joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468898
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
xor eax, eax
mov ecx, 0x5db03c
push ebx
push esi
push edi
lea esi, [ebp - 0xcc]
xor edx, edx
mov dl, byte [ecx]
mov ebx, edx
and ebx, 7
mov dword [ebp - 8], ebx
sar edx, 3
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx + edx]
mov ebx, dword [ebp - 8]
and dx, word [ebx*2 + 0x5dafcc]
je 0x4688d8
mov dl, 1
jmp 0x4688da
xor edx, edx
mov byte [esi], dl
inc eax
inc esi
inc ecx
cmp eax, 0x38
jl 0x4688b1
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x5db074
mov ecx, dword [ebp - 4]
add ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp + edx*4 - 0x94], ecx
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x94], ecx
xor eax, eax
lea ecx, [ebp - 0x104]
mov edx, dword [ebp - 0x10]
mov esi, edx
xor edx, edx
mov dl, byte [esi]
add edx, eax
cmp edx, 0x1c
jge 0x468938
mov dl, byte [ebp + edx - 0xcc]
mov byte [ecx], dl
jmp 0x468941
mov dl, byte [ebp + edx - 0xe8]
mov byte [ecx], dl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x468922
mov edx, dword [ebp - 0x10]
mov eax, 0x1c
mov esi, edx
lea ecx, [ebp - 0xe8]
xor edx, edx
mov dl, byte [esi]
add edx, eax
cmp edx, 0x38
jge 0x46896e
mov dl, byte [ebp + edx - 0xcc]
mov byte [ecx], dl
jmp 0x468977
mov dl, byte [ebp + edx - 0xe8]
mov byte [ecx], dl
inc eax
inc ecx
cmp eax, 0x38
jl 0x468958
mov ecx, dword [ebp - 0xc]
xor eax, eax
lea edx, [ebp + ecx*4 - 0x94]
mov dword [ebp - 0x14], edx
mov edx, 0x5db084
mov ecx, dword [ebp - 8]
lea ebx, [ebp + ecx*4 - 0x94]
mov ecx, 0x5dafdc
movzx esi, byte [edx]
cmp byte [ebp + esi - 0x104], 0
je 0x4689b2
mov esi, dword [ecx]
or dword [ebx], esi
movzx esi, byte [edx + 0x18]
cmp byte [ebp + esi - 0x104], 0
je 0x4689c7
mov esi, dword [ecx]
mov edi, dword [ebp - 0x14]
or dword [edi], esi
inc eax
add ecx, 4
inc edx
cmp eax, 0x18
jl 0x4689a1
inc dword [ebp - 4]
inc dword [ebp - 0x10]
cmp dword [ebp - 4], 0x10
jl 0x4688f0
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x94]
push eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00468a3c
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x38
push 0
push eax
call fcn.0046da90
add esp, 0xc
lea edx, [ebp - 0x104]
push 0x38
push 0
push edx
call fcn.0046da90
add esp, 0xc
lea ecx, [ebp - 0x94]
push pe_nt_image_headers32
push 0
push ecx
call fcn.0046da90
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468f64
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x5c
push 0
push ebx
call sub.cc3260mt.dll__memset
add esp, 0xc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
pop ebp
ret
Function at 0x469968
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x5db9c4
lea edi, [ebp - 0x40]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebx
call fcn.00468f64
pop ecx
lea eax, [ebx + 0x5c]
push eax
call fcn.00468f64
pop ecx
push 0x40
push 0
lea edx, [ebp - 0x40]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
cmp si, 0x40
jbe 0x4699d5
push esi
push edi
push ebx
call fcn.00469210
add esp, 0xc
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.004692c0
add esp, 8
push ebx
call fcn.00468f64
pop ecx
jmp 0x4699e6
movzx eax, si
push eax
push edi
lea edx, [ebp - 0x40]
push edx
call sub.cc3260mt.dll__memcpy
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x36
inc eax
inc edx
cmp al, 0x40
jb 0x4699eb
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.00469210
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x6c
inc eax
inc edx
cmp al, 0x40
jb 0x469a08
push 0x40
lea ecx, [ebp - 0x40]
push ecx
add ebx, 0x5c
push ebx
call fcn.00469210
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x469a60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x5dba04
lea edi, [ebp - 0x40]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebx
call fcn.00468f64
pop ecx
lea eax, [ebx + 0x5c]
push eax
call fcn.00468f64
pop ecx
push 0x40
push 0
lea edx, [ebp - 0x40]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
cmp si, 0x40
jbe 0x469acd
push esi
push edi
push ebx
call fcn.00469824
add esp, 0xc
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.004698d4
add esp, 8
push ebx
call fcn.00468f64
pop ecx
jmp 0x469ade
movzx eax, si
push eax
push edi
lea edx, [ebp - 0x40]
push edx
call sub.cc3260mt.dll__memcpy
