joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4515b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
movaps xmm5, xmmword [0x4b3e20]
push esi
mov esi, dword [esp + 0xc]
movups xmm4, xmmword [eax]
pshufb xmm4, xmmword [0x4b3e10]
mov eax, dword [esp + 0x10]
movaps xmm3, xmm4
add eax, 0xffffffe0
je 0x4516eb
dec eax
lea ecx, [esi + 8]
shr eax, 5
inc eax
mov edx, eax
shl edx, 5
nop dword [eax + eax]
movq qword [ecx - 8], xmm3
movaps xmm2, xmm3
lea ecx, [ecx + 0x20]
movaps xmm0, xmm3
movaps xmm1, xmm3
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm0, xmm4, 1
pclmulqdq xmm2, xmm4, 0x10
xorps xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm2, xmm0
movaps xmm0, xmm1
psrldq xmm1, 8
pclmulqdq xmm0, xmm5, 0x10
xorps xmm2, xmm0
movaps xmm0, xmm3
xorps xmm1, xmm2
psllq xmm1, 1
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm1, xmm5, 0
xorps xmm1, xmm0
movaps xmm0, xmm2
psrldq xmm0, 8
xorps xmm1, xmm0
punpcklqdq xmm2, xmm1
psllq xmm1, 1
psrlq xmm2, 0x3f
xorps xmm2, xmm1
movaps xmm0, xmm2
movaps xmm1, xmm2
movups xmmword [ecx - 0x18], xmm2
movups xmmword [ecx - 0x20], xmm3
movq qword [ecx - 0x20], xmm2
movaps xmm3, xmm2
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm0, xmm4, 1
pclmulqdq xmm3, xmm4, 0x10
xorps xmm3, xmm0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm3, xmm0
movaps xmm0, xmm1
psrldq xmm1, 8
pclmulqdq xmm0, xmm5, 0x10
xorps xmm3, xmm0
xorps xmm1, xmm3
movaps xmm0, xmm3
psllq xmm1, 1
psrldq xmm0, 8
pclmulqdq xmm1, xmm5, 0
pclmulqdq xmm2, xmm4, 0x11
xorps xmm1, xmm2
xorps xmm1, xmm0
punpcklqdq xmm3, xmm1
psrlq xmm3, 0x3f
psllq xmm1, 1
xorps xmm3, xmm1
sub eax, 1
jne 0x4515f0
movaps xmm2, xmm3
movq qword [edx + esi], xmm3
pclmulqdq xmm2, xmm4, 0x10
movaps xmm0, xmm3
movaps xmm1, xmm3
pclmulqdq xmm0, xmm4, 1
xorps xmm2, xmm0
pclmulqdq xmm1, xmm4, 0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm2, xmm0
movaps xmm0, xmm1
pclmulqdq xmm0, xmm5, 0x10
xorps xmm2, xmm0
psrldq xmm1, 8
xorps xmm1, xmm2
movaps xmm0, xmm3
psllq xmm1, 1
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm1, xmm5, 0
xorps xmm1, xmm0
movaps xmm0, xmm2
psrldq xmm0, 8
xorps xmm1, xmm0
punpcklqdq xmm2, xmm1
psrlq xmm2, 0x3f
psllq xmm1, 1
xorps xmm2, xmm1
movups xmmword [edx + esi + 0x10], xmm2
movups xmmword [edx + esi + 8], xmm3
movq qword [edx + esi + 8], xmm2
pop esi
ret

Function at 0x4519f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x451a17
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x451a1a
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004519cc
pop esi
leave
ret 8
Function at 0x4566a0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4566df
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4566df
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4566df
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4566df
cmp dword [ecx + 0x74], 0xe
jbe 0x4566df
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x458ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad99d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1024
call fcn.004568a0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x30]
call fcn.004019e0
mov dword [ebp - 4], 0
push 0x1000
push 0
lea eax, [ebp - 0x1030]
push eax
call fcn.0046f960
add esp, 0xc
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x1030]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x458d72
lea eax, [ebp - 0x1030]
push eax
call fcn.0048824f
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x1030]
push eax
lea ecx, [ebp - 0x30]
call fcn.00401aa0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004018e0
mov edx, dword [ebp - 0x10]
or edx, 1
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401880
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x459310
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x183c
call fcn.004568a0
mov dword [ebp - 0x14], 0
mov eax, dword [0x4de2e0]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x4de630]
cmp eax, dword [edx + 4]
jle 0x45937a
push 0x4de630
call fcn.004553bf
add esp, 4
cmp dword [0x4de630], 0xffffffff
jne 0x45937a
mov ecx, 0x4de618
call fcn.00404700
push 0x4b05e0
call fcn.004557a4
add esp, 4
push 0x4de630
call fcn.0045536e
add esp, 4
mov ecx, dword [0x4de628]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x459392
mov dword [ebp - 8], 1
jmp 0x459399
mov dword [ebp - 8], 0
mov dl, byte [ebp - 8]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
test eax, eax
je 0x459463
push 0x1000
push 0
lea ecx, [ebp - 0x183c]
push ecx
call fcn.0046f960
add esp, 0xc
mov dword [ebp - 0x1c], 0x800
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x183c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x45943e
push 0x800
push 0
lea ecx, [ebp - 0x83c]
push ecx
call fcn.0046f960
add esp, 0xc
lea edx, [ebp - 0x83c]
mov dword [ebp - 0xc], edx
push 0x44
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x183c]
push ecx
call fcn.004594c0
add esp, 0xc
test eax, eax
je 0x45943e
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x3c]
push eax
call fcn.0045b360
add esp, 8
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, 0x4de618
call fcn.0040da20
lea ecx, [ebp - 0x3c]
call fcn.00401a00
mov edx, dword [0x4de628]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
jne 0x459456
mov dword [ebp - 0x10], 1
jmp 0x45945d
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov byte [ebp - 2], al
