joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005022
Capabilities:
Get common file path

Disassembly:
mov dword [ebp + 8], eax
test edi, edi
je fcn.10005022
cmp dword [ebp + 0x10], 0
je 0x100050a5
sub edi, ebx
cmp edi, esi
jb 0x10004ff4
mov edi, esi
push edi
push ebx
push dword [ebp + 0x10]

Function at 0x10005113
Capabilities:
Check os version
Get common file path

Disassembly:
push ecx
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
cmp dword [eax + 0x10], esi
jbe 0x10005114
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
push dword [ecx + eax + 8]
lea ecx, [ebp - 0x28]
call fcn.10006ad8
mov ecx, dword [ebp - 0x28]
cmp ecx, esi

Function at 0x100059ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
push eax
push dword [ebp - 0x10]
call ebx
xor ebx, ebx
xor eax, eax
cmp dword [esi + 0x6c], 3
push ebx
sete al
push eax
push 0x1000b228
push dword [ebp - 0x10]
pop dword [esi]
push dword [ebp - 0x30]
call fcn.1000324f
or dword [ebp - 0x50], eax
add eax, edx
mov eax, dword [ebp - 0x64]
lea esi, [ebp - 0x30]
add ebx, dword [ebp - 0x78]
add dword [ebp - 0x80], 0x45
push esi
xor edi, esi
push eax
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10005a6b

Function at 0x10005afd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call dword [ecx + 0x40]
cmp eax, esi
mov dword [ebp - 0x20], eax
jl 0x10005acf
mov dword [ebp + 8], esi
add ebx, 0x6c
push dword [ebx - 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
push edi
call dword [eax + 0x58]
cmp eax, esi
mov dword [ebp - 0x20], eax
jl 0x10005b93
Function at 0x10005bbc
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
push dword [ebp - 0x18]
call fcn.10007481
cmp eax, 1
pop ecx
jne 0x10006e06
push ecx
mov ecx, esp
mov dword [ebp - 0xb4], esp
push 0x1000bd1c
call fcn.10006b8e
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x20], esp
push dword [ebp - 0x1c]
call fcn.10006cb3
call fcn.10003302
sub eax, dword [ebp - 0x8c]
mov word [ebp - 0x58], 0xd22
add dword [ebp - 0x64], 0xfffffffc
add eax, dword [ebp - 0x88]
push dword [ebp - 0x38]
call fcn.1000324f
add eax, dword [ebp - 0x84]
push dword [ebp - 0x34]
call fcn.1000324f
add dword [ebp - 0x80], ecx
push dword [ebp - 0x44]
call fcn.1000324f
and ebx, edi
lea ebx, [ebx + 0xe7e]
push dword [ebp - 0x5c]
call fcn.1000324f
cmp dword [ebp - 0x24], 0x10000002
jne 0x10005ade
xor eax, eax
push ebx
push eax
call fcn.1000658f
pop ecx
test eax, eax
pop ecx
je 0x10005ad5
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
je 0x10005a5e
call fcn.100086bd
push dword [ebp - 0x60]
call fcn.1000324f
and dword [ebp - 0x88], edx
and dword [ebp - 0x4c], edx
xor dword [ebp - 0x48], edx
mov ebx, dword [ebp - 0x30]
add edx, ebx
cmp dword [ebp - 0x6c], 1
je 0x10005b20
mov ecx, dword [ebp - 0x60]
add eax, 0xafb6
sub ebx, 8
cmp dword [ebp - 0x6c], 0xffffffed
jne 0x10005b4c
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x60], ecx
sub edi, eax
xor edi, dword [ebp - 0x3c]
sub edi, ebx
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10005b90
mov edi, dword [ebp - 0x30]
or eax, dword [ebp - 0x88]
xor word [ebp - 0x4c], 0xe50
mov edx, dword [ebp - 0x5c]
add eax, dword [ebp - 0x70]
sub edi, 0x14
and ecx, dword [ebp - 0x78]
and ecx, dword [ebp - 0x54]
mov edx, dword [edi + 0x20]
mov dword [ebp - 0x5c], edx
xor eax, esi
cmp dword [ebp - 0x6c], 1
je 0x10005bf8
mov dword fs:[0], ecx
mov eax, 0x1000bf33
call fcn.10005afd
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x467320
mov dword [esi + 0x80], 0x467318
mov eax, dword [esi + 0xb0]
mov dword [ebp - 4], 3
test eax, eax
je 0x10005bb4
mov ecx, dword [eax]
mov esi, dword [ebp - 0x30]
xor edi, esi
or dword [ebp - 0x70], 0x33
mov eax, dword [ebp - 0x28]
mov ebx, eax
sub esi, 0x28
add ecx, dword [ebp - 0x80]
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x28], eax
add dword [ebp - 0x70], eax
Function at 0x10005c21
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
call fcn.10006482
sub edi, dword [ebp + 0x10]
add esp, 0xc
cmp edi, dword [ebp + 8]
ja 0x10005bb4
pop esi
pop ebx
pop edi
pop ebp
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
cmp eax, ecx
push esi
je 0x10005bc8
mov edx, dword [esp + 0x10]
mov esi, edx
dec edx
Function at 0x10006252
Capabilities:
Check os version
Encrypt data using rc4 ksa
Get common file path
Resolve function by parsing pe exports

Disassembly:
mov ecx, eax
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 8], ecx
dec eax
je 0x10006295
sub eax, 0x10e
jne 0x100062c0
push edi
Function at 0x100067a7
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
add esp, 0xc
test ebx, ebx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000bf89
push 0x1000bf90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x10006753

Function at 0x100068e1
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
je 0x10005a66
mov eax, dword [eax + 8]
mov ebx, 0x1000bcd7
sub eax, ecx
mov ecx, ebx
cdq
idiv ecx
mov esi, eax
test esi, esi
sub dword [ebp - 0x38], 1
jne 0x100063ab
xor ecx, dword [ebp - 0x70]
cmp dword [ebp - 0x6c], 0xffffffa9
jne 0x10006930
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
pop edi
mov dword [ebx + 0x84], 0x15
pop esi
pop ebx
push ebp
mov ebp, esp
sub esp, 0x1000b2ab
push ebx
push esi
mov ecx, dword [ebp - 0x30]

Function at 0x10006ad8
Capabilities:
Check os version
Encrypt data using rc4 ksa
Get common file path
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x44], esi
call fcn.1000566c
mov eax, dword [ebp - 0x44]
push eax
mov dword [ebp - 0x34], eax
call edi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]

Function at 0x10006c3a
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
sub ebx, dword [ebp - 0x48]
mov word [ebp - 0x58], 0xaf
mov dword [ebp - 0x34], 0
add esi, 0xf325
mov dword [ebp - 0x28], 0
xor esi, edi
add edi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], 0x22856
push dword [ebp - 0x38]
call fcn.1000324f
mov dword [ebp - 0x7c], ebx
call 0x10003a56
sub eax, dword [ebp - 0x84]
mov ebx, dword [ebp - 0x28]
lea edi, [ebp - 0x34]
and ecx, dword [ebp - 0x40]
mov dword [ebp - 0x78], edi
push edi
sub eax, dword [ebp - 0x78]
push ebx
and ecx, dword [ebp - 0x4c]
call fcn.10003302
cmp dword [ebp - 0x6c], 0x10000002
jne 0x100036b6
jne 0x10003626
cmp dword [esi + 0x10], 3
jne 0x10006c77
cmp dword [esi + 0x14], edi
jne 0x10006c1c
cmp dword [esi + 0x1c], 0
jne 0x10006c99
mov esi, dword [0x1000b658]
Function at 0x10006f8e
Capabilities:
Check os version
Get common file path

Disassembly:
jbe 0x10006fc3
lea eax, [ebx + 0x98]
lea ecx, [ebx + 0xb8]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10003fb3
push dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1000466c
mov ecx, dword [ebp - 0x28]
cmp ecx, esi
je 0x10006f43
call fcn.10005335
xor eax, eax
Function at 0x1000736e
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
fld qword [ecx]
fcomp qword [0xbca568]
adc al, ah
sahf
jbe 0x10007377
fld qword [0x47e878]
jmp 0x10007394
Function at 0x1000778c
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
and dword [ebp - 0x40], edx
add edx, dword [eax + 0x70]
mov dword [ebp - 0x28], edx
and ebx, ecx
cmp dword [ebp - 0x6c], 0x14
jne 0x100077b8
test byte [0x1000ba72], 1
jne 0x1000777b
or byte [0x47ca80], 1
push 0x1000bb0e
call fcn.10004253
pop ecx
call fcn.10005d57
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 1]
mov ecx, 0x1000bef7
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0x10000002
jne 0x100077de

Function at 0x100077ac
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
and dword [ebp - 0x40], edx
add edx, dword [eax + 0x70]
mov dword [ebp - 0x28], edx
and ebx, ecx
cmp dword [ebp - 0x6c], 0x14
jne 0x100077b8
test byte [0x1000ba72], 1
jne 0x1000777b
or byte [0x47ca80], 1
push 0x1000bb0e
call fcn.10004253
pop ecx
call fcn.10005d57
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 1]
mov ecx, 0x1000bef7
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0x10000002
jne 0x100077de

Function at 0x100077c4
Capabilities:
Check os version
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
pop esi
pop edi
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, edx
dec edx
test ecx, ecx

Function at 0x10007b4e
Capabilities:
Check os version
Get common file path

Disassembly:
call fcn.10007739
test eax, eax
je 0x10007b04
push dword [0x1000bad8]
lea eax, [ebp - 0x2c]
mov ecx, esi
push edi
push eax
Function at 0x10007fde
Capabilities:
Check os version
Create process on windows
Create thread
Encrypt data using rc4 ksa
Encrypt data using speck
Get common file path
Resolve function by parsing pe exports

Disassembly:
lea ecx, [ebp - 0x28]
lea ecx, [ebp - 0x24]
lea ecx, [ebp - 0x2c]
lea ecx, [ebp - 0x40]
test byte [0x1000bb36], 1
jne 0x1000802e
or byte [0x47ca80], 1
push 0x1000bc17
call fcn.10006553
pop ecx
call fcn.10006a91
push ecx
mov al, byte [esp + 3]
mov byte [0x47afe8], al
xor eax, eax
mov dword [0x1000baff], eax
mov dword [0x1000b1c0], eax
mov eax, dword [ebp - 0x64]
lea ebx, [ebp - 0x30]
or esi, dword [ebp - 0x8c]
push ebx
and edx, dword [ebp - 0x50]
push eax
cmp dword [ebp - 0x6c], 0x10000002
jne 0x10008054
mov edi, dword [ecx]
cmp edi, ebx
mov dword [ebp - 0x24], edi
je 0x10006bde
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [edi]
lea ecx, [ebp - 0x18]
push ecx
push edi
call dword [eax + 0x1c]
cmp dword [esi + 0x11c], ebx
je 0x100080c5
push edi
call fcn.10003302
mov dword [ebp - 0x84], ecx
and dword [ebp - 0x7c], edx
push dword [ebp - 0x38]
call fcn.1000324f
mov dword [ebp - 0x3c], edx
and dword [ebp - 0x84], ecx
push dword [ebp - 0x60]
call fcn.1000324f
cmp dword [ebp - 0x6c], 1
je 0x100080d9
Function at 0x6e4c3c
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff37c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c84], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea edi, [ebp - 0x1c80]
xor eax, eax
push ebp
push 0x6e4e06
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6e4ddb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.004050e0
lea eax, [ebp - 0x244]
xor ecx, ecx
mov edx, 0x200
call fcn.004050e0
lea eax, [ebp - 0x344]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004050e0
lea eax, [ebp - 0x444]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004050e0
lea eax, [ebp - 0x1444]
xor ecx, ecx
mov edx, 0x1000
call fcn.004050e0
lea eax, [ebp - 0x1c44]
xor ecx, ecx
mov edx, 0x800
call fcn.004050e0
mov eax, edi
xor ecx, ecx
mov edx, 0x3c
call fcn.004050e0
mov dword [edi], 0x3c
lea eax, [ebp - 0x44]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x40
lea eax, [ebp - 0x244]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0x200
lea eax, [ebp - 0x344]
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], pe_nt_image_headers32
lea eax, [ebp - 0x444]
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], pe_nt_image_headers32
lea eax, [ebp - 0x1444]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0x1000
lea eax, [ebp - 0x1c44]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], 0x800
mov ebx, esi
test ebx, ebx
je 0x6e4d63
sub ebx, 4
mov ebx, dword [ebx]
push edi
push 0x90000000
push ebx
mov eax, esi
call fcn.004082a8
push eax
