joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41df07
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi], 0x440a58
mov dword [esi + 4], 1
lea edi, [esi + 8]
xor ebp, ebp
lea ecx, [esi + 0xc]
mov dword [edi], ebp
call fcn.0041d3d6
push 0x3c
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x5c], ebp
call fcn.0042cb56
cmp eax, ebp
pop ecx
je 0x41df4c
mov ecx, eax
call fcn.0041d40a
mov ebx, eax
jmp 0x41df4e
xor ebx, ebx
cmp ebx, ebp
je 0x41df60
push ebx
mov ecx, edi
call fcn.00412d4d
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov edi, 0x104
push edi
lea ebx, [esi + 0x64]
push ebp
push ebx
mov dword [esi + 0x60], ebp
call fcn.0042d770
push edi
lea ebp, [esi + 0x26c]
push 0
push ebp
call fcn.0042d770
add esp, 0x18
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.ShareFile.bat
push ebx
call fcn.0042dc09
pop ecx
pop ecx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.TTRecomList.xml
push ebp
call fcn.0042dc09
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x41df09
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi], 0x440a58
mov dword [esi + 4], 1
lea edi, [esi + 8]
xor ebp, ebp
lea ecx, [esi + 0xc]
mov dword [edi], ebp
call fcn.0041d3d6
push 0x3c
mov dword [esi + 0x50], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x5c], ebp
call fcn.0042cb56
cmp eax, ebp
pop ecx
je 0x41df4c
mov ecx, eax
call fcn.0041d40a
mov ebx, eax
jmp 0x41df4e
xor ebx, ebx
cmp ebx, ebp
je 0x41df60
push ebx
mov ecx, edi
call fcn.00412d4d
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov edi, 0x104
push edi
lea ebx, [esi + 0x64]
push ebp
push ebx
mov dword [esi + 0x60], ebp
call fcn.0042d770
push edi
lea ebp, [esi + 0x26c]
push 0
push ebp
call fcn.0042d770
add esp, 0x18
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.ShareFile.bat
push ebx
call fcn.0042dc09
pop ecx
pop ecx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.TTRecomList.xml
push ebp
call fcn.0042dc09
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x422407
Capabilities:
Delete file

Disassembly:
mov eax, 0x43d1ee
call fcn.0042e3c4
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
inc edi
mov dword [ebp - 0x14], edi
xor esi, esi
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.00422de7
mov dword [ebp - 0x14], eax
cmp eax, esi
jl 0x422498
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
push edi
mov ecx, ebx
call fcn.004224bc
or dword [ebp - 4], 0xffffffff
push esi
push str.TTPlayer_PlayerWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x422478
push esi
push esi
push 0x812
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x422485
add ebx, 0x26c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push esi
push 0x10
push dword [0x4533a8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x42372e
Capabilities:
Delete file

Disassembly:
mov eax, 0x43d202
call fcn.0042e3c4
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 1
xor esi, esi
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.00422de7
mov dword [ebp - 0x14], eax
cmp eax, esi
jl 0x4237c0
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
push esi
mov ecx, ebx
call fcn.004224bc
or dword [ebp - 4], 0xffffffff
push esi
push str.TTPlayer_PlayerWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4237a0
push esi
push esi
push 0x812
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4237ad
add ebx, 0x26c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push esi
push 0x10
push dword [0x4533a8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4237e4
Capabilities:
Delete file

Disassembly:
mov eax, 0x43d20c
call fcn.0042e3c4
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 1
xor esi, esi
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.00422de7
mov dword [ebp - 0x14], eax
cmp eax, esi
jl 0x423876
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
push esi
mov ecx, ebx
call fcn.004224bc
or dword [ebp - 4], 0xffffffff
push esi
push str.TTPlayer_PlayerWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x423856
push esi
push esi
push 0x813
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x423863
add ebx, 0x26c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push esi
push 0x10
push dword [0x4533a8]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x424ee3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x424eee
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x424fb1
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
inc edx
dec edi
jne 0x424f0e
pop edi
test eax, eax
je 0x424fcb
