joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ec80
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
jne 0x45ec96
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0xc
call fcn.00562e63
mov esi, eax
push 0xc
mov dword [ebp - 4], esi
mov dword [esi], 0
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
call fcn.00562e63
add esp, 8
mov dword [eax], esi
mov ecx, dword [esi + 4]
push 0
push 4
push eax
push 0x45ed00
push 0
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
push 0
mov dword [eax + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov eax, dword [esi]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x460d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
sub esp, 0xc
test edx, edx
je 0x460d88
push ebx
push esi
mov ecx, 0x63beab
mov byte [edx], 0xda
sub ecx, edx
mov dword [ebp - 4], 0x33
push edi
mov dword [ebp - 8], ecx
lea eax, [edx + 1]
mov esi, 0x63bea8
mov edi, 0x63bea9
mov ebx, 0x63beaa
mov ecx, 0x63beac
sub esi, edx
sub edi, edx
sub ebx, edx
sub ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, byte [esi + eax]
lea eax, [eax + 5]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [edi + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 3], cl
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
sub dword [ebp - 4], 1
mov byte [eax - 1], cl
jne 0x460d45
pop edi
pop esi
pop ebx
mov eax, 0x100
mov esp, ebp
pop ebp
ret
Function at 0x461760
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x110], ecx
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x461790
mov eax, dword [ebx]
jmp 0x461792
mov eax, ebx
push 0x104
mov byte [eax], 0
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00579420
add esp, 0xc
lea ecx, [ebp - 0x108]
mov edx, 1
call fcn.004430b0
mov dword [ebp - 0x10c], eax
test eax, eax
je 0x4617f2
push eax
call fcn.00442a40
mov edi, eax
push 0
push edi
call fcn.0058d125
push edi
mov esi, eax
call fcn.0058d115
add esp, 0x10
test esi, esi
je 0x4617f2
push dword [ebp - 0x10c]
call fcn.00442fc0
add esp, 4
push SysReAllocString
push 0x63f8f0
call fcn.0058ed2a
push eax
push 0x63f8f0
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0058e895
push SysReAllocString
push str.Adobe
call fcn.0058ed2a
push eax
push str.Adobe
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0058e895
lea eax, [ebp - 0x108]
push eax
call fcn.00442a40
mov edi, eax
push 0
push edi
call fcn.0058d125
push edi
mov esi, eax
call fcn.0058d115
add esp, 0x40
test esi, esi
je 0x46188d
lea eax, [ebp - 0x108]
push eax
call fcn.00442a40
mov edi, eax
add esp, 4
test edi, edi
je 0x46189a
push edi
call fcn.0058f008
push edi
mov esi, eax
call fcn.0058d115
add esp, 8
test esi, esi
jne 0x4618a4
cmp byte [ebp - 0x108], 0
jne 0x4618d6
xor ecx, ecx
jmp 0x4618e9
push 0x16
call fcn.0058f9c1
add esp, 4
mov eax, dword [ebp - 0x110]
push str.Error_creating_folder_for_client_application
push 0
push 2
push str.AdobeGCUpdater
push dword [eax + 4]
call fcn.00496770
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4618e0
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.00433660
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00562e44
mov esp, ebp
pop ebp
ret 4
Function at 0x4646f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db970
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
xor bl, bl
cmp dword [ebp + 0x18], 0
je 0x46483e
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call fcn.0058d125
add esp, 8
test eax, eax
jne 0x464750
mov bl, 1
jmp 0x46483e
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
push 2
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0046b170
cmp eax, 0xffffffff
je 0x46483e
push eax
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp + 8]
call fcn.0044c320
push eax
lea ecx, [ebp - 0x28]
call fcn.0043ebd0
lea ecx, [ebp - 0x44]
call fcn.004331f0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00433990
mov ecx, esi
call fcn.004646f0
cmp al, 1
jne 0x464829
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.0058f008
add esp, 4
test eax, eax
jne 0x46480e
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push str.Created__S
push 0
push 4
push str.AdobeGCUpdaterCFU
push dword [esi + 4]
call fcn.00496770
add esp, 0x18
mov bl, 1
jmp 0x464829
push str.Failed_to_Create__S
push 0
push 4
push str.AdobeGCUpdaterCFU
push dword [esi + 4]
call fcn.00496770
add esp, 0x14
xor bl, bl
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x46483e
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433df0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x464853
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00433df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret 0x18
Function at 0x464880
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x658318
push 0x579840
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x66c214]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x64], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], 0x7530
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 1
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
call edi
test eax, eax
jne 0x464a1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4649de
push dword [ebp - 0x48]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x54], eax
test eax, eax
je 0x4649de
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x48]
push eax
push 1
push esi
call edi
test eax, eax
je 0x4649cb
xor edi, edi
mov dword [ebp - 0x50], edi
cmp edi, dword [ebp - 0x20]
jae 0x464a0e
lea eax, [edi + edi*8]
mov ecx, dword [ebp - 0x54]
movups xmm1, xmmword [ecx + eax*4]
movups xmm0, xmmword [ecx + eax*4 + 0x10]
movups xmmword [ebp - 0x78], xmm0
mov eax, dword [ecx + eax*4 + 0x20]
mov dword [ebp - 0x68], eax
push 0x24
movd eax, xmm1
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x60], esi
