joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bc9a
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x45bd22
push 0x4dfe0c
xor ebx, ebx
mov dword [ebp - 0x100], esi
push ebx
push ebx
lea eax, [ebp - 0x104]
mov dword [ebp - 0x104], 1
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x45bd1e
lea eax, [ebp - 0x104]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x45bd1e
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x45bd1e
je 0x45bd22
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
push esi
call fcn.0045c32b
pop ecx
test al, al
jne 0x45bd18
cmp esi, 0x2726
jne 0x45bd1a
mov bl, 1
mov al, bl
jmp 0x45bd24
xor al, al
jmp 0x45bd24
mov al, 1
pop esi
pop ebx
leave
ret

Function at 0x45d02f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0
jne 0x45d040
push 2
jmp 0x45d049
mov edi, dword [ebp + 8]
test edi, edi
jne 0x45d053
push 5
pop esi
call fcn.0045888e
mov eax, esi
jmp 0x45d0b2
test byte [ebp + 0xc], 0x20
push dword [ebp + 0x10]
je 0x45d075
push edi
call fcn.0045e023
test al, al
jne 0x45d082
push 0x91
call fcn.00458880
pop ecx
push 4
jmp 0x45d0b1
mov eax, dword [ebp + 0xc]
and eax, 0xffffffef
push eax
push edi
call fcn.0045d139
push edi
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
push edi
call fcn.00458880
pop ecx
push 2
pop eax
cmp edi, eax
je 0x45d0b2
test edi, edi
jne 0x45d0a5
xor eax, eax
inc eax
jmp 0x45d0b2
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0045ea4c
push 3
pop eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x45d1f2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x3000f
push 0x40
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
call fcn.0045e0c0
test eax, eax
jne 0x45d220
call sub.KERNEL32.dll_GetLastError
xor ecx, ecx
cmp eax, 2
setne cl
lea eax, [ecx + 2]
jmp 0x45d237
push esi
push dword [ebp + 0x10]
mov ecx, edi
call fcn.0045d23c
mov ecx, edi
mov esi, eax
call fcn.0045ca12
mov eax, esi
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x45d23c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x45d253
push 6
call fcn.00458880
pop ecx
push 2
pop eax
jmp 0x45d27a
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
jne 0x45d267
inc eax
jmp 0x45d279
push esi
call fcn.00458880
xor eax, eax
cmp esi, 2
pop ecx
setne al
add eax, 2
pop esi
pop ebp
ret 4

Function at 0x45d465
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x45d47c
push 6
call fcn.00458880
pop ecx
push 2
pop eax
jmp 0x45d4a3
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x45d490
inc eax
jmp 0x45d4a2
push esi
call fcn.00458880
xor eax, eax
cmp esi, 2
pop ecx
setne al
add eax, 2
pop esi
pop ebp
ret 4
Function at 0x45d4a7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x45d4c8
push 6
call fcn.00458880
pop ecx
xor eax, eax
jmp 0x45d54a
push edi
push 0xc7
lea eax, [ebp - 0xd4]
xor edi, edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x45d536
push esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
call fcn.00428af1
push closesocket
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xc]
call fcn.0042f72b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00426428
push 0xc7
lea eax, [ebp - 0xd4]
inc edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x45d4e6
pop esi
xor ecx, ecx
cmp eax, 0x103
cmovne ecx, eax
push ecx
call fcn.00458880
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret 4

Function at 0x45d54f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x45d570
push 6
call fcn.00458880
pop ecx
xor eax, eax
jmp 0x45d5f2
push edi
push 0xc7
lea eax, [ebp - 0x19c]
xor edi, edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x45d5de
push esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
call fcn.00428af1
push closesocket
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0xc]
call fcn.0042fc81
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.00426428
push 0xc7
lea eax, [ebp - 0x19c]
inc edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x45d58e
pop esi
xor ecx, ecx
cmp eax, 0x103
cmovne ecx, eax
push ecx
call fcn.00458880
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x45de42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x45de5d
push 6
call fcn.00458880
pop ecx
xor al, al
jmp 0x45dea6
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
cmp ecx, 0x100000
ja 0x45dea2
sub eax, 0
je 0x45def8
dec eax
sub eax, 1
je 0x45dea2
sub eax, 0xe8
je 0x45deab
sub eax, 0x308
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0046aa17
cmp dword [ebp - 4], 0
mov edi, eax
jle 0x45df7d
push dword [ebp - 4]
mov ecx, edi
call fcn.00423af0
cmp dword [edi], 0
lea ecx, [ebp - 4]
push ecx
mov eax, 0x49bb60
cmovne eax, dword [edi]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45df53
mov ecx, edi
call fcn.00426428
jmp 0x45dea2
mov eax, dword [ebp - 8]
test eax, eax
je 0x45dea2
cmp eax, 3
jbe 0x45df42
cmp eax, 4
je 0x45df2a
cmp eax, 7
je 0x45df42
cmp eax, 0xb
jne 0x45dea2
cmp ecx, 8
jne 0x45dea2
push dword [ebp - 0x28]
mov esi, dword [ebp + 0xc]
mov ecx, esi
push dword [ebp - 0x2c]
call fcn.0046a931
jmp 0x45df53
cmp ecx, 4
jne 0x45dea2
push dword [ebp - 0x2c]
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0046a953
jmp 0x45df53
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
shr ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0046a9dd
cmp dword [ebp - 8], 1
je 0x45df5f
cmp dword [ebp - 8], 2
jne 0x45df7d
test dword [ebp + 0x10], 0x2000
jne 0x45df7d
mov ecx, esi
call fcn.0046a6f1
push 2
push 0x4b2d88
mov ecx, eax
call fcn.00426df9
mov al, 1
jmp 0x45dea4

Function at 0x45f1e1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0x10], 8
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
je 0x45f208
cmp dword [edi + 4], 0
jg 0x45f208
push dword [ebp + 8]
call fcn.0045d465
dec eax
neg eax
sbb al, al
inc al
jmp 0x45f279
test dword [ebp + 0x10], 0x8000
je 0x45f221
push dword [ebp + 8]
call fcn.0045f499
test al, al
je 0x45f221
mov al, 1
jmp 0x45f279
xor ecx, ecx
inc ecx
test byte [ebp + 0x10], 0x80
je 0x45f22f
push 3
pop ecx
jmp 0x45f23c
test dword [ebp + 0x10], 0x100
push 2
pop eax
cmovne ecx, eax
cmp dword [esi + 0x14], 0
jne 0x45f24d
push 6
call fcn.00458880
xor al, al
jmp 0x45f278
push dword [edi + 4]
cmp dword [edi], 0
mov eax, 0x49bb64
cmovne eax, dword [edi]
push eax
push ecx
push 0
push dword [ebp + 8]
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push esi
call fcn.00458880
test esi, esi
sete al
pop ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x460823
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00458877
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
and eax, 1
push 0x10
pop esi
push 4
mov dword [ebp - 4], eax
pop eax
cmovne esi, eax
test edi, edi
je 0x4608c1
cmp edi, 1
je 0x4608bc
push 2
pop ebx
cmp edi, ebx
je 0x460872
cmp edi, 3
je 0x4608c4
jle 0x4608b5
cmp edi, 5
jle 0x460876
cmp edi, 6
jne 0x4608b5
call fcn.00457618
push 0x40
test al, al
pop ecx
cmovne ebx, ecx
or esi, ebx
jmp 0x4608c4
call fcn.00460119
test al, al
jne 0x460883
xor al, al
jmp 0x4608f4
mov ecx, dword [0x4dfed0]
test ecx, ecx
jne 0x460897
push 0x78
call fcn.00458880
pop ecx
jmp 0x46087f
mov eax, dword [ebp + 0xc]
shr eax, 1
and eax, 1
push eax
push dword [ebp - 4]
xor eax, eax
cmp edi, 5
sete al
push eax
call ecx
test al, al
setne al
jmp 0x4608f4
call fcn.0045888e
jmp 0x46087f
or esi, 8
jmp 0x4608c4
or esi, 1
push 0
push 1
mov edi, str.SeShutdownPrivilege
push edi
call fcn.00460152
add esp, 0xc
push dword [ebp + 0x10]
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
test eax, eax
push 0
push edi
setne bl
call fcn.00460152
add esp, 0xc
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x461d3e
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0
je 0x461dfa
mov eax, dword [ebp + 0x10]
and eax, 2
mov dword [ebp - 8], eax
jne 0x461d65
call fcn.00461d08
test al, al
je 0x461dfa
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov esi, dword [esi + 4]
sub eax, 1
je 0x461d84
sub eax, 6
je 0x461d84
sub eax, 6
jne 0x461d85
add esi, 2
jmp 0x461d85
inc esi
and dword [ebp - 4], 0
push esi
call fcn.004570f2
mov edi, eax
pop ecx
test edi, edi
je 0x461ddb
push edi
call fcn.00457151
pop ecx
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x461ddb
mov edx, dword [ebp + 8]
mov eax, 0x49bb60
push esi
cmp dword [edx], 0
cmovne eax, dword [edx]
push eax
push ecx
call fcn.0047f970
push edi
call fcn.0045718c
add esp, 0x10
test byte [ebp + 0x10], 1
jne 0x461dd1
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp dword [ebp - 8], 0
jne 0x461de6
call sub.USER32.dll_CloseClipboard
test edi, edi
pop edi
pop esi
je 0x461df6
cmp dword [ebp - 4], 0
je 0x461df6
mov al, 1
leave
ret
xor eax, eax
leave
ret
xor al, al
leave
ret

