joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424cf5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x431e68], 0x1398
jl 0x40ce6f
push 0x431e6c
call fcn.0041a980
mov esi, dword [0x431e64]
add esp, 4
test esi, esi
je 0x40ce61
mov eax, dword [esi]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test esi, esi
jne 0x40ce91
push 0x1398
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40ce91
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040d140
mov byte [ebp - 4], 1
mov dword [esi], vtable.rg_volcano_YangWang::rg_SuiJiShuLei_n.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0x10]
push 0x1388
push eax
lea eax, [esi + 0x10]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d140
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424d7d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CVolObject.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [edi], vtable.rg_volcano_YangWang::rg_SuiJiShuLei_n.0
mov edx, 0x1571
mov dword [edi + 0x1394], 0xffffffff
mov ecx, 1
mov dword [edi + 0x14], 0x1571
mov ebx, esi
nop dword [eax]
mov eax, edx
lea ebx, [ebx + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
inc ecx
mov dword [ebx - 4], edx
cmp ecx, 0x270
jb 0x40d1b0
mov dword [edi + 0x10], 0x270
call dword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [edi + 0x14], eax
mov edx, 1
mov ecx, eax
lea esi, [esi + 4]
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
inc edx
mov dword [esi - 4], eax
cmp edx, 0x270
jb 0x40d1e3
mov dword [edi + 0x10], 0x270
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d2b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424ddd
mov eax, dword fs:[0]
push eax
mov eax, 0x1424
call fcn.00422e20
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1428], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1430], edi
mov dword [ebp - 0x142c], 0
call fcn.004029d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1424]
mov dword [ebp - 0x142c], 1
mov dword [ebp - 0x8c], 0x330061
mov dword [ebp - 0x88], 0x620043
mov dword [ebp - 0x84], 0x530030
mov dword [ebp - 0x80], 0x410063
mov dword [ebp - 0x7c], 0x47004a
mov dword [ebp - 0x78], 0x500064
mov dword [ebp - 0x74], 0x650034
mov dword [ebp - 0x70], 0x660042
mov dword [ebp - 0x6c], 0x360058
mov dword [ebp - 0x68], 0x440067
mov dword [ebp - 0x64], 0x510068
mov dword [ebp - 0x60], 0x590069
mov dword [ebp - 0x5c], 0x6b006a
mov dword [ebp - 0x58], 0x6c0046
mov dword [ebp - 0x54], 0x6d0048
mov dword [ebp - 0x50], 0x39006e
mov dword [ebp - 0x4c], 0x6f0049
mov dword [ebp - 0x48], 0x4c0056
mov dword [ebp - 0x44], 0x520070
mov dword [ebp - 0x40], 0x550071
mov dword [ebp - 0x3c], 0x72004b
mov dword [ebp - 0x38], 0x73004e
mov dword [ebp - 0x34], 0x4f0035
mov dword [ebp - 0x30], 0x570074
mov dword [ebp - 0x2c], 0x760075
mov dword [ebp - 0x28], 0x450037
mov dword [ebp - 0x24], 0x4d0077
mov dword [ebp - 0x20], 0x790078
mov dword [ebp - 0x1c], 0x7a0038
mov dword [ebp - 0x18], 0x540031
mov dword [ebp - 0x14], 0x5a0032
call fcn.0040d140
mov dword [ebp - 4], 1
mov esi, 5
nop
lea eax, [ebp - 0x1424]
lea ecx, [ebp - 0x1428]
mov dword [ebp - 0x1428], eax
call fcn.0040d470
mov ecx, edi
movzx eax, word [ebp + eax*2 - 0x8c]
push eax
call fcn.0041b3a0
sub esi, 1
jne 0x40d410
mov dword [ebp - 4], esi
mov dword [ebp - method.CWString.virtual_0], vtable.CVolObject.0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421eac
mov esp, ebp
pop ebp
ret 4
Function at 0x40d4c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ecx]
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x40d51e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x40d4e0
mov eax, dword [edi]
jmp 0x40d609
cmp eax, 0x4e0
jb 0x40d609
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x40d540
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x40d590
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0xa0
jl 0x40d80b
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x40d7fd
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x40d82d
push 0xa0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40d82d
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.0040eb90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40d950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424e55
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x431e68], 0xa0
jl 0x40d9af
push 0x431e6c
call fcn.0041a980
mov esi, dword [0x431e64]
add esp, 4
test esi, esi
je 0x40d9a1
mov eax, dword [esi]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test esi, esi
jne 0x40d9d1
push 0xa0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40d9d1
