joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bc58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x694], edi
je 0x45bcc4
cmp dword [ebp + 8], 0x100
jne 0x45bcb3
cmp word [ebp + 0xc], 0xd
jne 0x45bcb3
cmp byte [esi + 0x69a], 0
je 0x45bc98
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x45bcb3
cmp byte [esi + 0x69b], 0
jne 0x45bcb3
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x45bcaf
push 1
push edi
push edi
push edi
push str.return
push esi
call fcn.0044d04d
xor eax, eax
jmp 0x45bcc7
mov eax, dword [esi + 0x694]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x45c097
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x602280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x45c14d
movzx eax, word [esi]
test ax, ax
je 0x45c14d
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x45c0d7
cmp ax, 0x5c
jne 0x45c0d9
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x45c0cb
cmp edi, esi
je 0x45c120
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.0054f8ff
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x45c15d
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0045c097
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0054f7da
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0054f7ab
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0054bf74
mov esp, ebp
pop ebp
ret
call fcn.00551d98
int3

Function at 0x45c80b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x45c887
cmp dword [edi + 4], 0xffffffff
jne 0x45c887
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x5e4cf0
push esi
call fcn.0054f7ab
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x45c859
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x45c859
mov eax, 0x2000000
jmp 0x45c88c
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045ed11
add esp, 0x10
test eax, eax
jne 0x45c877
mov eax, dword [ebp - 4]
jmp 0x45c88c
push eax
call fcn.0045f418
mov dword [edi], eax
mov eax, dword [0x607bc8]
pop ecx
jmp 0x45c88c
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45ee1e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x45ee52
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45ee4d
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x45ee79
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x45ee62
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.0054c3e0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x45efec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x45effa
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x45f0b5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
dec edi
jne 0x45f018
pop edi
test esi, esi
je 0x45f0ce
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5963f8]
inc edx
dec esi
jne 0x45f0b9
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x46009f
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x589f3b
call fcn.0054f671
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.00460432
call fcn.00449c96
push eax
lea ecx, [ebp - 0x94]
call fcn.004476d8
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00449c9c
mov ecx, eax
call fcn.00447f3d
test al, al
je 0x4601b5
push ebx
lea ecx, [ebp - 0x94]
call fcn.004479ca
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00447de0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x460126
push str.Error_opening_file
jmp 0x460296
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x46022f
cmp edi, 0x400000
ja 0x460240
and dword [ebp - 0x2c8], 0
push edi
call fcn.00536ab2
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x46019e
push ebx
call fcn.0054d6ed
pop ecx
mov ecx, esi
call fcn.00460432
push 0
push str.Could_not_read_file
jmp 0x460296
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.004602e5
push dword [ebp - 0x2cc]
jmp 0x4602c4
call fcn.00449c9c
push eax
lea ecx, [ebp - 0x94]
call fcn.00447945
call fcn.00449e5e
test al, al
je 0x4601d6
call fcn.00449ca2
jmp 0x4601ed
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00447de0
push eax
call fcn.0045c893
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x4601fe
push eax
push str.Error_opening_zip_file
jmp 0x460296
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.0045c1eb
add esp, 0x14
test eax, eax
je 0x460225
push 0
push str.Could_not_find_ziped_file
jmp 0x460296
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x460238
push 0
push str.File_is_empty
jmp 0x460296
cmp ebx, 0x400000
jbe 0x460249
push 0
push 0x597e80
jmp 0x460296
push ebx
call fcn.00536ab2
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.0045cc48
add esp, 0x18
test eax, eax
je 0x4602a1
cmp eax, 0x600
je 0x4602a1
push dword [ebp - 0x2c8]
call fcn.0054d6ed
pop ecx
call fcn.00449e5e
test al, al
jne 0x46028f
push edi
call fcn.0045c04d
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.0046045a
mov bl, al
jmp 0x4602cc
call fcn.00449e5e
test al, al
jne 0x4602b1
push edi
call fcn.0045c04d
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.004602e5
push edi
mov bl, al
call fcn.0054d6ed
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004477c0
mov al, bl
call fcn.0054f620
ret 8
Function at 0x46d5f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x46d618
cmp dword [esi + 8], edi
jge 0x46d610
push esi
call fcn.004699fc
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x46d63e
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x46d624
mov dword [esi + 8], edx
jmp 0x46d653
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x46d649
xor dl, dl
jmp 0x46d64e
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x46d63e
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x46d68d
push str.zlib_corrupt
call fcn.00469925
add esp, 4
jmp 0x46d6cd
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46d69d
push str.read_past_buffer
jmp 0x46d683
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x46d6b7
push edi
push ecx
push esi
call fcn.0047015b
add esp, 0xc
test eax, eax
je 0x46d6cd
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0054c3e0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x4808eb
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x589c89
call fcn.0054f671
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x6e8], ebx
cmp dword [edi + 4], ebx
jne 0x48097d
lea eax, [ebp - 0xa8]
push eax
call fcn.00480558
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xa8]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00421520
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.00446ea1
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00465345
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.00449827
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00447f3d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.004477c0
mov esi, 0x6d8
test bl, bl
je 0x4809bc
mov eax, dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.0054f620
ret 4

