joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43176c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x72066c
push 0x786fdfd2
mov dword [esp], esp
push ecx
mov ecx, 4
add dword [esp + 4], ecx
pop ecx
mov ebp, dword [esp]
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
jmp 0x62c631
jmp 0x7431b7
jmp 0x666402
push esi
push esp
pop esi
add esi, 4
sub esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp], esi
mov dword [esp], 0
jmp 0x6664c3
pop eax
jmp 0x6664c9
jmp 0x6d1f07
jmp 0x6a2a30
pop esp
mov dword [esp], ebp
mov dword [esp], eax
pop dword [ebp - 0xc]
jmp 0x6a2a9d
push esi
mov esi, esp
add esi, 4
sub esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
jmp 0x6a296b
jmp 0x6f5204
jmp 0x6b69ab
push 0xbccce7f
mov dword [esp], ebx
mov dword [esp], edx
mov dword [esp], 0
mov eax, dword [esp]
add esp, 4
jmp 0x6b69c8
jmp 0x6e903a
push eax
mov dword [esp], 0x71b74672
mov dword [esp], ecx
mov dword [esp], ebx
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0x6d1566
jmp 0x6d2297
jmp 0x6d1f69
cpuid
jmp 0x6d2027
jmp 0x6d5b2a
jmp 0x6d234f
push 0x466076c5
mov dword [esp], esi
mov dword [esp], 0x5f98ca1c
mov dword [esp], edx
pop dword [ebp - 0x10]
jmp 0x6d23c6
jmp 0x6663a8
jmp 0x6d5c3e
add esi, 4
xchg dword [esp], esi
pop esp
jmp 0x6d5c58
push ecx
mov dword [esp], 0
push dword [esp]
pop eax
push esi
mov esi, esp
add esi, 4
jmp 0x6d5b83
jmp 0x717de7
jmp 0x6d86a9
push edx
mov dword [esp], 0x6256ed33
mov dword [esp], edx
mov dword [esp], 0
mov eax, dword [esp]
add esp, 4
jmp 0x6d86c9
jmp 0x6ed5a8
cpuid
jmp 0x6e9146
jmp 0x6d8598
jmp 0x6ebe07
push edi
push ebp
push ebx
mov dword [esp], 0x24d1be79
pop ebp
mov dword [esp + 4], ebp
pop ebp
mov dword [esp], edx
jmp 0x6ebec7
jmp 0x757b9f
jmp 0x6ed60a
cpuid
jmp 0x6ed6ad
jmp 0x7183ed
push ebx
push esp
mov ebx, dword [esp]
add esp, 4
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], edx
pop dword [ebp - 8]
jmp 0x6f532c
jmp 0x7bd678
cpuid
jmp 0x717eec
jmp 0x6b6894
jmp 0x718497
rdtsc
jmp 0x7184f4
jmp 0x6a2966
push edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ecx
mov dword [esp], esi
mov dword [esp], ebp
jmp 0x72079f
jmp 0x62c50a
jmp 0x743203
push eax
push esp
pop eax
add eax, 4
sub eax, 0x14
push ebx
mov dword [esp], eax
push dword [esp + 4]
pop eax
pop dword [esp]
mov esp, dword [esp]
jmp 0x7432bc
jmp 0x771641
jmp 0x757c97
rdtsc
jmp 0x757c9e
jmp 0x6d144e
jmp 0x77175b
xchg dword [esp], ebx
pop esp
mov dword [esp], ebx
mov dword [esp], esi
mov dword [esp], ebx
jmp 0x771778
push ebx
mov ebx, esp
push edx
mov edx, 0x56df7db6
add edx, 0xa920824e
add ebx, edx
pop edx
sub ebx, 4
jmp 0x77168e
jmp 0x80dd02
jmp 0x7bd733
xchg dword [esp], esi
mov esp, dword [esp]
jmp 0x7bd7ac
push dword [ebp - 0xc]
mov eax, dword [esp]
push esi
push esp
pop esi
add esi, 4
add esi, 4
jmp 0x7bd67d
jmp 0x6e22e0
push edi
mov edi, esp
push edx
mov edx, 4
add edi, edx
pop edx
sub edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
jmp 0x80de22
mov dword [esp], ecx
jmp 0x80de2a
jmp 0x6ebdb6
Function at 0x100013a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005eb1a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1007f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.10036931
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10001460
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.10039405
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x1007d194
push eax
call fcn.1003b3b4
push edi
push esi
call fcn.10036c79
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ffb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x62fffffc], esi
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.1000f790
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000f745
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1000f790
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000f745
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.1000f790
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000f745
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.1000f780
jle 0x10010189
test dword [eax], esp
cld
invalid
wait
or al, 0x80
movsd dword es:[edi], dword [esi]
int3
Function at 0x10010680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1000f75e
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1000f790
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000f745
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1000f780
sub edi, dword [edx - 0x7a]
inc edx
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.1000f780
pop edx
stosb byte es:[edi], al
or dword es:[eax - 0x7fff1f9b], eax
loope 0x100107a2
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.1000f790
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000f745
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
invalid

Function at 0x10013c00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10013c19
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10013c56
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10013c52
nop word [eax + eax]
cmp esi, edx
jae 0x10013c56
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10013c40
cmp esi, edx
jb 0x10013c5d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10019720
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
xorps xmm0, xmm0
push str.TOASTSDK_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_51.0.2704.103_Safari_537.36
push 0x400
mov dword [esi + 0x2844], 0x10073834
lea eax, [esi + 0x285c]
mov dword [esi + 0x385c], eax
lea eax, [esi + 0x40]
mov byte [esi + 0x2848], 0
mov dword [esi + 0x284c], 0x1000
mov dword [esi + 0x2850], 0
mov dword [esi + 0x2854], 0
mov dword [esi + 0x2858], 0x1000
mov dword [esi], 0x1f4
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x2840], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x3860], 0
mov dword [esi + 0x3864], 0
mov dword [esi + 0x3868], 0
mov dword [esi + 0x386c], 0
movups xmmword [esi + 0x14], xmm0
push eax
movups xmmword [esi + 0x24], xmm0
movq qword [esi + 0x34], xmm0
mov dword [esi + 0x14], 0x28
call fcn.10046cdb
push str.Content_Type:_application_json
lea eax, [esi + 0x840]
push 0x1000
push eax
call fcn.10046cdb
add esp, 0x18
mov eax, esi
pop esi
ret

Function at 0x10019900
Capabilities:
Connect to http server
Create http request
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1007f070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
movzx ebx, word [ebp + 0xc]
lea eax, [ebp - 8]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 4
push eax
push 2
push dword [esi + 0x10]
mov dword [esi + 4], 2
mov dword [ebp - 8], 0x1388
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [esi + 0x3860]
neg eax
sbb eax, eax
and eax, 0x10000000
push eax
push 0
push 0
push 0
push str.TOASTSDK_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_51.0.2704.103_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
je 0x100199b8
cmp dword [esi + 0x3860], 0
je 0x10019978
push 0x100199d0
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
push esi
push 0
push 3
push 0
push 0
push ebx
push edi
push dword [esi + 8]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x100199b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100199ba
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 8
Function at 0x10019a60
Capabilities:
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007f070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0
jne 0x10019ae1
push 0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
push 0x20000005
push dword [esi + 0x10]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x10019ac8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10019be6
movzx eax, ax
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xc]
mov ecx, dword [esi + 0x2840]
call fcn.1001a230
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
jmp 0x10019af8
mov edx, dword [esi + 0x2c]
test edx, edx
je 0x10019af8
mov ecx, dword [esi + 0x2840]
push 1
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
push ebx
push edi
push esi
push 1
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
call dword [sym.imp.WININET.dll_InternetReadFileExW]
mov ebx, eax
xor edi, edi
test ebx, ebx
jne 0x10019b38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10019b30
test eax, eax
jle 0x10019be2
movzx edi, ax
or edi, 0x80070000
test ebx, ebx
je 0x10019be2
test edi, edi
js 0x10019be2
mov edx, dword [esi + 0x2c]
test edx, edx
je 0x10019bcb
mov ecx, dword [esi + 0x2840]
push 1
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x2840]
mov eax, dword [ecx]
mov edi, dword [ecx + 0x1018]
mov eax, dword [eax + 0xc]
call eax
add eax, edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x2840]
push esi
push 1
mov ecx, dword [eax + 0x14]
sub ecx, dword [eax + 0x10]
lea eax, [esi + 0x14]
push eax
push dword [esi + 0x10]
mov dword [esi + 0x2c], ecx
call dword [sym.imp.WININET.dll_InternetReadFileExW]
mov ebx, eax
xor edi, edi
test ebx, ebx
jne 0x10019b38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10019bb4
test eax, eax
jle 0x10019be2
movzx edi, ax
or edi, 0x80070000
test ebx, ebx
jne 0x10019b38
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x3860]
test ecx, ecx
je 0x10019be2
push dword [esi + 0x3868]
mov eax, dword [ecx]
push 0
call dword [eax + 4]
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10037fa1
mov esp, ebp
pop ebp
ret
Function at 0x10019c00
Capabilities:
Check http status code
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007f070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
push edi
push 0x80800200
push dword [edi + 0x3c]
mov dword [edi + 4], 3
push 0
push 0
push ecx
push str.POST
push dword [edi + 0xc]
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x2840], eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [edi + 0x10], eax
test eax, eax
je 0x10019d93
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
lea ecx, [ebp - 8]
push 4
push ecx
push 5
push eax
mov dword [ebp - 8], 0x1388
call esi
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x1388
push eax
push 6
push dword [edi + 0x10]
call esi
push dword [edi + 0x2854]
lea esi, [edi + 0x840]
push dword [edi + 0x385c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push dword [edi + 0x10]
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x10019d3e
cmp dword [edi + 0x3860], 0
jne 0x10019d2a
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x10019d2a
push edi
mov edx, 0x13
call fcn.10019dc0
add esp, 4
test eax, eax
js 0x10019da5
cmp dword [edi], 0xc8
jne 0x10019d08
mov ecx, edi
call fcn.10019e30
push dword [edi]
mov ecx, edi
mov esi, eax
call fcn.10019f50
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 0x10
push dword [edi]
mov ecx, edi
mov esi, 0x80004005
call fcn.10019f50
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 0x10
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10019d5e
test eax, eax
jg 0x10019d55
mov esi, eax
jmp 0x10019d5e
movzx esi, ax
or esi, 0x80070000
mov eax, dword [edi + 0x2840]
sub esp, 0x18
mov ecx, esp
push dword [eax + 0x1018]
call fcn.1000ac30
mov ecx, dword [edi + 0x10]
call fcn.1001dc70
add esp, 0x18
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10019da5
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10019e30
Capabilities:
Get http content length
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007f070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], 0
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
mov esi, ecx
mov dword [ebp - 0xc], 4
push eax
push 0x20000005
push dword [esi + 0x10]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x10019e9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10019e92
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10019e9b
push 0x1000
jmp 0x10019e9e
push dword [ebp - 0x14]
mov ecx, dword [esi + 0x2840]
call fcn.1001a230
mov ebx, dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
lea eax, [ebp - 0x10]
push 0
push 0
push eax
push dword [esi + 0x10]
call ebx
test eax, eax
je 0x10019f0b
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 0x2840]
add eax, edi
push eax
call fcn.1001a230
lea ecx, [ebp - 8]
add eax, edi
push ecx
push dword [ebp - 0x10]
push eax
push dword [esi + 0x10]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10019f0b
mov eax, dword [ebp - 8]
test eax, eax
je 0x10019f2f
add edi, eax
mov eax, dword [esi + 0x2840]
push 0
push 0
mov dword [eax + 0x10], edi
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x10]
call ebx
test eax, eax
jne 0x10019ec0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
jle 0x10019f1e
movzx eax, ax
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037fa1
mov esp, ebp
pop ebp
ret
Function at 0x1001a070
Capabilities:
Check http status code
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007f070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [edi + 0x2840], eax
mov eax, dword [edi + 0x3860]
neg eax
mov dword [edi + 4], 1
mov dword [edi + 0x28], 0
sbb eax, eax
mov dword [edi + 0x2c], 0
and eax, 0x10000000
push eax
push 0
push 0
push 0
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 8], eax
test eax, eax
je 0x1001a1bb
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
lea eax, [ebp - 8]
push 4
push eax
push 2
push dword [edi + 0x10]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x1388
call esi
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x1388
push eax
push 6
push dword [edi + 0x10]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 0x41
push dword [edi + 8]
call esi
cmp dword [edi + 0x3860], 0
je 0x1001a12a
push 0x100199d0
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
push edi
push 0x80000200
lea esi, [edi + 0x840]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push ebx
push dword [edi + 8]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp dword [edi + 0x3860], 0
mov dword [edi + 0x10], eax
jne 0x1001a19b
test eax, eax
je 0x1001a19b
push edi
mov edx, 0x13
mov ecx, eax
call fcn.10019dc0
mov esi, eax
add esp, 4
test esi, esi
js 0x1001a1d4
cmp dword [edi], 0xc8
jne 0x1001a18b
mov ecx, edi
call fcn.10019e30
push dword [edi]
mov ecx, edi
mov esi, eax
call fcn.10019f50
jmp 0x1001a1d0
push dword [edi]
mov ecx, edi
mov esi, 0x80004005
call fcn.10019f50
jmp 0x1001a1d0
xor esi, esi
test eax, eax
jne 0x1001a1d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1001a1d0
test eax, eax
jg 0x1001a1b6
mov esi, eax
jmp 0x1001a1d0
movzx esi, ax
jmp 0x1001a1ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1001a1d2
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x1001a1dc
push ecx
mov ecx, edi
call fcn.100198a0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001a570
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061b4b
mov eax, dword fs:[0]
push eax
mov eax, 0x4ab0
call fcn.100392c0
mov eax, dword [0x1007f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4a80]
push 0x3870
push 0
push eax
call fcn.1003b430
add esp, 0xc
lea ecx, [ebp - 0x4a80]
call fcn.10019720
push 0x3c
lea eax, [ebp - 0x4abc]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x121c], ebx
mov dword [ebp - 0x1214], 0
call fcn.1003b430
lea eax, [ebp - 0x210]
mov dword [ebp - 0x4abc], 0x3c
add esp, 0xc
mov dword [ebp - 0x4aac], eax
lea eax, [ebp - 0x1210]
mov dword [ebp - 0x4aa8], 0x100
mov dword [ebp - 0x4a90], eax
lea eax, [ebp - 0x4abc]
mov dword [ebp - 0x4a8c], 0x800
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
push dword [ebp - 0x4aa4]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x4a80]
call fcn.10019900
mov edi, eax
test edi, edi
js 0x1001a744
mov ecx, dword [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
mov byte [ebp - 0x2238], 1
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x222c], eax
mov eax, dword [ecx + 0x1018]
mov dword [ebp - 0x1224], eax
lea eax, [ebp - 0x1210]
push ecx
push eax
lea ecx, [ebp - 0x4a80]
mov dword [ebp - 0x2230], 0
call fcn.10019c00
mov edi, eax
test edi, edi
jns 0x1001a6ba
mov ecx, dword [ebx + 4]
cmp ecx, 0xc8
je 0x1001a6ba
call fcn.1001a3e0
mov edi, eax
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
lea eax, [ebp - 0x2224]
mov dword [ebp - 0x1224], eax
mov eax, dword [ebp - 0x4a70]
mov dword [ebp - 0x222c], 0
mov dword [ebp - 0x2228], 0x1000
mov byte [ebp - 0x2238], 0
test eax, eax
je 0x1001a6fe
push eax
call esi
mov dword [ebp - 0x4a70], 0
mov eax, dword [ebp - 0x4a74]
test eax, eax
je 0x1001a715
push eax
call esi
mov dword [ebp - 0x4a74], 0
mov eax, dword [ebp - 0x4a78]
test eax, eax
je 0x1001a744
cmp dword [ebp - 0x1220], 0
je 0x1001a737
push 0
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov eax, dword [ebp - 0x4a78]
push eax
call esi
mov dword [ebp - 0x4a78], 0
lea ecx, [ebp - 0x4a80]
call fcn.10019810
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037fa1
mov esp, ebp
pop ebp
ret 0x14