joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x405094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401ba0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x405094]
movzx eax, al
bt eax, esi
jae 0x401c00
mov ecx, dword [0x405084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401aa6
test byte [0x402018], 8
jne 0x401b40
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402028], 8
jne 0x401af0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401a75
cmp esi, 3
jbe 0x401ab0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4030dc]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym.unk_9
jmp 0x401a75
mov ecx, dword [0x405094]
test ecx, ecx
je 0x401be0
mov dword [esp], 0x402028
call dword [0x405094]
test al, 8
je 0x401a4c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x401a4c
mov ebx, dword [0x405094]
test ebx, ebx
je 0x401bc0
mov dword [esp], 0x402018
call dword [0x405094]
test al, 8
je 0x401a39
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x401a3f
mov ecx, sym.unk_6
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym.unk_8
jmp 0x401a00
mov ecx, sym.unk_6
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym.unk_8
jmp 0x401b4a
mov ecx, sym.unk_6
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym.unk_8
jmp 0x401afe
mov eax, 0xffffffff
jmp 0x401aa6
Function at 0x401d60
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.unk_20
call sym.unk_18
call sym.unk_19
mov esi, dword [eax]
call sym.unk_16
mov edi, dword [eax]
call sym.unk_17
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.unk_21
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43b658
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x43b3c1
pop edi
sub edx, ecx
mov ecx, 0x83ad7200
add ecx, 1
call fcn.0043b6a8
sub edx, 0x3c56f643
add edx, edx
mov ecx, ecx
xor dword [esi], edi
add edx, ecx
add edx, 0x95f422d9
inc esi
mov edx, ecx
add ecx, 1
or edx, ecx
cmp esi, ebx
jne fcn.0043b658
dec ecx
add edx, ecx
sub edx, 1
ret
Function at 0x4018c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x450e9c
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x46b114]
xor eax, esp
mov dword [esp + 0x44c], eax
push edi
mov eax, dword [0x46b114]
xor eax, esp
push eax
lea eax, [esp + 0x458]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x4e]
push ecx
mov word [esp + 0x50], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0x44]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Thunder_NetworkThunderNewTask_
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x44]
push ecx
call fcn.00434de8
call fcn.004016b0
lea edi, [esp + 0xc]
call fcn.00407bc0
mov dword [esp + 0x460], 0
cmp dword [esp + 0x24], 0x10
mov eax, dword [esp + 0x10]
jae 0x401964
lea eax, [esp + 0x10]
push eax
call fcn.00434e0e
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x256]
push eax
mov word [esp + 0x258], dx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x250]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x2e
lea edx, [esp + 0x250]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0042fd71
mov eax, dword [esp + 0x38]
add esp, 0xc
cmp dword [esp + 0x40], 8
jae 0x4019c5
lea eax, [esp + 0x2c]
push eax
push 0x459e78
push 0
push 0
push 0x459e98
call fcn.00434dc6
push 0
call fcn.00434dfb
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0xc]
mov dword [esp + 0x460], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x458]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.004390e8
add esp, 0x45c
ret

Function at 0x401a30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x46b114]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
mov esi, dword [ebp + 0x10]
call fcn.004016b0
call fcn.004018c0
call section..text
test al, al
je 0x401a66
call fcn.00401060
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.00401d60
push esi
call fcn.00401780
add esp, 4
mov esi, eax
call fcn.00401cc0
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp byte [0x4ad235], 0
je 0x401ac5
cmp byte [0x4ad234], 0
je 0x401abe
call fcn.004010c0
mov byte [0x4ad235], 0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004390e8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4022d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44ff98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46b114]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.Xunlei::XARFileChecker.0
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x403760
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
push 0x45aa40
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, eax
mov eax, dword [esp + 0x124]
push eax
push ebx
call esi
lea eax, [ebx + 0x208]
push ebx
push eax
call esi
lea eax, [ebx + 0x618]
push ebx
push eax
call esi
test edi, edi
jne 0x4037c8
lea edi, [ebx + 0xa28]
push edi
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x40385d
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x456438
call edi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
test eax, eax
jne 0x4037f2
mov dword [esp + 0x1c], eax
jmp 0x40382e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
inc ebp
lea edi, [esp + 0x20]
mov ecx, ebp
lea esi, [esp + 0x1c]
call fcn.0040abf0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ebp, ebp
push ebp
push eax
push ebp
push ecx
call dword [sym.imp.MSVCR90.dll_memcpy_s]
push eax
call fcn.00401330
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0x14
mov edx, dword [esp + 0x1c]
push edx
lea edi, [ebx + 0xa28]
push edi
call esi
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x403852
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.Thunder_NetworkThunder_
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.Profiles_
lea ebp, [ebx + 0x208]
push ebp
lea esi, [ebx + 0x410]
push esi
call edi
push str.thunderxarThunderNewTask_
push ebx
lea eax, [ebx + 0x1040]
push eax
call edi
push str.Data_
lea eax, [ebx + 0x618]
lea ecx, [ebx + 0x820]
push eax
push ecx
call edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4038bf
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push eax
call esi
jmp 0x4038c5
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4038d4
push ebp
push eax
call esi
lea ebp, [ebx + 0x820]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4038e9
push ebp
push eax
call esi
mov ecx, dword [esp + 0x124]
push str..Program_
push ecx
add ebx, 0xc30
push ebx
call edi
push ebx
call fcn.00403920
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
Function at 0x403cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x450e52
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x46b114]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ecx, 0x4ad2f8
mov dword [esp + 4], 0x4ad2f8
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0x4ad728
mov ecx, 0x4ad2f8
mov dword [esp + 0x30], 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push str.newtask.ini
lea eax, [esp + 0xc]
push 0x4ad2f8
push eax
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0xc
push eax
mov ecx, 0x4ad2f8
mov byte [esp + 0x30], 1
call dword [0x454368]
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, 0x4ad2f8
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
add esp, 0x2c
ret

Function at 0x403d50
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44ff59
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x46b114]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x18]
mov ecx, 8
mov dword [esp + 0x10], 0
cmp dword [eax + 0x18], ecx
jb 0x403d8c
mov eax, dword [eax + 4]
jmp 0x403d8f
add eax, 4
mov edx, dword [esp + 0x3c]
cmp dword [esp + 0x50], ecx
jae 0x403d9d
lea edx, [esp + 0x3c]
cmp dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x20]
jae 0x403dab
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x58]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov esi, eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x38]
mov dword [esp + 0x10], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x40
Function at 0x405280
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
push esi
push 0x28
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetProcessMemoryInfo
mov esi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x40
call esi
test dword [esp + 0x38], 0xfff00000
je 0x4052ed
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], 0x40
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
shr eax, 0x14
imul eax, eax, 0x64
shr ecx, 0x14
xor edx, edx
div ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405520
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 8
rdtsc
mov dword [esp + 4], eax
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
mov dword [esp], eax
mov ecx, dword [esp]
sub ecx, dword [esp + 4]
mov eax, 0x4f8b588f
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xf
add esp, 8
ret
Function at 0x4108a0
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x451d8b
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46b114]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
inc dword [ebp + 0xbc]
lea edi, [ebp + 0xbc]
push 0xc
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x38]
add esp, 4
push edi
lea ebx, [ebp + 0x9c]
mov dword [esi], 0x40efb0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
call fcn.00413940
push 0x2c
mov dword [eax], esi
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x34], esi
xor ebx, ebx
mov dword [esp + 0x1c], ebx
cmp esi, ebx
je 0x410927
lea ecx, [esi + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
jmp 0x410929
xor esi, esi
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esi + 0x10]
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esi], edx
lea edx, [esp + 0x24]
push edx
push ebx
push esi
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
mov ecx, dword [edi]
push 0x410990
push ebx
mov dword [esi + 0xc], ecx
push ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
Function at 0x411100
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x451d5b
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46b114]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
inc dword [ebp + 0xbc]
lea edi, [ebp + 0xbc]
push 0xc
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x30]
add esp, 4
push edi
lea ebx, [ebp + 0x9c]
mov dword [esi], 0x40f020
mov dword [esi + 4], eax
mov dword [esi + 8], 0
call fcn.00413940
push 0x24
mov dword [eax], esi
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x2c], esi
xor ebx, ebx
mov dword [esp + 0x1c], ebx
cmp esi, ebx
je 0x411187
lea ecx, [esi + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
jmp 0x411189
xor esi, esi
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [edi]
mov dword [esi + 4], ecx
push edx
lea ecx, [esi + 8]
mov dword [esi], ebp
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [esp + 0x24]
push eax
push ebx
push esi
push 0x4113d0
push ebx
push ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4111e0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x451d5b
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46b114]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x24]
inc dword [ebp + 0xbc]
lea edi, [ebp + 0xbc]
push 0xc
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x30]
add esp, 4
push edi
lea ebx, [ebp + 0x9c]
mov dword [esi], 0x40f0d0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
call fcn.00413940
push 0x24
mov dword [eax], esi
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x2c], esi
xor ebx, ebx
mov dword [esp + 0x1c], ebx
cmp esi, ebx
je 0x411267
lea ecx, [esi + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
jmp 0x411269
xor esi, esi
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [edi]
mov dword [esi + 4], ecx
push edx
lea ecx, [esi + 8]
mov dword [esi], ebp
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [esp + 0x24]
push eax
push ebx
push esi
push 0x4112c0
push ebx
push ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x413130
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x4509a4
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x46b114]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x14]
lea edi, [eax + 8]
lea eax, [esp + 0x2c]
push eax
lea ebx, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.00413a60
xor eax, eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x8c], eax
push ecx
lea ebx, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.00413a60
push 0x3c
lea edx, [esp + 0x48]
push 0
push edx
mov byte [esp + 0x98], 1
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x44]
mov ebx, dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
add esp, 0xc
sar eax, 1
mov dword [esp + 0x44], 0x3c
jne 0x4131c7
call ebx
mov edx, dword [esp + 0x24]
sub edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
sar edx, 1
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edi
jne 0x4131e1
call ebx
cmp dword [esi + 0x18], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x74], edi
jb 0x4131fb
mov esi, dword [esi + 4]
jmp 0x4131fe
add esi, 4
lea ecx, [esp + 0x44]
push ecx
push 0
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x38]
sar edx, 1
jne 0x41321b
call ebx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x94]
push eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
sar ecx, 1
jne 0x41323b
call ebx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x98]
push edx
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x9c]
lea edx, [esp + 0x14]
push edx
mov dword [ecx], eax
mov byte [esp + 0x90], 0
call fcn.00413ac0
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x90], 0xffffffff
call fcn.00413ac0
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x80
ret 0xc