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.0040eb90
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_YangWang::rg_WangLaoFangWenLei_n.0
call fcn.0040db20
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40dd30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0x11c
jl 0x40dd8b
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x40dd7d
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x40ddad
push 0x11c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40ddad
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004127c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40def0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424f25
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x431e68], 0x11c
jl 0x40df4f
push 0x431e6c
call fcn.0041a980
mov esi, dword [0x431e64]
add esp, 4
test esi, esi
je 0x40df41
mov eax, dword [esi]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test esi, esi
jne 0x40df71
push 0x11c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40df71
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004127c0
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.rg_volcano_YangWang::rg_WangLaoURLZuJianXinXiLei_n.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
push edi
mov dword [esi + 8], eax
call fcn.004128d0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0x68
jl 0x40e2b8
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x40e2aa
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x40e2d7
push 0x68
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40e2d7
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00413380
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40e3a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425045
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x431e68], 0x68
jl 0x40e3fc
push 0x431e6c
call fcn.0041a980
mov esi, dword [0x431e64]
add esp, 4
test esi, esi
je 0x40e3ee
mov eax, dword [esi]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test esi, esi
jne 0x40e41b
push 0x68
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40e41b
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00413380
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_YangWang::rg_WangLaoDaiLiXinXiLei_n.0
call fcn.0040e530
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422fed
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x431e68], 0xe0
jl 0x40e7bb
push 0x431e6c
call fcn.0041a980
mov ecx, dword [0x431e64]
add esp, 4
test ecx, ecx
je 0x40e7ad
mov eax, dword [ecx]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test ecx, ecx
jne 0x40e7dd
push 0xe0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x40e7dd
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.004124a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40e900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425155
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x431008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x431e68], 0xe0
jl 0x40e95f
push 0x431e6c
call fcn.0041a980
mov esi, dword [0x431e64]
add esp, 4
test esi, esi
je 0x40e951
mov eax, dword [esi]
mov dword [0x431e64], eax
mov dword [0x431e6c], 1
test esi, esi
jne 0x40e981
push 0xe0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x40e981
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.004124a0
mov byte [ebp - 4], 1
mov ecx, esi
push edi
mov dword [esi], vtable.rg_volcano_YangWang::rg_WangYeFangWenXiangYingLei_n.0
call fcn.0040ea80
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4110e0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x9c], 0
jne 0x41121c
cmp dword [edi + 0x38], 3
jne 0x411135
mov ecx, dword [edi + 0x74]
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x41111d
cmp dword [edi + 0x8c], ecx
mov ecx, 0x428a5c
je 0x41111a
mov ecx, dword [edi + 0x84]
mov dword [ebp - 4], ecx
mov edx, dword [edi + 0x48]
test edx, edx
jne 0x41113c
cmp dword [edi + 0x60], edx
jne 0x411130
mov edx, 0x428a5c
jmp 0x41113c
mov edx, dword [edi + 0x58]
jmp 0x41113c
xor ecx, ecx
xor edx, edx
mov dword [ebp - 4], ecx
test byte [edi + 0x10], 1
je 0x411146
xor eax, eax
jmp 0x4111a9
mov eax, dword [edi + 0x18]
xor ecx, ecx
test eax, eax
je 0x411157
cmp word [eax], cx
sete cl
jmp 0x41115e
cmp dword [edi + 0x30], 2
setle cl
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
je 0x411198
mov eax, dword [0x43109c]
test eax, eax
jne 0x4111a9
mov esi, dword [0x4310b4]
test esi, esi
jne 0x411184
mov eax, 0x428a5c
jmp 0x4111a9
mov eax, dword [0x4310ac]
test esi, esi
mov dword [ebp - 8], 0
cmove eax, dword [ebp - 8]
jmp 0x4111a9
test eax, eax
jne 0x4111a9
cmp dword [edi + 0x30], eax