call sub.wininet.dll_InternetCrackUrlW
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x244]
mov ecx, pe_nt_image_headers32
call fcn.00408364
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x6e4dc9
lea eax, [ebp - 0x1c84]
lea edx, [ebp - 0x44]
mov ecx, 0x20
call fcn.00408364
push dword [ebp - 0x1c84]
push 0x6e4e20
mov eax, dword [ebp - 4]
push dword [eax]
push 0x6e4e34
mov eax, dword [ebp - 4]
mov edx, 4
call fcn.0040859c
jmp 0x6e4dd1
mov eax, dword [ebp - 4]
call fcn.00407460
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6e4ded
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e4e0d
lea eax, [ebp - 0x1c84]
call fcn.00407460
ret
Function at 0x6e5f00
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x6e5f09
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00407544
xor eax, eax
push ebp
push 0x6e617b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x6e6134
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, 0x72e2e0
mov edx, dword [ebp - 4]
call reloc.comctl32.dll_ImageList_DragEnter
xor ecx, ecx
mov dl, 1
mov eax, dword [0x63bd7c]
call fcn.005ca18c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x6e60ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.006080ac
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x140], 1
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x15c], ebx
mov dword [eax + 0x158], 0x6e5d94
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x154], ebx
mov dword [eax + 0x150], 0x6e5dac
mov eax, dword [ebp - 0x14]
call fcn.0063fa48
add eax, 0xa8
mov edx, 0x6e6198
call reloc.comctl32.dll_ImageList_DragEnter
xor eax, eax
push ebp
push 0x6e6090
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6e5ff2
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0063d4fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6e5ffc
mov eax, dword [ebp - 0x14]
call fcn.0063fa3c
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 0x50]
mov edx, eax
lea eax, [ebp - 8]
call fcn.00408310
mov eax, dword [ebp - 0x14]
call fcn.0063fa3c
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0xc]
mov edx, 0x6e6280
call fcn.005f3944
mov eax, dword [ebp - 0x14]
call fcn.0063fa08
cmp eax, 0xc8
je 0x6e6074
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
push 0x6e62b4
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call fcn.0063fa1c
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040859c
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov eax, dword [0x72e2d4]
call fcn.006e665c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e6097
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x98]
call reloc.user32.dll_CreateWindowExW
ret
Function at 0x6e8410
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6e84e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
push 0x6e84f8
call sub.wininet.dll_InternetOpenW
mov esi, eax
push 0
push 0x200
push 0
push 0
mov eax, ebx
call fcn.004082a8
push eax
push esi
call sub.wininet.dll_InternetOpenUrlW
mov ebx, eax
test ebx, ebx
jne 0x6e8474
mov eax, edi
mov edx, 0x6e8508
call reloc.comctl32.dll_ImageList_DragEnter
jmp 0x6e84cc
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x201
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40e]
push eax
push 0x13
push ebx
call sub.wininet.dll_HttpQueryInfoW
test eax, eax
jne 0x6e84a9
mov eax, edi
mov edx, 0x6e8508
call reloc.comctl32.dll_ImageList_DragEnter
jmp 0x6e84c6
lea eax, [ebp - 4]
lea edx, [ebp - 0x40e]
mov ecx, 0x201
call fcn.00408364
mov eax, edi
mov edx, dword [ebp - 4]
call reloc.comctl32.dll_ImageList_DragEnter
push ebx
call sub.wininet.dll_InternetCloseHandle
push esi
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e84ef
lea eax, [ebp - 4]
call fcn.00407460
ret

Function at 0x6e86a4
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff998
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407544
mov eax, dword [ebp - 8]
call fcn.00407544
lea ebx, [ebp - 0x18]
xor eax, eax
push ebp
push 0x6e882f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x6e8840
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x10], eax
push 0
push 0
push 3
push 0
push 0
push 0x50
mov eax, dword [ebp - 4]
call fcn.004082a8
mov esi, eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetConnectW
xor eax, eax
push ebp
push 0x6e880d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x6e87ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x668]
call fcn.00404f10
call fcn.0040482c
mov edx, 1
lea eax, [ebp - 0x668]
call fcn.00405284
call fcn.0040482c
xor eax, eax
push ebp
push 0x6e87d1
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x400
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x418]
mov ecx, dword [ebx]
lea eax, [ebp - 0x668]
call fcn.00405068
call fcn.0040482c
cmp dword [ebx], 0
jne 0x6e8772
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e87d8
lea eax, [ebp - 0x668]
call fcn.00405088
call fcn.0040482c
mov eax, dword [ebp - 8]
call fcn.006e948c
mov byte [ebp - 9], 1
ret
Function at 0x6e8844
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff998
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407544
mov eax, dword [ebp - 8]
call fcn.00407544
lea ebx, [ebp - 0x18]
xor eax, eax
push ebp
push 0x6e89d2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x6e89e4
call sub.wininet.dll_InternetOpenW
mov dword [ebp - 0x10], eax
push 0
push 0
push 3
push 0
push 0
push 0x1bb
mov eax, dword [ebp - 4]
call fcn.004082a8
mov esi, eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetConnectW
xor eax, eax
push ebp
push 0x6e89b0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlW
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x6e8992
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x668]
call fcn.00404f10
call fcn.0040482c
mov edx, 1
lea eax, [ebp - 0x668]
call fcn.00405284
call fcn.0040482c
xor eax, eax
push ebp
push 0x6e8974
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x400
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x418]
mov ecx, dword [ebx]
lea eax, [ebp - 0x668]
call fcn.00405068
call fcn.0040482c
cmp dword [ebx], 0
jne 0x6e8915
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e897b
lea eax, [ebp - 0x668]
call fcn.00405088
call fcn.0040482c
mov eax, dword [ebp - 8]
call fcn.006e948c
mov byte [ebp - 9], 1
ret
Function at 0x6e91d4
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff384
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.004050e0
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x200
call fcn.004050e0
lea eax, [ebp - 0x340]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004050e0
lea eax, [ebp - 0x440]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.004050e0
lea eax, [ebp - 0x1440]
xor ecx, ecx
mov edx, 0x1000
call fcn.004050e0
lea eax, [ebp - 0x1c40]
xor ecx, ecx
mov edx, 0x800
call fcn.004050e0
lea eax, [ebp - 0x1c7c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004050e0
mov dword [ebp - 0x1c7c], 0x3c
lea eax, [ebp - 0x40]
mov dword [ebp - 0x1c78], eax
mov dword [ebp - 0x1c74], 0x40
lea eax, [ebp - 0x240]
mov dword [ebp - 0x1c6c], eax
mov dword [ebp - 0x1c68], 0x200
lea eax, [ebp - 0x340]
mov dword [ebp - 0x1c60], eax
mov dword [ebp - 0x1c5c], pe_nt_image_headers32
lea eax, [ebp - 0x440]
mov dword [ebp - 0x1c58], eax
mov dword [ebp - 0x1c54], pe_nt_image_headers32
lea eax, [ebp - 0x1440]
mov dword [ebp - 0x1c50], eax
mov dword [ebp - 0x1c4c], 0x1000
lea eax, [ebp - 0x1c40]
mov dword [ebp - 0x1c48], eax
mov dword [ebp - 0x1c44], 0x800
mov ebx, esi
test ebx, ebx
je 0x6e92fc
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x1c7c]
push eax
push 0x90000000
push ebx
mov eax, esi
call fcn.004082a8
push eax
call sub.wininet.dll_InternetCrackUrlW
mov eax, edi
lea edx, [ebp - 0x40]
mov ecx, 0x20
call fcn.00408364
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6e932c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f4
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push 0
push 0
push 0
push 0
push 0
call sub.wininet.dll_InternetOpenW
mov ebx, eax
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.004082a8
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlW
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x401
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x80a]
push eax
push 1
push esi
call sub.wininet.dll_HttpQueryInfoW
test eax, eax
je 0x6e93a0
mov eax, edi
lea edx, [ebp - 0x80a]
mov ecx, 0x401
call fcn.00408364
jmp 0x6e93a7
mov eax, edi
call fcn.00407460
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret