [ebp + eax - 0x1008], 0
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp + 0x10]
call fcn.00404604
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx - 8]
cmp eax, dword [ebp - 0x100c]
jl 0x40ab3e
mov eax, dword [ebp - 0x100c]
cmp dword [ebx - 8], eax
pop edi
jl 0x40aba2
lea eax, [ebp + 0x10]
jmp 0x40abb9
push 0x447445
lea ecx, [ebp + 0x14]
call fcn.0040454b
mov dword [ebp - 0x1014], 1
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00401e1e
test byte [ebp - 0x1014], 1
je 0x40abde
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40abde
call fcn.004013ad
lea ecx, [ebx - 0xc]
cmp ecx, dword [0x453174]
pop esi
pop ebx
je 0x40abf0
call fcn.004013ad
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.0042dc80
leave
ret 0x10
Function at 0x40ad54
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x40ada2
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40ad72
call fcn.004013ad
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40ad85
call fcn.004013ad
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40ad98
call fcn.004013ad
mov eax, 0x80004005
jmp 0x40aeda
push edi
mov edi, dword [ebp + 0x10]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
push edi
push dword [esi]
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x40adfe
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40add1
call fcn.004013ad
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40ade4
call fcn.004013ad
lea ecx, [edi - 0xc]
cmp ecx, dword [0x453174]
je 0x40adf4
call fcn.004013ad
mov eax, 0x80004005
jmp 0x40aed9
mov edi, dword [ebp + 8]
push esi
push 0x84400200
push ebx
push edi
push ebx
push dword [ebp + 0xc]
push 0x448c38
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x40ae65
push ebx
push ebx
push 0xffffffffffffffff
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x40ae9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x3e5
setne cl
mov eax, ecx
cmp eax, ebx
jne 0x40ae65
mov eax, dword [esi + 0x18]
push 0xc
pop ecx
xor edx, edx
div ecx
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
neg eax
mov dword [ebp + 8], eax
je 0x40ae9a
mov ecx, esi
call fcn.0040302b
lea ecx, [edi - 0xc]
cmp ecx, dword [0x453174]
je 0x40ae7c
call fcn.004013ad
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40ae8f
call fcn.004013ad
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff4
jmp 0x40ade7
mov ecx, esi
call fcn.0040302b
lea ecx, [edi - 0xc]
cmp ecx, dword [0x453174]
je 0x40aeb1
call fcn.004013ad
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40aec4
call fcn.004013ad
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40aed7
call fcn.004013ad
xor eax, eax
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x40ddbd
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x2dc], 0
je 0x40de13
mov eax, dword [0x453170]
push esi
push str.TTPlayer.exe
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str.__s_
push eax
call fcn.00401d30
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 4]
call fcn.0040de28
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esi - 0xc]
cmp ecx, dword [0x453174]
pop esi
je 0x40de13
call fcn.004013ad
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x40de26
call fcn.004013ad
leave
ret
Function at 0x40eb47
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x18]
mov esi, ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040167e
test eax, eax
je 0x40ebc1
test byte [ebp + 0xf], 0x40
push ebx
jne 0x40ebbd
push edi
lea eax, [ebp + 0xc]
push eax
push dword [esi]
xor edi, edi
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov ebx, eax
push ebx
push dword [ebp + 0xc]
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [ebp + 0x18], eax
je 0x40ebaf
push ebx
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp + 0x18]
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x2c]
cmp eax, edi
pop edi
je 0x40ebc6
mov dword [esi + 0x30], eax
mov dword [esi + 0x28], ebx
xor eax, eax
inc eax
pop ebx
pop esi
pop ebp
ret 0x14
mov ecx, esi
call fcn.0040ebd1
xor eax, eax
jmp 0x40ebc0

Function at 0x40f4fc
Capabilities:
Terminate thread

Disassembly:
push ebp
lea ebp, [esp - 0x7a0]
sub esp, 0x820
mov eax, dword [0x44ecf8]
push ebx
xor ebx, ebx
mov dword [ebp + 0x79c], eax
cmp byte [edi + 4], bl
je 0x40f5fd
mov eax, dword [edi + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x6c], eax
mov byte [edi + 4], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 8]
je 0x40f5fa
push esi
push dword [ebp + 0x7a8]
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov eax, dword [0x45834c]
jne 0x40f59b
test byte [eax + 4], 0x10
je 0x40f5f9
push ebx
push 0x800
lea eax, [ebp - 0x64]
lea esi, [ebp - 0x80]
call fcn.0040f23b
push str.CThreadInfo::Destroy_shutdown_normally___thread_id_is
call fcn.0040f396
push dword [ebp - 0x68]
mov ecx, esi
call fcn.0040f2ed
mov ecx, dword [0x45834c]
push ebx
push dword [eax + 4]
push 0x10
pop eax
call fcn.0040fe1c
jmp 0x40f5f9
test byte [eax + 4], 0x10
je 0x40f5ef
push ebx
push 0x800
lea eax, [ebp - 0x64]
lea esi, [ebp - 0x80]
call fcn.0040f23b
push 0x448df8
call fcn.0040f396
push dword [ebp - 0x68]
mov ecx, esi
push str._thread_id_is:
push dword [ebp + 0x7a8]
call fcn.0040f29b
call fcn.0040f351
mov ecx, eax
call fcn.0040f2ed
mov ecx, dword [0x45834c]
push ebx
push dword [eax + 4]
push 0x10
pop eax
call fcn.0040fe1c
push ebx
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov dword [edi + 0x10], ebx
mov ecx, dword [ebp + 0x79c]
pop ebx
call fcn.0042dc80
add ebp, 0x7a0
leave
ret

Function at 0x410140
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push dword [ecx + 0x4c]
push 0x43f59c
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
ret 0x10