mov eax, 0x428a5c
je 0x4111a9
mov eax, dword [edi + 0x28]
push 0
push ecx
push edx
push dword [edi + 0x38]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [edi + 0x9c], eax
test eax, eax
jne 0x4111c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
lea ecx, [ebp - 8]
push 4
push ecx
push 0x8c
push eax
mov dword [ebp - 8], 1
call esi
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x99
push dword [edi + 0x9c]
call esi
push 0x7530
push 0x7530
push 0x7d0
push 0x1388
push dword [edi + 0x9c]
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4116d0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov edi, dword [esi + 0x24]
test edi, edi
je 0x411732
shr edi, 2
lea eax, [edi*4 + 4]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
xor edx, edx
mov dword [ebx + edi*4], 0
test edi, edi
je 0x411732
nop
cmp dword [esi + 0x24], 0
jne 0x41171a
xor eax, eax
jmp 0x41171d
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + edx*4]
mov ecx, 0x428a5c
test eax, eax
cmovne ecx, eax
mov dword [ebx + edx*4], ecx
inc edx
cmp edx, edi
jb 0x411710
mov edx, dword [ebp + 0x10]
xor eax, eax
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x411746
cmp word [ecx], ax
sete al
jmp 0x41174d
cmp dword [edx + 0x24], 2
setle al
test eax, eax
je 0x411755
xor ecx, ecx
jmp 0x411766
test ecx, ecx
jne 0x411766
cmp dword [edx + 0x24], ecx
mov ecx, 0x428a5c
je 0x411766
mov ecx, dword [edx + 0x1c]
mov esi, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41177a
cmp word [eax], dx
sete dl
jmp 0x411781
cmp dword [esi + 0x24], 2
setle dl
test edx, edx
je 0x411789
xor eax, eax
jmp 0x41179a
test eax, eax
jne 0x41179a
cmp dword [esi + 0x24], eax
mov eax, 0x428a5c
je 0x41179a
mov eax, dword [esi + 0x1c]
mov edx, dword [ebp + 8]
mov esi, dword [edx + 0xc]
test esi, esi
jne 0x4117b1
cmp dword [edx + 0x24], esi
mov esi, 0x428a5c
je 0x4117b1
mov esi, dword [edx + 0x1c]
mov edi, dword [ebp - 4]
mov edx, dword [edi + 0xc]
test edx, edx
jne 0x4117c8
cmp dword [edi + 0x24], edx
mov edx, 0x428a5c
je 0x4117c8
mov edx, dword [edi + 0x1c]
push dword [ebp + 0x18]
push ebx
push ecx
push eax
push esi
push edx
push dword [ebp - 8]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
test ebx, ebx
je 0x4117e9
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x411800
Capabilities:
Set http header

Disassembly:
push esi
mov esi, dword [edx + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x411832
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411810
sub eax, edx
push 0xa0000000
sar eax, 1
push eax
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
pop edi
pop esi
ret 4
mov eax, dword [edx + 0x24]
test eax, eax
jne 0x411851
push 0xa0000000
push eax
mov esi, 0x428a5c
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
pop edi
pop esi
ret 4
mov esi, dword [edx + 0x1c]
shr eax, 1
push 0xa0000000
dec eax
push eax
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
pop edi
pop esi
ret 4
Function at 0x411870
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
mov dword [ebp - 0xc], ecx
push esi
push edi
mov dword [ebx + 0xc], 0
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x411896
mov eax, dword [ebx + 0x10]
push ecx
lea ecx, [ebx + 0x10]
call dword [eax + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x20], 0
mov eax, dword [edi + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4118fe
cmp dword [ebp - 4], eax
jbe 0x4118f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x4118f3
mov dword [edi + 0xc], 0xffffffff
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [ebp + 8], eax
test eax, eax
je 0x411989
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x411945
cmp dword [ebx + 0x24], ecx
mov ecx, 0x428a5c
je 0x411945
mov ecx, dword [ebx + 0x1c]
cmp edi, ecx
je 0x411989
mov dword [ebx + 0xc], 0
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x411961
mov eax, dword [ebx + 0x10]
push ecx
lea ecx, [ebx + 0x10]
call dword [eax + 0xc]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x20], 0
test edi, edi
je 0x411989
cmp word [edi], 0
je 0x411989
push edi
lea ecx, [ebx + 0x10]
call fcn.00419ee0
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4119a0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
or edx, 0x20000000
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
mov eax, dword [esi + 0xc]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push edx
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4119ee
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0
jbe 0x411a08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x411a08
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8