Function at 0x463731
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00428af1
cmp dword [ebp + 0xc], 0
je 0x46376a
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, eax
test ecx, ecx
jle 0x46376a
lea eax, [ecx + 1]
add ecx, ecx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423af0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp + 8]
pop ebp
ret
Function at 0x4650eb
Capabilities:
Get common file path

Disassembly:
mov eax, 0x49a2b9
call fcn.0046b790
sub esp, 0x250
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x14]
or ecx, 0x100000
mov dword [ebx + 0x14], ecx
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
movzx eax, cx
sub eax, 1
je 0x465130
sub eax, 1
je 0x46512c
sub eax, 1
jne 0x465136
push 0x17
jmp 0x465132
push 2
jmp 0x465132
push 0x11
pop edi
mov dword [ebp - 0x18], edi
and dword [ebp - 0x20], 0
test edi, edi
js 0x46514e
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebx]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebx + 0x14]
test ecx, 0x80000
je 0x465191
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00465ce7
pop ecx
pop ecx
push 0
sub esp, 0xc
mov esi, esp
mov ecx, esi
call fcn.00428af1
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0042f70d
lea esi, [ebx + 0x18]
push esi
call fcn.00445b0a
add esp, 0x14
lea ecx, [ebp - 0x2c]
call fcn.00426428
jmp 0x465194
lea esi, [ebx + 0x18]
push esi
call fcn.00442044
push 0
push 0x20
lea eax, [ebp - 0x4c]
push eax
call fcn.0042a315
add esp, 0x10
mov eax, dword [ebx]
mov dword [ebp - 0x4c], eax
mov eax, 0x49bb64
cmp dword [ebx + 8], 0
cmovne eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x46184e
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
push 0x41
pop eax
test dword [ebx + 0x14], 0x20000
mov ecx, 0x8041
cmove eax, ecx
mov dword [ebp - 0x3c], eax
test dword [ebx + 0x14], 0x40000
je 0x4651f3
or eax, 0x10
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x4652d9
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
setne byte [ebp - 0x11]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x465258
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x465258
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x46525f
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
jmp 0x465275
cmp byte [ebp - 0x11], 0
je 0x4652d9
push closesocket
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebx + 0x24]
call fcn.0042fc81
test dword [ebx + 0x14], 0x80000
je 0x4652cb
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00465ce7
push ecx
mov esi, esp
mov ecx, esi
call fcn.00428af1
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0042f70d
lea eax, [ebx + 0x24]
push eax
call fcn.004450d3
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.00426428
mov al, 1
jmp 0x4652db
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4659df
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x49a2cd
call fcn.0046b790
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
push esi
call fcn.004321f9
pop ecx
test al, al
je 0x465a0e
push 0x7b
call fcn.00458880
pop ecx
xor al, al
jmp 0x465ab7
call fcn.00458877
and dword [ebp - 4], 0
mov ebx, dword [ebp + 0x18]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
mov edi, dword [ebp + 0x14]
push edi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
jmp 0x465a54
cmp eax, 5
jne 0x465aa7
test edi, edi
je 0x465a6e
push 0x49bf30
push edi
call fcn.004322be
pop ecx
pop ecx
test al, al
je 0x465a07
mov dword [ebp - 4], 2
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
jmp 0x465aa7
cmp eax, 0x20
jle 0x465a07
call fcn.00458877
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4673de
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp word [ebp - 0x218], 0
je 0x46742a
mov ecx, dword [ebp + 8]
call fcn.00428af1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push closesocket
push eax
call fcn.0042fc81
jmp 0x467470
call fcn.0045760b
test al, al
lea eax, [ebp - 0xc]
push eax
je 0x467445
call fcn.00458b6f
mov dword [esp], str.System32
jmp 0x467451
call fcn.00458b6f
mov dword [esp], str.System
cmp dword [eax], 0
mov ecx, 0x49bb64
cmovne ecx, dword [eax]
push ecx
push dword [ebp + 8]
call fcn.00444edd
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.00426428
mov eax, dword [ebp + 8]
leave
ret

