joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430b50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x5c62e8
test esi, esi
jne 0x430b6f
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add edi, ecx
sub esi, ecx
add ebx, ecx
test eax, eax
je 0x430ba0
test ecx, ecx
je 0x430ba0
mov eax, dword [ebp - 4]
test esi, esi
jne 0x430b72
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431210
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5bd250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x4312de
cmp word [esi], 0
je 0x4312de
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43125e
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 4
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0053e230
push esi
push 0x596370
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00546433
add esp, 0x1c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x4312de
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4312c3
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.00431210
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 4

Function at 0x4316d0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5bd250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x431712
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret
push 0x59641c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push esi
push eax
call fcn.005465e7
add esp, 0xc
test eax, eax
jne 0x4317ec
push 2
push eax
push dword [ebp - 0x18]
call fcn.005448c8
push dword [ebp - 0x18]
call fcn.00544cdb
push 0
push 0
push dword [ebp - 0x18]
mov edi, eax
call fcn.005448c8
add esp, 0x1c
cmp edi, 0x10
jb 0x4317e1
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push 1
xorps xmm0, xmm0
mov dword [ebp - 8], ebx
push 0x10
push eax
movq qword [ebp - 0x10], xmm0
call fcn.0054478d
add esp, 0x10
cmp dword [ebp - 0x14], 0x10
jne 0x4317e1
mov esi, dword [ebp - 0xc]
lea eax, [esi + 0x10]
cmp edi, eax
jne 0x4317e1
lea eax, [esi + 2]
push eax
call fcn.00521d36
mov edi, eax
add esp, 4
test edi, edi
je 0x4317e1
lea eax, [esi + 2]
push eax
push 0
push edi
call fcn.0053e230
push dword [ebp - 0x18]
push esi
push 1
push edi
call fcn.0054478d
push dword [ebp - 0x24]
mov edx, esi
mov ecx, edi
call fcn.00431940
add esp, 0x20
mov ecx, edi
call fcn.00431a40
cmp eax, dword [ebp - 8]
jne 0x4317e1
mov eax, dword [ebp - 0x1c]
mov ebx, 1
mov dword [eax], edi
mov eax, dword [ebp - 0x20]
mov dword [eax], esi
push dword [ebp - 0x18]
call fcn.00544038
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret
Function at 0x431940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
test esi, esi
je 0x4319bb
test edx, edx
je 0x4319bb
xor eax, eax
test edx, edx
je 0x4319bb
cmp edx, 0x20
jb 0x4319a7
push edi
mov ecx, edx
mov edi, edx
and ecx, 0x1f
sub edi, ecx
lea ecx, [esi + 0x10]
mov edi, edi
movdqu xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
movdqu xmmword [ecx - 0x30], xmm0
movdqu xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
movdqu xmmword [ecx - 0x20], xmm0
cmp eax, edi
jb 0x431980
pop edi
cmp eax, edx
jae 0x4319bb
jmp 0x4319b0
xor byte [eax + esi], bl
lea ecx, [eax + esi]
inc eax
cmp eax, edx
jb 0x4319b0
pop esi
pop ebx
pop ebp
ret

Function at 0x4319e0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
test edi, edi
je 0x431a30
push esi
mov esi, 0x7bd3b105
xor eax, eax
nop
imul esi, esi, 0xdd548
mov ecx, eax
and ecx, 0x1f
add esi, 0x92fb05
mov edx, esi
shr edx, 0x10
and edx, 0x7fff
add edx, str.gUl
xor edx, dword [ecx*4 + 0x590cb0]
xor edx, dword [eax + edi]
xor edx, 0xd6312bda
mov dword [eax + edi], edx
add eax, 4
cmp eax, 0x1060
jl 0x4319f0
pop esi
pop edi
ret

Function at 0x431a40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5bd250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x431b52
test edi, edi
je 0x431b52
push 0x3fc
lea eax, [ebp - 0x400]
mov dword [ebp - 0x404], 0
push 0
push eax
call fcn.0053e230
add esp, 0xc
xor ecx, ecx
jmp 0x431a90
mov eax, ecx
shr eax, 1
test cl, 1
je 0x431a9e
xor eax, 0xedb88320
test al, 1
je 0x431aab
shr eax, 1
xor eax, 0xedb88320
jmp 0x431aad
shr eax, 1
test al, 1
je 0x431aba
shr eax, 1
xor eax, 0xedb88320
jmp 0x431abc
shr eax, 1
test al, 1
je 0x431ac9
shr eax, 1
xor eax, 0xedb88320
jmp 0x431acb
shr eax, 1
test al, 1
je 0x431ad8
shr eax, 1
xor eax, 0xedb88320
jmp 0x431ada
shr eax, 1
test al, 1
je 0x431ae7
shr eax, 1
xor eax, 0xedb88320
jmp 0x431ae9
shr eax, 1
test al, 1
je 0x431af6
shr eax, 1
xor eax, 0xedb88320
jmp 0x431af8
shr eax, 1
test al, 1
je 0x431b05
shr eax, 1
xor eax, 0xedb88320
jmp 0x431b07
shr eax, 1
mov dword [ebp + ecx*4 - 0x404], eax
inc ecx
cmp ecx, 0x100
jb 0x431a90
push esi
or edx, 0xffffffff
xor esi, esi
test edi, edi
je 0x431b3d
movzx ecx, byte [esi + ebx]
inc esi
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ebp + ecx*4 - 0x404]
cmp esi, edi
jb 0x431b25
pop esi
not edx
pop edi
mov eax, edx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret
Function at 0x4324a0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
lea eax, [ebp - 0x3c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.0053e230
push 0x2454
push 0
push esi
call fcn.0053e230
lea eax, [esi + 8]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], eax
add esp, 0x18
lea eax, [esi + 0x2148]
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x2c], eax
lea eax, [esi + 0x48]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x1048]
mov dword [ebp - 8], eax
lea eax, [esi + 0x2348]
mov dword [ebp - 0x20], eax
lea eax, [esi + 0x2048]
mov dword [ebp - 0x18], eax
mov eax, edi
mov dword [ebp - 0x28], 0x100
mov dword [ebp - 0xc], 0x800
mov dword [ebp - 4], 0x800
mov dword [ebp - 0x1c], 0x80
lea edx, [eax + 2]
mov dword [ebp - 0x14], 0x80
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432530
lea ecx, [ebp - 0x3c]
sub eax, edx
push ecx
push dword [ebp + 8]
sar eax, 1
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x432597
mov ecx, dword [ebp - 0x30]
cmp ecx, 3
je 0x432564
cmp ecx, 4
je 0x432564
cmp ecx, 1
jne 0x432597
mov ax, word [ebp - 0x24]
mov word [esi], ax
mov eax, 1
pop edi
mov dword [esi + 0x2448], 0
mov dword [esi + 0x244c], 0
mov dword [esi + 4], ecx
mov dword [esi + 0x2450], 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4325a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
je 0x4325b8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0x5d540]
push str.MetalinkFile
push edi
call fcn.0053eb4f
add esp, 8
test eax, eax
je 0x4325e7
xor ecx, ecx
mov word [eax], cx
add eax, 0x1a
push eax
call fcn.0053d7ab
add esp, 4
mov dword [esi + 0x2698], eax
mov ecx, dword [esi + 0x62f00]
mov eax, 0xe1800e19
sub ecx, dword [esi + 0x62efc]
imul ecx
add edx, ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x43261a
push eax
lea edx, [esi + 0x10]
mov ecx, edi
call fcn.004324a0
add esp, 4
test eax, eax
je 0x4325b0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2464], eax
test eax, eax
je 0x432678
cmp dword [esi + 0x2480], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x5d108], 8
jne 0x432672
lea eax, [ebp - 4]
push eax
push 0
push esi
push fcn.00432a30
push 0
push 0
call fcn.00543c9a
mov dword [esi + 0xc], eax
add esp, 0x18
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.00432a30
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433670
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0x26e8]
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 2
cmp dword [eax + 4], 1
