joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6bf6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc], 0
je 0x4c6c0c
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
cmp eax, dword [ecx]
je 0x4c6c30
mov eax, dword [esi]
push dword [esi + 0xc]
mov eax, dword [eax + 0x18]
push eax
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 0x18]
push ecx
push eax
call dword [eax]
add esp, 0x10
mov dword [esi + 0xc], eax
test eax, eax
je 0x4c6c8d
cmp dword [esi + 4], 0
je 0x4c6c40
mov ecx, dword [esi]
mov eax, dword [esi + 8]
cmp eax, dword [ecx + 4]
je 0x4c6c65
mov eax, dword [esi]
push dword [esi + 4]
mov eax, dword [eax + 0x18]
push eax
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0x18]
push ecx
push eax
call dword [eax]
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
je 0x4c6c8d
and dword [esi + 0x34], 0
lea eax, [esi + 0x3c]
and dword [esi + 0x38], 0
push eax
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4c6c89
lea eax, [esi + 0x40]
push eax
call fcn.004c9f15
pop ecx
test eax, eax
je 0x4c6c90
push 0xc
jmp 0x4c6c8f
push 2
pop eax
pop esi
pop ebp
ret

Function at 0x4c6d09
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
and dword [esi + 0xc], 0
lea eax, [esi + 4]
push eax
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4c6d3f
lea eax, [esi + 8]
push eax
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4c6d3f
push esi
push 0x4c6c93
push esi
call fcn.004ca0cb
add esp, 0xc
pop esi
pop ebp
ret

Function at 0x4c9c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
mov edi, dword [ebp + 0xc]
xor cl, cl
xor eax, eax
or dword [esi], 0xffffffff
mov byte [esi + 4], 0
test edi, edi
je 0x4c9cf5
mov edx, dword [ebp + 8]
xor cl, byte [eax + edx]
inc eax
cmp eax, edi
jb 0x4c9caf
test cl, cl
jne 0x4c9cf5
test edi, edi
je 0x4c9cf5
mov ecx, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov edx, edi
mov byte [esi + 4], bl
call fcn.004adf11
mov edx, eax
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x5f7514], edx
jne 0x4c9ce5
cmp dword [eax + 0x5f7510], edi
je 0x4c9cfe
add eax, 0xc
inc ecx
cmp eax, 0x48
jb 0x4c9cd5
or dword [esi], 0xffffffff
mov byte [esi + 4], 0
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
mov dword [esi], ecx
test ecx, ecx
js 0x4c9cf1
jmp 0x4c9cf5

Function at 0x4ca0cb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
call fcn.005872c7
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x4ca0f7
call fcn.004c9fe8
mov esi, eax
mov eax, esi
pop esi
leave
ret
Function at 0x4cf734
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x200
jb 0x4cf79a
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x4cf79a
mov ecx, dword [edx + 0x3c]
cmp ecx, 0x1000
jae 0x4cf79a
lea eax, [ecx + 0x200]
cmp eax, dword [ebp + 0xc]
ja 0x4cf79a
test cl, 7
jne 0x4cf79a
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x4cf79a
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x4cf7b3
sub eax, 0x74
je 0x4cf7ac
dec eax
sub eax, 1
je 0x4cf7ac
dec eax
sub eax, 1
je 0x4cf7a5
sub eax, 0x3c
je 0x4cf79e
sub eax, 0x8464
je 0x4cf7b3
xor eax, eax
pop ebp
ret
mov edx, 0x3030401
jmp 0x4cf7b8
mov edx, 0x3030701
jmp 0x4cf7b8
mov edx, 0x3030501
jmp 0x4cf7b8
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x4cf79a
movzx eax, word [ecx + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x4cf7db
mov ecx, 0x20b
cmp ax, cx
jne 0x4cf79a
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
inc eax
pop ebp
ret
Function at 0x4d4ffb
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret
Function at 0x4d5b27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 5
mov esi, ecx
push eax
push esi
mov dword [ebp - 0x88], esi
call fcn.004d4644
push 5
lea ecx, [ebp - 0x84]
lea eax, [esi + 0x60]
push ecx
push eax
mov dword [ebp - 0x8c], eax
call fcn.004d4644
add esp, 0x18
lea edi, [ebp - 0x44]
mov esi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4d5bcb
lea esi, [ebp - 0x44]
sub esi, ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x88]
call fcn.004d4773
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call fcn.004d4773
add esp, 0x18
mov ecx, ebx
push 5
pop edx
mov eax, dword [esi + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x4d5bb9
sub edi, 1
jne 0x4d5b85
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052ef51
leave
ret 8

Function at 0x4d5bdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x10
xor eax, eax
mov dword [ebp - 0xbc], ebx
pop ecx
lea edi, [ebp - 0x58]
mov dword [ebp - 0xc0], esi
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
cmp edi, 0x40
jbe 0x4d5c5a
lea eax, [ebp - 0xb8]
push eax
call fcn.004d4ffb
push edi
lea eax, [ebp - 0xb8]
push esi
push eax
call fcn.004d502d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.004d46e3
add esp, 0x18
xor esi, esi
mov ecx, esi
mov eax, dword [ebp + ecx - 0x18]
bswap eax
mov dword [ebp + ecx - 0x58], eax
add ecx, 4
cmp ecx, 0x14
jb 0x4d5c46
jmp 0x4d5c91
xor esi, esi
mov ebx, esi
test edi, edi
je 0x4d5c8b
mov esi, dword [ebp - 0xc0]
mov eax, ebx
mov edx, ebx
and eax, 3
shr edx, 2
push 3
pop ecx
sub ecx, eax
movzx eax, byte [esi + ebx]
shl ecx, 3
shl eax, cl
or dword [ebp + edx*4 - 0x58], eax
inc ebx
cmp ebx, edi
jb 0x4d5c68
xor esi, esi
mov ebx, dword [ebp - 0xbc]
mov eax, esi
movups xmm0, xmmword [ebp + eax*4 - 0x58]
pxor xmm0, xmmword [str.6666666666666666jjjjjjjjjjjjjjjj]
movups xmmword [ebp + eax*4 - 0x58], xmm0
add eax, 4
cmp eax, 0x10
jb 0x4d5c93
push ebx
call fcn.004d4ffb
push 0x10
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.004d4694
add esp, 0x10
movups xmm0, xmmword [ebp + esi*4 - 0x58]
pxor xmm0, xmmword [0x5f7be0]
movups xmmword [ebp + esi*4 - 0x58], xmm0
add esi, 4
cmp esi, 0x10
jb 0x4d5cc2
lea esi, [ebx + 0x60]
push esi
call fcn.004d4ffb
push 0x10
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.004d4694
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0052ef51
leave
ret 8
Function at 0x4d5d05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov eax, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x48], ecx
mov byte [ebp + eax - 0x44], bl
inc eax
cmp eax, 0x40
jb 0x4d5d27
cmp edi, 0x40
jbe 0x4d5d55
push esi
call fcn.004d4ffb
push edi
push dword [ebp - 0x48]
push esi
call fcn.004d502d
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004d46e3
add esp, 0x18
jmp 0x4d5d67
test edi, edi
je 0x4d5d67
push edi
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.00541e20
add esp, 0xc
mov eax, ebx
xor byte [ebp + eax - 0x44], 0x36
inc eax
cmp eax, 0x40
jb 0x4d5d69
push esi
call fcn.004d4ffb
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004d502d
add esp, 0x10
xor byte [ebp + ebx - 0x44], 0x6a
inc ebx
cmp ebx, 0x40
jb 0x4d5d89
add esi, 0x60
push esi
call fcn.004d4ffb
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.004d502d
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0052ef51
leave
ret 8

Function at 0x4d6a5e
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 8]
cmp dword [eax], esi
jne 0x4d6a76
push eax
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4d6a88
lea eax, [edi + 0xc]
cmp dword [eax], esi
jne 0x4d6a86
push eax
call fcn.004c9f15
pop ecx
mov esi, eax
mov eax, esi
pop edi
pop esi
ret
Function at 0x4d6fbd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x4d703a
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.0048c81c
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.004d709f
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x4d7043
mov ecx, esi
call fcn.004c016b
mov bl, al
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x4d706e
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x14], 1
cmp byte [eax + 0x24], cl
jne 0x4d7071
mov byte [ebp + 0x14], cl
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.004d709f
test bl, bl
je 0x4d709a
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4d9e4f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x4d9e62
xor eax, eax
jmp 0x4d9eec
lea eax, [esi + 0x30]
push edi
push eax
call fcn.004c9f3c
pop ecx
test eax, eax
jne 0x4d9ee8
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4d9ee8
lea eax, [esi + 0x18]
push eax
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4d9ee8
lea eax, [esi + 0x1c]
push eax
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4d9ee8
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push eax
call fcn.004ca06c
add esp, 0xc
test eax, eax
jne 0x4d9ee8
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.004ca06c
add esp, 0xc
test eax, eax
jne 0x4d9ee8
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], edi
push dword [ebp + 0xc]
push eax
call fcn.004ca0cb
add esp, 0xc
test eax, eax
jne 0x4d9ee8
mov dword [esi], edi
jmp 0x4d9eeb
push 0xc
pop eax
pop edi
pop esi
pop ebp
ret
Function at 0x4da0a9
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x4da0c0
push ebx
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4da102
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x4da0d4
push edi
call fcn.004c9f15
pop ecx
test eax, eax
jne 0x4da101
push ebx
call fcn.004c9fb0
push edi
call fcn.004c9fb0
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x4da0f2
xor eax, eax
jmp 0x4da101
push esi
push 0x4da06b
push eax
call fcn.004ca0cb
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4e0dd8
Capabilities:
Create directory

Disassembly:
push 0x38
mov eax, 0x5dd371
call fcn.0052fb6b
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x4e0df8
mov al, 1
jmp 0x4e0e3f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x4e0e09
xor al, al
jmp 0x4e0e3f
lea ecx, [ebp - 0x44]
call fcn.004e1608
lea ecx, [ebp - 0x1c]
call fcn.0048c7d3
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.004e179c
test al, al
je 0x4e0e34
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.0052ef5f
pop ecx
mov al, bl
call fcn.0052fb39
ret

Function at 0x4e12a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.0048ca26
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.0052ef51
leave
ret

Function at 0x4e155a
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4e1d39
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret

Function at 0x4e204d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.0048ca26
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.0052ef51
leave
ret
Function at 0x4e6c80
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x4e6c98
mov dword [ebp - 8], 0x5f81b0
jmp 0x4e6c9f
mov dword [ebp - 8], 0x5f81b8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x4e6cdc
mov dword [ebp - 0xc], 1
jmp 0x4e6ce3
mov dword [ebp - 0xc], 0
movzx eax, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e72c0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0
push str.Microsoft_Internet_Explorer
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x4e72fa
mov eax, dword [ebp - 4]
mov dword [eax + 0x84], 1
xor al, al
jmp 0x4e7320
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4e7580
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x35], 0
push 0x30
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.005423a0
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0
push 5
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4e75ef
mov dword [ebp - 0x44], 0
push 0xa
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00587e32
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov byte [ebp - 0x35], 1
movzx eax, byte [ebp - 0x35]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052ef51
mov esp, ebp
pop ebp
ret 4

Function at 0x4e76a0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], 0
push 0x30
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.005423a0
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0
push 0x13
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4e770c
mov dword [ebp - 0x44], 0
push 0xa
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00587e32
add esp, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052ef51
mov esp, ebp
pop ebp
ret
Function at 0x4e7ae0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddc1d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x28]
call fcn.00407812
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.004e7330
movzx ecx, al
test ecx, ecx
jne 0x4e7b6c
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.00407769
mov eax, dword [ebp - 0x3c]
or eax, 1
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040772f
mov eax, dword [ebp + 8]
jmp 0x4e7c76
mov ecx, dword [ebp - 0x30]
call fcn.004e76a0
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 4], 0x194
jne 0x4e7b9b
mov dword [ebp - 0x40], 5
push 0x649658
lea eax, [ebp - 0x40]
push eax
call fcn.005458a4
push 0x1000
call fcn.0057e78b
add esp, 4
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x29], 0
mov ecx, 1
test ecx, ecx
je 0x4e7c33
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x4e7bcf
jmp 0x4e7c33
cmp dword [ebp - 0x38], 0
ja 0x4e7bdb
mov byte [ebp - 0x29], 1
jmp 0x4e7c33
cmp dword [ebp - 0x38], 0x1000
jbe 0x4e7bff
mov edx, dword [ebp - 0x34]
push edx
call fcn.0056b88b
add esp, 4
mov eax, dword [ebp - 0x38]
push eax
call fcn.0057e78b
add esp, 4
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x4e7c1e
jmp 0x4e7c33
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00407d16
jmp 0x4e7baf
mov edx, dword [ebp - 0x34]
push edx
call fcn.0056b88b
add esp, 4
movzx eax, byte [ebp - 0x29]
test eax, eax
jne 0x4e7c4f
lea ecx, [ebp - 0x28]
call fcn.004e7e60
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407769
mov edx, dword [ebp - 0x3c]
or edx, 1
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040772f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ef51
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4e7ca0
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddc5d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x65a640]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x24
call fcn.004eada0
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x60]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.004e4e90
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040772f
push 0xa0000000
lea ecx, [ebp - 0x28]
call fcn.00402ff6
push eax
lea ecx, [ebp - 0x28]
call fcn.00402ffe
push eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [ebp + 8], 0
jne 0x4e7d3c
mov dword [ebp - 0x50], 0
jmp 0x4e7d4b
mov eax, dword [ebp + 8]
push eax
call fcn.00580250
add esp, 4
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x48], ecx
cmp dword [ebp + 0xc], 0
jne 0x4e7d9e
push 0
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
cmp eax, 1
jne 0x4e7d84
mov dword [ebp - 0x54], 1
jmp 0x4e7d8b
mov dword [ebp - 0x54], 0
mov cl, byte [ebp - 0x54]
mov byte [ebp - 0x41], cl
lea ecx, [ebp - 0x28]
call fcn.00403027
mov al, byte [ebp - 0x41]
jmp 0x4e7de5
push 0
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
cmp eax, 1
jne 0x4e7dcd
mov dword [ebp - 0x58], 1
jmp 0x4e7dd4
mov dword [ebp - 0x58], 0
mov dl, byte [ebp - 0x58]
mov byte [ebp - 0x42], dl
lea ecx, [ebp - 0x28]
call fcn.00403027
mov al, byte [ebp - 0x42]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ef51
mov esp, ebp
pop ebp
ret 8