push 0x4de618
mov ecx, dword [ebp + 8]
call fcn.00404610
mov edx, dword [ebp - 0x14]
or edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x45a760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call fcn.0045a7f0
add esp, 4
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
jmp 0x45a792
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jge 0x45a7e6
mov eax, dword [ebp - 4]
and eax, 0x800000ff
jns 0x45a7ab
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
add edx, dword [ebp - 0xc]
and edx, 0x800000ff
jns 0x45a7c5
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], al
jmp 0x45a789
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4620d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae59d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
lea ecx, [ebp - 0x78]
call fcn.004019e0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x78]
push ecx
call fcn.00461d60
add esp, 8
lea edx, [ebp - 0x78]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x14], 8
jb 0x462128
mov dword [ebp - 0x20], 1
jmp 0x46212f
mov dword [ebp - 0x20], 0
mov dl, byte [ebp - 0x20]
mov byte [ebp - 0xd], dl
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x46214b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0
je 0x462213
lea eax, [ebp - 0x78]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x14], 8
jb 0x46217f
mov dword [ebp - 0x28], 1
jmp 0x462186
mov dword [ebp - 0x28], 0
mov al, byte [ebp - 0x28]
mov byte [ebp - 0xe], al
movzx ecx, byte [ebp - 0xe]
test ecx, ecx
je 0x4621a2
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
movzx edx, word [ecx]
test edx, edx
je 0x462213
lea eax, [ebp - 0x78]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x14], 8
jb 0x4621d6
mov dword [ebp - 0x30], 1
jmp 0x4621dd
mov dword [ebp - 0x30], 0
mov al, byte [ebp - 0x30]
mov byte [ebp - 0xf], al
movzx ecx, byte [ebp - 0xf]
test ecx, ecx
je 0x4621f9
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x462236
lea edx, [ebp - 0x78]
push edx
call fcn.00461ed0
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.00401880
mov eax, dword [ebp - 0x5c]
jmp 0x46224f
mov dword [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.00401880
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x463a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0
lea eax, [ebp - 0x14]
push eax
call fcn.0048b530
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040f6b0
push 0xb
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0046f960
add esp, 0xc
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x469420
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
pop ebp
ret

Function at 0x469670
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aeb78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
cmp dword [ebp + 8], 0
je 0x4696ac
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x4696ac
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4696b3
xor eax, eax
jmp 0x46978a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00465e00
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x4696df
mov dword [ebp - 0x14], 1
jmp 0x4696e6
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0x14]
mov byte [ebp - 0xd], al
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x469771
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x46970c
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00466d00
add esp, 8
lea ecx, [ebp - 0xb4]
call fcn.004a0d30
mov byte [ebp - 4], 1
push 1
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0xb4]
call fcn.004a3470
movzx ecx, al
cmp ecx, 1
jne 0x469741
mov dword [ebp - 0x18], 1
jmp 0x469748
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb4]
call fcn.0042f790
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401a00
mov eax, dword [ebp - 0x20]
jmp 0x46978a
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401a00
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x46a2a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aece3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00404700
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00404700
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00404700
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0046a840
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46ad00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
pop ebp
ret
Function at 0x46c540
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x46c556
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x46c575
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x4d94d0]
mov dword [edx + ecx*4 + 0x88], eax
jmp 0x46c54d
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x46cb80
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp dword [ebp + 0x10], 0x40
jne 0x46cb9b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x40
jmp 0x46cc13
cmp dword [ebp + 0x10], 0x40
jbe 0x46cbc4
mov dword [ebp - 8], 0x20
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046c390
add esp, 0xc
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xc], ecx
jmp 0x46cbd0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, 0x40
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x36
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x2a0]
push edx
call fcn.0046f960
add esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
