joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004b020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009c530
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100e6018]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1004b1b5
cmp dword [eax], 0
je 0x1004b1b5
push 1
push 0x100b3768
lea ecx, [ebx + 0x10]
call fcn.10012ea0
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x1004b0ac
cmp dword [ebx + 0x24], 0x10
jb 0x1004b091
mov eax, dword [ebx + 0x10]
jmp 0x1004b094
lea eax, [ebx + 0x10]
mov al, byte [eax + ecx - 1]
cmp al, 0x20
je 0x1004b0bc
cmp al, 0xa
je 0x1004b0ac
push 0xa
push 1
lea ecx, [ebx + 0x10]
call fcn.10044460
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x28]
push eax
lea ecx, [ebx + 0x10]
call fcn.10012db0
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sym.iImportLib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_Json::Value::getComment_enum_Json::CommentPlacement_
push eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x58], 0
call sym.iImportLib.dll_private:_static_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Json::StyledStreamWriter::normalizeEOL_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 8
mov byte [esp + 0x50], 2
cmp dword [esp + 0x24], 0x10
jb 0x1004b0f9
push dword [esp + 0x10]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
lea esi, [esp + 0x28]
cmp eax, 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
cmovae esi, edx
cmp eax, 0x10
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x28]
cmovae ecx, edx
add eax, ecx
lea ecx, [ebx + 0x10]
cmp esi, eax
je 0x1004b195
movzx eax, byte [esi]
push eax
push 1
call fcn.10044460
cmp byte [esi], 0xa
jne 0x1004b18a
cmp byte [esi + 1], 0x2f
jne 0x1004b18a
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x1004b17a
cmp dword [ebx + 0x24], 0x10
jb 0x1004b15f
mov eax, dword [ebx + 0x10]
jmp 0x1004b162
lea eax, [ebx + 0x10]
mov al, byte [eax + ecx - 1]
cmp al, 0x20
je 0x1004b18a
cmp al, 0xa
je 0x1004b17a
push 0xa
push 1
lea ecx, [ebx + 0x10]
call fcn.10044460
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x28]
push eax
lea ecx, [ebx + 0x10]
call fcn.10012db0
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
inc esi
jmp 0x1004b120
push 1
push 0x100b3768
call fcn.10012ea0
cmp dword [esp + 0x3c], 0x10
jb 0x1004b1b5
push dword [esp + 0x28]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret 4
Function at 0x1004cfa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009c748
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi]
mov edi, dword [ebp + 8]
push 1
lea eax, [ebp - 0x34]
push 2
push eax
call dword [sym.imp.MSVCR110.dll_fread]
mov ax, word [ebp - 0x34]
add esp, 0x10
test ax, ax
jne 0x1004d001
push 0
push 0x100b2814
mov ecx, edi
call fcn.100089b0
mov al, 1
jmp 0x1004d127
movzx eax, ax
push eax
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new___unsigned_int_]
movzx ecx, word [ebp - 0x34]
push ecx
mov ebx, eax
push 0
push ebx
call sub.MSVCR110.dll_memset
push dword [esi]
movzx eax, word [ebp - 0x34]
push 1
dec eax
push eax
push ebx
call dword [sym.imp.MSVCR110.dll_fread]
push dword [esi]
lea eax, [ebp - 0x30]
push 1
push 1
push eax
call dword [sym.imp.MSVCR110.dll_fread]
add esp, 0x30
test eax, eax
setne byte [ebp - 0x35]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp byte [ebx], 0
jne 0x1004d05f
xor ecx, ecx
jmp 0x1004d06d
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004d064
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10008870
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
add eax, ecx
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
test eax, eax
je 0x1004d09f
sub eax, ecx
push dword [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.1003f2f0
push ebx
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
mov bl, byte [ebp - 0x35]
mov esi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
test bl, bl
je 0x1004d117
push 0xfde9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x50]
push eax
call sym.iImportLib.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_elex::strings::s2ws_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int_
mov ebx, eax
add esp, 0xc
cmp edi, ebx
je 0x1004d106
cmp dword [edi + 0x14], 8
jb 0x1004d0eb
push dword [edi]
call esi
add esp, 4
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push ebx
mov ecx, edi
mov word [edi], ax
call fcn.1000d5d0
cmp dword [ebp - 0x3c], 8
jb 0x1004d114
push dword [ebp - 0x50]
call esi
add esp, 4
mov bl, byte [ebp - 0x35]
cmp dword [ebp - 0x18], 0x10
jb 0x1004d125
push dword [ebp - 0x2c]
call esi
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 4
Function at 0x1004d670
Capabilities:
Access peb ldr_data
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009c7fc
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x10], ebx
push 4
mov dword [esi], vtable.elex::net::DbUpdater.0
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
mov dword [esp + 0x38], ebx
test edi, edi
je 0x1004d702
push str.iSafe_HttpAsync_1.0
lea ecx, [esp + 0x18]
mov dword [edi], ebx
call fcn.10008550
push 0x10000000
push 0
mov dword [edi], 0
cmp dword [esp + 0x30], 8
push 0
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push 0
push eax
mov ebx, 1
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [edi], eax
jmp 0x1004d704
xor edi, edi
mov dword [esi + 4], edi
test bl, 1
je 0x1004d720
cmp dword [esp + 0x28], 8
jb 0x1004d720
push dword [esp + 0x14]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esi + 0x20], 0xf
mov dword [esi + 0x1c], 0