test esi, esi
je 0x4649cb
mov dword [ebp - 4], 1
lea eax, [ebp - 0x44]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4649cb
cmp dword [ebp - 0x40], 1
je 0x4649e2
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x48]
push eax
push 0x24
lea eax, [ebp - 0x44]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4649cb
cmp dword [ebp - 0x40], 1
je 0x4649e2
call ebx
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5c]
jbe 0x464995
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x66c214
call fcn.0057ba90
add esp, 0xc
xor eax, eax
jmp 0x464a1f
mov dword [ebp - 4], 0
call fcn.00464a06
inc edi
jmp 0x46493e
mov dword [ebp - 4], 0xfffffffe
call fcn.00464a3b
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x467c70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, 3
cmp byte [0x6405d4], cl
push edi
mov edi, dword [ebp + 8]
cmove eax, ecx
push eax
push 0x6405d4
mov ecx, edi
call fcn.00433660
xorps xmm0, xmm0
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x1b], xmm0
movups xmmword [ebp - 0x2b], xmm0
mov dword [ebp - 0x13], 0
mov word [ebp - 0xf], 0
mov byte [ebp - 0xd], 0
call fcn.0043e9c0
cmp byte [ebp - 0x2c], 0
jne 0x467cd4
xor ecx, ecx
jmp 0x467ce9
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x467ce0
sub ecx, edx
push ecx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 0x18]
call fcn.00433660
xor eax, eax
mov byte [ebp - 0xc], 0
push 8
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [eax - 2]
cmp ecx, 5
ja 0x467d3a
lea ecx, [ebp - 0xc]
push 8
add eax, ecx
push eax
push 0x5a
push 0x400
mov byte [eax - 1], 0x5f
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp byte [ebp - 0xc], 0
jne 0x467d44
xor ecx, ecx
jmp 0x467d59
lea ecx, [ebp - 0xc]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x467d50
sub ecx, edx
push ecx
lea eax, [ebp - 0xc]
push eax
lea ecx, [edi + 0x30]
call fcn.00433660
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00562e44
mov esp, ebp
pop ebp
ret 4
Function at 0x46cee0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc71e
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00579420
add esp, 0xc
xor bl, bl
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x46d02c
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x46d025
cmp word [ebp - 0x218], 0
je 0x46d025
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea edx, [ebp - 0x230]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x218]
call fcn.0043e7c0
test al, al
je 0x46d01a
mov dword [ebp - 0x234], 0xf
mov dword [ebp - 0x238], 0
mov byte [ebp - 0x248], bl
mov byte [ebp - 4], 2
lea eax, [ebp - 0x24c]
cmp dword [ebp - 0x21c], 8
lea esi, [ebp - 0x230]
push eax
cmovae esi, dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.004393d0
lea ecx, [ebp - 0x248]
push dword [eax]
push esi
call fcn.0043c180
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x248]
call fcn.00433290
lea ecx, [ebp - 0x248]
mov esi, eax
call fcn.004332e0
test esi, esi
sete bl
lea ecx, [ebp - 0x230]
call fcn.004331f0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x20]
cmp ecx, 0x10
jb 0x46d041
inc ecx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00430ec0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x470eb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
test ecx, ecx
je 0x470f3a
test esi, esi
je 0x470f3a
push ebx
lea eax, [ebp - 0x14]
xor bl, bl
push eax
push 1
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x470f1f
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x470f1f
cmp dword [ebp - 0x10], 0
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00562e44
mov esp, ebp
pop ebp
ret

Function at 0x471470
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x10c], ebx
call fcn.00579420
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push SysReAllocString
push str.System32driversetchosts
call fcn.0058ed2a
push eax
push str.System32driversetchosts
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0058e895
lea eax, [ebp - 0x108]
push eax
call fcn.00442a40
mov edi, eax
push 0
push edi
call fcn.0058d125
push edi
mov esi, eax
call fcn.0058d115
add esp, 0x28
test esi, esi
jne 0x47156e
lea eax, [ebp - 0x108]
push eax
call fcn.00442a40
push 0x63eec8
mov ebx, eax
call fcn.00442a40
mov edi, eax
push 0x40
push edi
push ebx
call fcn.00586252
push ebx
mov esi, eax
call fcn.0058d115
push edi
call fcn.0058d115
mov eax, dword [ebp - 0x10c]
add esp, 0x1c
mov dword [0x679c00], esi
test esi, esi
je 0x47155c
push str.Hostfile_opened_successfully
push 0
push 4
push str.AdobeGCHostfileValidation
push dword [eax]
jmp 0x47157e
push str.Error_opening_host_file
push 0
push 5
push str.AdobeGCHostfileValidation
push dword [eax]
jmp 0x47157e
push str.No_host_file_found
push 0
push 4
push str.AdobeGCHostfileValidation
push dword [ebx]
call fcn.00496770
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x485990
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x4859bb
push 8
call fcn.00562e63
mov dword [esp + 0x24], eax
add esp, 4
mov dword [eax], vtable.adobe_ial::HTTPCommunicationAgent.0
mov dword [edi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, dword [edi + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ecx]
push dword [ebp + 8]
call dword [eax + 4]
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x485a4c
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x485a4c
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x485a4c
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00563c50
mulsd xmm0, qword [0x64a4d8]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00563c50
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x485a4f
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [eax + 0x10]
push ebx
push str.HTTPCommunicationAgent__Return_Code:__d__response_size___d__time_taken___.2f_ms.
push 4
call fcn.00480190
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x485a80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x485aab
push 8
call fcn.00562e63
mov dword [esp + 0x24], eax
add esp, 4
mov dword [eax], vtable.adobe_ial::HTTPCommunicationAgent.0
mov dword [edi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call esi
cmp dword [ebp + 0x10], 0
mov ecx, dword [edi + 4]
push 0x7d
setne al
movzx eax, al
mov edx, dword [ecx]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx + 8]
mov ebx, eax
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x485b43
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x485b43
mov esi, dword [esp + 0x20]
mov eax, esi
mov edi, dword [esp + 0x24]
or eax, edi
je 0x485b43
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.00563c50
mulsd xmm0, qword [0x64a4d8]
mov edx, edi
mov ecx, esi
movsd qword [esp + 0x38], xmm0
call fcn.00563c50
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x38]
cvtps2pd xmm1, xmm1
divsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
jmp 0x485b46
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [eax + 0x10]
push ebx
push str.HTTPCommunicationAgent__Return_Code:__d__response_size___d__time_taken___.2f_ms.
push 4
call fcn.00480190
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x490d00
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2610
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov edi, dword [0x685520]
mov eax, 7
xor ecx, ecx
mov esi, dword [edi]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 1
cmp esi, edi
je 0x490e05
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
nop dword [eax]
cmp dword [esi + 0x24], 0x10
lea ecx, [esi + 0x10]
jb 0x490d7b
mov ecx, dword [ecx]
lea edx, [ebp - 0x40]
call fcn.004908d0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00433990
push 2
push 0x649e24
lea ecx, [ebp - 0x28]
call fcn.00436450
cmp dword [esi + 0x3c], 0x10
lea ecx, [esi + 0x28]
jb 0x490dad
mov ecx, dword [ecx]
lea edx, [ebp - 0x40]
call fcn.004908d0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00436580
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0xa0000000
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x48]
call ebx
lea ecx, [ebp - 0x44]
call fcn.0043b290
mov esi, dword [ebp - 0x44]
cmp esi, edi
jne 0x490d70
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x490e02
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433df0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
cmp eax, 8
jb 0x490e2b
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00433df0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x4929b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x492a3a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x492a3a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4929e1
shr eax, 4
pop esi
and eax, 1
pop ebx
pop ebp
ret 4
push edi
push esi
call fcn.00597f68
mov edi, eax
push 0x5c
push edi
call fcn.005d4818
add esp, 0xc
test eax, eax
je 0x492a31
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push edi
call fcn.004929b0
push edi
test al, al
jne 0x492a1c
call fcn.0058d115
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
call fcn.0058d115
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x492a13
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x492a50
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x492a80
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, 1
sete bl
test bl, bl
je 0x492ae7
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
test eax, eax
setne bl
test bl, bl
je 0x492ae7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
setne bl
test bl, bl
je 0x492ae7
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
setne bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x492b00
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov dword [ebp - 4], edx
mov al, byte [ebx]
test al, al
je 0x492b7a
push esi
push edi
mov edi, dword [edx + 4]
mov esi, 0x34567890
nop
mov ecx, dword [edx]
lea ebx, [ebx + 1]
movsx eax, al
xor eax, dword [edx]
mov edx, dword [ebp + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edx], eax
movzx eax, al
add eax, edi
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [edx + 4], edi
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ecx + eax*4]
mov dword [edx + 8], esi
mov al, byte [ebx]
test al, al
jne 0x492b30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495770
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x49577b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00495790
Function at 0x4965f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.005638a0
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push ecx
push 0
push eax
test esi, esi
jne 0x49667d
lea eax, [ebp - 0x1008]
push 0xffd
push eax
call fcn.0042db70
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00585fd7
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
jle 0x496650
lea eax, [ebp + eax - 0x1008]
jmp 0x496658
cmp eax, 0xffffffff
jne 0x496696
lea eax, [ebp - 0xb]
mov word [eax], 0xa0d
mov byte [eax + 2], 0
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
push esi
call fcn.0042db70
push dword [eax + 4]
push dword [eax]
call fcn.00585e9b
push esi
call fcn.0058e76c
add esp, 0x1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00562e44
mov esp, ebp
pop ebp
ret