push 0x5c
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x2e0]
push eax
call fcn.0046f960
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x46cc25
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jge 0x46cc5f
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor ecx, 0x36
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx + 0x2a0], cl
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor ecx, 0x5c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx + 0x2e0], cl
jmp 0x46cc1c
mov eax, dword [ebp + 8]
push eax
call fcn.0046c540
add esp, 4
push 0x40
mov ecx, dword [ebp + 8]
add ecx, 0x2a0
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0046c9c0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0xa8
push eax
call fcn.0046c540
add esp, 4
push 0x40
mov ecx, dword [ebp + 8]
add ecx, 0x2e0
push ecx
mov edx, dword [ebp + 8]
add edx, 0xa8
push edx
call fcn.0046c9c0
add esp, 0xc
push 0xa8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x150
push ecx
call fcn.0046f3e0
add esp, 0xc
push 0xa8
mov edx, dword [ebp + 8]
add edx, 0xa8
push edx
mov eax, dword [ebp + 8]
add eax, 0x1f8
push eax
call fcn.0046f3e0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x46d780
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0xa0000000
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46d7b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x46e2e0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x46e435
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46e435
xor ecx, ecx
je 0x46e365
push 0
push 0x10000
push 0x46e520
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
cmp eax, 0xffffffff
jne 0x46e365
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4bb554
push str._s:WinHttpSetStatusCallback___failed:_d
mov eax, dword [ebp - 0xc]
push eax
call fcn.0046e890
add esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 0x1f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryOption]
test eax, eax
jne 0x46e3a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4bb5d0
push str._s:WinHttpQueryOption___failed:_d
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0046e890
add esp, 0x10
mov edx, dword [ebp - 4]
or edx, 0x100
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, 0x2000
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
or ecx, 0x1000
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x3300
mov dword [ebp - 4], edx
push 4
lea eax, [ebp - 4]
push eax
push 0x1f
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x46e40a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CJHHttp::OpenRequest
push str._s:WinHttpSetOption___failed:_d
mov edx, dword [ebp - 0xc]
push edx
call fcn.0046e890
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x46e435
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x46e435
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0046d780
mov ecx, dword [ebp + 0x14]
add ecx, 4
mov dword [ebp + 0x14], ecx
jmp 0x46e410
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x20
Function at 0x46e440
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x46e469
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x46e4b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4bb284
push str._s:WinHttpOpen___failed:_d
mov eax, dword [ebp - 4]
push eax
call fcn.0046e890
add esp, 0x10
jmp 0x46e4fa
mov dword [ebp - 8], 0x2a0
mov ecx, dword [ebp - 8]
or ecx, 0x800
mov dword [ebp - 8], ecx
push 4
lea edx, [ebp - 8]
push edx
push 0x54
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x46e4fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CJHHttp::OpenSession
push 0x4bb318
mov edx, dword [ebp - 4]
push edx
call fcn.0046e890
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x46e50c
mov dword [ebp - 0xc], 1
jmp 0x46e513
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x46e7b0
Capabilities:
Receive http response
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x46e880
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10], ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46e880
cmp dword [ebp - 0x10], 0
je 0x46e86b
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x46e823
mov dword [ebp - 0x14], 1
jmp 0x46e82a
mov dword [ebp - 0x14], 0
mov cl, byte [ebp - 0x14]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x46e846
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46e880
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x48ec75
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4bf4b8
push 0x4bf4b0
push str.FlsAlloc
push 0x1f
call fcn.0048eb3d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48eca9
push dword [ebp + 8]
mov ecx, esi
call dword [0x4b1284]
call esi
jmp 0x48ecaf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x48ecf3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4bf4c8
push 0x4bf4c0
push str.FlsGetValue
push 0x21
call fcn.0048eb3d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48ed2a
push dword [ebp + 8]
mov ecx, esi
call dword [0x4b1284]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x48ed32
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4bf4d0
push 0x4bf4c8
push str.FlsSetValue
push 0x22
call fcn.0048eb3d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48ed6c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4b1284]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]