joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460931
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x5f6974
call fcn.005bbf01
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.00460cc4
call fcn.0044a4e6
push eax
lea ecx, [ebp - 0x94]
call fcn.00447f28
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044a4ec
mov ecx, eax
call fcn.0044878d
test al, al
je 0x460a47
push ebx
lea ecx, [ebp - 0x94]
call fcn.0044822d
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00448106
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x4609b8
push str.Error_opening_file
jmp 0x460b28
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x460ac1
cmp edi, 0x400000
ja 0x460ad2
and dword [ebp - 0x2c8], 0
push edi
call fcn.005a3188
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x460a30
push ebx
call fcn.005b9f72
pop ecx
mov ecx, esi
call fcn.00460cc4
push 0
push str.Could_not_read_file
jmp 0x460b28
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.00460b77
push dword [ebp - 0x2cc]
jmp 0x460b56
call fcn.0044a4ec
push eax
lea ecx, [ebp - 0x94]
call fcn.004481a8
call fcn.0044a6ae
test al, al
je 0x460a68
call fcn.0044a4f2
jmp 0x460a7f
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00448106
push eax
call fcn.0045d125
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x460a90
push eax
push str.Error_opening_zip_file
jmp 0x460b28
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.0045ca7d
add esp, 0x14
test eax, eax
je 0x460ab7
push 0
push str.Could_not_find_ziped_file
jmp 0x460b28
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x460aca
push 0
push str.File_is_empty
jmp 0x460b28
cmp ebx, 0x400000
jbe 0x460adb
push 0
push 0x60df20
jmp 0x460b28
push ebx
call fcn.005a3188
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.0045d4da
add esp, 0x18
test eax, eax
je 0x460b33
cmp eax, 0x600
je 0x460b33
push dword [ebp - 0x2c8]
call fcn.005b9f72
pop ecx
call fcn.0044a6ae
test al, al
jne 0x460b21
push edi
call fcn.0045c8df
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.00460cec
mov bl, al
jmp 0x460b5e
call fcn.0044a6ae
test al, al
jne 0x460b43
push edi
call fcn.0045c8df
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.00460b77
push edi
mov bl, al
call fcn.005b9f72
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00448010
mov al, bl
call fcn.005bbeb0
ret 8
Function at 0x46de18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x46de3c
cmp dword [esi + 8], edi
jge 0x46de34
push esi
call fcn.0046a220
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x46de62
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x46de48
mov dword [esi + 8], edx
jmp 0x46de77
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x46de6d
xor dl, dl
jmp 0x46de72
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x46de62
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x46deb1
push str.zlib_corrupt
call fcn.0046a149
add esp, 4
jmp 0x46def1
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46dec1
push str.read_past_buffer
jmp 0x46dea7
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x46dedb
push edi
push ecx
push esi
call fcn.0047097f
add esp, 0xc
test eax, eax
je 0x46def1
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005b8be0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x481109
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x5f669f
call fcn.005bbf01
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x6e8], ebx
cmp dword [edi + 4], ebx
jne 0x48119b
lea eax, [ebp - 0xa8]
push eax
call fcn.00480d76
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xa8]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00421590
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.004476f1
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00465bb8
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.0044a077
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0044878d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00448010
mov esi, 0x6d8
test bl, bl
je 0x4811da
mov eax, dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.005bbeb0
ret 4

Function at 0x481210
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x689300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044f67d
mov ecx, dword [esi + 0x6f0]
test ecx, ecx
je 0x48128c
lea eax, [ebp - 0x14]
push eax
call fcn.00480d76
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x6f0]
test eax, eax
je 0x481268
push 0
call fcn.004215c0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x48128c
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.004215c0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005b8774
mov esp, ebp
pop ebp
ret 0xc
Function at 0x481374
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x689300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
mov ebx, ecx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00450c0e
mov ecx, dword [ebx + 0x6f0]
test ecx, ecx
je 0x4813f8
lea eax, [ebp - 0x14]
push eax
call fcn.00480d76
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x6f0]
test eax, eax
je 0x4813d4
push 0
call fcn.004215c0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4813f8
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.004215c0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b8774
mov esp, ebp
pop ebp
ret 0x14
Function at 0x48421f
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x5f769d
call fcn.005bbf01
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2d0], ebx
call fcn.0044a4e6
push eax
lea ecx, [ebp - 0x94]
call fcn.00447f28
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044a4ec
mov ecx, eax
call fcn.0044878d
test al, al
je 0x484316
push ebx
lea ecx, [ebp - 0x94]
call fcn.0044822d
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00448106
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4842b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00448010
jmp 0x4843f7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x4842c7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48429c
push esi
mov dword [ebp - 0x2cc], edi
call fcn.005a3188
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2cc]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2cc], esi
je 0x4843e2
push edi
call fcn.005b9f72
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00448010
jmp 0x4843f5
call fcn.0044a4ec
push eax
lea ecx, [ebp - 0x94]
call fcn.004481a8
call fcn.0044a6ae
test al, al
je 0x484337
call fcn.0044a4f2
jmp 0x48434e
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00448106
push eax
call fcn.0045d125
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x48429c
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2d0]
push ebx
call fcn.0045ca7d
add esp, 0x14
test eax, eax
jne 0x48429c
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x48429c
push esi
call fcn.005a3188
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.0045d4da
add esp, 0x18
test eax, eax
je 0x4843d2
cmp eax, 0x600
je 0x4843d2
push edi
call fcn.005b9f72
pop ecx
call fcn.0044a6ae
test al, al
jne 0x484302
push ebx
call fcn.0045c8df
jmp 0x484301
call fcn.0044a6ae
test al, al
jne 0x4843e2
push ebx
call fcn.0045c8df
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00448010
test edi, edi
jne 0x484472
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x48446e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x484431
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48446e
push esi
mov dword [ebp - 0x2c8], edi
call fcn.005a3188
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x48446a
push edi
call fcn.005b9f72
pop ecx
xor edi, edi
test edi, edi
jne 0x484472
xor eax, eax
jmp 0x48448a
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.00484492
push edi
mov esi, eax
call fcn.005b9f72
pop ecx
mov eax, esi
call fcn.005bbeb0
ret 4
Function at 0x4858b0
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x4858f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:InternetGetConnectedState_fail_0x_x
push 1
push 0x32
push 0x613550
push str.CBaseRequest::IsUseProxyConnect
call fcn.004f5380
add esp, 0x18
xor al, al
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 4]
shr al, 2
and al, 1
mov esp, ebp
pop ebp
ret

Function at 0x485c70
Capabilities:
Receive http response
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.005ba320
mov eax, dword [0x689300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor bl, bl
cmp dword [eax + 0x14], 8
push edi
mov edi, ecx
jb 0x485c99
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x485d4b
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x485d44
jmp 0x485cf0
mov eax, dword [ebp - 0x1008]
test eax, eax
je 0x485d42
push 0
lea ecx, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0
push ecx
push eax
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x485d44
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x485cf0
jmp 0x485d44
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b8774
mov esp, ebp
pop ebp
ret 4
Function at 0x485d60
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f792d
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x689300]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x834], esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov dword [ebp - 4], 0
mov dword [ebp - 0x830], 1
mov dword [ebp - 0x82c], 0
jmp 0x485de0
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.005ba350
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
push 0x7ff
lea eax, [ebp - 0x810]
push eax
push dword [edi + 0x6c]
call ebx
test eax, eax
je 0x485e86
push dword [ebp - 0x82c]
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 0xf
push eax
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov byte [ebp - 0x828], 0
call fcn.00421120
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00423410
cmp dword [ebp - 0x814], 0x10
mov byte [ebp - 4], 0
jb 0x485e79
push dword [ebp - 0x828]
call fcn.00470aa0
add esp, 4
cmp dword [ebp - 0x82c], 0
ja 0x485de0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b8774
mov esp, ebp
pop ebp
ret 4

Function at 0x485ec0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x6c]
sub esp, 0xc
test eax, eax
je 0x485f25
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], 4
push ecx
push 0
push 0x20000005
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x485f2d
push str.CWinHttpRequest::GetUrlFileSize
push 0x6138a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6138ac
call fcn.00486170
add esp, 0x10
xor al, al
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x485f40
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x485f90
push str.CWinHttpRequest::HttpRead
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6138e8
call fcn.00486170
add esp, 0x10
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x485fa0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0x613758
cmp dword [esi + 0x48], 8
lea edx, [esi + 0x34]
push edi
mov dword [ebp - 4], 0
jb 0x485fc3
mov edx, dword [edx]
cmp dword [esi + 0x18], 8
lea ecx, [esi + 4]
jb 0x485fce
mov ecx, dword [ecx]
cmp byte [ebp + 8], 0
mov eax, 0x100
mov edi, 0x800100
cmovne eax, edi
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x613760
push edx
push ecx
push dword [esi + 0x68]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0x6c], eax
pop edi
pop esi
test eax, eax
jne 0x48602c
push str.CWinHttpRequest::OpenRequest
push 0x613794
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6137a0
call fcn.00486170
add esp, 0x10
xor al, al
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x486040
Capabilities:
Initialize winhttp library

Disassembly:
push esi
mov esi, ecx
call fcn.004858b0
push 0
push 0
push 0
test al, al
je 0x486056
push 0
jmp 0x486058
push 1
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0x64], eax
pop esi
test eax, eax
jne 0x486090
push str.CWinHttpRequest::OpenSession
push 0x613704
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x613710
call fcn.00486170
add esp, 0x10
xor al, al
ret
mov al, 1
ret

Function at 0x4860a0
Capabilities:
Receive http response
Set http header

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x4860f2
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x4860b5
mov eax, dword [eax]
push 0x20000000
push ecx
push eax
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x4860f2
push 0x6137b4
push 0x6137d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6137e0
call fcn.00486170
add esp, 0x10
xor al, al
pop esi
ret
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x486134
push 0x6137fc
push 0x61381c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x613828
call fcn.00486170
add esp, 0x10
xor al, al
pop esi
ret
push 0
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x48616c
push str.CWinHttpRequest::SendRequest
push 0x61385c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x613868
call fcn.00486170
add esp, 0x10
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x4874c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f7c70
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x689300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.005baa92
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x18]
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.00420f90
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [ebp - 4], 1
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x48754e
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x487650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f7c70
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x689300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.005baa92
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x18]
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.00420f90
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [ebp - 4], 1
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x4876e4
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48aae0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48ab51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x6924b8]
mov edx, eax
test cl, 1
jne 0x48ab30
or ecx, 1
mov dword [0x6924b0], 0x25c5e09b
mov eax, vtable.boost::system::detail::system_error_category.0
mov dword [0x6924b8], ecx
mov dword [0x6924b4], 0x8fafd21e
mov dword [0x6924a8], eax
jmp 0x48ab35
mov eax, dword [0x6924a8]
mov eax, dword [eax + 0x18]
mov ecx, 0x6924a8
push edx
mov dword [ebp - 0xc], edx
call eax
mov byte [ebp - 8], al
mov dword [ebp - 4], 0x6924a8
test al, al
jne 0x48ab58
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x614924
lea eax, [ebp - 0xc]
push eax
call fcn.00489360
int3

Function at 0x48df50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f83eb
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
mov eax, dword [0x689300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x60]
mov eax, dword [esi + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [esi + 0xc]
push 0xffffffffffffffff
mov dword [ebp - 0x64], eax
lea eax, [esi + 0x10]
push 0
push eax
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x60], 0
call fcn.00420f90
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x44], eax
lea eax, [esi + 0x30]
push eax
mov dword [ebp - 4], 0
call fcn.004b61e0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x68]
push eax
push dword [esi]
mov dword [ebp - 4], 1
lea ecx, [ecx + 0x10]
call fcn.00498360
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 2
test eax, eax
je 0x48e011
test al, 1
jne 0x48e00a
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x48e00a
lea ecx, [ebp - 0x28]
push 2
push ecx
push ecx
call eax
add esp, 0xc
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x4c], 0x10
jb 0x48e022
push dword [ebp - 0x60]
call fcn.00470aa0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4