je 0x4336f8
cmp dword [edi + 0x2484], 0
je 0x4336d3
push dword [esi + 0xc]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2488]
push dword [edi + 0x2484]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4336df
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x433728
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp dword [esi], 0
jne 0x433713
mov eax, dword [esi + 4]
test eax, eax
je 0x433713
mov dword [esi + 0x18], eax
mov eax, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
push 1
push ecx
mov ecx, edi
mov dword [esi + 0x28], 0
call fcn.00434e40
test eax, eax
jne 0x4336d3
pop edi
xor eax, eax
pop esi
pop ecx
pop ebp
ret 4
Function at 0x433f10
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x26e8]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], 6
cmp dword [eax + 4], 1
je 0x433f9c
cmp dword [edi + 0x2484], 0
je 0x433fd2
push dword [esi + 0xc]
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp + 8]
push eax
push dword [edi + 0x2488]
push dword [edi + 0x2484]
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x433f83
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x3e5
sete cl
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp dword [esi], 0
jne 0x433fb7
mov eax, dword [esi + 4]
test eax, eax
je 0x433fb7
mov dword [esi + 0x18], eax
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 1
push ebx
mov dword [esi + 0x28], 4
call fcn.00434e40
test eax, eax
jne 0x433fd2
push ebx
mov ecx, edi
call fcn.00434880
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
Function at 0x434100
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x26e8]
mov edi, dword [eax + ebx*4]
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 1
je 0x4342a1
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x434161
lea ecx, [ebp - 4]
mov dword [ebp + 8], 0
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 8], 4
push ecx
push 0x20000013
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x434161
mov eax, dword [ebp + 8]
jmp 0x434163
xor eax, eax
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x434170
mov dword [ecx + 0x2450], eax
cmp dword [edi], 0
jne 0x43422c
cmp eax, 0xce
jne 0x43422c
cmp dword [esi + 0x5d110], 0xffffffff
jne 0x43419a
cmp dword [esi + 0x5d114], 0xffffffff
je 0x434248
push edi
mov ecx, esi
call fcn.00435590
test eax, eax
je 0x434259
cmp dword [edi + 0x38], 0xffffffff
mov edx, dword [edi + 0x3c]
jne 0x4341bc
cmp edx, 0xffffffff
je 0x434259
mov eax, dword [edi + 0x8040]
mov ecx, dword [eax + 8]
add ecx, dword [edi + 0x38]
mov eax, dword [eax + 0xc]
adc eax, edx
cmp dword [esi + 0x5d118], 0
mov edx, dword [esi + 0x5d11c]
jne 0x4341e0
test edx, edx
je 0x4341ec
cmp dword [esi + 0x5d118], ecx
jne 0x434201
cmp edx, eax
jne 0x434201
cmp dword [esi + 0x5d110], ecx
jne 0x434259
cmp dword [esi + 0x5d114], eax
jne 0x434259
jmp 0x4342b0
mov eax, dword [edi + 0x20]
test eax, eax
je 0x434212
mov dword [eax + 0x244c], 1
push ebx
mov ecx, esi
call fcn.00434880
push 4
mov ecx, esi
call fcn.00432fd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x1f4
jne 0x43426f
mov ecx, esi
push 1
push ebx
mov dword [edi + 0x28], 4
call fcn.00434e40
test eax, eax
jne 0x434261
cmp dword [esi + 0x2700], 0
je 0x434259
push ecx
mov ecx, esi
call fcn.00436b40
push ebx
mov ecx, esi
call fcn.00434880
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x194
jne 0x434248
mov eax, dword [edi + 0x20]
test eax, eax
je 0x434287
mov dword [eax + 0x244c], 1
push ebx
mov ecx, esi
call fcn.00434880
push 4
mov ecx, esi
call fcn.00432fd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
jne 0x434235
mov eax, dword [edi + 4]
test eax, eax
je 0x434235
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x20]