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x442a98]
inc edx
dec eax
jne 0x424fb5
mov eax, esi
pop esi
not eax
pop ebx
ret
Function at 0x4254da
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x18], edi
je 0x42558f
mov eax, dword [esi + 0x1c]
mov ebx, dword [ebp + 0xc]
lea ecx, [ebx + eax]
mov eax, dword [esi + 0x20]
cmp ecx, eax
jb 0x425575
add eax, eax
cmp eax, ecx
mov dword [ebp - 4], eax
ja 0x42550a
mov dword [ebp - 4], ecx
push edi
push dword [ebp - 4]
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, edi
je 0x42553e
push dword [ebp - 4]
push edi
push edi
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x425545
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x300
jmp 0x4255b8
push dword [esi + 0x20]
push dword [esi + 0x18]
push edi
call fcn.0042cc20
add esp, 0xc
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [esi + 4], ebx
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], edi
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x18]
push ebx
push dword [ebp + 8]
push eax
call fcn.0042cc20
add esp, 0xc
add dword [esi + 0x1c], ebx
mov eax, ebx
jmp 0x4255b8
mov eax, dword [esi]
cmp eax, edi
je 0x4255af
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
jmp 0x4255b8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x425823
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x58]
test ecx, ecx
push edi
je 0x42586d
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x5c]
cmp eax, edi
jae 0x4258a9
sub edi, eax
cmp edi, dword [ebp + 0xc]
jbe 0x425845
mov edi, dword [ebp + 0xc]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0042cc20
add dword [esi + 0x60], edi
add dword [esi + 0x48], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x4c]
call fcn.00424ee3
add esp, 0x18
mov dword [esi + 0x4c], eax
mov eax, edi
jmp 0x4258ab
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4258a2
push 0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4258a9
mov edi, dword [ebp + 0xc]
add dword [esi + 0x48], edi
push edi
push dword [ebp + 8]
push dword [esi + 0x4c]
call fcn.00424ee3
add esp, 0xc
jmp 0x425866
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x425fb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
xor edx, edx
push edi
mov edi, dword [esp + 0x14]
inc edx
xor ebx, ebx
cmp edi, edx
jl 0x425fc9
cmp edi, 8
jg 0x425fc9
mov al, dl
jmp 0x425fcb
xor al, al
mov esi, dword [esp + 0x10]
push str.bad_pack_level
push eax
push esi
call fcn.00423b90
lea ecx, [esi + 0x6af70]
add esp, 0xc
cmp dword [ecx], ebx
lea eax, [esi + 0x6af78]
mov dword [eax], ebx
jne 0x425ff8
mov dword [eax], edx
mov dword [ecx], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push ebx
push eax
mov dword [esi + 0x6af6c], ebx
call fcn.0042d770
mov eax, edi
shl eax, 3
movzx ecx, word [eax + 0x442a4a]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax + 0x442a48]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax + 0x442a4c]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax + 0x442a4e]
add esp, 0xc
cmp edi, 2
mov dword [esi + 0x6af94], eax
jg 0x42605a
mov eax, dword [esp + 0x18]
or byte [eax], 4
jmp 0x426066
cmp edi, 8
jl 0x426066
mov eax, dword [esp + 0x18]
or byte [eax], 2
push 0x10000
lea edi, [esi + 0x1af70]
push edi
push esi
mov dword [esi + 0x6af84], ebx
mov dword [esi + 0x6af74], ebx
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebx
mov dword [esi + 0x6af90], eax
je 0x4260d0
cmp eax, 0xffffffff
je 0x4260d0
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebx
jae 0x4260a8
push esi
call fcn.004245f1
pop ecx
mov dword [esi + 0x6af7c], ebx
movzx eax, byte [edi + ebx]
mov ecx, dword [esi + 0x6af7c]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
inc ebx
cmp ebx, 2
mov dword [esi + 0x6af7c], eax
jb 0x4260ae
jmp 0x4260e0
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4266b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x6af90], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x6af80], 2
je 0x4268b7
push edi
mov edi, 0x7fff
cmp dword [esi + 0x6af90], 3
jb 0x42672c
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, edi
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, edi
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
cmp dword [ebp - 4], 0
je 0x42676d
mov eax, dword [esi + 0x6af84]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0x42676d
mov ecx, dword [esi + 0x6af90]
lea eax, [esi + 0x6afa0]
cmp dword [eax], ecx
jbe 0x426754
mov dword [eax], ecx
push dword [ebp - 4]
push esi
call fcn.00424458
mov ebx, eax
mov eax, dword [esi + 0x6af90]
cmp ebx, eax
pop ecx
pop ecx
jbe 0x42676d
mov ebx, eax
cmp ebx, 3
jb 0x426831
lea eax, [ebx - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.00423f4c
sub dword [esi + 0x6af90], ebx
add esp, 0xc
cmp ebx, dword [esi + 0x6af98]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
ja 0x4267ff
cmp eax, 3
jb 0x4267ff
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, edi
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, edi
dec ebx
mov dword [esi + edx*4 + 0x2af70], ecx
mov eax, dword [esi + 0x6af7c]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x4267ad
jmp 0x426854
add dword [esi + 0x6af84], ebx
mov eax, dword [esi + 0x6af84]
lea edx, [eax + esi]
movzx ecx, byte [edx + 0x1af70]
lea eax, [esi + 0x6af7c]
mov dword [eax], ecx
movzx edx, byte [edx + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, edi
mov dword [eax], edx
jmp 0x42685a
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push 0
push esi
call fcn.00423f4c
add esp, 0xc
dec dword [esi + 0x6af90]
mov dword [ebp + 8], eax
inc dword [esi + 0x6af84]
cmp dword [ebp + 8], 0
je 0x426896
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x426873
lea ecx, [eax + esi + 0x1af70]
jmp 0x426875
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.0042650c
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4268a9
push esi
call fcn.004245f1
pop ecx
cmp dword [esi + 0x6af90], 0
jne 0x4266dc
pop edi
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0x4268ca
lea ecx, [eax + esi + 0x1af70]
jmp 0x4268cc
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.0042650c
add esp, 0x10
pop esi
pop ebx
leave
ret
Function at 0x429596
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov eax, 0x2494
lea ebp, [esp - 0x2414]
call fcn.0042de00
mov eax, dword [0x44ecf8]
push ebx
push esi
push edi
mov dword [ebp + 0x2410], eax
mov esi, ecx
call fcn.00427537
mov edi, 0x10000000
push edi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x78]
call fcn.004029ad
mov eax, dword [esi + 0x80]
mov eax, dword [eax + 8]
push edi
push eax
lea ecx, [ebp - 0x78]
call fcn.00402a12
test eax, eax
je 0x4296ec
push ebx
push ebx
push 3
push dword [ebp - 0x54]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x68]
push dword [esi + 0x6c]
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
mov dword [esi + 0x70], eax
je 0x4296ec
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.00402a78
mov edi, dword [eax]
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x78]
call fcn.00402adb
mov eax, dword [eax]
push esi
push 0x80400200
push ebx
push edi
push ebx
push eax
push 0x446e7c
push dword [esi + 0x70]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ecx, dword [ebp - 0x7c]
add ecx, 0xfffffff4
mov dword [esi + 0x74], eax
cmp ecx, dword [0x453174]
je 0x429657
call fcn.004013ad
mov ecx, dword [ebp - 0x80]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x42966a
call fcn.004013ad
cmp dword [esi + 0x74], ebx
je 0x4296ec
mov eax, dword [esi + 0x68]
cmp eax, ebx
mov edi, dword [0x453170]
mov dword [ebp - 0x7c], edi
jbe 0x429694
push eax
lea eax, [ebp - 0x7c]
push str.Range:_bytes_u__r_n
push eax
call fcn.00401d30
mov edi, dword [ebp - 0x7c]
add esp, 0xc
mov eax, dword [edi - 8]
push ebx
push ebx
push eax
push edi
push dword [esi + 0x74]
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x4296bd
lea ecx, [edi - 0xc]
cmp ecx, dword [0x453174]
je 0x4296b8
call fcn.004013ad
push 2
pop eax
jmp 0x4296ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
lea ecx, [edi - 0xc]
jne 0x4296df
cmp ecx, dword [0x453174]
je 0x4296da
call fcn.004013ad
xor eax, eax
inc eax
jmp 0x4296ee
cmp ecx, dword [0x453174]
je 0x4296ec
call fcn.004013ad
xor eax, eax
mov ecx, dword [ebp + 0x2410]
pop edi
pop esi
pop ebx
call fcn.0042dc80
add ebp, 0x2414
leave
ret
Function at 0x429c01
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x64], edi
je 0x429c17
call fcn.004275e0
mov eax, dword [esi + 0x40]
cmp eax, edi
je 0x429d1a
cmp dword [eax], 0x18
jne 0x429d1a
push ebx
push dword [eax + 8]
lea ecx, [ebp - 4]
call fcn.00401af2
mov eax, dword [esi + 0x40]
mov ecx, dword [eax + 4]
cmp ecx, edi
mov ebx, dword [ebp - 4]
jne 0x429c52
push 0x10000000
push edi
push edi
push 1
jmp 0x429d0c
cmp ecx, 1
je 0x429d04
cmp dword [ebx - 8], edi
je 0x429d04
push dword [eax + 0x10]
lea ecx, [ebp - 0xc]
call fcn.00401af2
mov eax, dword [esi + 0x40]
push dword [eax + 0x14]
lea ecx, [ebp - 8]
call fcn.00401af2
mov eax, dword [0x453170]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x40]
push dword [eax + 0xc]
