joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e810
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422dab
mov eax, dword fs:[0]
push eax
mov eax, 0x123c
call fcn.0041fd70
mov eax, dword [0x42e07c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x210]
push str.FN_CSharedMemoryChannel_GetMessage
push eax
call fcn.00401880
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x423484
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, edi
call fcn.0041e4b0
cmp eax, 0xfffe00ff
jne 0x41e8cc
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
lea edx, [eax - 1]
cmp edx, 0xffe
ja 0x41e8b2
push eax
lea eax, [ebp - 0x1210]
mov ecx, edi
push eax
call fcn.0041e540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ecc2
mov esp, ebp
pop ebp
ret
push str.Invalid_Message_Header
lea ecx, [ebp - 0x1228]
call fcn.00402d30
lea eax, [ebp - 0x1228]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x1244]
call fcn.00401b80
push 0x42b38c
lea eax, [ebp - 0x1244]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x41f37b
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42b2e0
call fcn.0041fa90
push 1
call fcn.0041f03d
pop ecx
test al, al
je 0x41f4d7
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041f00b
mov byte [ebp - 0x24], al
mov eax, dword [0x43222c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41f4d7
test eax, eax
jne 0x41f405
mov dword [0x43222c], ecx
push 0x423340
push 0x42332c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41f3e8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41f4d1
push 0x423328
push 0x423314
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x43222c], 2
jmp 0x41f40a
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041f1aa
pop ecx
call fcn.0041fc0d
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41f43b
push esi
call fcn.0041f120
pop ecx
test al, al
je 0x41f43b
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call dword [0x423310]
call esi
call fcn.0041fc13
mov esi, eax
cmp dword [esi], edi
je 0x41f459
push esi
call fcn.0041f120
pop ecx
test al, al
je 0x41f459
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0041f819
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0041f84f
test al, al
je 0x41f4de
test bl, bl
jne 0x41f487
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0041f1c7
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41f4d1
call fcn.0041fad6
ret
push 7
call fcn.0041f6fd
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.00564000
jmp 0x41f37b
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x4066be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4066cd
pop dword [ebp - 0x1c]
mov eax, 0x564f9a29
add eax, 0xa9f0cca4
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3df02
push 0
mov eax, 0x4eb1c73a
add eax, 0xb18f19e6
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x5a6a
xor esi, esi
add esi, eax
mov edi, 0x4bc11c79
add edi, 0xb4805b87
add edi, dword [ebp - 0x1c]
mov ebx, 0x2630eefd
sub ebx, 0x7d8ef904
xor dword [ebp - 0x14], 0x1e35cbec
mov edx, dword [edi]
sub dword [ebp - 0x18], 0x7b91c581
xor edx, ebx
sub dword [ebp - 8], 0x50816d6b
mov dword [esi], edx
add dword [ebp - 0xc], edi
add esi, 0x7e8d1a8b
sub esi, 0x7e8d1a87
add edi, 0xa309f4ce
add edi, 0x5cf60b36
loop 0x406728
add eax, 0x852630c8
sub eax, 0x8524d44d
xor ebx, ebx
add ebx, eax
add eax, 0x4220c1cc
sub eax, 0x4220c1c7
mov ecx, 0x3c49109c
sub ecx, 0x3c09109c
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x41d31d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41d35c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41d35c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d35c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41d35c
cmp dword [ecx + 0x74], 0xe
jbe 0x41d35c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4246b8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x424755
push ebx
push esi
call fcn.00424681
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00424615
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x424702
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x424754
push edi
push eax
call fcn.0042301b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x424722
call fcn.00423069
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x424753
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00424615
add esp, 0x20
test eax, eax
jne 0x424741
push edi
call fcn.00423069
jmp 0x424749
push ebx
call fcn.00423069
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x425965
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42ed10
push 0x42ed08
push str.FlsAlloc
push 0x1f
call fcn.00425824
mov esi, eax
add esp, 0x10
test esi, esi
je 0x425999
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c148]
call esi
jmp 0x42599f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4259e3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42ed20
push 0x42ed18
push str.FlsGetValue
push 0x21
call fcn.00425824
mov esi, eax
add esp, 0x10
test esi, esi
je 0x425a1a
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x425a22
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42ed28
push 0x42ed20
push str.FlsSetValue
push 0x22
call fcn.00425824
mov esi, eax
add esp, 0x10
test esi, esi
je 0x425a5c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42c148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x42ae20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42ae4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42ae4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40673a
pop dword [ebp - 0x34]
mov eax, 0x288b5415
add eax, 0xd7b51325
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x6e7073cc
add dword [ebp - 0x44], 0xdfe1d17f
mov dword [ebp - 0x40], 0x7925068b
sub dword [ebp - 0x40], 0x46f1ba46
mov dword [ebp - 0x3c], 0x917c4a4c
add dword [ebp - 0x3c], 0xbacff9e2
mov dword [ebp - 0x38], 0x5afad78e
add dword [ebp - 0x38], 0xa5052872
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x27b5724f
add dword [ebp - 0x44], 0x4cbcf707
mov dword [ebp - 0x40], 0x6a44931f
add dword [ebp - 0x40], 0xd727ce56
mov dword [ebp - 0x3c], 0x53b96ce7
add dword [ebp - 0x3c], 0xfb5ff85
mov dword [ebp - 0x38], 0x61bdf4e7
add dword [ebp - 0x38], 0x9e420b19
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x52e1fdb6
sub eax, 0x52a17cb6
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x321fd
push 0
call eax
mov ecx, 0xb4393088
add ecx, 0x4bc701e7
xor ebx, ebx
add ebx, eax
mov edx, 0x46e400
add edx, dword [ebp - 0x34]
mov edi, 0x82356a7d
sub edi, 0xb97e4d9f
add dword [ebp - 0x18], 0x877dd32e
mov esi, dword [edx]
add esi, edi
mov dword [ebx], esi
xor dword [ebp - 0x14], esi
add ebx, 0xf7226c02
add ebx, 0x8dd9402
add edx, 0x2303e0c0
sub edx, 0x2303e0bc
loop 0x406853
add eax, 0x90b96797
sub eax, 0x90b8ab08
mov ebx, eax
add eax, 0xf94676d3
sub eax, 0xf94676ce
mov ecx, 0x5dfb5353
add ecx, 0xa244acad
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0xc654d8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub eax, dword [edx + ecx + 0x10]
jmp 0xbd6afd
je 0xd27633
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x837261
je 0xd27633
mov eax, dword [eax + ecx + 0x7c]
cmp cl, 0xc7
clc
cmc
push ebx
push edi
cmc
clc
mov dword [ebp - 0x10], eax
stc
mov dword [ebp - 8], 0xffffffff
clc
cmc
cmp esi, 0xffff
jmp 0x891b09
mov edi, dword [edx + ecx + 0x18]
jmp 0xc9647b
je 0xd27633
mov eax, 0x5a4d
cmp al, 0xa1
jmp 0xc13037
ja 0x81fcac
mov eax, esi
test ecx, ecx
jmp 0x7a22c7
cmp dword [eax + ecx], 0x4550
jmp 0xbe98bc
mov dword [ebp - 8], eax
jmp 0xd08ac7
jne 0xd27633
mov edx, dword [eax + ecx + 0x78]
cmp ax, di
jmp 0xca3894
add eax, ecx
cmp ah, 0xb
cmp bp, si
xor ebx, ebx
jmp 0xd01ca8
cmp word [ecx], ax
jmp 0xd2762d
push ebp
mov ebp, esp
xor cl, 0xf2
ror cl, cl
mov ecx, dword [ebp + 8]
lea esp, [esp - 0x114]
push esi
clc
test ecx, ecx
jmp 0x7ca930
js 0x8302a4
jmp 0xd16cda
je 0x8302a4
mov eax, dword [edx + ecx + 0x20]
test bx, 0x78ab
cmp ah, dl
jmp 0xbefab2
mov eax, dword [ecx + 0x3c]
jmp 0xbd537c
test edi, edi
jmp 0xc74b18
mov dword [ebp - 4], edx
test edx, edx
jmp 0x81bf06
ret
dec edi
jmp 0xd1b746
jmp 0x8302a4
mov dword [ebp - 0xc], eax
jmp 0xc66898
je 0xc85398
xor eax, eax
pop esi
mov esp, ebp
pop ebp
jmp 0xcd1877
Function at 0x4192f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, 6
lodsd eax, dword [esi]
bswap eax
ror eax, 0xd
mov edx, eax
not edx
lodsd eax, dword [esi]
rol eax, 0xb
bswap eax
xor eax, edx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
rol eax, 9
bswap eax
mov edx, eax
not edx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
rol eax, 7
bswap eax
xor eax, edx
mov edx, eax
not edx
stosd dword es:[edi], eax
rol eax, 5
xor eax, edx
stosd dword es:[edi], eax
lea esi, [edi - 0x10]
dec ebx
test ebx, ebx
jne 0x419305
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x419348
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0xfffefdfc
mov ecx, 0x40
mov ebx, dword [ebp + 0x10]
mov dword [ebx + ecx*4 - 4], eax
sub eax, 0x4040404
dec ecx
jne 0x41935b
mov edi, dword [ebp + 0xc]
mov esi, 0x40
xor ebx, ebx
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x419375
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 8]
mov esi, 0x20
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x4193ae
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 0xc]
mov esi, 0x40
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x4193e7
pop ebp
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x41941c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
xor edx, edx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x419468
push ebp
mov ebp, dword [ebp + 0x10]
mov dl, byte [ebp + ecx]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
mov dl, byte [ebp + edx]
inc dl
mov al, byte [ebp + edx]
xor byte [edi], al
mov dl, byte [ebp + ebx]
xchg byte [ebp + ecx], dl
mov byte [ebp + ebx], dl
inc cl
inc edi
dec esi
test esi, esi
jne 0x419439
pop ebp
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10003f1f
pop dword [ebp - 0x4c]
mov eax, 0x5f7ef69f
sub eax, 0x4f7eb780
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x848ad
push 0
mov eax, 0xcb45d173
sub eax, 0xbb358fa7
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x5c2b
xor edi, edi
add edi, eax
mov esi, 0xfa49fee0
sub esi, 0xea321ae0
add esi, dword [ebp - 0x4c]
mov ebx, 0xafabd4f
add dword [ebp - 0x24], 0x8a02c02c
mov edx, dword [esi]
add dword [ebp - 0x2c], ebx
xor edx, ebx
sub dword [ebp - 0x24], 0x94cf35d5
mov dword [edi], edx
add dword [ebp - 8], 0x2509af35
add edi, 0x32c0db40
sub edi, 0x32c0db3c
add esi, 4
loop 0x10003f74
add eax, 0x3a4abbd4
sub eax, 0x3a495855
mov ebx, eax
add eax, 5
mov ecx, 0xf841b5
sub ecx, 0xf0f841b5
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1002fac0
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101530b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x102
push esi
mov esi, dword [ebp + 0x24]
mov dword [ebp - 0x210], esi
mov dword [esi], 1
je 0x1002fbc7
push ebx
mov ebx, dword [ebp + 0x14]
push 0x10
mov dword [ebp - 0x208], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002fb13
or ebx, 0x10000
mov dword [ebp - 0x208], ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002fb2c
or ebx, 0x20000
mov dword [ebp - 0x208], ebx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002fb45
or ebx, 0x40000
mov dword [ebp - 0x208], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1015ba8c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1015c500]
cmp eax, dword [ecx + 4]
jg 0x1002fbda
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp - 0x206]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x205]
imul edx, ecx, 0x1000193
mov ecx, 0x1015c4e0
xor edx, eax
imul eax, edx, 0x1000193
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.10003f10
pop ebx
mov eax, dword [eax + 4]
test eax, eax
je 0x1002fbc7
cmp eax, dword [0x1015c4e4]
je 0x1002fbc7
mov dword [esi], 0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000551e
mov esp, ebp
pop ebp
ret 0x20
push 0x1015c500
call fcn.10003f10
add esp, 4
cmp dword [0x1015c500], 0xffffffff
jne 0x1002fb61
push edi
mov dword [ebp - 0x20c], 0
lea edi, [ebp - 0x204]
mov dword [ebp - 0x20c], 0
mov ecx, 0x80
mov eax, dword [ebp - 0x20c]
mov esi, 0x1010f410
rep movsd dword es:[edi], dword [esi]
mov dword [0x1015c4e0], eax
mov dword [0x1015c4e4], 0
mov dword [0x1015c4e8], 0
push 0xc
lfence
call fcn.10003f10
add esp, 4
mov ecx, 0x1015c4ec
mov dword [eax], eax
mov dword [eax + 4], eax
push eax
push 0x10
mov dword [0x1015c4e4], eax
mov dword [0x1015c4ec], 0
mov dword [0x1015c4f0], 0
mov dword [0x1015c4f4], 0
mov dword [0x1015c4f8], 7
mov dword [0x1015c4fc], 8
mov dword [0x1015c4e0], 0x3f800000
call fcn.10003f10
lea eax, [ebp - 4]
mov ecx, 0x1015c4e0
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.10003f10
push 0x10102700
call fcn.10003f10
push 0x1015c500
call fcn.10003f10
mov esi, dword [ebp - 0x210]
add esp, 8
pop edi
jmp 0x1002fb61
Function at 0x100ab010
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x30]
mov ecx, esi
call fcn.1004d0a0
movzx edi, al
mov ecx, esi
neg edi
sbb edi, edi
and edi, 0x800000
call fcn.1004d0a0
test al, al
je 0x100ab058
mov eax, dword [ebx]
push 0x800
push 0x54
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x1010452c]
mov ecx, ebx
call esi
lea esi, [ebx + 0x30]
push 0xd
mov ecx, ebx
call fcn.10003f10
cmp dword [ebx + 0x40], 0
je 0x100ab0c3
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.10003f10
push edi
push 0
push 0
push 0
push dword [eax]
push dword [ebx + 0x10]
push dword [ebx + 0x40]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x44], eax
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100ab0b4
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1010452c]
mov ecx, edi
call esi
cmp dword [ebx + 0x44], 0
je 0x100ab0ca
push 0xe
mov ecx, ebx
call fcn.10003f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.10003f10
push 0x1013b7d0
lea eax, [ebp - 0x10]
push eax
call fcn.10003f10
int3
Function at 0x100ab430
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fe9ee
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002920
mov edi, eax
test edi, edi
je 0x100ab589
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1010452c]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 0xc]
push eax
push dword [ebx + 0x44]
mov dword [ebp - 0x14], 1
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100ab569
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x100ab593
shr esi, 1
sub esi, 1
js 0x100ab57f
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x100ab505
push esi
mov ecx, edi
lfence
call fcn.10003f10
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x100ab57f
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x100ab546
push dword [ecx - 8]
push ecx
call fcn.10003f10
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x100ab57f
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x100ab57f
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x100ab569
push esi
push 0x1010644c
mov ecx, edi
call fcn.10003f10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.10003f10
push 0x80004005
call fcn.10003f10
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.10003f10
push 0x1013fb60
lea eax, [ebp - 0x20]
push eax
call fcn.10003f10
int3
Function at 0x100ab5b0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fea1d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 8]
lea esi, [eax + 0x14]
mov eax, dword [esi + 4]
sub eax, dword [esi]
add edi, eax
mov dword [ebp - 0x1c], eax
cmp edi, 0xa00000
jg 0x100ab6d7
lfence
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
mov byte [ebp - 0xd], 0
cmp edi, ecx
jae 0x100ab615
lea eax, [edx + edi]
mov dword [esi + 4], eax
jmp 0x100ab646
jbe 0x100ab646
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x100ab631
lea eax, [ebp - 0xd]
mov ecx, esi
push eax
push edi
lfence
call fcn.10003f10
jmp 0x100ab646
sub edi, ecx
je 0x100ab643
push edi
push 0
push ebx
call fcn.100075c0
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add eax, edi
push ecx
push dword [ebp + 8]
mov dword [ebp - 0x14], 0
push eax
mov eax, dword [ebp - 0x18]
push dword [eax + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x100ab6f2
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
add edi, dword [ebp - 0x14]
cmp edi, ecx
jae 0x100ab688
lea eax, [edx + edi]
mov dword [esi + 4], eax
jmp 0x100ab6b9
jbe 0x100ab6b9
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x100ab6a4
lea eax, [ebp - 0xd]
mov ecx, esi
push eax
push edi
lfence
call fcn.10003f10
jmp 0x100ab6b9
sub edi, ecx
je 0x100ab6b6
push edi
push 0
push ebx
call fcn.100075c0
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov ecx, dword [ebp - 0x18]
push 0xa
call fcn.10003f10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x28]
call fcn.10003f10
push 0x1013fb60
lea eax, [ebp - 0x28]
push eax
call fcn.10003f10
push 0x1010644c
lea ecx, [ebp - 0x1c]
call fcn.10003f10
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.10003f10
push 0x10140a54
lea eax, [ebp - 0x30]
push eax
call fcn.10003f10
int3