mov byte [esi + 0xc], 0
mov dword [esi + 0x3c], 7
mov dword [esi + 0x38], 0
xor eax, eax
mov word [esi + 0x28], ax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], 7
mov word [esi + 0x40], ax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], 7
mov word [esi + 0x58], ax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004d850
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 8], 2
jne 0x1004d95f
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x100b3ff4
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x24], eax
cmp eax, 0xffffffff
jne 0x1004d924
mov ecx, esi
mov dword [esi + 0x44], 1
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::CleanRequest_void_
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 4
cmp word [ebp - 0x20c], 0
jne 0x1004d932
xor eax, eax
jmp 0x1004d94f
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
jmp 0x1004d940
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1004d940
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x58]
call fcn.100089b0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100947be
mov esp, ebp
pop ebp
ret 4

Function at 0x1004e310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [edi + 0x10]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x1004e365
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 8]
push ecx
sub eax, esi
push eax
mov ecx, edi
mov dword [ebp - 8], 0
call fcn.10008740
add eax, esi
push eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x24]
call ebx
add esi, dword [ebp - 8]
mov eax, dword [edi + 0x10]
cmp esi, eax
jb 0x1004e338
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100947be
mov esp, ebp
pop ebp
ret 4
Function at 0x1004e6d0
Capabilities:
Prepare http request
Set http header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x20], 8
lea ecx, [esi + 0xc]
jb 0x1004e6e4
mov ecx, dword [ecx]
movzx eax, word [esi + 0x3c]
push 0
push eax
push ecx
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edx, eax
mov dword [esi + 4], edx
test edx, edx
je 0x1004e783
xor ecx, ecx
cmp byte [esi + 0x40], cl
mov eax, 0x800000
cmovne ecx, eax
cmp dword [esi + 0x38], 8
lea eax, [esi + 0x24]
jb 0x1004e71a
mov eax, dword [eax]
push ecx
push 0
push 0
push 0
push eax
push 0x100b6a50
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, eax
mov dword [esi + 8], edx
test edx, edx
je 0x1004e783
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x1004e757
cmp dword [esi + 0x5c], 8
lea eax, [esi + 0x48]
jb 0x1004e749
mov eax, dword [eax]
push 0x1000000
push ecx
push eax
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push 0
push 0x7e4000
push sym.iImportLib.dll_private:_static_void___stdcall_elex::net::CHttpAsyncRequest::AsyncCallback_void___unsigned_long_int__unsigned_long_int__void___unsigned_long_int_
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
test eax, eax
jne 0x1004e783
push esi
push eax
push eax
push eax
push eax
push eax
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x1004e795
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov dword [esi + 0x44], eax
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::CleanRequest_void_
xor eax, eax
test bl, bl
pop esi
sete al
pop ebx
pop ebp
ret 4
Function at 0x1004e820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009ca28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1004e950
mov eax, dword [ebp + 0x10]
cmp eax, 0x80000
ja 0x1004e918
je 0x1004e8f8
cmp eax, 0x4000
je 0x1004e8bb
cmp eax, 0x20000
je 0x1004e8a1
cmp eax, 0x40000
jne 0x1004e950
mov eax, dword [ebp + 0x14]
mov ecx, esi
push dword [eax]
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::HandleResponseDataAvailable_unsigned_long_int_
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov ecx, esi
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::HandleResponseHeaderAvailable_void_
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp + 0x14]
lea ecx, [esp + 0x10]
call fcn.10008550
mov dword [esp + 0x30], 0
mov ecx, dword [esi]
lea edx, [esp + 0xc]
mov eax, dword [ecx]
push edx
push esi
call dword [eax + 0xc]
lea ecx, [esp + 0xc]
call sym.iImportLib.dll_public:_void___thiscall_elex::strings::CAnalyzeCmdline::destructor_void_
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::HandleResponseDataComplete_char___unsigned_long_int_
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 0x200000
je 0x1004e940
cmp eax, 0x400000
jne 0x1004e950
mov ecx, esi
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::HandleRequestSuccess_void_
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [esi + 0x44], eax
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::CleanRequest_void_
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1004e970
Capabilities:
Receive http response

Disassembly:
push esi
mov esi, ecx
push esi
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax]
push 0
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x1004e99a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x44], eax
mov ecx, esi
pop esi
jmp sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::CleanRequest_void_
pop esi
ret
Function at 0x1004e9d0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
jne 0x1004e9e9
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::CleanRequest_void_
pop edi
pop ebx
pop ebp
ret 4
push esi
lea esi, [ebx + 1]
push esi
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new___unsigned_int_]
push esi
push 0
push eax
mov dword [ebp + 8], eax
call sub.MSVCR110.dll_memset
mov esi, dword [ebp + 8]
add esp, 0x10
push 0
push ebx
push esi
push dword [edi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x1004ea28
push esi
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov ecx, edi
call sym.iImportLib.dll_private:_void___thiscall_elex::net::CHttpAsyncRequest::CleanRequest_void_
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1004eb70
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
lea edx, [esi + 2]
cmp ebx, 0xffff
jne 0x1004ebe0
mov eax, dword [edi + 0x10]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new___unsigned_int_]
add esp, 4
cmp dword [edi + 0x14], 8
mov esi, eax
mov eax, dword [edi + 0x10]
jb 0x1004ebc9
mov ecx, dword [edi]
jmp 0x1004ebcb
mov ecx, edi
lea eax, [eax*2 + 2]
push eax
push ecx
push esi
call sub.MSVCR110.dll_memcpy
mov eax, dword [ebp - 0xc]
add esp, 0xc
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push ebx
push dword [eax + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1004ec17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1004ec17
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x1004ec25
push esi
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new___unsigned_int_]
add esp, 4
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push esi
push 0
push ebx
push dword [eax + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1004ec9c
cmp word [esi], 0
jne 0x1004ec73
xor ecx, ecx
push ecx
push esi
mov ecx, edi
call fcn.100089b0
mov bl, 1
jmp 0x1004ec9e
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x1004ec80
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004ec80
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.100089b0
mov bl, 1
jmp 0x1004ec9e
xor bl, bl
push esi
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret 8
Function at 0x1004ecc0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
lea esi, [edi + 1]
push esi
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new___unsigned_int_]
push esi
push 0
push eax
mov dword [ebp + 8], eax
call sub.MSVCR110.dll_memset
mov esi, dword [ebp + 8]
add esp, 0x10
push 0
push edi
push esi
push dword [ebx + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x1004ed0b
push esi
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
Function at 0x10052c30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009d48e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100e6018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push 0xc
mov dword [esp + 0x18], ebx
call dword [sym.imp.MSVCR110.dll_void____cdecl_operator_new_unsigned_int_]
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], ebx
test edi, edi
je 0x10052cce
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [edi + 8], ebx
call fcn.100547f0
mov esi, eax
mov byte [esp + 0x30], 1
mov ebx, 1
push 0x2728
mov ecx, edi
mov dword [esp + 0x18], ebx
call dword [sym.imp.curlpp.dll_public:_void___thiscall_curlpp::OptionBase::constructor_enum_CURLoption_]
mov dword [esp + 0x30], 2
push esi
mov ecx, edi
mov dword [edi], vtable.curlpp::Option_class_std::list_class_utilspp::clone_ptr_class_curlpp::FormPart___class_std::allocator_class_utilspp::clone_ptr_class_curlpp::FormPart____.0
mov dword [edi + 8], 0
call fcn.10054730
mov dword [edi], vtable.curlpp::OptionTrait_class_std::list_class_utilspp::clone_ptr_class_curlpp::FormPart___class_std::allocator_class_utilspp::clone_ptr_class_curlpp::FormPart_____10024_.0
jmp 0x10052cd0
xor edi, edi
test bl, 1
je 0x10052ceb
lea ecx, [esp + 0x1c]
call fcn.100524f0
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10054d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, edx
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x10054d6c
test edi, edi
je 0x10054d6c
shr edi, 2
xor eax, eax
test edi, edi
je 0x10054d65
push ebx
mov ebx, dword [ebp + 8]
push esi
xor dword [ecx + eax*4], ebx
mov esi, eax
and esi, 0xff0000
mov ecx, eax
shr ecx, 0x10
or esi, ecx
mov edx, eax
mov ecx, eax
and edx, 0xff00
shl ecx, 0x10
or edx, ecx
mov ecx, dword [ebp - 4]
shr esi, 8
shl edx, 8
or esi, edx
inc eax
xor ebx, esi
cmp eax, edi
jb 0x10054d30
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10056670
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x100e6018]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
lea eax, [esp + 8]
push eax
xor esi, esi
push 0x1ab
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100566fd
mov ebx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100566fd
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.100565b0
test eax, eax
je 0x100566fd
mov ebx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push str.SeTcbPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100566fd
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.100565b0
mov ecx, 1
test eax, eax
cmovne esi, ecx
mov eax, dword [esp + 8]
test eax, eax
je 0x1005670c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret

Function at 0x10056840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push str.IsWow64Process
xor esi, esi
push str.kernel32
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0x208
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 8], esi
test edi, edi
je 0x100568aa
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x100568aa
cmp dword [ebp - 8], esi
je 0x100568aa
lea eax, [ebp - 0x14]
push eax
push 0x20119
jmp 0x100568b3
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100568ec
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 1
test eax, eax
cmove esi, ecx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100568fa
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret