joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45caa0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4a2120]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
cmp dword [ebp + 0x8c], 2
push edi
mov edi, dword [ebp]
mov dword [esp + 0xc], edi
je 0x45cc05
cmp dword [ebp + 0x250], 0
push ebx
push esi
jne 0x45cbfa
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, 0x80
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x45cb29
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.0044f800
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push edi
call fcn.0045a9f0
add esp, 0x18
jmp 0x45cc03
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x9c]
push eax
push esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x45cb69
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push ebp
call fcn.0044f800
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push edi
call fcn.0045a9f0
add esp, 0x18
jmp 0x45cc03
lea edi, [ebp + 0xb8]
lea ebx, [ebp + 0xe8]
lea esi, [esp + 0x18]
call fcn.0045ca60
test eax, eax
jne 0x45cba7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.0044f800
mov ecx, dword [esp + 0x1c]
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ecx
call fcn.0045a9f0
add esp, 0x18
jmp 0x45cc03
lea edi, [ebp + 0x58]
mov ecx, 0xb
lea esi, [ebp + 0xb8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp + 0x11c]
lea edi, [ebp + 0xec]
lea esi, [esp + 0x98]
call fcn.0045ca60
test eax, eax
jne 0x45cbfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.0044f800
mov edx, dword [esp + 0x1c]
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push edx
call fcn.0045a9f0
add esp, 0x18
jmp 0x45cc03
push ebp
call fcn.0045ca00
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
xor ecx, esp
call fcn.0043094a
add esp, 0x10c
ret

Function at 0x45cc20
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
mov eax, dword [esi + 0x35c]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x45cc63
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0044f800
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.0045a960
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.0045a960
add esp, 8
pop esi
pop ecx
ret
Function at 0x45cc80
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xac
mov eax, dword [0x4a2120]
xor eax, esp
mov dword [esp + 0xa8], eax
mov eax, dword [0x4a5a90]
mov dword [esp], 0x4020
mov dword [esp + 4], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x45cd23
push 0x9c
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004308d0
add esp, 0xc
push 3
push 2
push 0
push 0
mov dword [esp + 0x1c], 0x9c
mov dword [esp + 0x20], 6
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x45cd17
mov dword [0x4a5a90], 2
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.0043094a
add esp, 0xac
ret
mov dword [0x4a5a90], 1
jmp 0x45cd28
cmp eax, 2
je 0x45cd72
push esi
mov esi, dword [esp + 0xb4]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x45cd59
mov ecx, dword [esp + 8]
cmp ecx, dword [esp + 4]
jg 0x45cd71
push 4
lea edx, [esp + 8]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.0043094a
add esp, 0xac
ret

Function at 0x45cdb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi + 0x5c0]
test esi, esi
je 0x45cdfd
mov eax, dword [edi + 0x44]
test eax, eax
je 0x45cdfd
push 0x45cd90
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
mov edx, dword [eax + 0x30]
push ecx
push edx
call fcn.00476750
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x45ce06
mov dword [edi + 0x5c0], 0
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x45ce10
mov dword [eax], esi
cmp dword [esi + 0x17c], 0
mov edi, dword [esi + 0x154]
je 0x45ce35
push esi
call fcn.004515a0
add esp, 4
test eax, eax
jne 0x45ce49
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
push 2
push 1
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x45cdfd
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x45cfa0
Capabilities:
Connect socket

Disassembly:
sub esp, 0xd8
mov eax, dword [0x4a2120]
xor eax, esp
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0xe0]
push ebp
mov ebp, dword [esp + 0xe0]
mov edx, dword [ebp]
mov dword [esp + 4], ecx
mov dword [ecx], 0xffffffff
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0xc], edx
lea edx, [esp + 0x1c]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0
call fcn.0045cec0
add esp, 0x10
test eax, eax
je 0x45d00c
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.0043094a
add esp, 0xd8
ret
push ebx
push esi
push edi
lea ebx, [esp + 0x20]
lea edi, [esp + 0xb4]
lea esi, [esp + 0x34]
call fcn.0045ca60
test eax, eax
jne 0x45d05a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebp
call fcn.0044f800
push eax
mov eax, dword [esp + 0x20]
push esi
push str.sa_addr_inet_ntop___failed_with_errno__d:__s
push eax
call fcn.0045a9f0
mov ecx, dword [esp + 0x34]
push ecx
push ebp
call fcn.0045ce60
add esp, 0x20
jmp 0x45d1cc
mov esi, dword [esp + 0x14]
lea edx, [esp + 0xb4]
push edx
push str.__Trying__s..._n
push esi
call fcn.0045a960
mov ebx, dword [esp + 0x28]
add esp, 0xc
cmp dword [esi + 0x35c], 0
je 0x45d08a
mov edx, ebx
mov edi, ebp
call fcn.0045cc20
push ebx
call fcn.0045cc80
add esp, 4
cmp dword [esi + 0x464], 0
je 0x45d0a3
mov edi, ebx
call fcn.0045c400
mov eax, dword [esi + 0x1b0]
test eax, eax
je 0x45d0c9
mov ecx, dword [esi + 0x1b4]
push 0
push ebx
push ecx
call eax
add esp, 0xc
cmp eax, 2
jne 0x45d0f6
mov dword [esp + 0x18], 1
mov edx, dword [esp + 0x24]
push edx
push ebx
push ebp
call fcn.0045c590
mov edi, eax
add esp, 0xc
test edi, edi
je 0x45d10e
push ebx
push ebp
call fcn.0045ce60
mov eax, edi
dec eax
add esp, 8
neg eax
sbb eax, eax
and eax, edi
jmp 0x45d1ce
test eax, eax
je 0x45d0c9
push ebx
push ebp
call fcn.0045ce60
add esp, 8
mov eax, 0x2a
jmp 0x45d1ce
push 1
push ebx
call fcn.0047c250
add esp, 8
call fcn.0045a540
cmp dword [ebp + 0x2b8], 1
mov dword [ebp + 0x2b0], eax
mov dword [ebp + 0x2b4], edx
jle 0x45d143
mov eax, dword [ebp + 0x2bc]
push eax
push esi
call fcn.00458ca0
add esp, 8
cmp dword [esp + 0x18], 0
jne 0x45d1c6
cmp dword [ebp + 0x8c], 1
jne 0x45d1c6
mov ecx, dword [esp + 0x30]
push ecx
lea edx, [esp + 0x38]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x45d1bc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0xb
je 0x45d1ba
cmp edi, 0x2732
jle 0x45d186
cmp edi, 0x2734
jle 0x45d1ba
push edi
push ebp
call fcn.0044f800
push eax
lea eax, [esp + 0xc0]
push eax
push str.Immediate_connect_fail_for__s:__s_n
push esi
call fcn.0045a960
push ebx
push ebp
mov dword [esi + 0x85fc], edi
call fcn.0045ce60
mov edi, 7
add esp, 0x20
mov eax, edi
jmp 0x45d1ce
xor edi, edi
mov ecx, dword [esp + 0x10]
mov dword [ecx], ebx
mov eax, edi
jmp 0x45d1ce
mov edx, dword [esp + 0x10]
mov dword [edx], ebx
xor eax, eax
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.0043094a
add esp, 0xd8
ret
Function at 0x45eac0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
push ebp
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [esp + 0x20]
push edx
push eax
push ecx
mov dword [esp + 0x18], ebx
xor ebp, ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x45ec71
push edi
mov edi, dword [esp + 0x14]
cmp edi, ebx
je 0x45ec4f
push esi
jmp 0x45eb10
cmp dword [edi + 4], 2
jne 0x45ebc8
cmp dword [edi + 0x18], ebx
je 0x45ebc8
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x45ebc8
cmp eax, 0x10
jb 0x45ebc8
push 0x20
call dword [0x4a3680]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x45ebd5
mov edx, dword [edi]
mov dword [esi], edx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
push 0x10
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
call dword [0x4a3680]
add esp, 4
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x45ebdf
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x45ebb5
push eax
call dword [0x4a368c]
add esp, 4
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x45ebf3
cmp dword [esp + 0x10], ebx
jne 0x45ebbf
mov dword [esp + 0x10], esi
cmp ebp, ebx
je 0x45ebc6
mov dword [ebp + 0x1c], esi
mov ebp, esi
mov edi, dword [edi + 0x1c]
cmp edi, ebx
jne 0x45eb10
jmp 0x45ec0f
mov dword [esp + 0x14], 8
jmp 0x45ec0f
push esi
mov dword [esp + 0x18], 8
call dword [0x4a3684]
add esp, 4
jmp 0x45ec0f
mov edx, dword [esi + 0x18]
push edx
mov dword [esp + 0x18], 8
call dword [0x4a3684]
push esi
call dword [0x4a3684]
add esp, 8
mov eax, dword [esp + 0x18]
pop esi
cmp eax, ebx
je 0x45ec1f
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [esp + 0x10], ebx
je 0x45ec49
mov eax, dword [esp + 0xc]
push eax
call fcn.0045ea70
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
mov ecx, ebx
pop ebp
mov dword [esp + 4], ebx
mov dword [edx], ecx
pop ebx
add esp, 0xc
ret
cmp dword [esp + 0xc], ebx
jne 0x45ec62
push 0x2af9
mov dword [esp + 0x14], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov dword [edx], ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x45efb0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.004824c9
add esp, 0x18
test eax, eax
je 0x45efd3
cmp eax, 0xffffffff
jne 0x45efd5
xor eax, eax
ret
Function at 0x45f110
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x45f11f
jmp dword [ecx*4 + 0x45f174]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
Function at 0x46a3b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x490254
push ecx
call fcn.0045a960
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.00469560
test eax, eax
jne 0x46a3e0
mov eax, esi
jmp fcn.004699f0
ret
Function at 0x46c340
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x154]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x46c384
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.0045a9f0
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.0046c240
add esp, 4
pop esi
pop ecx
ret
Function at 0x46d120
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [esp + 4], eax
jne 0x46d28a
push ebp
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea ebp, [ebx + 0x1eb0]
mov dword [ebp], edi
cmp edi, ebp
jae 0x46d159
mov byte [edi], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46d166
mov byte [eax], 0xfa
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46d173
mov byte [eax], 0x1f
inc dword [ebp]
movzx ecx, word [ebx + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push ecx
call esi
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [esp + 0x20], edx
call esi
movzx ecx, ax
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46d1a7
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46d1b7
mov dl, byte [esp + 0x1d]
mov byte [eax], dl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46d1c3
mov byte [eax], cl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46d1cf
mov byte [eax], ch
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46d1dc
mov byte [eax], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46d1e9
mov byte [eax], 0xf0
inc dword [ebp]
mov eax, dword [ebp]
mov esi, dword [esp + 0x10]
mov ecx, eax
sub ecx, edi
sub ecx, 2
push ecx
lea edx, [ebx + 0x1cb2]
push edx
push 0x3e
mov dword [ebx + 0x1eb4], eax
mov dword [ebp], edi
call fcn.0046c6d0
mov ebp, dword [sym.imp.WS2_32.dll_send]
add esp, 0xc
push 0
push 3
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x154]
push eax
call ebp
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jge 0x46d249
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.0045a9f0
add esp, 0xc
lea edx, [ebx + 0x1cb3]
push 4
push edx
call fcn.0046cfb0
mov eax, dword [edi + 0x154]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push eax
call ebp
test eax, eax
jge 0x46d287
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.0045a9f0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x46dcc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x4a2120]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x158]
push ebp
mov ebp, dword [esi]
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
or edi, 0xffffffff
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x46dd14
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.0045ce60
add esp, 8
cmp edi, 0xffffffff
jne 0x46dd48
push str.Error_accept__ing_server_connect
push ebp
call fcn.0045a9f0
add esp, 8
pop edi
pop ebp
mov eax, 0x1e
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043094a
add esp, 0x18
ret
push str.Connection_accepted_from_server_n
push ebp
call fcn.0045a960
push 1
push edi
mov dword [esi + 0x158], edi
call fcn.0047c250
mov dword [esi + 0x168], 1
mov eax, dword [ebp + 0x1b0]
add esp, 0x10
test eax, eax
je 0x46ddb6
mov ecx, dword [ebp + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x46ddb6
push edi
push esi
call fcn.0045ce60
add esp, 8
pop edi
pop ebp
mov dword [esi + 0x158], 0xffffffff
mov eax, 0x2a
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043094a
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043094a
add esp, 0x18
ret
Function at 0x471480
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x4714b6
push str.Couldnt_set_desired_mode
push ebx
call fcn.0045a9f0
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x4714cd
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0045a960
add esp, 0xc
cmp ebp, 0x13
jne 0x4714e1
push edi
call fcn.00471410
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x4714f5
push edi
call fcn.0046e750
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x471507
mov ecx, edi
call fcn.00471460
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x471515
mov ecx, edi
call fcn.00471470
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x477fc0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4a2120]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0044cbdc
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x478025
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x478025
lea edx, [esp]
push edx
call dword [0x4a368c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0043094a
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0043094a
add esp, 0x108
ret
jmp 0x477fc0