Function at 0x467bdd
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.00430e83
pop ecx
test al, al
je 0x467bf9
call fcn.0045888e
xor al, al
jmp 0x467c3c
push ebx
mov ecx, esi
call fcn.00467d22
call fcn.00458877
push dword [ebp + 8]
mov bl, byte [ebp + 0xc]
movzx eax, bl
push eax
push 0
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
test eax, eax
je 0x467c39
test bl, bl
je 0x467c32
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
je 0x467c39
mov byte [esi + 4], bl
mov al, 1
jmp 0x467c3b
xor al, al
pop ebx
pop esi
pop ebp
ret 8

Function at 0x468cd8
Capabilities:
Terminate thread

Disassembly:
mov eax, 0x49a31d
call fcn.0046b790
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
test esi, esi
jne 0x468cf5
xor al, al
jmp 0x468d29
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
setne bl
mov byte [ebp - 0x11], bl
or dword [ebp - 4], 0xffffffff
jmp 0x468d20
push esi
call fcn.00468c49
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x468d89
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x468d9b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ebp
ret

Function at 0x468d9d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
mov eax, dword [ebp + 0x14]
and eax, 1
mov dword [ebp - 4], edi
shl eax, 2
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push edi
call fcn.0048d66f
mov esi, eax
add esp, 0x18
test esi, esi
je 0x468dea
cmp dword [ebp + 0x10], 3
je 0x468ddd
push dword [ebp + 0x10]
push esi
call fcn.00468d38
pop ecx
pop ecx
push edi
push dword [ebp - 4]
call fcn.00468bee
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x46b01b
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x46b030
mov ecx, ebx
call fcn.00426428
cmp dword [0x4e10b4], 0
je 0x46b1b5
cmp dword [0x4e10c4], 0
je 0x46b1b5
cmp dword [0x4e10e8], 0
je 0x46b1b5
cmp dword [0x4e10ec], 0
je 0x46b1b5
cmp dword [0x4e10f0], 0
je 0x46b1b5
call fcn.00458877
mov eax, dword [0x4e10c4]
xor ecx, ecx
push ecx
push ecx
push 3
push ecx
push ecx
push dword [ebp + 0x28]
push dword [ebp + 8]
push dword [0x4e10b4]
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46b1bd
push esi
push edi
push dword [ebp + 0x24]
call fcn.00430e83
mov edx, dword [ebp + 0x14]
test al, al
mov eax, dword [ebp + 0x14]
mov edi, 0x49ce8c
cmove edi, dword [ebp + 0x24]
and edx, 0x10
or dword [ebp + 0x10], 0xffffffff
pop ecx
mov esi, dword [0x4e10e8]
shl edx, 0x16
or edx, 0x200
push 0
mov ecx, edx
or ecx, 0x80000100
and al, 8
cmove ecx, edx
push ecx
push 0x4dcdcc
push 0
push str.HTTP_1.0
push dword [ebp + 0xc]
push edi
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
je 0x46b190
push dword [ebp + 0x20]
mov esi, dword [0x4e10ec]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.004311f0
pop ecx
push eax
push dword [ebp + 0x18]
push edi
call esi
test eax, eax
je 0x46b190
mov eax, dword [0x4e10f0]
lea ecx, [ebp - 8]
push 0
push ecx
lea ecx, [ebp + 0x10]
mov dword [ebp - 8], 4
push ecx
push 0x20000013
push edi
call eax
test eax, eax
je 0x46b190
cmp dword [ebp + 0x10], 0xc8
jne 0x46b190
test byte [ebp + 0x14], 0x20
jne 0x46b190
lea ecx, [ebp - 0x20]
call fcn.00401a6c
push dword [ebp + 0x2c]
call sub.KERNEL32.dll_GetTickCount