lea eax, [ebp - 4]
push ebx
push str.httphttp:___s:_d
push eax
call fcn.00401d30
mov edi, dword [ebp - 4]
add esp, 0x10
push 0x10000000
push str._local_
push edi
push 3
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
lea ecx, [edi - 0xc]
mov dword [esi + 0x64], eax
cmp ecx, dword [0x453174]
je 0x429cc9
call fcn.004013ad
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x429cdc
call fcn.004013ad
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x429cef
call fcn.004013ad
xor edi, edi
lea ecx, [ebx - 0xc]
cmp ecx, dword [0x453174]
pop ebx
je 0x429d2e
call fcn.004013ad
jmp 0x429d2e
push 0x10000000
push edi
push edi
push edi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x64], eax
jmp 0x429cf1
push 0x10000000
push edi
push edi
push edi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x64], eax
mov esi, dword [esi + 0x64]
cmp esi, edi
jne 0x429d39
xor eax, eax
jmp 0x429d4d
push 0x427c68
push esi
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
inc eax
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
leave
ret 4

Function at 0x429dfd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call fcn.00427e64
test eax, eax
je 0x429ea0
push edi
mov ecx, esi
call fcn.00427ea0
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x429e2b
call edi
sub eax, dword [esi + 0x54]
cmp eax, 0x4e20
jae 0x429e56
mov ecx, esi
call fcn.0042917d
push 0
mov ecx, esi
call fcn.00427df4
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0xc0]
call fcn.004284e6
mov ecx, esi
call fcn.00429d53
cmp eax, 2
je 0x429e9f
mov eax, dword [esp + 0xc]
add eax, 0x34
push eax
lea ecx, [esi + 0x34]
call fcn.004289d8
call edi
sub eax, dword [esi + 0x54]
cmp eax, 1
jae 0x429e75
xor eax, eax
inc eax
jmp 0x429e7a
call edi
sub eax, dword [esi + 0x54]
and dword [esi + 0x54], 0
mov ecx, esi
mov dword [esi + 0x50], eax
call fcn.0042917d
mov eax, dword [esi + 0x60]
test eax, eax
mov dword [esi + 0x20], 1
je 0x429e9f
push dword [esi + 0x5c]
push 0
push 3
call eax
pop edi
pop esi
ret 4
Function at 0x42a768
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x42b5c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x44ecf8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [edi]
mov esi, dword [eax - 8]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x63
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x29
mov byte [ebp - 0xb], 0x25
mov byte [ebp - 0xa], 0x21
mov byte [ebp - 9], 0x24
mov byte [ebp - 8], 0
call fcn.0040454b
jmp 0x42b623
lea eax, [ebp - 0x14]
push eax
call fcn.00404604
mov eax, dword [ebp + 0xc]
cmp dword [eax - 8], esi
lea ecx, [ebp + 0xc]
jl 0x42b61a
push esi
call fcn.00401ead
mov eax, dword [0x453170]
push esi
mov dword [ebp - 0x18], eax
call fcn.0042d439
test eax, eax
pop ecx
mov dword [ebp - 0x1c], eax
jne 0x42b64f
lea eax, [ebp - 0x18]
jmp 0x42b6b9
mov edi, dword [edi]
lea eax, [esi - 1]
test eax, eax
jl 0x42b67c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
push ebx
sub edx, eax
mov ebx, edi
add ecx, eax
sub ebx, dword [ebp + 0xc]
lea edx, [edx + esi - 1]
lea edi, [eax + 1]
mov al, byte [ebx + ecx]
xor al, byte [ecx]
dec ecx
mov byte [edx], al
inc edx
dec edi
jne 0x42b66f
pop ebx
lea ecx, [ebp - 0x20]
lea eax, [esi + esi + 1]
push ecx
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
call fcn.00401e78
push eax
push esi
push dword [ebp - 0x1c]
call fcn.0040183d
add esp, 0x10
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.00401ead
push dword [ebp - 0x1c]
call fcn.0042d321
pop ecx
lea ecx, [ebp - 0x18]
call fcn.0040e98c
mov ecx, dword [ebp + 8]
push eax
call fcn.00401e1e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x42b6d5
call fcn.004013ad
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
cmp ecx, dword [0x453174]
je 0x42b6e8
call fcn.004013ad
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
pop edi
pop esi
call fcn.0042dc80
leave
ret
Function at 0x42e6df
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x42e6fc
call fcn.0042feda
mov dword [eax], 0x16
xor eax, eax
jmp 0x42e766
push esi
push 0x8c
push 1
call fcn.0042ee08
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x42e751
push esi
call fcn.00433872
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x42e72f
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x42e64a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x42e765
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0042d321
test ebx, ebx
pop ecx
je 0x42e763
push ebx
call fcn.0042feec
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret