joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5109a654
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5109a682
mov eax, ebx
call fcn.5109b108
cmp dword [ebx + 0x40], 0
je 0x5109a67b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5109a6f3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5109a6e5
cmp dword [ebx + 8], 0
je 0x5109a6a4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5109a6b6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5109a6e5
cmp dword [ebx + 8], 0
je 0x5109a697
cmp eax, 3
je 0x5109a6c9
dec eax
jne 0x5109a697
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5109a697
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5109a697
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5109a711
cmp dword [ebx + 0x14], 0xcc
je 0x5109a711
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.5109a71c
pop ebx
ret

Function at 0x510af480
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], ecx
mov ebx, edx
mov edi, eax
lea edx, [esp + 4]
mov eax, ebx
mov ecx, 4
call fcn.51002cac
lea edx, [esp + 8]
mov esi, ebx
mov eax, esi
add eax, 4
mov ecx, 4
call fcn.51002cac
lea edx, [esp + 0xc]
mov eax, esi
add eax, 8
mov ecx, 4
call fcn.51002cac
lea edx, [esp + 0x10]
mov eax, esi
add eax, 0xc
mov ecx, 4
call fcn.51002cac
mov eax, dword [edi + 0xcc]
sub dword [esp + 0xc], eax
mov eax, dword [edi + 0xc8]
sub dword [esp + 4], eax
mov esi, 0x14
mov ebx, dword [esp + 4]
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x10]
add eax, eax
inc eax
imul dword [esp + 0x10]
mov edx, 5
call fcn.510af25c
mov ebp, eax
mov eax, dword [esp + 8]
add eax, eax
inc eax
imul dword [esp + 8]
mov edx, 5
call fcn.510af25c
mov ebx, eax
mov eax, esi
add eax, eax
push dword [edi + eax*4 + 0x24]
mov eax, dword [esp + 0x10]
pop edx
sub eax, edx
mov edx, ebx
call fcn.510af270
xor eax, ebp
mov dword [esp + 0xc], eax
mov eax, esi
add eax, eax
push dword [edi + eax*4 + 0x20]
mov eax, dword [esp + 8]
pop edx
sub eax, edx
mov edx, ebp
call fcn.510af270
xor ebx, eax
mov dword [esp + 4], ebx
dec esi
test esi, esi
jne 0x510af4f2
mov eax, dword [edi + 0x24]
sub dword [esp + 0x10], eax
mov eax, dword [edi + 0x20]
sub dword [esp + 8], eax
mov edx, dword [esp]
lea eax, [esp + 4]
mov ecx, 4
call fcn.51002cac
mov ebx, dword [esp]
mov edx, ebx
add edx, 4
lea eax, [esp + 8]
mov ecx, 4
call fcn.51002cac
mov edx, ebx
add edx, 8
lea eax, [esp + 0xc]
mov ecx, 4
call fcn.51002cac
mov edx, ebx
add edx, 0xc
lea eax, [esp + 0x10]
mov ecx, 4
call fcn.51002cac
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x510af738
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
mov edi, edx
mov esi, eax
xor ebx, ebx
xor eax, eax
mov ecx, edi
shr ecx, 2
jecxz 0x510af78c
mov edx, dword [esi]
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0x510c611c]
mov bl, al
xor bl, dh
shr eax, 8
xor eax, dword [ebx*4 + 0x510c611c]
shr edx, 0x10
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0x510c611c]
mov bl, al
xor bl, dh
shr eax, 8
xor eax, dword [ebx*4 + 0x510c611c]
add esi, 4
loop 0x510af74a
mov ecx, edi
and ecx, 3
jecxz 0x510af7a4
mov bl, al
xor bl, byte [esi]
shr eax, 8
inc esi
xor eax, dword [ebx*4 + 0x510c611c]
loop 0x510af793
pop ebx
pop edi
pop esi
ret
Function at 0x510b0544
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x510b06d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.510045e4
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.5100467c
mov dword [ebp - 0x24], 0xff
mov eax, dword [ebp - 4]
call fcn.510048a4
test eax, eax
jle 0x510b06b9
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.51004aa4
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x510b0697
mov eax, dword [ebp - 0x1c]
call fcn.51002a8c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x510b0690
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x510b0677
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x510b06e0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x510b064e
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.510076f8
movzx eax, ax
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea edx, [ebp - 0x44]
mov ecx, 2
mov eax, 0x510b0704
call fcn.51009ec0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.5100467c
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x28]
call fcn.51004aa4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x510b0677
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.510099a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b0697
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.51002abc