Function at 0x4809f2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x602280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044ee48
mov ecx, dword [esi + 0x6f0]
test ecx, ecx
je 0x480a6e
lea eax, [ebp - 0x14]
push eax
call fcn.00480558
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x6f0]
test eax, eax
je 0x480a4a
push 0
call fcn.00421550
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x480a6e
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.00421550
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0054bf74
mov esp, ebp
pop ebp
ret 0xc
Function at 0x480b56
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x602280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
mov ebx, ecx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004503d9
mov ecx, dword [ebx + 0x6f0]
test ecx, ecx
je 0x480bda
lea eax, [ebp - 0x14]
push eax
call fcn.00480558
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x6f0]
test eax, eax
je 0x480bb6
push 0
call fcn.00421550
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x480bda
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.00421550
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054bf74
mov esp, ebp
pop ebp
ret 0x14
Function at 0x483a09
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x58ac62
call fcn.0054f671
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2d0], ebx
call fcn.00449c96
push eax
lea ecx, [ebp - 0x94]
call fcn.004476d8
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00449c9c
mov ecx, eax
call fcn.00447f3d
test al, al
je 0x483b00
push ebx
lea ecx, [ebp - 0x94]
call fcn.004479ca
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00447de0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x483a9a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004477c0
jmp 0x483be1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x483ab1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x483a86
push esi
mov dword [ebp - 0x2cc], edi
call fcn.00536ab2
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2cc]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2cc], esi
je 0x483bcc
push edi
call fcn.0054d6ed
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004477c0
jmp 0x483bdf
call fcn.00449c9c
push eax
lea ecx, [ebp - 0x94]
call fcn.00447945
call fcn.00449e5e
test al, al
je 0x483b21
call fcn.00449ca2
jmp 0x483b38
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00447de0
push eax
call fcn.0045c893
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x483a86
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2d0]
push ebx
call fcn.0045c1eb
add esp, 0x14
test eax, eax
jne 0x483a86
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x483a86
push esi
call fcn.00536ab2
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.0045cc48
add esp, 0x18
test eax, eax
je 0x483bbc
cmp eax, 0x600
je 0x483bbc
push edi
call fcn.0054d6ed
pop ecx
call fcn.00449e5e
test al, al
jne 0x483aec
push ebx
call fcn.0045c04d
jmp 0x483aeb
call fcn.00449e5e
test al, al
jne 0x483bcc
push ebx
call fcn.0045c04d
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004477c0
test edi, edi
jne 0x483c5c
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x483c58
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x483c1b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x483c58
push esi
mov dword [ebp - 0x2c8], edi
call fcn.00536ab2
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x483c54
push edi
call fcn.0054d6ed
pop ecx
xor edi, edi
test edi, edi
jne 0x483c5c
xor eax, eax
jmp 0x483c74
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.00483c7c
push edi
mov esi, eax
call fcn.0054d6ed
pop ecx
mov eax, esi
call fcn.0054f620
ret 4
Function at 0x485140
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x485183
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:InternetGetConnectedState_fail_0x_x
push 1
push 0x32
push str.toolBaseRequest.cpp
push str.CBaseRequest::IsUseProxyConnect
call fcn.0048af50
add esp, 0x18
xor al, al
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 4]
shr al, 2
and al, 1
mov esp, ebp
pop ebp
ret

