joyce8/EMBER2024-capa huggingface dataset:
Function at 0x654c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00566580
Function at 0x6ab4a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov esi, dword [ecx + 0x28]
mov ebx, dword [ecx + 0x2c]
cmp esi, ebx
je 0x6ab4e3
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
mov ecx, esi
push edi
call fcn.006acca0
test al, al
jne 0x6ab4dd
add esi, 0x58
cmp esi, ebx
jne 0x6ab4ca
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x2c]
cmp esi, ebx
je 0x6ab51a
cmp byte [esi + 0x1b], 0
js 0x6ab4f2
lea eax, [esi + 0x10]
jmp 0x6ab4f5
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
xor edi, edi
inc edi
cmp eax, 0xffffffff
cmovne edi, ecx
test edi, edi
jne 0x6ab51d
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x6ab51d
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6ab660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movups xmm0, xmmword [edx]
movups xmmword [ebp - 0x20], xmm0
mov edi, dword [ecx + 0x28]
mov esi, dword [ecx + 0x2c]
cmp edi, esi
je 0x6ab6a3
mov dword [ebp - 0x24], ecx
lea ebx, [ebp - 0x20]
mov ecx, edi
push ebx
call fcn.006acca0
test al, al
jne 0x6ab69d
add edi, 0x58
cmp edi, esi
jne 0x6ab68a
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx + 0x2c]
xor ebx, ebx
inc ebx
cmp edi, esi
je 0x6ab6f3
mov eax, dword [edi + 0x50]
cmp eax, dword [ebp + 8]
jne 0x6ab6e7
cmp byte [edi + 0x1b], 0
js 0x6ab6bf
mov esi, ecx
lea eax, [edi + 0x10]
jmp 0x6ab6c4
mov esi, ecx
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6ab6f3
shr eax, 3
and eax, 2
mov ebx, eax
jne 0x6ab6f3
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x24], 1
mov dword [eax], edi
xor ebx, ebx
jmp 0x6ab6f3
xor ecx, ecx
cmp eax, 1
sete cl
lea ebx, [ecx + ecx*2]
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6ab830
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc8
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0xb8]
mov dword [edi], 0xffffffff
mov edx, edi
call fcn.004d30d0
mov ebx, dword [edi]
test ebx, ebx
je 0x6ab8f6
mov dword [ebp - 0xd0], esi
mov esi, dword [ebp + 8]
xor eax, eax
dec eax
lea ecx, [ebp - 0xc4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.0055fdd0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xb4], xmm0
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x2c]
cmp esi, edi
je 0x6ab8c0
mov dword [ebp - 0xc8], ebx
lea ebx, [ebp - 0xb4]
mov ecx, esi
push ebx
call fcn.006acca0
test al, al
jne 0x6ab8b7
add esi, 0x58
cmp esi, edi
jne 0x6ab8a4
mov ebx, dword [ebp - 0xc8]
mov edi, dword [ebx + 0x2c]
cmp esi, edi
jne 0x6ab8fd
xor esi, esi
inc esi
lea ecx, [ebp - 0xc4]
call fcn.0055ff40
lea ecx, [ebp - 0xb8]
call fcn.004d39b0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0xc8
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, 3
jmp 0x6ab8d2
lea eax, [esi + 0x10]
lea ecx, [ebp - 0xc4]
push eax
call fcn.0055ff60
mov ecx, dword [ebx + 0x2c]
cmp ecx, esi
je 0x6aba7d
mov dword [ebp - 0xc8], ebx
lea eax, [ebx + 0x28]
mov dword [ebp - 0xcc], eax
lea eax, [esi + 0x58]
mov edx, esi
cmp eax, ecx
je 0x6ab93c
mov edi, esi
mov dword [ebp - 0xd4], ecx
jmp 0x6ab9f4
sub edx, esi
add edx, esi
mov ecx, dword [ebp - 0xcc]
call fcn.006ac690
mov eax, dword [ebp - 0xc8]
mov byte [eax + 0x24], 1
cmp byte [ebp - 0xb9], 0
lea eax, [ebp - 0xc4]
jns 0x6ab96a
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov ecx, dword [ebp - 0xd0]
je 0x6aba15
push dword [ebp + 8]
call fcn.006d54e0
xor esi, esi
jmp 0x6ab8c7
push dword [ebx]
call fcn.005c57c0
add esp, 4
mov eax, dword [edi + 0x7c]
mov dword [ebx + 8], eax
movsd xmm0, qword [edi + 0x74]
movsd qword [ebx], xmm0
xor eax, eax
mov byte [edi + 0x7f], al
mov byte [edi + 0x74], al
movups xmm0, xmmword [edi + 0x80]
movups xmm1, xmmword [edi + 0x90]
movups xmmword [edi + 0x28], xmm0
movups xmmword [edi + 0x38], xmm1
movsd xmm0, qword [edi + 0xa0]
movsd qword [edi + 0x48], xmm0
mov eax, dword [edi + 0xa8]
mov dword [edi + 0x50], eax
lea edx, [edi + 0x58]
add edi, 0xb0
mov ecx, dword [ebp - 0xd4]
cmp edi, ecx
mov edi, edx
je 0x6ab93c
movups xmm0, xmmword [edi + 0x58]
movups xmmword [edi], xmm0
lea ecx, [edi + 0x10]
lea eax, [edi + 0x68]
push eax
call fcn.0055ffc0
lea ebx, [edi + 0x1c]
cmp byte [edi + 0x27], 0
jns 0x6ab998
jmp 0x6ab98e
mov esi, 2
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x6ab8c7
call fcn.00642ea0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x36f
push str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0xb
push str.DeleteFile
push eax
call fcn.00533f70
add esp, 0xc
lea ecx, [ebp - 0xc4]
push ecx
push eax
call fcn.00643c60
add esp, 8
mov ecx, edi
call fcn.00642f10
jmp 0x6ab8c7
ud2
Function at 0x6af0e0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
mov edx, dword [0x808040]
xor edx, ebp
mov dword [ebp - 0x10], edx
test ecx, ecx
je 0x6af104
mov ecx, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
test eax, eax
je 0x6af114
mov eax, dword [ebp + 0x18]
xor edi, edi
dec edi
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
push 0x10000000
push ecx
push eax
push esi
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebx], 0x7744d0
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
test eax, eax
je 0x6af2d9
mov esi, eax
lea edi, [ebp - 0x120]
push 0x110
push 0
push edi
call fcn.005c9b00
add esp, 0xc
mov dword [edi - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x77fb40]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov dword [ebp - 0x130], esi
mov esi, 3
xor ecx, ecx
inc ecx
push esi
push ecx
push edx
push eax
call ebx
push esi
push 0x20
push edx
push eax
call ebx
mov dword [edi - 8], 6
xor ecx, ecx
inc ecx
mov dword [edi - 4], ecx
mov word [edi + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x6af24c
push 0x110
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.005c9b00
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x77fb40]
movups xmmword [esp], xmm0
call ebx
push esi
push 1
push edx
push eax
call ebx
push esi
push 0x20
push edx
push eax
call ebx
mov dword [ebp - 0x128], 6
mov dword [ebp - 0x124], esi
mov word [ebp - 0x18], 0
push edx
push eax
push 0x23
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x6af24c
mov dword [ebp - 0x12c], 0xa80
push 4
lea eax, [ebp - 0x12c]
push eax
push 0x54
push dword [ebp - 0x130]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 0x110
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.005c9b00
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x77fb40]
movups xmmword [esp], xmm0
call ebx
push esi
push 1
push edx
push eax
call ebx
push esi
push 0x20
push edx
push eax
call ebx
mov dword [ebp - 0x128], 6
mov dword [ebp - 0x124], esi
mov word [ebp - 0x18], 0
push edx
push eax
push 0x23
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
mov ebx, dword [ebp + 8]
je 0x6af2d9
mov dword [ebp - 0x12c], 3
push 4
lea eax, [ebp - 0x12c]
push eax
push 0x76
push dword [ebp - 0x130]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b0df0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx ebx, byte [ecx + 0x88]
movsx eax, byte [ecx + 0xa7]
test eax, eax
js 0x6b0ea0
lea ecx, [esi + 0x9c]
test eax, eax
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x6b0eb5
shl ebx, 0x17
or ebx, 0x100
lea edi, [ebp - 0x1c]
push eax
push ecx
push edi
call fcn.004a8d80
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x6b0e53
mov edi, dword [ebp - 0x1c]
xor eax, eax
push ebx
push eax
push eax
push eax
push edi
push dword [esi + 0xa8]
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, dword [ebp + 8]
mov dword [esi], 0x7744d0
mov dword [esi + 4], eax
mov byte [esi + 8], 0
cmp byte [ebp - 0x11], 0
jns 0x6b0e8a
push dword [ebp - 0x1c]
call fcn.005c57c0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [esi + 0xa0]
test eax, eax
js 0x6b0eb5
mov ecx, dword [esi + 0x9c]
jmp 0x6b0e21
ud2

Function at 0x6b12e0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [ecx + 0x20], 0
je 0x6b1366
mov esi, ecx
mov eax, dword [ecx + 0xd0]
mov ecx, dword [ecx + 0xd4]
mov edx, ecx
sub edx, eax
cmp edx, 0x3fff
jbe 0x6b1325
cmp edx, 0x4000
je 0x6b1344
add edx, 0xffffc000
dec ecx
cmp edx, ecx
ja 0x6b136e
lea ecx, [eax + 0x4000]
mov dword [esi + 0xd4], ecx
jmp 0x6b1348
lea ecx, [esi + 0xd0]
mov eax, 0x4000
sub eax, edx
push eax
call fcn.005447c0
mov eax, dword [esi + 0xd0]
mov ecx, dword [esi + 0xd4]
cmp eax, ecx
je 0x6b136e
sub ecx, eax
push 0
push ecx
push eax
push dword [esi + 0x20]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x6b136b
pop esi
pop ebp
jmp fcn.0060e270
mov eax, 0x800704c7
pop esi
pop ebp
ret
ud2
Function at 0x6d67a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6d67c3
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6d67e7
mov ebx, eax
mov al, byte [ebp + 0xc]
mov ecx, ebx
shr ecx, 0xa
xor al, 1
test cl, al
jne 0x6d683b
and ebx, 0x10
shr ebx, 4
jmp 0x6d683d
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x6d683b
call fcn.00642ea0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x80
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00533f70
add esp, 0xc
push edi
push eax
call fcn.00643c60
add esp, 8
mov ecx, esi
call fcn.00642f10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x6d6860
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6d6883
mov eax, dword [edi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x6d68f8
cmp byte [ebp + 0x10], 0
je 0x6d68a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x6d690f
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x6d68f6
call fcn.00642ea0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x61
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x10
push str.CreateDirectory
push eax
call fcn.00533f70
add esp, 0xc
push edi
push eax
call fcn.00643c60
add esp, 8
mov ecx, esi
call fcn.00642f10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push edi
call fcn.006d67a0
add esp, 8
test al, al
jne 0x6d68f8
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x6d68f6
lea esi, [ebp - 0xb4]
mov ecx, esi
push 2
push 0x5c
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.004ba430
lea eax, [ebp - 0xac]
push edi
push eax
call fcn.00643c60
add esp, 8
push 0x10
push str._not_a_directory
push eax
call fcn.00533f70
add esp, 0xc
mov ecx, esi
call fcn.004ba910
jmp 0x6d68f6
Function at 0x6d6970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x6d6993
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6d69be
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x6d6a0f
call fcn.00642ea0
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0x73
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x12
push str.GetFileAttributes
push eax
call fcn.00533f70
add esp, 0xc
push edi
push eax
call fcn.00643c60
add esp, 8
mov ecx, esi
call fcn.00642f10
xor ebx, ebx
jmp 0x6d69a7

Function at 0x6d6a20
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x6d6a43
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x6d6ae6
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x6d6a6c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x6d6acf
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x6d6acd
call fcn.00642ea0
lea edi, [ebp - 0xb4]
mov ecx, edi
push eax
push 2
push 0x93
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0xb
push str.DeleteFile
push eax
call fcn.00533f70
add esp, 0xc
push esi
push eax
call fcn.00643c60
add esp, 8
mov ecx, edi
call fcn.00642f10
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov ecx, esi
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.006d6b10
Function at 0x6d6b10
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov esi, ecx
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x6d6b32
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
je 0x6d6b5b
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.0055f440
add esp, 4
test al, al
je 0x6d6b3f
call fcn.00642ea0
lea ebx, [ebp - 0xb4]
mov ecx, ebx
push eax
push 2
push 0x2f
push str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
call fcn.00642eb0
lea eax, [ebp - 0xac]
push 0x10
push str.RemoveDirectory
push eax
call fcn.00533f70
add esp, 0xc
push esi
push eax
call fcn.00643c60
add esp, 8
mov ecx, ebx
call fcn.00642f10
jmp 0x6d6b3f
Function at 0x6e4490
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [edi], eax
push eax
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
cmp esi, 0x8007007a
je 0x6e44f5
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
dec eax
lea esi, [ebp - 0x20]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x14]
shr eax, 1
mov ecx, esi
push eax
call fcn.00602ee0
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x6e455b
push 0
push edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x6e456e
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6e44e1
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
je 0x6e455d
add ecx, 0xfffffffe
jne 0x6e4552
ud2
mov dword [ebp - 0x1c], eax
push eax
call fcn.005c57c0
add esp, 4
jmp 0x6e44e1
mov eax, dword [ebp - 0x14]
test al, 1
jne 0x6e459e
mov esi, dword [ebp + 0x14]
shr eax, 1
lea edi, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0049d390
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov edi, edx
sub edi, eax
sar edi, 1
mov ecx, esi
push edi
push edx
push eax
call fcn.00602f40
xor esi, esi
jmp 0x6e4548
int3

Function at 0x6e45b0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [0x808040]
xor esi, ebp
mov dword [ebp - 0xc], esi
mov esi, 0x20000000
or esi, dword [ebp + 0xc]
lea edi, [ebp - 0x10]
mov dword [edi], 4
push 0
push edi
push edx
push ecx
push esi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor esi, esi
test eax, eax
jne 0x6e460c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005c6b46
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x6fb300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov edi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x808040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
jne 0x6fb327
call fcn.0064dca0
mov ebx, eax
test edi, edi
cmove edi, ebx
push ebx
call fcn.004c1390
add esp, 4
lea ecx, [eax*2 + 2]
cmp ecx, esi
ja 0x6fb360
mov dword [ebp - 0x68], edi
lea edx, [eax + eax]
mov edi, esi
mov esi, edx
not esi
lea ecx, [edi + esi]
dec ecx
cmp ecx, dword [ebp + 0x14]
jae 0x6fb38b
push 0x6a
push str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
push 0x72
jmp 0x6fb369
push 0x64
push str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
push 0x7e
push 0
push 4
call fcn.006baa70
add esp, 0x14
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b46
mov eax, edi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [edi - 1]
mov dword [ebp - 0x60], ecx
cmp ecx, edx
ja 0x6fb3a8
push 0x6f
jmp 0x6fb362
xor ebx, ebx
xor edi, edi
push ebx
call fcn.005646a0
add esp, 4
jmp 0x6fb377
mov edx, dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov dword [ebp - 0x5c], eax
add eax, edi
inc eax
xor ecx, ecx
push ecx
push ebx
push ecx
mov dword [ebp - 0x58], eax
push eax
push edx
push dword [ebp + 0x18]
call fcn.004c13a0
add esp, 0x18
test eax, eax
je 0x6fb399
mov ebx, dword [ebp - 0x60]
mov ecx, dword [ebp + 0x14]
sub ebx, ecx
add esi, ebx
mov edx, dword [ebp - 0x5c]
je 0x6fb3f7
mov eax, dword [ebp - 0x58]
add eax, edx
push esi
push 0
push eax
mov esi, edx
call fcn.005c9b00
mov edx, esi
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov eax, edx
not eax
add ebx, dword [ebp - 0x58]
mov byte [eax + ebx], 1
lea eax, [edi + 1]
mov dword [ebp - 0x54], eax
test ecx, ecx
mov esi, edx
je 0x6fb429
mov eax, edi
add eax, esi
add eax, dword [ebp + 0xc]
sub eax, ecx
sub eax, esi
push ecx
push dword [ebp + 0x10]
push eax
call fcn.005c9580
mov esi, dword [ebp - 0x5c]
add esp, 0xc
push esi
push dword [ebp - 0x54]
call fcn.00565510
add esp, 8
test eax, eax
je 0x6fb399
mov edi, dword [ebp - 0x60]
sub edi, esi
push edi
call fcn.00564600
add esp, 4
test eax, eax
je 0x6fb399
mov ebx, eax
push dword [ebp - 0x68]
push esi
push dword [ebp - 0x54]
mov dword [ebp - 0x64], edi
push edi
push eax
call fcn.004c3170
add esp, 0x14
test eax, eax
je 0x6fb39b
cmp dword [ebp - 0x60], esi
mov esi, dword [ebp - 0x58]
je 0x6fb48f
mov eax, dword [ebp - 0x64]
cmp eax, 1
adc eax, 0
xor ecx, ecx
mov dl, byte [ebx + ecx]
xor byte [esi + ecx], dl
inc ecx
cmp eax, ecx
jne 0x6fb484
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x50]
movdqu xmmword [eax + 0x30], xmm0
movdqu xmmword [eax + 0x20], xmm0
movdqu xmmword [eax + 0x10], xmm0
movdqu xmmword [eax], xmm0
push dword [ebp - 0x68]
push dword [ebp - 0x64]
push esi
mov esi, dword [ebp - 0x5c]
push esi
push eax
call fcn.004c3170
add esp, 0x14
test eax, eax
je 0x6fb39b
xor edi, edi
inc edi
test esi, esi
je 0x6fb39d
mov edx, esi
xor eax, eax
mov esi, dword [ebp - 0x54]
mov cl, byte [ebp + eax - 0x50]
xor byte [esi + eax], cl
inc eax
cmp edx, eax
jne 0x6fb4d7
jmp 0x6fb39d