joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5080c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x508249
sub esp, 0x6c
xor ebx, ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov eax, dword [esp + 0x74]
imul eax, dword [esp + 0x78]
mov dword [esp], 0x70b300
mov ecx, eax
cdq
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, ecx
cdq
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.00449940
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x5c], ecx
mov ebp, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x58], eax
mov dword [esp + 0x2c], ecx
cmp ecx, eax
jge 0x508143
mov eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x54], esi
mov dword [esp], esi
mov dword [esp + 0x28], ebp
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.00463ec0
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
cmp edx, ecx
jge 0x508208
cmp edx, ecx
ja 0x508242
mov esi, ecx
sub esi, edx
mov ebp, edi
sub ebp, edx
mov ecx, dword [esp + 0x30]
cmp ebp, 0
je 0x50818e
add ecx, edx
mov dword [esp + 0x58], esi
mov esi, ecx
mov dword [esp + 0x20], edx
mov ecx, edx
cmp edx, edi
ja 0x50823b
mov edx, dword [esp + 0x30]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x54], esi
mov eax, dword [esp + 0x58]
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x60], edx
mov ebp, edx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x68], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x4c], eax
mov dword [esp + 0x40], edx
cmp edx, eax
jge 0x5081da
mov eax, edx
mov dword [esp + 0x48], esi
mov dword [esp], esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call fcn.00463ec0
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x20]
shl edx, 1
cmp edx, ecx
jl 0x508173
mov dword [esp], 0
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edi
call fcn.0044d780
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x7c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x80], ebx
add esp, 0x6c
ret
call fcn.004359e0
ud2
call fcn.004359e0
ud2
call fcn.004616d0
jmp fcn.005080c0
Function at 0x5c2500
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c26f6
mov edx, dword [esp + 8]
movzx ecx, byte [esp + 4]
cmp cl, 0x41
jb 0x5c252f
cmp cl, 0x5a
ja 0x5c252f
mov byte [esp + 0xc], 0
ret
cmp cl, 0x61
jb 0x5c2539
cmp cl, 0x7a
jbe 0x5c2529
cmp cl, 0x30
jb 0x5c2543
cmp cl, 0x39
jbe 0x5c2529
cmp edx, 2
je 0x5c2644
cmp edx, 3
je 0x5c2644
cmp cl, 0x2f
ja 0x5c25f7
cmp cl, 0x2b
ja 0x5c25d2
cmp cl, 0x24
jne 0x5c25c6
cmp edx, 4
jg 0x5c25b0
cmp edx, 1
jne 0x5c2584
cmp cl, 0x3f
je 0x5c257d
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
jmp 0x5c257c
cmp edx, 4
jne 0x5c25aa
cmp cl, 0x40
je 0x5c25a3
cmp cl, 0x2f
je 0x5c25a3
cmp cl, 0x3f
je 0x5c25a3
cmp cl, 0x3a
je 0x5c25a3
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
jmp 0x5c25a2
mov byte [esp + 0xc], 1
ret
cmp edx, 5
jne 0x5c25bb
mov byte [esp + 0xc], 1
ret
cmp edx, 6
jne 0x5c25aa
mov byte [esp + 0xc], 0
ret
cmp cl, 0x26
je 0x5c2568
cmp cl, 0x2b
je 0x5c2568
jmp 0x5c25aa
cmp cl, 0x2d
ja 0x5c25e7
cmp cl, 0x2c
je 0x5c2568
cmp cl, 0x2d
jne 0x5c25aa
mov byte [esp + 0xc], 0
ret
cmp cl, 0x2e
je 0x5c25e1
cmp cl, 0x2f
je 0x5c2568
jmp 0x5c25aa
cmp cl, 0x3d
ja 0x5c2619
cmp cl, 0x3a
je 0x5c2568
cmp cl, 0x3b
je 0x5c2568
cmp cl, 0x3d
je 0x5c2568
jmp 0x5c25aa
cmp cl, 0x40
ja 0x5c2635
cmp cl, 0x3f
je 0x5c2568
cmp cl, 0x40
je 0x5c2568
jmp 0x5c25aa
cmp cl, 0x5f
je 0x5c25e1
cmp cl, 0x7e
je 0x5c25e1
jmp 0x5c25aa
cmp cl, 0x2a
ja 0x5c269a
cmp cl, 0x26
ja 0x5c2677
cmp cl, 0x22
ja 0x5c2668
cmp cl, 0x21
jne 0x5c265e
mov byte [esp + 0xc], 0
ret
cmp cl, 0x22
je 0x5c2658
jmp 0x5c2555
cmp cl, 0x24
je 0x5c2658
cmp cl, 0x26
je 0x5c2658
jmp 0x5c2555
cmp cl, 0x28
ja 0x5c268b
cmp cl, 0x27
je 0x5c2658
cmp cl, 0x28
je 0x5c2658
jmp 0x5c2555
cmp cl, 0x29
je 0x5c2658
cmp cl, 0x2a
je 0x5c2658
jmp 0x5c2555
cmp cl, 0x3b
ja 0x5c26c2
cmp cl, 0x2c
ja 0x5c26b3
cmp cl, 0x2b
je 0x5c2658
cmp cl, 0x2c
je 0x5c2658
jmp 0x5c2555
cmp cl, 0x3a
je 0x5c2658
cmp cl, 0x3b
je 0x5c2658
jmp 0x5c2555
cmp cl, 0x3d
ja 0x5c26d6
cmp cl, 0x3c
je 0x5c2658
cmp cl, 0x3d
je 0x5c2658
jmp 0x5c2555
cmp cl, 0x3e
je 0x5c2658
cmp cl, 0x5b
je 0x5c2658
cmp cl, 0x5d
je 0x5c2658
jmp 0x5c2555
call fcn.004616d0
jmp fcn.005c2500
Function at 0x5c4fb0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c50f9
sub esp, 0x10
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, ecx
cmp ecx, edx
jge 0x5c5004
cmp ecx, edx
jae 0x5c50f2
mov ebp, esi
add ebp, ecx
movzx ebx, byte [ebp]
cmp bl, 0x2a
ja 0x5c5087
cmp bl, 0x26
ja 0x5c5066
cmp bl, 0x24
ja 0x5c505a
cmp bl, 0x21
jne 0x5c500d
inc ecx
cmp ecx, edx
jl 0x5c4fd7
mov byte [esp + 0x1c], 1
add esp, 0x10
ret
cmp bl, 0x24
je 0x5c4fff
mov dword [esp + 0xc], ecx
cmp ecx, edx
jae 0x5c5053
mov ebp, esi
add ebp, ecx
movzx ebx, byte [ebp]
mov byte [esp], bl
mov dword [esp + 4], 1
call fcn.005c2500
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
movzx ebx, byte [esp + 8]
cmp bl, 0
je 0x5c5051
mov byte [esp + 0x1c], 0
add esp, 0x10
ret
jmp 0x5c4fff
call fcn.00435970
ud2
cmp bl, 0x25
je 0x5c4fff
cmp bl, 0x26
je 0x5c4fff
jmp 0x5c5012
cmp bl, 0x28
ja 0x5c5077
cmp bl, 0x27
je 0x5c4fff
cmp bl, 0x28
je 0x5c4fff
jmp 0x5c5012
cmp bl, 0x29
je 0x5c4fff
cmp bl, 0x2a
je 0x5c4fff
jmp 0x5c5012
cmp bl, 0x3b
ja 0x5c50bf
cmp bl, 0x2c
ja 0x5c50a8
cmp bl, 0x2b
je 0x5c4fff
cmp bl, 0x2c
je 0x5c4fff
jmp 0x5c5012
cmp bl, 0x3a
je 0x5c4fff
cmp bl, 0x3b
je 0x5c4fff
jmp 0x5c5012
cmp bl, 0x40
ja 0x5c50db
cmp bl, 0x3d
je 0x5c4fff
cmp bl, 0x40
je 0x5c4fff
jmp 0x5c5012
cmp bl, 0x5b
je 0x5c4fff
cmp bl, 0x5d
je 0x5c4fff
jmp 0x5c5012
call fcn.00435970
ud2
call fcn.004616d0
jmp fcn.005c4fb0
Function at 0x5d7940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d7ada
sub esp, 0x64
xor ebx, ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
xor ebx, ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp], ebx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 4], ebx
call fcn.004fb6f0
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
cmp ecx, 0
je 0x5d79c4
xor ebx, ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], edx
nop
call fcn.00436b10
add esp, 0x64
ret
mov dword [esp + 0x2c], ebp
mov dword [esp + 8], ebp
mov dword [esp], 0xc
mov eax, 0x7b6a80
mov dword [esp + 4], eax
call fcn.00435c50
cmp eax, 0
jne 0x5d7ad0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
call fcn.004ff350
mov edx, dword [esp + 4]
mov dword [esp + 0x30], edx
mov ecx, dword [esp + 8]
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], eax
cmp eax, 0
jne 0x5d7a52
mov dword [esp], ecx
mov ebx, dword [edx + 0x24]
call ebx
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
cmp ecx, 0
jg 0x5d7a52
jl 0x5d7a4a
cmp edx, 0x3b9aca00
jae 0x5d7a52
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
mov eax, 0x8c3430
mov dword [esp + 0x48], eax
mov dword [esp], eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
add eax, 0x200
adc edx, 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call fcn.005d76e0
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x58], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x60], ebp
mov dword [esp + 0x78], ebp
mov dword [esp + 0x50], edx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x80], ecx
nop
call fcn.00436b10
add esp, 0x64
ret
nop
call fcn.00436b10
add esp, 0x64
ret
call fcn.004616d0
jmp fcn.005d7940
Function at 0x5dff30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5dff73
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
xor ecx, ecx
cmp ecx, edi
jge 0x5dff6e
movzx ebp, byte [eax]
imul edx, edx, 0x1000193
xchg ebp, eax
movzx ebx, al
xchg ebp, eax
xor edx, ebx
inc eax
inc ecx
cmp ecx, edi
jl 0x5dff58
mov dword [esp + 0x14], edx
ret
call fcn.004616d0
jmp fcn.005dff30
Function at 0x608690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6087b4
sub esp, 0x40
xor ebx, ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp], 0x70e540
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00412cf0
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x44]
mov dword [esp], ebx
mov ebx, dword [esp + 0x48]
mov dword [esp + 4], ebx
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call fcn.00608a90
mov eax, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov ebp, dword [esp + 0x50]
mov dword [eax + 0x18], ebp
mov ebp, dword [esp + 0x4c]
cmp byte [0x8f7eb8], 0
jne 0x60879c
mov dword [eax + 0x14], ebp
mov dword [esp], eax
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x28], ebx
call fcn.006094a0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
add esp, 0x40
ret
lea esi, [eax + 0x14]
mov dword [esp], esi
mov dword [esp + 4], ebp
call fcn.0041b160
mov eax, dword [esp + 0x3c]
jmp 0x608728
call fcn.004616d0
jmp fcn.00608690
Function at 0x673cb0
Capabilities:
Encrypt data using des

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x673e5d
sub esp, 0x3c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 8
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
jge 0x673e1b
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
xor ecx, ecx
cmp ecx, 4
jge 0x673e02
xor eax, eax
cmp eax, 0x10
jge 0x673df8
mov ebx, dword [esp + 0x1c]
mov edi, 7
sub edi, ebx
mov ebx, dword [esp + 0x1c]
mov ebp, 0x8cbd00
cmp ebx, 8
jae 0x673e56
shl ebx, 6
add ebp, ebx
mov dword [esp + 0x24], ecx
mov ebx, ecx
mov esi, ebp
cmp ecx, 4
jae 0x673e4f
shl ebx, 4
add esi, ebx
mov dword [esp + 0x20], eax
mov ebp, esi
cmp eax, 0x10
jae 0x673e48
add ebp, eax
movzx ebx, byte [ebp]
xor edx, edx
mov eax, ebx
mov ecx, edi
shl ecx, 2
cmp ecx, 0x40
jae 0x673e3f
cmp ecx, 0x20
jae 0x673e34
shld edx, eax, cl
shl eax, cl
mov ecx, edx
mov edx, 0x8c52a0
cmp edx, 0
je 0x673e2d
mov edi, 0x20
mov esi, 0x20
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 8], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x10], esi
call fcn.00673bb0
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, esi
shl esi, 4
add esi, edi
mov ebx, dword [esp + 0x1c]
mov ebp, 0x8f97c0
cmp ebx, 8
jae 0x673e26
shl ebx, 8
add ebp, ebx
mov ebx, esi
mov esi, ebp
cmp ebx, 0x40
jae 0x673e1f
shl ebx, 2
add esi, ebx
mov dword [esi], edx
mov eax, edi
inc eax
cmp eax, 0x10
jl 0x673d07
inc ecx
cmp ecx, 4
jl 0x673cfc
mov ebx, dword [esp + 0x2c]
inc ebx
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
jl 0x673ce9
add esp, 0x3c
ret
call fcn.00435970
ud2
call fcn.00435970
ud2
mov dword [edx], eax
jmp 0x673d84
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x673d74
xor edx, edx
xor eax, eax
jmp 0x673d66
call fcn.00435970
ud2
call fcn.00435970
ud2
call fcn.00435970
ud2
call fcn.004616d0
jmp fcn.00673cb0
Function at 0x698fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6991cf
sub esp, 0x68
xor ebx, ebx
xor ebx, ebx
xor ebx, ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp], 0
mov ebx, dword [esp + 0x6c]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x70]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0xc], ebx
call fcn.0044d780
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebx, 0x761673
mov dword [esp], ebx
mov dword [esp + 4], 0x13
mov dword [esp + 0x34], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], eax
call fcn.0050de40
mov esi, dword [esp + 0x10]
mov dword [esp + 0x78], esi
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x7c], ebp
mov edx, dword [esp + 0x18]
mov dword [esp + 0x80], edx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x84], ecx
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x88], eax
cmp eax, 0
je 0x69907b
add esp, 0x68
ret
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ebx, 0x761673
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0x13
call fcn.0050b790
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1c]
cmp edx, esi
jne 0x6990ea
mov ebp, dword [esp + 0x2c]
mov dword [esp], ebp
mov dword [esp + 0x30], edx
mov dword [esp + 4], edx
mov ebp, dword [esp + 0x34]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call fcn.004633f0
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
movzx ebx, byte [esp + 0x10]
cmp bl, 0
je 0x6990ea
add esp, 0x68
ret
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], esi
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x40], edx
xor ebx, ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
lea ebx, [esp + 0x58]
mov dword [esp + 0x28], ebx
mov dword [esp], 0x70b040
lea ebx, [esp + 0x44]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call fcn.004178c0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x28]
mov dword [ebx], ecx
mov dword [ebx + 4], eax
mov dword [esp], 0x70b040
lea ebx, [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call fcn.004178c0
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], eax
mov edx, 2
mov ecx, 2
mov eax, ebx
mov ebx, 0x7719fc
mov dword [esp], ebx
mov dword [esp + 4], 0x6a
mov dword [esp + 0x4c], eax
mov dword [esp + 8], eax
mov dword [esp + 0x50], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x10], ecx
call fcn.00469a70
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x88], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x8c], ebx
jmp 0x6990e6
call fcn.004616d0
jmp fcn.00698fa0
Function at 0x69d360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x69d4f7
sub esp, 0x70
xor ebx, ebx
xor ebx, ebx
xor ebx, ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
xor ebx, ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov ebx, dword [esp + 0x80]
mov dword [esp], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 4], ebx
call fcn.005eaeb0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], edx
mov dword [esp], edx
mov dword [esp + 0x50], ecx
mov dword [esp + 4], ecx
mov dword [esp + 0x54], eax
mov dword [esp + 8], eax
call fcn.005e6df0
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x44], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x88]
mov dword [esp], ebx
mov ebx, dword [esp + 0x8c]
mov dword [esp + 4], ebx
call fcn.0069d510
lea esi, [esp + 8]
lea edi, [esp + 0x58]
cld
call fcn.00463c94
mov ebx, dword [esp + 0x40]
mov dword [esp], ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x48]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0
lea esi, [esp + 0x58]
lea edi, [esp + 0x1c]
cld
call fcn.00463c94
call fcn.00699dd0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x9c], ecx
cmp ecx, 0
je 0x69d4aa
xor ebx, ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
add esp, 0x70
ret
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
cmp eax, ecx
ja 0x69d4f0
mov ebp, ecx
sub ebp, eax
sub edx, eax
mov ecx, dword [esp + 0x74]
cmp edx, 0
je 0x69d4c7
add ecx, eax
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], edx
xor ebx, ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
add esp, 0x70
ret
call fcn.004359e0
ud2
call fcn.004616d0
jmp fcn.0069d360
Function at 0x401280
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e17a
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x41d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x260], 0
push 0x3c
lea eax, [ebp - 0x25c]
push 0
push eax
mov dword [ebp - 4], 1
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x20]
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x25c], 0x3c
mov dword [ebp - 0x254], 0x10
mov dword [ebp - 0x248], 0x100
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 0x100
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
add esp, 0xc
mov byte [esi], 0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x25c]
push ecx
push 0
push dword [ebp + 0x18]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x260], 1
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x4013a5
mov edx, dword [ebp - 0x24c]
mov ecx, edx
lea edi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401370
sub ecx, edi
je 0x4013a5
cmp byte [edx], al
jne 0x40138c
xor ecx, ecx
push ecx
push edx
mov ecx, esi
call fcn.00402140
jmp 0x4013be
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401391
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00402140
jmp 0x4013be
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp + 8]
cmp esi, eax
je 0x4013be
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00401f70
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x4013ca
mov edi, dword [esi]
jmp 0x4013cc
mov edi, esi
cmp ecx, 0x10
jb 0x4013d5
mov edx, dword [esi]
jmp 0x4013d7
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, 0x10
jb 0x4013e5
mov edx, dword [esi]
jmp 0x4013e7
mov edx, esi
cmp edx, eax
je 0x401401
push dword [sym.imp.MSVCR110.dll_tolower]
lea ecx, [ebp - 0x264]
push edi
push eax
call fcn.00402660
add esp, 0xc
cmp dword [ebp + 0x1c], 0x10
jb 0x401413
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c4b2
mov esp, ebp
pop ebp
ret
Function at 0x401430
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x41d034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x401487
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x19c]
push ecx
mov dword [ebp - 0x19c], eax
push 0
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x4014ac
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor esi, esi
cmp dword [ebp + 0x1c], 0x10
jb 0x40149b
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040c4b2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x19c]
xor esi, esi
test eax, eax
je 0x4014c2
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x4014c2
mov esi, dword [ecx + 4]
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x401489