Function at 0x485540
Capabilities:
Receive http response
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0054da90
mov eax, dword [0x602280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor bl, bl
cmp dword [eax + 0x14], 8
push edi
mov edi, ecx
jb 0x485569
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x48561b
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x485614
jmp 0x4855c0
mov eax, dword [ebp - 0x1008]
test eax, eax
je 0x485612
push 0
lea ecx, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0
push ecx
push eax
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x485614
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x4855c0
jmp 0x485614
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054bf74
mov esp, ebp
pop ebp
ret 4
Function at 0x485630
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58aeed
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x602280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x834], esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov dword [ebp - 4], 0
mov dword [ebp - 0x830], 1
mov dword [ebp - 0x82c], 0
jmp 0x4856b0
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.0054dac0
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
push 0x7ff
lea eax, [ebp - 0x810]
push eax
push dword [edi + 0x6c]
call ebx
test eax, eax
je 0x485756
push dword [ebp - 0x82c]
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 0xf
push eax
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov byte [ebp - 0x828], 0
call fcn.004210e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00423360
cmp dword [ebp - 0x814], 0x10
mov byte [ebp - 4], 0
jb 0x485749
push dword [ebp - 0x828]
call fcn.0054b7e0
add esp, 4
cmp dword [ebp - 0x82c], 0
ja 0x4856b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054bf74
mov esp, ebp
pop ebp
ret 4

Function at 0x485790
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x6c]
sub esp, 0xc
test eax, eax
je 0x4857f5
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], 4
push ecx
push 0
push 0x20000005
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x4857fd
push str.CWinHttpRequest::GetUrlFileSize
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59d664
call fcn.00485a40
add esp, 0x10
xor al, al
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x485810
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x485860
push str.CWinHttpRequest::HttpRead
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59d694
call fcn.00485a40
add esp, 0x10
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x485870
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0x59d5a0
cmp dword [esi + 0x48], 8
lea edx, [esi + 0x34]
push edi
mov dword [ebp - 4], 0
jb 0x485893
mov edx, dword [edx]
cmp dword [esi + 0x18], 8
lea ecx, [esi + 4]
jb 0x48589e
mov ecx, dword [ecx]
cmp byte [ebp + 8], 0
mov eax, 0x100
mov edi, 0x800100
cmovne eax, edi
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x5e4cc8
push edx
push ecx
push dword [esi + 0x68]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0x6c], eax
pop edi
pop esi
test eax, eax
jne 0x4858fc
push str.CWinHttpRequest::OpenRequest
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59d5c8
call fcn.00485a40
add esp, 0x10
xor al, al
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x485910
Capabilities:
Initialize winhttp library

Disassembly:
push esi
mov esi, ecx
call fcn.00485140
push 0
push 0
push 0
test al, al
je 0x485926
push 0
jmp 0x485928
push 1
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0x64], eax
pop esi
test eax, eax
jne 0x485960
push str.CWinHttpRequest::OpenSession
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59d564
call fcn.00485a40
add esp, 0x10
xor al, al
ret
mov al, 1
ret

Function at 0x485970
Capabilities:
Receive http response
Set http header

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x4859c2
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x485985
mov eax, dword [eax]
push 0x20000000
push ecx
push eax
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x4859c2
push str.CWinHttpRequest::SendRequest
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59d5fc
call fcn.00485a40
add esp, 0x10
xor al, al
pop esi
ret
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x485a04
push str.CWinHttpRequest::SendRequest
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59d618
call fcn.00485a40
add esp, 0x10
xor al, al
pop esi
ret
push 0
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x485a3c
push str.CWinHttpRequest::SendRequest
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59d62c
call fcn.00485a40
add esp, 0x10
xor al, al
pop esi
ret
mov al, 1
pop esi
ret