push eax
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.0046b1c3
add esp, 0x10
test al, al
jne 0x46b179
mov dword [ebp + 0x10], 0xfffffffe
jmp 0x46b188
test ebx, ebx
je 0x46b188
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00425696
lea ecx, [ebp - 0x14]
call fcn.00426428
call sub.KERNEL32.dll_GetLastError
push edi
mov esi, eax
call fcn.0046b281
push dword [ebp - 4]
call fcn.0046b281
push esi
call fcn.00458880
mov eax, dword [ebp + 0x10]
add esp, 0xc
pop edi
pop esi
jmp 0x46b1c0
push 0x78
call fcn.00458880
pop ecx
or eax, 0xffffffff
pop ebx
leave
ret
Function at 0x46f120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
not eax
push esi
mov esi, dword [esp + 0x10]
push edi
cmp esi, 8
jbe 0x46f1f6
test bl, 7
je 0x46f159
nop
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4b4f68]
test bl, 7
jne 0x46f140
mov edi, esi
and esi, 7
and edi, 0xfffffff8
add edi, ebx
cmp ebx, edi
jae 0x46f1f6
nop dword [eax + eax]
xor eax, dword [ebx]
add ebx, 4
mov dword [esp + 0x18], ebx
add dword [esp + 0x18], 4
mov ebx, dword [ebx]
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x4b5368]
xor edx, dword [ecx*4 + 0x4b5768]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
xor edx, dword [ecx*4 + 0x4b6368]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x4b6768]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x4b4f68]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x4b5f68]
movzx ecx, bl
mov ebx, dword [esp + 0x18]
xor edx, dword [ecx*4 + 0x4b5b68]
xor edx, dword [eax*4 + 0x4b6b68]
mov eax, edx
cmp ebx, edi
jb 0x46f170
test esi, esi
je 0x46f21a
nop word [eax + eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4b4f68]
sub esi, 1
jne 0x46f200
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x46f220
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
not eax
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
not esi
cmp edi, 4
jbe 0x46f306
mov dword [esp + 0x1c], ebx
test bl, 3
je 0x46f278
nop word [eax + eax]
movzx ecx, byte [ebx]
dec edi
movzx edx, al
inc ebx
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x4b6f68]
xor esi, dword [edx*8 + 0x4b6f6c]
test bl, 3
jne 0x46f250
mov dword [esp + 0x1c], ebx
mov ebp, edi
xor edx, edx
and ebp, 0xfffffffc
and edi, 3
mov dword [esp + 0x18], edi
lea ecx, [ebx + ebp]
shr ebp, 2
cmp ebx, ecx
cmova ebp, edx
test ebp, ebp
je 0x46f306
xor edi, edi
mov ebx, dword [ebx]
inc edi
xor ebx, eax
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*8 + 0x4b7768]
mov edx, dword [edx*8 + 0x4b776c]
xor eax, dword [ecx*8 + 0x4b7f68]
xor edx, dword [ecx*8 + 0x4b7f6c]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*8 + 0x4b6f68]
xor edx, dword [ecx*8 + 0x4b6f6c]
movzx ecx, bl
mov ebx, dword [esp + 0x1c]
add ebx, 4
mov dword [esp + 0x1c], ebx
xor eax, dword [ecx*8 + 0x4b8768]
xor edx, dword [ecx*8 + 0x4b876c]
xor eax, esi
xor edx, 0
mov esi, edx
cmp edi, ebp
jb 0x46f297
mov edi, dword [esp + 0x18]
test edi, edi
je 0x46f335
nop word [eax + eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x4b6f68]
xor esi, dword [edx*8 + 0x4b6f6c]
sub edi, 1
jne 0x46f310
not esi
not eax
pop edi
mov edx, esi
pop esi
pop ebp
pop ebx
ret