ret
mov eax, dword [ebp - 8]
mov edx, 0x510b072c
call fcn.510049f0
jne 0x510b06b9
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x510b06b9
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.510b0738
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b06db
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.51004608
ret
Function at 0x510b0738
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.51004a94
xor eax, eax
push ebp
push 0x510b0869
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.510045e4
cmp dword [ebp - 4], 0
je 0x510b0853
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.51004aa4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x510b0853
mov eax, dword [ebp - 8]
call fcn.51002a8c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x510b084c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x510b0878
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
shr esi, 0x10
mov dx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x1a], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1c], dx
mov di, word [eax + 0xc]
and di, 0xffff
push ebx
movzx eax, si
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [ebp - 0x1a]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
movzx eax, word [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, di
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x510b0884
call fcn.51009ec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b0853
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.51002abc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b0870
lea eax, [ebp - 4]
call fcn.510045e4
ret
Function at 0x510b1768
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, edx
mov ebx, eax
mov dword [ebp - 4], 0x80004005
test ebx, ebx
jne 0x510b178b
mov dword [ebp - 4], 0x80070057
jmp 0x510b182e
lea eax, [ebp - 8]
push eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x510b182e
mov eax, dword [ebp - 0xc]
call fcn.51002a8c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x510b1827
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x510b1811
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x510b1838
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x510b1811
cmp dword [ebp - 0x14], 0
je 0x510b1811
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [esi], eax
xor eax, eax
mov dword [ebp - 4], eax
call fcn.51004004
jmp 0x510b182e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b182e
mov eax, dword [ebp - 0x10]
call fcn.51002abc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x510b21c8
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff50
mov dword [esp], edx
lea eax, [esp + 0x14]
xor ecx, ecx
mov edx, 0x9c
call fcn.5100311c
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0x9c
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetVersionExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x510b24a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
movzx esi, word [esp + 0xa8]
movzx eax, word [esp + 0xaa]
mov dword [esp + 0xc], eax
cmp ebx, 5
jbe 0x510b24a0
push 0x510b24ac
call sub.kernel32.dll_LoadLibraryA
mov edi, eax
test edi, edi
je 0x510b24a0
push 0x510b24bc
push edi
call sub.kernel32.dll_GetProcAddress_1
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je case.0x510b2286.0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push esi
push ebp
push ebx
call dword [esp + 0x18]
test eax, eax
jle case.0x510b2286.0
mov eax, dword [esp + 0x10]
cmp eax, 0x19
ja case.0x510b2286.0
jmp dword [eax*4 + 0x510b228d]
mov eax, dword [esp]
mov edx, 0x510b24d4
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b24e8
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b24fc
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2514
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2544
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2574
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2588
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b25b8
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b25e8
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b261c
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2630
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2648
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2660
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2674
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2698
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b26b0
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b26d8
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2704
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2730
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2740
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2764
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b2784
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b27a4
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b27c8
call fcn.51004638
jmp case.0x510b2286.0
mov eax, dword [esp]
mov edx, 0x510b27dc
call fcn.51004638
push edi
call sub.kernel32.dll_FreeLibrary_1
add esp, 0xb0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x510b2b88
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
xor edx, edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x510b2d23
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x510b2bfc
mov eax, dword [ebp - 0x90]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x88]
and eax, 0xffff
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x1c]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.51004854
jmp 0x510b2c0b
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x10]
sub eax, 4
je 0x510b2c1e
dec eax
je 0x510b2c4b
dec eax
je 0x510b2c87
jmp 0x510b2c9e
mov eax, dword [ebx + 0x14]
sub eax, 0xa
je 0x510b2c2d
sub eax, 0x50
je 0x510b2c3c
jmp 0x510b2cab
lea eax, [ebx + 4]
mov edx, 0x510b2d38
call fcn.51004638
jmp 0x510b2cab
lea eax, [ebx + 4]
mov edx, 0x510b2d44
call fcn.51004638
jmp 0x510b2cab
mov eax, dword [ebx + 0x14]
sub eax, 1
jb 0x510b2c5a
je 0x510b2c69
dec eax
je 0x510b2c78
jmp 0x510b2cab
lea eax, [ebx + 4]
mov edx, 0x510b2d50
call fcn.51004638
jmp 0x510b2cab
lea eax, [ebx + 4]
mov edx, 0x510b2d60
call fcn.51004638
jmp 0x510b2cab
lea eax, [ebx + 4]
mov edx, 0x510b2d6c
call fcn.51004638
jmp 0x510b2cab
mov eax, dword [ebx + 0x14]
sub eax, 1
jae 0x510b2cab
lea eax, [ebx + 4]
mov edx, 0x510b2d7c
call fcn.51004638
jmp 0x510b2cab
lea eax, [ebx + 4]
mov edx, 0x510b2d8c
call fcn.51004638
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 0x10]
cmp eax, 4
jle 0x510b2cd7
cmp eax, 6
jge 0x510b2cd7
lea edx, [ebp - 0x98]
mov eax, ebx
call fcn.510b27f8
mov edx, dword [ebp - 0x98]
lea eax, [ebx + 8]
call fcn.51004638
cmp dword [ebx + 0x10], 5
jle 0x510b2cf8
lea edx, [ebp - 0x9c]
mov eax, ebx
call fcn.510b21c8
mov edx, dword [ebp - 0x9c]
lea eax, [ebx + 8]
call fcn.51004638
cmp dword [ebx + 0x10], 4
jle 0x510b2d05
mov eax, ebx
call fcn.510b2e14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b2d2a
lea eax, [ebp - 0x9c]
mov edx, 2
call fcn.51004608
ret
Function at 0x510b7a40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.51004a94
xor eax, eax
push ebp
push 0x510b7b71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.510045e4
cmp dword [ebp - 4], 0
je 0x510b7b5b
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.51004aa4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x510b7b5b
mov eax, dword [ebp - 8]
call fcn.51002a8c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x510b7b54
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x510b7b80
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
shr esi, 0x10
mov dx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x1a], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1c], dx
mov di, word [eax + 0xc]
and di, 0xffff
push ebx
movzx eax, si
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
movzx eax, word [ebp - 0x1a]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
movzx eax, word [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
movzx eax, di
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x510b7b8c
call fcn.51009ec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b7b5b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.51002abc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510b7b78
lea eax, [ebp - 4]
call fcn.510045e4
ret
Function at 0x510bd2e4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.51004a94
xor eax, eax
push ebp
push 0x510bd34a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
call fcn.51004aa4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x510bd334
mov edx, ebx
lea eax, [ebp - 0x108]
call fcn.510099a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510bd351
lea eax, [ebp - 4]
call fcn.510045e4
ret

Function at 0x510bde70
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff998
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1668], ebx
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x510bdffc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x5c]
mov edx, 0x1f
call fcn.510bde64
lea eax, [ebp - 0x15c]
mov edx, 0xff
call fcn.510bde64
lea eax, [ebp - 0x1dc]
mov edx, 0x7f
call fcn.510bde64
lea eax, [ebp - 0x25c]
mov edx, 0x7f
call fcn.510bde64
lea eax, [ebp - 0xa5c]
mov edx, 0x7ff
call fcn.510bde64
lea eax, [ebp - 0x1263]
mov edx, 0x806
call fcn.510bde64
lea eax, [ebp - 0x1663]
mov edx, 0x3ff
call fcn.510bde64
lea eax, [ebp - 0x3c]
mov edx, 0x3c
call fcn.5100770c
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0x20
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], pe_nt_image_headers32
lea eax, [ebp - 0x1dc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x80
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x80
lea eax, [ebp - 0xa5c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x800
lea eax, [ebp - 0x1663]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x400
lea eax, [ebp - 0x3c]
push eax
push 0x90000000
mov eax, esi
call fcn.510048a4
push eax
mov eax, esi
call fcn.51004aa4
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, edi
lea edx, [ebp - 0x15c]
mov ecx, pe_nt_image_headers32
call fcn.51004854
mov eax, ebx
lea edx, [ebp - 0xa5c]
mov ecx, 0x800
call fcn.51004854
lea eax, [ebp - 0x1668]
lea edx, [ebp - 0x1663]
mov ecx, 0x400
call fcn.51004854
mov edx, dword [ebp - 0x1668]
mov eax, ebx
call fcn.510048ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510be003
lea eax, [ebp - 0x1668]
call fcn.510045e4
ret
Function at 0x510be6e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x510be783
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.510099a8
mov edx, dword [ebp - 0x108]
lea eax, [ebx + 0x10]
call fcn.51004638
lea edx, [ebp - 0x10c]
mov eax, dword [ebx + 0x10]
call fcn.5100da10
mov edx, dword [ebp - 0x10c]
lea eax, [ebx + 0x10]
mov ecx, 0x510be798
call fcn.510048f0
mov eax, dword [ebx + 0x10]
call fcn.51009464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510be78a
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.51004608
ret

Function at 0x510be860
Capabilities:
Connect to http server
Create http request
Get http content length
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], ecx
xor ecx, ecx
push ebp
push 0x510be967
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
call fcn.510be9e0
lea eax, [ebp - 0x24]
mov edx, 0x510be980
call fcn.5100467c
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.51004aa4
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
push 0
push 0
push 3
push 0
push 0
push 0x50
mov eax, dword [ebp - 0x14]
call fcn.51004aa4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.51004aa4
push eax
push 0x510be9cc
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_HttpOpenRequestA
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_HttpSendRequestA
mov dword [ebp - 0x1c], 4
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
push 0x20000005
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_HttpQueryInfoA
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510be96e
lea eax, [ebp - 0x24]
call fcn.510045e4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.51004608
ret
Function at 0x510be9e0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff99c
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
lea edi, [ebp - 0x3c]
lea eax, [ebp - 0x5c]
mov edx, 0x1f
call fcn.510be9d4
lea eax, [ebp - 0x15c]
mov edx, 0xff
call fcn.510be9d4
lea eax, [ebp - 0x1dc]
mov edx, 0x7f
call fcn.510be9d4
lea eax, [ebp - 0x25c]
mov edx, 0x7f
call fcn.510be9d4
lea eax, [ebp - 0xa5c]
mov edx, 0x7ff
call fcn.510be9d4
lea eax, [ebp - 0x1263]
mov edx, 0x806
call fcn.510be9d4
lea eax, [ebp - 0x1663]
mov edx, 0x3ff
call fcn.510be9d4
mov eax, edi
mov edx, 0x3c
call fcn.5100770c
mov dword [edi], 0x3c
lea eax, [ebp - 0x5c]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x20
lea eax, [ebp - 0x15c]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], pe_nt_image_headers32
lea eax, [ebp - 0x1dc]
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0x80
lea eax, [ebp - 0x25c]
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], 0x80
lea eax, [ebp - 0xa5c]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0x800
lea eax, [ebp - 0x1663]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], 0x400
push edi
push 0x90000000
mov eax, ebx
call fcn.510048a4
push eax
mov eax, ebx
call fcn.51004aa4
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, esi
lea edx, [ebp - 0x15c]
mov ecx, pe_nt_image_headers32
call fcn.51004854
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xa5c]
mov ecx, 0x800
call fcn.51004854
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4