cmp dword [eax + 0x2448], 0xffffffff
jne 0x4342ce
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x20]
sub eax, dword [edi + 8]
mov dword [ecx + 0x2448], eax
cmp dword [esi + 0x2700], 0
je 0x4342ef
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x4e20
push eax
push 6
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [edi + 0x8040]
cmp dword [eax + 4], 0
jne 0x434259
mov dword [eax + 4], 1
mov eax, 1
mov dword [edi + 0x28], 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x434320
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xorps xmm0, xmm0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push 0x8000
mov eax, dword [ebx + 0x26e8]
push 0
mov edi, dword [eax + edi*4]
movdqu xmmword [edi + 0x8044], xmm0
lea esi, [edi + 0x40]
movdqu xmmword [edi + 0x8054], xmm0
push esi
movq qword [edi + 0x8064], xmm0
mov dword [edi + 0x8044], 0x28
call fcn.0053e230
mov edx, dword [edi + 0x8040]
add esp, 0xc
mov dword [edi + 0x8058], esi
lea esi, [edi + 0x805c]
mov dword [esi], 0x8000
test edx, edx
je 0x4343c3
mov eax, dword [edx + 0x10]
sub eax, dword [edx + 0x18]
mov ecx, dword [edx + 0x14]
sbb ecx, dword [edx + 0x1c]
sub eax, dword [edx + 8]
sbb ecx, dword [edx + 0xc]
add eax, 1
adc ecx, 0
test ecx, ecx
jb 0x4343be
ja 0x4343b0
cmp eax, 0x8000
jbe 0x4343be
mov eax, 0x8000
mov dword [ebp - 4], 0
jmp 0x434402
mov dword [ebp - 4], ecx
jmp 0x434402
mov eax, dword [ebx + 0x5d110]
mov ecx, dword [ebx + 0x5d114]
cmp eax, 0xffffffff
jne 0x4343d8
cmp ecx, eax
je 0x434404
sub eax, dword [ebx + 0x5d120]
sbb ecx, dword [ebx + 0x5d124]
test ecx, ecx
jb 0x4343ff
ja 0x4343f1
cmp eax, 0x8000
jbe 0x4343ff
mov eax, 0x8000
mov dword [ebp - 4], 0
jmp 0x434402
mov dword [ebp - 4], ecx
mov dword [esi], eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [edi + 0x20]
mov dword [edi + 0x28], 9
cmp dword [eax + 4], 1
je 0x434466
push edi
push 1
lea eax, [edi + 0x8044]
push eax
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
je 0x43444b
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x434489
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push dword [esi]
push dword [edi + 0x8058]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x434434
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x43443d
push dword [ebp + 8]
mov ecx, ebx
call fcn.00434880
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4349b0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
mov eax, dword [0x5bd250]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x868], esi
cmp cx, word [ebx + 0x61a68]
je 0x4349e9
lea edi, [ebx + 0x61a68]
jmp 0x434ac7
xor eax, eax
cmp ax, word [0x5c4840]
jne 0x434ac2
push 0x823
push eax
mov byte [ebp - 0x834], al
lea eax, [ebp - 0x833]
push eax
call fcn.0053e230
add esp, 0xc
mov dword [ebp - 0x86c], 0x823
lea eax, [ebp - 0x86c]
lea edx, [ebp - 0x834]
push eax
call fcn.00431d60
add esp, 4
test eax, eax
jne 0x434ab7
lea edx, [ebp - 0x834]
lea ecx, [ebp - 0x84c]
call fcn.004145d0
cmp dword [ebp - 0x838], 8
lea esi, [ebp - 0x84c]
mov ecx, 0x5c4840
mov edx, 0x824
cmovae esi, dword [ebp - 0x84c]
sub esi, ecx
jmp 0x434a70
lea eax, [edx + 0x7ffff7da]
test eax, eax
je 0x434a8e
movzx eax, word [esi + ecx]
test ax, ax
je 0x434a8e
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x434a70
jmp 0x434a92
test edx, edx
jne 0x434a95
sub ecx, 2
xor eax, eax
cmp dword [ebp - 0x838], 8
mov word [ecx], ax
jb 0x434ab1
push dword [ebp - 0x84c]
call fcn.0053ce3a
add esp, 4
mov esi, dword [ebp - 0x868]
xor eax, eax
cmp ax, word [0x5c4840]
je 0x434ac7
mov edi, 0x5c4840
push 0x10000000
push 0
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, eax
mov dword [esi + 0x14], ecx
test ecx, ecx
je 0x434c28
mov eax, dword [ebp - 0x868]
xor esi, esi
xor edi, edi
mov edx, dword [eax + 0x20]
cmp word [edx + 0x2348], si
lea eax, [edx + 0x2348]
cmovne edi, eax
cmp word [edx + 0x2048], si
lea eax, [edx + 0x2048]
cmovne esi, eax
test edi, edi
jne 0x434b27
cmp word [ebx + 0x60618], di
lea eax, [ebx + 0x60618]
cmovne edi, eax
test esi, esi
jne 0x434b3b
cmp word [ebx + 0x60718], si
lea eax, [ebx + 0x60718]
cmovne esi, eax
cmp dword [edx + 4], 1
mov eax, 3
mov edx, 1
push 0x432b50
cmove eax, edx
push ecx
mov dword [ebp - 0x86c], eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov edx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x86c]
push edx
push dword [ebx + 0x26e4]
mov ecx, dword [edx + 0x20]
push eax
push esi
push edi
movzx eax, word [ecx]
push eax
lea eax, [ecx + 0x2148]
push eax
push dword [edx + 0x14]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov esi, dword [ebp - 0x868]
mov dword [esi + 0x18], eax
test eax, eax
je 0x434c28
cmp word [ebx + 0x60a20], 0
lea edx, [ebx + 0x60a20]
je 0x434c10
lea ecx, [ebp - 0x864]
call fcn.00414370
cmp dword [ebp - 0x850], 0x10
lea eax, [ebp - 0x864]
push 0xc
cmovae eax, dword [ebp - 0x864]
mov dword [ebp - 0x83c], eax
lea eax, [ebp - 0x840]
push eax
push 0x26
push dword [esi + 0x14]
mov dword [ebp - 0x840], 3
mov dword [ebp - 0x838], 0x590a2d
call dword [sym.imp.WININET.dll_InternetSetOptionA]
cmp dword [ebp - 0x850], 0x10
jb 0x434c10
push dword [ebp - 0x864]
call fcn.0053ce3a
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 4
Function at 0x434c40
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0053fec0
mov eax, dword [0x5bd250]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x1020], 0x59a360
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x59a34c
cmp dword [ebx + 0x2484], 0
mov esi, str.POST
push 0xffe
cmove esi, eax
mov dword [ebp - 0x101c], 0
xor eax, eax
push eax
mov word [ebp - 0x100c], ax
lea eax, [ebp - 0x100a]
push eax
call fcn.0053e230
mov ecx, dword [edi + 0x20]
add esp, 0xc
lea eax, [ecx + 0x1048]
push eax
lea eax, [ecx + 0x48]
push eax
push 0x59a368
lea eax, [ebp - 0x100c]
push 0x7ff
push eax
call fcn.00546433
add esp, 0x14
mov eax, 0x8408c300
cmp dword [ebx + 0x62ecc], 0
mov ecx, 0x8400c300
cmovne ecx, eax
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 4
jne 0x434cef
or ecx, 0x803000
push edi
push ecx
lea eax, [ebp - 0x1020]
push eax
push 0
push str.HTTP_1.1
lea eax, [ebp - 0x100c]
push eax
push esi
push dword [edi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x434e1e
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
lea ecx, [ebp - 0x1018]
push 4
push ecx
push 2
push eax
mov dword [ebp - 0x1018], 0x3a98
call esi
push 4
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1014], 1
push eax
push 0x41
push dword [edi + 0x1c]
call esi
mov dword [ebp - 0x1010], eax
xor ecx, ecx
mov eax, 0x5168
mov edx, 2
mul edx
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x1048], xmm0
movdqu xmmword [ebp - 0x1038], xmm0
mov dword [ebp - 0x1048], 0x28
movq qword [ebp - 0x1028], xmm0
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00521d36
mov esi, eax
add esp, 4
test esi, esi
je 0x434de5
push 0xa2d0
push 0
push esi
call fcn.0053e230
add esp, 0xc
push dword [ebp - 0x1010]
push ecx
push esi
push edi
mov ecx, ebx
call fcn.00434f40
mov ecx, esi
mov dword [ebp - 0x1040], esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434dd0
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x103c], ecx
push edi
push 1
push 0
lea eax, [ebp - 0x1048]
push eax
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov edi, eax
test esi, esi
je 0x434e09
push esi
call fcn.0053d801
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret 4