joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100143a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14c
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [esp + 0x150]
mov dword [ecx], eax
test eax, eax
jns 0x100143c4
xor al, al
add esp, 0x14c
ret
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], 0x1467d36a
mov dword [esp + 0x1c], 0x786f4e69
mov dword [esp + 0x20], 0x5927c062
mov dword [esp + 0x24], 0x139de853
mov edx, 0xaa80e81a
mov ecx, 0x5f1d5a41
xor eax, eax
push ebx
mov bl, byte [esp + esi + 0x1c]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x1c], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x136d0
jl 0x100143f7
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xe0263e1f
mov dword [esp + 0x10], 0xb3a5df63
mov dword [esp + 0x14], 0x92644da0
mov dword [esp + 0x18], 0x507e2790
mov edx, 0x2fe139d8
mov ecx, 0x2b9c4bc0
xor eax, eax
lea ebx, [ebx]
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x136d0
jl 0x10014450
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x164]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x2c]
push ebp
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x18]
push 1
mov dword [esp + 0x50], edx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x28]
push 0
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x5c], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10014562
xor esi, esi
xor edi, edi
mov dword [esp + 0x30], 0x48c9475a
mov dword [esp + 0x34], 0x6f839f24
mov word [esp + 0x38], 0x4ac6
mov byte [esp + 0x3a], 0xd4
mov edx, 0x643e58e0
mov ecx, 0xfdcda128
xor eax, eax
mov bl, byte [esp + esi + 0x30]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x30], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0xd5af
jl 0x10014504
mov edi, dword [esp + 0x168]
mov esi, dword [ebp]
mov ebx, dword [esi]
push edi
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x7c]
push 0x100
push ecx
call fcn.10014320
mov edx, dword [ebx + 0xc]
add esp, 0xc
push eax
push esi
call edx
test eax, eax
jns 0x1001456f
pop ebp
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x14c
ret
mov eax, dword [edi]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
pop ebp
pop ebx
test eax, eax
pop edi
setns al
pop esi
add esp, 0x14c
ret
Function at 0x100146b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x224
push ebp
call fcn.10014240
mov ebp, eax
mov dword [esp + 0x1c], ebp
test ebp, ebp
jne 0x100146d0
xor al, al
pop ebp
add esp, 0x224
ret
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xad38a5c7
mov dword [esp + 0x10], 0xd9280259
mov dword [esp + 0x14], 0x83106b4f
mov dword [esp + 0x18], 0x1839f56e
mov dword [esp + 0x1c], 0xad6bba7f
mov byte [esp + 0x20], 0x90
mov edx, 0x20dd1354
mov ecx, 0x2eeacc34
xor eax, eax
push ebx
mov bl, byte [esp + esi + 0x10]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x10], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x197f1
jl 0x10014710
lea eax, [esp + 0x10]
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebp
test eax, eax
je 0x100147f8
push 0x104
lea ecx, [esp + 0x30]
push ecx
call eax
test eax, eax
je 0x100147f8
xor edx, edx
mov word [esp + 0x232], dx
lea eax, [esp + 0x2c]
cmp word [esp + 0x2c], dx
je 0x10014786
cmp word [eax], 0x5c
jne 0x1001477e
xor ecx, ecx
mov word [eax + 2], cx
add eax, 2
cmp word [eax], dx
jne 0x10014772
xor esi, esi
xor edi, edi
mov dword [esp + 0x10], 0x4a148163
mov dword [esp + 0x14], 0xb3f3e037
mov dword [esp + 0x18], 0x62064d19
mov dword [esp + 0x1c], 0xdf23da2f
mov dword [esp + 0x20], 0xa25d9d70
mov word [esp + 0x24], 0x5cdf
mov edx, 0xe56c8a50
mov ecx, 0x20dfd754
xor eax, eax
mov bl, byte [esp + esi + 0x10]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x10], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1ab5e
jl 0x100147c5
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
push eax
call ebp
test eax, eax
jne 0x10014805
pop ebx
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x224
ret
mov ecx, dword [esp + 0x238]
push 0
push 0
push 0
push 0
push ecx
push 0
push 0
lea edx, [esp + 0x48]
push edx
call eax
pop ebx
pop edi
test eax, eax
pop esi
setne al
pop ebp
add esp, 0x224
ret
Function at 0x10014830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c0
push ebx
mov eax, 0x1a7
xor ebx, ebx
mov edi, edi
dec eax
mov byte [esp + eax + 0x1d], bl
jns 0x10014840
mov dword [esp + 0x1c], 0x1a8
call fcn.100142b0
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x1001495b
push ebp
push esi
push edi
xor ebp, ebp
xor esi, esi
xor edi, edi
mov dword [esp + 0x10], 0x15bd103b
mov dword [esp + 0x14], 0x72ab6722
mov dword [esp + 0x18], 0xd69907ea
mov dword [esp + 0x1c], 0xafa174cb
mov dword [esp + 0x20], 0xcad125fb
mov edx, 0x3b12394c
mov eax, 0x70e0fdaa
xor ecx, ecx
lea ecx, [ecx]
mov bl, byte [esp + esi + 0x10]
sub bl, dl
xor bl, al
add eax, ecx
add edx, edi
mov byte [esp + esi + 0x10], bl
add ecx, 0x136d
inc esi
add edi, 0x170f
cmp ecx, 0x18484
jl 0x100148a0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x10014958
push ebx
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
call esi
test eax, eax
je 0x10014958
jmp 0x100148f0
test byte [esp + 0xcc], 4
jne 0x10014928
inc ebp
mov eax, 0x1a7
dec eax
mov byte [esp + eax + 0x29], bl
jns 0x10014900
push ebx
lea eax, [esp + 0x2c]
push eax
push ebp
push ebx
mov dword [esp + 0x38], 0x1a8
call esi
test eax, eax
jne 0x100148f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0
ret
mov ecx, dword [esp + 0x1d8]
mov eax, ecx
cmp ecx, 0x80
jb 0x1001493e
mov eax, 0x80
push eax
mov eax, dword [esp + 0x1d8]
lea edx, [esp + 0xd4]
push edx
push ecx
push eax
call fcn.10013e30
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0
ret

Function at 0x10014970
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 8], 0x6277eedf
mov dword [esp + 0xc], 0x1a44c6a8
mov dword [esp + 0x10], 0x92c95e92
mov word [esp + 0x14], 0xb6e6
mov edx, 0x1eedf680
mov ecx, 0xf9dac76e
xor eax, eax
push ebx
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x10ff6
jl 0x100149a5
mov eax, dword [esp + 0x20]
lea esi, [eax + 0x20]
lea ecx, [esp + 0xc]
pop ebx
cmp eax, esi
jae 0x100149f5
movzx edx, word [ecx]
xor edi, edi
mov word [eax], dx
cmp di, dx
je 0x100149f3
add ecx, 2
lea edx, [esp + 0x14]
add eax, 2
cmp ecx, edx
jb 0x100149d4
cmp eax, esi
jne 0x10014a03
xor eax, eax
pop edi
mov word [esi - 2], ax
pop esi
add esp, 0x10
ret
lea edx, [esp + 0x14]
cmp ecx, edx
jne 0x10014a10
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x10014d10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xe3d42b59
mov dword [esp + 0x10], 0x8d84b558
mov dword [esp + 0x14], 0xff900f05
mov dword [esp + 0x18], 0x5ef2981b
mov edx, 0x9ce11ba2
mov ecx, 0x9984fde0
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x136d0
jl 0x10014d46
xor esi, esi
xor edi, edi
mov dword [esp + 0x1c], 0x442bd08d
mov dword [esp + 0x20], 0xfc27a85a
mov dword [esp + 0x24], 0x74fb403e
mov dword [esp + 0x28], 0xac309867
mov dword [esp + 0x2c], 0xa47eb085
mov dword [esp + 0x30], 0x5cc288f5
mov word [esp + 0x34], 0x2080
mov edx, 0x999985f8
mov ecx, 0xaabb04d8
xor eax, eax
mov bl, byte [esp + esi + 0x1c]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x1c], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x10014db0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.10014a80
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x10014e00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xe3d42b59
mov dword [esp + 0x10], 0x8d84b558
mov dword [esp + 0x14], 0xff900f05
mov dword [esp + 0x18], 0x5ef2981b
mov edx, 0x9ce11ba2
mov ecx, 0x9984fde0
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x136d0
jl 0x10014e36
xor esi, esi
xor edi, edi
mov dword [esp + 0x1c], 0xba5d4679
mov dword [esp + 0x20], 0x72311e7c
mov dword [esp + 0x24], 0xea2eb677
mov dword [esp + 0x28], 0x22450e78
mov dword [esp + 0x2c], 0x1a842683
mov dword [esp + 0x30], 0xd2d8feeb
mov word [esp + 0x34], 0x96f6
mov edx, 0x8fee3236
mov ecx, 0x1e947710
xor eax, eax
mov bl, byte [esp + esi + 0x1c]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x1c], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x10014ea0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.10014a80
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x10014ef0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0x95065d4b
mov dword [esp + 0x10], 0xe7f6a70a
mov word [esp + 0x14], 0x173b
mov byte [esp + 0x16], 0xc0
mov edx, 0x9f6c1ff4
mov ecx, 0x4e2a5000
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0xd5af
jl 0x10014f22
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], 0x442bd08d
mov dword [esp + 0x1c], 0xfc27a85a
mov dword [esp + 0x20], 0x74fb403e
mov dword [esp + 0x24], 0xac309867
mov dword [esp + 0x28], 0xa47eb085
mov dword [esp + 0x2c], 0x5cc288f5
mov word [esp + 0x30], 0x2080
mov edx, 0x999985f8
mov ecx, 0xaabb04d8
xor eax, eax
lea esp, [esp]
mov bl, byte [esp + esi + 0x18]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x18], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x10014f90
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.10014a80
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x10014fe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0x95065d4b
mov dword [esp + 0x10], 0xe7f6a70a
mov word [esp + 0x14], 0x173b
mov byte [esp + 0x16], 0xc0
mov edx, 0x9f6c1ff4
mov ecx, 0x4e2a5000
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0xd5af
jl 0x10015012
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], 0xba5d4679
mov dword [esp + 0x1c], 0x72311e7c
mov dword [esp + 0x20], 0xea2eb677
mov dword [esp + 0x24], 0x22450e78
mov dword [esp + 0x28], 0x1a842683
mov dword [esp + 0x2c], 0xd2d8feeb
mov word [esp + 0x30], 0x96f6
mov edx, 0x8fee3236
mov ecx, 0x1e947710
xor eax, eax
lea esp, [esp]
mov bl, byte [esp + esi + 0x18]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x18], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x10015080
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.10014a80
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x100150d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xd93ab18f
mov dword [esp + 0x10], 0xf455db2e
mov dword [esp + 0x14], 0x70037a45
mov dword [esp + 0x18], 0x545f279
mov dword [esp + 0x1c], 0xc780ab91
mov word [esp + 0x20], 0x10f5
mov edx, 0x3e1ca6c0
mov ecx, 0x3463b998
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1ab5e
jl 0x10015115
xor esi, esi
xor edi, edi
mov dword [esp + 0x24], 0x5e8cea23
mov dword [esp + 0x28], 0x1682c2c1
mov dword [esp + 0x2c], 0x8e625a9b
mov dword [esp + 0x30], 0xc6bab2ce
mov dword [esp + 0x34], 0xbed2caeb
mov dword [esp + 0x38], 0x76cea24f
mov edx, 0x97d3b7b2
mov ecx, 0x93084938
xor eax, eax
mov bl, byte [esp + esi + 0x24]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x24], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1d238
jl 0x10015178
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.10014a80
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x100151d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xd93ab18f
mov dword [esp + 0x10], 0xf455db2e
mov dword [esp + 0x14], 0x70037a45
mov dword [esp + 0x18], 0x545f279
mov dword [esp + 0x1c], 0xc780ab91
mov word [esp + 0x20], 0x10f5
mov edx, 0x3e1ca6c0
mov ecx, 0x3463b998
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1ab5e
jl 0x10015215
xor esi, esi
xor edi, edi
mov dword [esp + 0x24], 0xba5d4679
mov dword [esp + 0x28], 0x72311e7c
mov dword [esp + 0x2c], 0xea2eb677
mov dword [esp + 0x30], 0x22450e78
mov dword [esp + 0x34], 0x1a842683
mov dword [esp + 0x38], 0xd2d8feeb
mov word [esp + 0x3c], 0x96f6
mov edx, 0x8fee3236
mov ecx, 0x1e947710
xor eax, eax
nop
mov bl, byte [esp + esi + 0x24]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0x24], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0x1f912
jl 0x10015280
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.10014a80
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x34
ret

Function at 0x10016b30
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x800
mov edx, dword [esp + 0x804]
push 0x400
lea ecx, [esp + 4]
push ecx
xor eax, eax
push edx
mov word [esp + 0xc], ax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x10016b62
xor al, al
add esp, 0x800
ret
lea eax, [esp]
lea edx, [eax + 2]
jmp 0x10016b70
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10016b70
mov ecx, dword [esp + 0x808]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 4]
push eax
call fcn.10002ec0
mov al, 1
add esp, 0x800
ret
Function at 0x10016ef0
Capabilities:
Receive http response

Disassembly:
push 0xffffffffffffffff
push 0x100850be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
xor edi, edi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0xec], edi
jne 0x10016f99
test byte [0x100bbcc4], 1
jne 0x10016f6a
or dword [0x100bbcc4], 1
mov ecx, 0x100bbca0
mov dword [esp + 0x20], edi
call fcn.10009750
push 0x100875d0
call fcn.10083c4f
add esp, 4
mov dword [esp + 0x20], 0xffffffff
push str.ReadHTTPBytes:_Request_made_to_read_a_channel_with_no_active_request_handle
push str.WinHTTPInterface::ReadHTTPBytes
push 1
push 0x100bbca0
call fcn.10009820
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x1c
push ebx
lea ebx, [ebx]
mov edi, dword [esp + 0x44]
mov dword [esp + 0x10], 0
test edi, edi
jl 0x10016fd2
jg 0x10016fb9
cmp dword [esp + 0x40], 0
jbe 0x10016fd2
call fcn.100109c0
cmp edx, edi
jg 0x1001706b
jl 0x10016fd2
cmp eax, dword [esp + 0x40]
ja 0x1001706b
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x10016fe5
mov dl, byte [eax]
cmp dl, 1
je 0x1001707a
mov eax, dword [ebp]
mov edx, dword [eax + 0x18]
mov ecx, ebp
call edx
mov ebx, edx
mov edi, eax
test ebx, ebx
jl 0x10017076
jg 0x10016ffd
test edi, edi
je 0x10017076
cmp ebx, dword [esp + 0x18]
jl 0x10017011
jg 0x1001700b
cmp edi, dword [esp + 0x14]
jbe 0x10017011
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov ecx, dword [esi]
add ecx, dword [esp + 0x2c]
mov edx, dword [ebp + 0xec]
lea eax, [esp + 0x10]
push eax
push edi
push ecx
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x10017076
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10017076
mov edx, dword [esp + 0x18]
xor eax, eax
sub dword [esp + 0x14], ecx
sbb edx, eax
add dword [esi], ecx
mov dword [esp + 0x18], edx
adc dword [esi + 4], eax
test edx, edx
jl 0x10017076
jg 0x10017058
cmp dword [esp + 0x14], eax
jbe 0x10017076
test ebx, ebx
jl 0x10017076
jg 0x10016fa0
test edi, edi
je 0x10017076
jmp 0x10016fa0
push 0x5b4
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x3c]
pop ebx
test eax, eax
je 0x10017085
mov al, byte [eax]
cmp al, 1
je 0x10017096
mov ecx, dword [esi]
cmp ecx, dword [esp + 0x2c]
jne 0x100170af
mov edx, dword [esi + 4]
cmp edx, dword [esp + 0x30]
jne 0x100170af
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x1c
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret 0x1c
Function at 0x10017400
Capabilities:
Initialize winhttp library

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
mov esi, ecx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10017410
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esi + 0xc8]
call fcn.10002ec0
movzx eax, byte [esp + 0x10]
neg eax
sbb eax, eax
and eax, 0x10000000
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
xor ecx, ecx
mov dword [esi + 0xe8], eax
test eax, eax
pop edi
setne al
pop esi
ret 8
Function at 0x100178e0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov esi, ecx
mov edx, dword [esi + 0xec]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x804]
push ecx
push 0
push ebx
push edx
mov dword [ebp - 4], 0x400
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
cmp eax, 1
je 0x1001797c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001796b
mov eax, dword [ebp - 4]
test eax, eax
je 0x1001796b
add eax, eax
call fcn.10083ca0
mov ecx, dword [esi + 0xec]
mov edi, esp
push 0
lea eax, [ebp - 4]
push eax
push edi
push 0
push ebx
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
cmp eax, 1
jne 0x1001796b
mov ecx, dword [ebp + 0xc]
push edi
call fcn.10003840
mov al, 1
lea esp, [ebp - 0x810]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
lea esp, [ebp - 0x810]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10017985
mov ecx, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x804]
push edx
call fcn.10002ec0
mov al, 1
lea esp, [ebp - 0x810]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10018480
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x100bc1d8], 0
mov eax, ecx
jne 0x10018533
push esi
xor esi, esi
mov edx, esi
shl edx, 0x18
test edx, edx
jns 0x100184a5
add edx, edx
xor edx, 0x4c11db7
jmp 0x100184a7
add edx, edx
test edx, edx
jns 0x100184b5
add edx, edx
xor edx, 0x4c11db7
jmp 0x100184b7
add edx, edx
test edx, edx
jns 0x100184c5
add edx, edx
xor edx, 0x4c11db7
jmp 0x100184c7
add edx, edx
test edx, edx
jns 0x100184d5
add edx, edx
xor edx, 0x4c11db7
jmp 0x100184d7
add edx, edx
test edx, edx
jns 0x100184e5
add edx, edx
xor edx, 0x4c11db7
jmp 0x100184e7
add edx, edx
test edx, edx
jns 0x100184f5
add edx, edx
xor edx, 0x4c11db7
jmp 0x100184f7
add edx, edx
test edx, edx
jns 0x10018505
add edx, edx
xor edx, 0x4c11db7
jmp 0x10018507
add edx, edx
test edx, edx
jns 0x10018515
add edx, edx
xor edx, 0x4c11db7
jmp 0x10018517
add edx, edx
mov dword [esi*4 + 0x100bbdd8], edx
inc esi
cmp esi, 0x100
jl 0x10018492
mov byte [0x100bc1d8], 1
pop esi
ret

Function at 0x10018540
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
lea esi, [edx + ecx]
xor eax, eax
cmp edx, esi
jae 0x10018570
mov ecx, eax
shr ecx, 0x18
xor ecx, dword [edx]
shl eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x100bbdd8]
add edx, 4
cmp edx, esi
jb 0x10018552
pop esi
ret
Function at 0x10019070
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x10085b36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x100190cd
push 0x50
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0
test eax, eax
je 0x100190b4
push 0
mov ecx, eax
call fcn.100120a0
jmp 0x100190b6
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 0x10], eax
test eax, eax
jne 0x100190cd
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x10]
push 0
push eax
push str.UIState
call fcn.10012790
test al, al
je 0x10019155
cmp dword [esi + 0x10], 0
jne 0x10019129
push 0x50
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
test eax, eax
je 0x10019110
push 0
mov ecx, eax
call fcn.100120a0
jmp 0x10019112
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10019129
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esi + 0x10]
push 0
push edx
push str.UIStateUpdateTick
call fcn.10012a20
test al, al
je 0x10019155
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x10019170
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x10085b36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x100191cd
push 0x50
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0
test eax, eax
je 0x100191b4
push 0
mov ecx, eax
call fcn.100120a0
jmp 0x100191b6
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 0x10], eax
test eax, eax
jne 0x100191cd
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x10]
push 0
push eax
push str.GameState
call fcn.10012580
inc dword [0x100bc210]
cmp dword [esi + 0x10], 0
jne 0x1001922b
push 0x50
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
test eax, eax
je 0x10019212
push 0
mov ecx, eax
call fcn.100120a0
jmp 0x10019214
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 0x10], eax
test eax, eax
jne 0x1001922b
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
mov ecx, dword [0x100bc210]
push 0
push ecx
mov ecx, dword [esi + 0x10]
push str.GameStateUpdateTick
call fcn.10012950
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4