Function at 0x478040
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x4a2120]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0044cbdc
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x478025
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x478025
lea edx, [esp]
push edx
call dword [0x4a368c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0043094a
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0043094a
add esp, 0x108
ret
jmp 0x477fc0
Function at 0x47c280
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x47c299
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0045a540
push edx
push eax
call fcn.0045a570
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x47c2e6
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.0045a540
push edx
push eax
call fcn.0045a570
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x47c2e8
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x47d000
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x47d031
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
ret

Function at 0x47d040
Capabilities:
Hash data via wincrypt

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
ret
Function at 0x1001a513
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001a552
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a552
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a552
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001a552
cmp dword [ecx + 0x74], 0xe
jbe 0x1001a552
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001d1cf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d26c
push ebx
push esi
call fcn.1001d198
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d12c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d219
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d26b
push edi
push eax
call fcn.1001e18a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d239
call fcn.1001bc74
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d26a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d12c
add esp, 0x20
test eax, eax
jne 0x1001d258
push edi
call fcn.1001bc74
jmp 0x1001d260
push ebx
call fcn.1001bc74
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001d4d9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cc8
push 0x10024cc0
push str.FlsAlloc
push 0x1f
call fcn.1001d3f5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d50d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10023150]
call esi
jmp 0x1001d513
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001d557
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cd8
push 0x10024cd0
push str.FlsGetValue
push 0x21
call fcn.1001d3f5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d58e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10023150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001d596
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024ce0
push 0x10024cd8
push str.FlsSetValue
push 0x22
call fcn.1001d3f5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d5d0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10023150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10022c50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022c7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022c7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret