joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f13f
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1031f08
call fcn.0100f264
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10385cc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100eefa
cmp eax, esi
jne 0x100eeed
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100eefd
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100eed4
xor esi, esi
inc esi
mov eax, dword [0x10385c8]
cmp eax, esi
jne 0x100ef10
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100ef3f
mov eax, dword [0x10385c8]
test eax, eax
jne 0x100ef39
mov dword [0x10385c8], esi
push 0x100155c
push 0x1001550
call fcn.0100ee36
pop ecx
pop ecx
test eax, eax
je 0x100ef3f
jmp 0x100f063
mov dword [0x10380fc], esi
mov eax, dword [0x10385c8]
cmp eax, esi
jne 0x100ef63
push 0x100154c
push 0x1001508
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10385c8], 2
cmp dword [ebp - 0x20], ebx
jne 0x100ef70
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10385dc], ebx
je 0x100ef91
push 0x10385dc
call fcn.0100fef9
pop ecx
test eax, eax
je 0x100ef91
push ebx
push 2
push ebx
call dword [0x10385dc]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100f063
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x100effb
cmp cx, bx
je 0x100efb6
cmp dword [ebp - 0x1c], ebx
jne 0x100effb
movzx ecx, word [eax]
cmp cx, bx
je 0x100efcb
cmp cx, 0x20
ja 0x100efcb
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x100efb6
test byte [ebp - 0x40], 1
je 0x100efd7
movzx ecx, word [ebp - 0x3c]
jmp 0x100efda
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x10380f8], eax
cmp dword [0x10380ec], ebx
jne 0x100f040
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x100f00c
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x100efa0
cmp dword [0x10380fc], ebx
jne 0x100f04e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10380f8]
jmp 0x100f06f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100f2a9
ret
call fcn.0101003e
jmp 0x100ee97
Function at 0x1013950
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x1013969
xor al, al
jmp 0x1013a69
cmp byte [ecx + 0xd], bl
jne 0x1013975
mov al, 1
jmp 0x1013a69
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + edx*4 - 4]
push esi
mov esi, dword [eax + 4]
mov eax, dword [ecx + 0x14]
mov byte [ebp + 0xb], bl
cmp eax, ebx
je 0x1013a65
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
push 0x800c
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1013a65
cmp dword [ebp - 4], ebx
je 0x1013a65
mov eax, dword [esi + 0xc]
push ebx
push dword [eax + 0x44]
push dword [eax + 0x48]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1013a5c
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 4
pop eax
push ebx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], ebx
call esi
push dword [ebp - 8]
call fcn.0100ed46
pop ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
push 2
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
call esi
test eax, eax
je 0x1013a4e
push 0x20
pop edx
mov dword [ebp - 0xc], 0x10021c8
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp - 8], edx
jne 0x1013a3c
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0xc]
mov ecx, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1013a38
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x1013a49
add dword [ebp - 0x10], edx
add dword [ebp - 0xc], edx
cmp dword [ebp - 0x10], edx
jb 0x1013a20
jmp 0x1013a4d
mov byte [ebp + 0xb], 1
pop edi
cmp dword [ebp - 0x14], ebx
je 0x1013a5c
push dword [ebp - 0x14]
call fcn.0100ecc6
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov al, byte [ebp + 0xb]
pop esi
pop ebx
leave
ret 4
Function at 0x10142f4
Capabilities:
Create new key via cryptacquirecontext
Get common file path

Disassembly:
push 0x214
mov eax, 0x102ebd3
call fcn.0100f48e
mov eax, dword [ebp + 8]
mov esi, ecx
lea ebx, [esi + 0x18]
mov ecx, ebx
mov dword [ebp - 0x220], esi
mov dword [esi], 0x1002204
mov dword [esi + 0x10], eax
call fcn.01008c9b
xor edi, edi
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], edi
call fcn.01008c9b
lea ecx, [esi + 0x20]
call fcn.01008c9b
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0xf0000000
push 0x18
push edi
lea eax, [esi + 0x14]
push edi
push eax
mov byte [ebp - 4], 3
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [eax], edi
mov byte [esi + 0xc], 1
mov byte [esi + 0xd], 1
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0x20c
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x106
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x21c]
push eax
mov ecx, ebx
call fcn.0100b6a9
push 0x1002248
mov ecx, ebx
call fcn.0100b683
lea eax, [ebp - 0x21c]
lea edi, [esi + 0x1c]
push eax
mov ecx, edi
call fcn.0100b6a9
push 0x1002220
mov ecx, edi
call fcn.0100b683
lea eax, [ebp - 0x21c]
push eax
lea ecx, [esi + 0x20]
call fcn.0100b6a9
mov ecx, esi
call fcn.01013dd0
mov eax, esi
call fcn.0100f520
ret 4

Function at 0x10155da
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10370ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
push esi
lea esi, [eax + 4]
mov eax, dword [esi]
xor ebx, ebx
mov dword [ebp - 0x210], ebx
cmp dword [eax - 0xc], ebx
jne 0x101568d
push edi
mov edi, 0x1001cc4
push edi
mov ecx, esi
call fcn.0100b6a9
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x210], eax
cmp eax, ebx
jne 0x101568c
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0100b6a9
push 0x10027ec
mov ecx, esi
call fcn.0100b683
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x101565f
mov ecx, esi
jmp 0x101567a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
mov ecx, esi
cmp eax, 0xb7
jne 0x1015686
mov dword [ebp - 0x210], ebx
push 0x10027d4
call fcn.0100b683
jmp 0x101568c
push edi
call fcn.0100b6a9
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f31b
leave
ret
Function at 0x10177b3
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10370ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
mov dword [ebp - 0x210], edi
cmp dword [eax - 0xc], edi
jne 0x1017873
push ebx
mov ebx, 0x1001cc4
push ebx
call fcn.0100b6a9
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x1c
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x210], eax
cmp eax, edi
jne 0x1017872
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0100b6a9
push 0x10027ec
mov ecx, esi
call fcn.0100b683
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1017848
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
cmp eax, 0xb7
jne 0x1017856
mov dword [ebp - 0x210], edi
push 0x1003384
mov ecx, esi
call fcn.0100b683
jmp 0x1017872
cmp eax, edi
jle 0x101786a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
push ebx
mov ecx, esi
call fcn.0100b6a9
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.0100f31b
leave
ret

Function at 0x1017a64
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x102f230
call fcn.0100f41b
mov esi, ecx
push dword [ebp + 8]
call fcn.010178eb
mov ebx, eax
xor edi, edi
cmp ebx, edi
jl 0x1017b73
mov ecx, esi
call fcn.010177b3
mov ebx, eax
cmp ebx, edi
jl 0x1017b6e
mov ecx, esi
call fcn.010175a7
test al, al
je 0x1017b6e
cmp dword [esi + 0x18], edi
jne 0x1017ad5
push 8
call fcn.0100ecd7
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edi
cmp ecx, edi
je 0x1017acc
push dword [esi + 0x14]
push dword [ebp + 8]
call fcn.01017bdf
jmp 0x1017ace
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x18], eax
lea ecx, [ebp - 0x20]
call fcn.0100a957
push 0x1038044
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.0101672d
mov ecx, dword [esi + 0x18]
mov byte [ebp - 4], 2
cmp ecx, edi
je 0x1017b48
mov eax, dword [esi]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x20]
push edx
push eax
call fcn.0101815c
test al, al
je 0x1017b48
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], edi
je 0x1017b55
cmp dword [ebp - 0x18], edi
jbe 0x1017b55
lea edi, [esi + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x10]
lea ecx, [esi + 4]
push eax
call fcn.0100b4db
lea eax, [ebp - 0x20]
lea ecx, [esi + 8]
push eax
call fcn.01017974
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1017b55
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 0x80004005
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0100744d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0100c334
jmp 0x1017b73
mov ebx, 0x80004005
mov eax, ebx
call fcn.0100f507
ret 4
Function at 0x1018564
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 4], ebx
cmp byte [edi + 8], bl
jne 0x10185bd
push esi
push 0xf0000000
push 0x18
push ebx
push ebx
lea esi, [edi + 4]
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x101859a
cmp dword [esi], ebx
je 0x101859a
mov byte [edi + 8], 1
jmp 0x10185bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10185ae
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x10185bc
mov ecx, edi
call fcn.010183be
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x1018c7e
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push 0x20
mov eax, 0x102f4e8
call fcn.0100f41b
mov esi, ecx
push dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xd], bl
call fcn.010169af
push dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], ebx
call fcn.0102de6a
cmp eax, ebx
jl 0x1018dc4
cmp dword [ebp - 0x18], ebx
je 0x1018dc4
cmp dword [ebp - 0x1c], ebx
jbe 0x1018dbb
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1018dbb
lea ecx, [ebp + 0xc]
push ecx
push ebx
push ebx
push 0x800c
push eax
mov dword [ebp + 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1018dbb
cmp dword [ebp + 0xc], ebx
je 0x1018dbb
push ebx
push dword [ebp + 8]
push 2
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x1018db2
push dword [ebp + 0x10]
lea ecx, [ebp + 0x10]
call fcn.010169af
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.0102de6a
cmp eax, ebx
jl 0x1018da4
cmp dword [ebp - 0x28], ebx
je 0x1018da4
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
lea edx, [ebp - 0x24]
push edx
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
call dword [eax + 4]
test al, al
je 0x1018d9b
cmp dword [ebp - 0x20], ebx
je 0x1018d9b
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push dword [ebp - 0x24]
mov dword [ebp + 8], ebx
push dword [ebp - 0x20]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1018d92
cmp dword [ebp + 8], ebx
je 0x1018d92
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
je 0x1018d89
mov byte [ebp - 0xd], 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0x20]
call fcn.0100ecc6
pop ecx
push dword [ebp - 0x28]
call fcn.0100ecc6
pop ecx
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0100744d
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push dword [ebp - 0x18]
call fcn.0100ecc6
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0100744d
mov al, byte [ebp - 0xd]
call fcn.0100f507
ret 0xc
Function at 0x101a34a
Capabilities:
Check http status code
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
push eax
lea esi, [ecx + 0x28]
push esi
push 0
push 0x20000013
push dword [ecx + 0xc]
mov dword [esi], 0x190
mov dword [ebp - 4], 4
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x101a394
mov esi, dword [esi]
cmp esi, 0x190
jae 0x101a38a
xor eax, eax
jmp 0x101a3a8
or esi, 0x80190000
mov eax, esi
jmp 0x101a3a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101a3a8
and eax, 0xffff
or eax, 0x80070000
pop esi
leave
ret

Function at 0x101a3b0
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x101a483
call fcn.0101a34a
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x101a483
push ebx
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push edi
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x16
push dword [esi + 0xc]
mov dword [ebp - 8], edi
call ebx
test eax, eax
jne 0x101a417
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x101a417
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x101a414
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x101a46b
mov eax, dword [ebp - 8]
mov dword [esi + 0x10], eax
cmp eax, edi
jbe 0x101a482
push eax
call fcn.0100ed46
pop ecx
mov dword [esi + 0x14], eax
cmp eax, edi
je 0x101a45f
push edi
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push 0x16
push dword [esi + 0xc]
call ebx
test eax, eax
jne 0x101a482
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x101a45a
and eax, 0xffff
or eax, 0x80070000
mov dword [esi + 0x10], edi
jmp 0x101a47f
mov dword [ebp - 4], 0x8007000e
mov dword [esi + 0x10], edi
jmp 0x101a482
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x101a47f
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x101a4c1
Capabilities:
Receive http response
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0100f330
mov eax, dword [0x10370ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
lea eax, [ebp - 0x2008]
push eax
push dword [esi + 0xc]
mov dword [ebp - 0x2008], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x101a561
cmp dword [ebp - 0x2008], ebx
jbe 0x101a54e
lea eax, [ebp - 0x2008]
push eax
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x101a561
push ebx
lea eax, [ebp - 0x2008]
push eax
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x101a561
cmp dword [ebp - 0x2008], ebx
ja 0x101a4e4
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f31b
leave
ret 4
mov eax, 0x80004005
jmp 0x101a550
Function at 0x101a56d
Capabilities:
Receive http response

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
xor ebx, ebx
inc eax
push edi
push eax
call fcn.0100ed46
mov edi, eax
pop ecx
cmp edi, ebx
je 0x101a5c7
mov eax, dword [esi + 0x1c]
inc eax
push eax
push ebx
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push dword [esi + 0x1c]
push edi
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x101a5cc
push edi
call fcn.0100ecc6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101a5c3
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x101a5cc
mov ebx, 0x8007000e
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x101a570
Capabilities:
Receive http response

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
xor ebx, ebx
inc eax
push edi
push eax
call fcn.0100ed46
mov edi, eax
pop ecx
cmp edi, ebx
je 0x101a5c7
mov eax, dword [esi + 0x1c]
inc eax
push eax
push ebx
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push dword [esi + 0x1c]
push edi
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x101a5cc
push edi
call fcn.0100ecc6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101a5c3
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x101a5cc
mov ebx, 0x8007000e
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x101a5d7
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
cmp eax, 0xffffffff
je 0x101a619
push 0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101a60b
mov dword [ebp - 4], 0x80004005
push dword [ebp + 8]
call fcn.0100ecc6
pop ecx
jmp 0x101a699
mov eax, dword [esi + 0x20]
mov dword [ebp - 8], eax
test eax, eax
jne 0x101a62b
mov eax, dword [ebp + 8]
mov dword [esi + 0x20], eax
jmp 0x101a699
mov eax, dword [esi + 0x18]
push ebx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [eax + edi + 1]
push eax
call fcn.0100ed46
mov ebx, eax
pop ecx
test ebx, ebx
je 0x101a67a
mov eax, dword [esi + 0x18]
lea eax, [eax + edi + 1]
push eax
push 0
push ebx
call sub.msvcrt.dll_memset
push dword [esi + 0x18]
push dword [ebp - 8]
push ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x18]
push edi
push dword [ebp + 8]
add eax, ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x24
add dword [esi + 0x18], edi
mov dword [esi + 0x20], ebx
jmp 0x101a685
and dword [esi + 0x18], 0
mov dword [ebp - 4], 0x8007000e
push dword [ebp - 8]
call fcn.0100ecc6
push dword [ebp + 8]
call fcn.0100ecc6
pop ecx
pop ecx
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x101a869
Capabilities:
Initialize winhttp library

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 8]
push eax
mov esi, ecx
xor ebx, ebx
call sub.SensApi.dll_IsNetworkAlive
test eax, eax
jne 0x101a897
mov dword [esi + 0x2038], 2
mov eax, 0x800704c6
jmp 0x101a926
mov eax, dword [esi + 0x2038]
cmp eax, 1
je 0x101a8ae
cmp eax, 2
je 0x101a8ae
mov ecx, esi
call fcn.0101a2a2
mov eax, dword [ebp + 8]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2034], eax
cmp eax, ebx
jne 0x101a8d2
push ebx
push ebx
push ebx
push ebx
push 0x1003c64
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov byte [esi + 0x2c], bl
jmp 0x101a8e9
push 0x10000000
push ebx
push ebx
push ebx
push 0x1003c64
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov byte [esi + 0x2c], 1
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x203c], eax
cmp dword [esi + 4], ebx
jne 0x101a91a
mov dword [esi + 0x2038], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101a926
and eax, 0xffff
or eax, 0x80070000
jmp 0x101a926
mov dword [esi + 0x2038], 4
mov eax, ebx
pop esi
pop ebx
leave
ret 8

Function at 0x101a931
Capabilities:
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
and dword [esi], 0
push esi
push dword [edi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x101a9ab
mov eax, dword [esi]
test eax, eax
jbe 0x101a9bb
inc eax
push eax
call fcn.0100ed46
mov ebx, eax
pop ecx
test ebx, ebx
je 0x101a9b4
mov eax, dword [esi]
inc eax
push eax
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [esi]
push ebx
push dword [edi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x101a9ab
cmp dword [ebp - 8], 0
jbe 0x101a9bb
push dword [ebp - 8]
mov ecx, edi
push ebx
call fcn.0101a5d7
cmp dword [esi], 0
mov dword [ebp - 4], eax
jbe 0x101a9bb
test eax, eax
jge 0x101a944
jmp 0x101a9bb
mov dword [ebp - 4], 0x80004005
jmp 0x101a9bb
mov dword [ebp - 4], 0x8007000e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101abe4
Capabilities:
Prepare http request

Disassembly:
push 0xc
mov eax, 0x102f710
call fcn.0100f41b
mov esi, ecx
mov edi, 0x1038044
push edi
lea ecx, [ebp - 0x14]
call fcn.0101672d
xor ebx, ebx
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0101672d
mov byte [ebp - 4], 1
cmp dword [esi + 4], ebx
jne 0x101ac29
push ebx
push ebx
mov ecx, esi
call fcn.0101a869
cmp dword [esi + 4], ebx
je 0x101ad2c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0101a9f4
test al, al
je 0x101ad2c
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [esi + 8], eax
cmp eax, ebx
je 0x101ad2c
mov edx, 0x148
cmp byte [ebp + 8], bl
je 0x101ac73
mov edx, 0x800148
cmp byte [esi + 0x2044], bl
je 0x101ac82
mov ecx, 0x1003ca4
jmp 0x101ac91
mov ecx, 0x1003c9c
cmp dword [ebp + 0x10], ebx
jbe 0x101ac91
mov ecx, 0x1003c90
push edx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0xc], eax
cmp eax, ebx
je 0x101ad2c
push dword [ebp + 8]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push eax
push dword [esi + 4]
call fcn.01019fb8
test al, al
je 0x101ad2c
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [ebp - 0x18]
push eax
push 0x58
push dword [esi + 0xc]
mov dword [ebp - 0x18], ebx
call edi
cmp byte [ebp + 8], bl
je 0x101acf3
push 4
lea eax, [ebp - 0x18]
push eax
push 0x1f
push dword [esi + 0xc]
mov dword [ebp - 0x18], 0x100
call edi
cmp dword [ebp + 0x14], ebx
je 0x101ad0f
push ebx
push 0x7e0000
push dword [ebp + 0x14]
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
cmp eax, 0xffffffff
je 0x101ad2c
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push ebx
push dword [esi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x101ad2c
xor esi, esi
jmp 0x101ad4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [esi + 0x24], eax
jle 0x101ad43
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x101ad4e
mov esi, 0x80004005
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0100744d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0100744d
mov eax, esi
call fcn.0100f507
ret 0x10