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x36
inc eax
inc edx
cmp al, 0x40
jb 0x469ae3
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push ebx
call fcn.00469824
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x40]
xor byte [edx], 0x6c
inc eax
inc edx
cmp al, 0x40
jb 0x469b00
push 0x40
lea ecx, [ebp - 0x40]
push ecx
add ebx, 0x5c
push ebx
call fcn.00469824
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push 0x10
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.00469d30
add esp, 0xc
push 0x10
mov ecx, dword [ebp + 0x10]
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.00469d30
add esp, 0xc
xor esi, esi
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov edx, eax
mov eax, dword [ebp + 8]
mov bl, byte [eax]
inc eax
xor bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
inc esi
cmp esi, 0x10
jb 0x469c99
xor eax, eax
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x30]
mov al, byte [eax + 0x5dba44]
inc ecx
xor byte [edx], al
mov al, byte [edx]
inc edx
and eax, 0xff
cmp ecx, 0x30
jb 0x469cb1
lea edx, [esi + eax]
inc esi
and edx, 0xff
cmp esi, 0x12
mov eax, edx
jb 0x469cac
push 0x10
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00469d30
mov edx, dword [ebp + 0xc]
xor eax, eax
add esp, 0xc
xor esi, esi
mov al, byte [edx + 0xf]
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov edx, dword [ebp + 0x10]
xor ebx, ebx
inc esi
mov bl, byte [edx]
inc edx
xor eax, ebx
mov al, byte [eax + 0x5dba44]
xor byte [ecx], al
mov al, byte [ecx]
inc ecx
and eax, 0xff
cmp esi, 0x10
jb 0x469cfc
push 0x30
push 0
lea edx, [ebp - 0x30]
push edx
call fcn.00469d58
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x469d78
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x46fefc
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
pop ebp
ret

Function at 0x470760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov eax, dword [ebp + 8]
test eax, eax
jge 0x47077a
neg eax
mov dword [0x5dbcec], eax
mov eax, 1
mov edx, dword [0x5dbcec]
xor ecx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0x5dbd00
mov dword [ebp - 0x10], 0x5dbcf0
mov dword [ebp - 0xc], eax
mov ecx, eax
mov edx, dword [ebp - 0x10]
xor ecx, dword [edx]
mov edx, ecx
mov eax, ecx
shr edx, 0x10
and eax, 0xffff
mov ebx, eax
mov ecx, edx
imul ecx, edx
imul ebx, eax
imul edx
not ecx
add ebx, ecx
mov edx, dword [ebp - 0xc]
mov ecx, ebx
and ebx, 0xffff
shl ebx, 0x10
shr ecx, 0x10
or ecx, ebx
mov ebx, dword [ebp - 0x14]
xor ecx, dword [ebx]
add ecx, eax
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], edx
inc dword [ebp - 8]
add dword [ebp - 0x14], 4
add dword [ebp - 0x10], 4
cmp dword [ebp - 8], 4
mov eax, ecx
jb 0x470796
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478250
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, 0x609aa0
lea esi, [ebp - 0x24]
mov eax, 0x5e0cd4
call fcn.005496a0
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebx + 0x70]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x64]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x60]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x5c]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x58]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x54]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x4c]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x40]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x3c]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x38]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x34]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x30]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x2c]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x28]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x24]
mov edx, 2
call fcn.00549c08
dec dword [esi + 0x1c]
lea eax, [ebx + 0x20]
mov edx, 2
call fcn.00549c08
mov ecx, dword [esi]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47837c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov ebx, 0x609aa0
mov eax, 0x5e0d68
call fcn.005496a0
xor edx, edx
xor ecx, ecx
mov dword [ebx], edx
mov dword [ebx + 8], ecx
xor eax, eax
mov edx, 0x5e0cdc
mov dword [ebx + 0xc], eax
lea eax, [ebp - 4]
mov word [ebp - 0x20], 8
call fcn.005499e4
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
lea eax, [ebx + 0x28]
call fcn.00549c38
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00549c08
mov word [ebp - 0x20], 0x14
mov edx, 0x5e0cdd
lea eax, [ebp - 8]
call fcn.005499e4
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
lea eax, [ebx + 0x2c]
call fcn.00549c38
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00549c08
mov word [ebp - 0x20], 0x20
mov edx, 0x5e0cde
lea eax, [ebp - 0xc]
call fcn.005499e4
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
lea eax, [ebx + 0x30]
call fcn.00549c38
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00549c08
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ca28
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48cb3c
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x48cb02
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call sub.rtl60.bpl__System__FillChar_qqrpvic
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0xc], 1
mov eax, esi
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call sub.wininet.dll_InternetCrackUrlA
mov eax, dword [ebp - 0x30]
add eax, 0xfffffffd
sub eax, 2
jb 0x48cacb
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x40], 0xb
lea eax, [ebp - 0x44]
push eax
push 0
lea edx, [ebp - 0x48]
mov eax, dword [0x6052a0]
call sub.rtl60.bpl__System_LoadResString_qqrp20System_TResStringRec
mov ecx, dword [ebp - 0x48]
mov dl, 1
mov eax, dword [sym.imp.rtl60.bpl__Sysutils_Exception_]
call sub.rtl60.bpl__Sysutils_Exception__bctr_qqrx17System_AnsiStringpx14System_TVarRecxi
call sub.rtl60.bpl__System__RaiseExcept_qqrv
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x58], eax
movzx eax, word [ebp - 0x24]
mov dword [ebx + 0x54], eax
lea eax, [ebx + 0x4c]
push eax
mov edx, dword [ebp - 0x2c]
sub edx, edi
inc edx
mov ecx, dword [ebp - 0x28]
mov eax, esi
call sub.rtl60.bpl__System__LStrCopy_qqrv
lea eax, [ebx + 0x50]
push eax
mov edx, dword [ebp - 0x10]
sub edx, edi
inc edx
mov ecx, dword [ebp - 0xc]
mov eax, esi
call sub.rtl60.bpl__System__LStrCopy_qqrv
jmp 0x48cb1c
xor eax, eax
mov dword [ebx + 0x54], eax
lea eax, [ebx + 0x4c]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebx + 0x50]
call sub.rtl60.bpl__System__LStrClr_qqrpv
xor eax, eax
mov dword [ebx + 0x58], eax
lea eax, [ebx + 0x3c]
mov edx, esi
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cb43
lea eax, [ebp - 0x48]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x48ccd0
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
test dl, dl
je 0x48cdf6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39], 0
jne 0x48ce2d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
test eax, eax
jle 0x48cd05
mov ebx, 3
jmp 0x48cd07
xor ebx, ebx
push 0
call sub.wininet.dll_InternetAttemptConnect
test eax, eax
je 0x48cd17
call sub.rtl60.bpl__Sysutils_Abort_qqrv
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.wininet.dll_InternetOpenA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x64], esi
test esi, esi
setne dl
xor dl, 1
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.0048c840
xor eax, eax
push ebp
push 0x48cdd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
push 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
push eax
call sub.wininet.dll_InternetConnectA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], ebx
test ebx, ebx
setne dl
xor dl, 1
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.0048c840
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48ce2d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x48ce06
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x68], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
test eax, eax
je 0x48ce1e
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x64], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x48ce34
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48cfa5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
mov edi, ebx
push edi
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x48cf13
cmp dword [ebp - 0x10], 0x12c
jb 0x48cf13
cmp dword [ebp - 0x10], 0x1f4
je 0x48cf13
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x1000
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrSetLength_qqrv
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
call sub.rtl60.bpl__System__UniqueStringA_qqrr17System_AnsiString
push eax
push 0x14
push edi
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x48cf13
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrSetLength_qqrv
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea eax, [ebp - 0x34]
push eax
push 2
mov ecx, 0x48cfbc
mov dl, 1
mov eax, dword [sym.imp.rtl60.bpl__Sysutils_Exception_]
call sub.rtl60.bpl__Sysutils_Exception__bctr_qqrx17System_AnsiStringpx14System_TVarRecxi
call sub.rtl60.bpl__System__RaiseExcept_qqrv
xor eax, eax
mov dword [ebp - 0x14], eax
push 0
push 0
lea eax, [ebp - 8]
push eax
mov edi, ebx
push edi
call sub.wininet.dll_InternetQueryDataAvailable
mov edx, eax
cmp edx, 1
sbb edx, edx
neg edx
mov cl, 1
mov eax, esi
call fcn.0048c840
cmp dword [ebp - 8], 0
jbe 0x48cf89
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrSetLength_qqrv
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
call sub.rtl60.bpl__System__UniqueStringA_qqrr17System_AnsiString
push eax
push edi
call sub.wininet.dll_InternetReadFile
mov edx, eax
cmp edx, 1
sbb edx, edx
neg edx
mov cl, 1
mov eax, esi
call fcn.0048c840
lea eax, [ebp - 0x1c]
call sub.rtl60.bpl__System__UniqueStringA_qqrr17System_AnsiString
mov edx, eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp dword [ebp - 8], 0
jne 0x48cf18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cfac
lea eax, [ebp - 0x1c]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x48d298
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48d440
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0048ccd0
push 2
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x48d270]
call sub.rtl60.bpl__System__DynArraySetLength_qqrv
add esp, 4
mov eax, 0x48d450
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 4], edx
mov dword [ebp - 0xc], 0x4000000
mov eax, dword [ebp - 4]
cmp dword [eax + 0x58], 4
jne 0x48d312
or dword [ebp - 0xc], 0x800000
mov eax, dword [ebp - 4]
test byte [eax + 0x75], 2
je 0x48d312
or dword [ebp - 0xc], 0x3000
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x48d3f9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x48d454
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne dl
xor dl, 1
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0048c840
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpSendRequestA
test eax, eax
jne 0x48d3ef
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x2f0d
jne 0x48d3c3
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1f
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetQueryOptionA
or dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1f
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
jmp 0x48d369
lea eax, [ebp - 0x14]
push eax
push 7
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetDesktopWindow
push eax
call sub.wininet.dll_InternetErrorDlg
sub eax, 1
jb 0x48d3ef
sub eax, 0x4c6
jne 0x48d369
call sub.rtl60.bpl__Sysutils_Abort_qqrv
jmp 0x48d369
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48d421
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d447
lea eax, [ebp - 0x18]
mov edx, dword [0x48d270]
call sub.rtl60.bpl__System__DynArrayClear_qqrrpvpv
ret
Function at 0x49f060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x49f0fc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebp - 4]
call fcn.0048c9fc
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
call fcn.0048cb4c
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0x18]
call fcn.0048cb74
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0x10]
call fcn.0048cb9c
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x30]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f103
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x4c3fbc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov byte [ebp - 8], dl
test dl, dl
jle 0x4c3fce
call fcn.0054c350
mov byte [ebp - 0x29], dl
mov dword [ebp - 4], eax
mov eax, 0x5e1e1c
call fcn.005496a0
mov word [ebp - 0x18], 8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Classes_TThread__bctr_qqro
add dword [ebp - 0xc], 2
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [edx + 0x30], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x34], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x29], 0
je 0x4c4022
call fcn.0054c35d
mov esp, ebp
pop ebp
ret 8