joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4adcc0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov ebx, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x14]
mov dword [ebp - 0x234], eax
movzx eax, word [ecx + 0x16]
mov dword [ebp - 0x230], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call esi
mov word [ebp - 0x224], ax
movzx eax, word [ebx + 0x16]
mov dword [ebp - 0x22c], eax
movzx eax, word [ebx + 0x14]
mov dword [ebp - 0x228], eax
call esi
mov esi, edi
mov word [ebp - 0x222], ax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.00463600
add esp, 0xc
mov eax, 0x104
push esi
push dword [ebp - 0x230]
push dword [ebp - 0x234]
push str.StringFileInfo_04x_04x_ls
push eax
push eax
push edi
call fcn.00491220
add esp, 0x1c
lea eax, [ebp - 0x21c]
mov dword [eax], 0
lea ecx, [ebp - 0x220]
mov dword [ecx], 0xffffffff
push ecx
push eax
push edi
push dword [ebx + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4addb9
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4addb9
mov edx, dword [ebp - 0x220]
test edx, edx
je 0x4addb9
mov ecx, dword [ebp + 0xc]
dec edx
push edx
push eax
call fcn.0042c1e0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0x208
push 0xff
push edi
call fcn.00463600
add esp, 0xc
movzx eax, word [ebp - 0x224]
push esi
push dword [ebp - 0x22c]
push eax
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
push edi
call fcn.00491220
add esp, 0x1c
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0xffffffff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebx + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4ade37
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4ade37
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x4add93
push 0x208
push 0xff
push edi
call fcn.00463600
add esp, 0xc
mov eax, 0x104
push esi
push 0x4e4
push dword [ebp - 0x228]
push str.StringFileInfo_04x_04x_ls
push eax
push eax
push edi
call fcn.00491220
add esp, 0x1c
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0xffffffff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebx + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4adeb2
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4adeb2
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x4add93
push 0x208
push 0xff
push edi
call fcn.00463600
add esp, 0xc
movzx eax, word [ebp - 0x222]
push esi
push 0x4e4
push eax
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
push edi
call fcn.00491220
add esp, 0x1c
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0xffffffff
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebx + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4adf2f
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4adf2f
mov edx, dword [ebp - 0x220]
test edx, edx
jne 0x4add93
xor ebx, ebx
jmp 0x4adda0
Function at 0x4aec60
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2d10
call fcn.00460860
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x4aeca6
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4aeca6
dec eax
mov ecx, 0x7ffffffd
cmp eax, 0x7ffffffd
cmovb ecx, eax
inc ecx
mov dword [ebp - 0x2d1c], ecx
xor esi, esi
xor edi, edi
jmp 0x4aecd5
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x2d10
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov byte [eax], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x10
mov esi, 0
je 0x4aeca4
mov eax, 0x200
push eax
push 0xff
lea ebx, [ebp - 0x210]
push ebx
call fcn.00463600
add esp, 0xc
push edi
push str..PhysicalDrive_d
mov eax, 0x200
push eax
push ebx
call fcn.004ae820
sub esp, 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
movaps xmm0, xmmword [0x4dd730]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
cmp eax, 0xffffffff
je 0x4aecca
mov ebx, eax
mov dword [ebp - 0x2d18], esi
xorps xmm0, xmm0
movsd qword [ebp - 0x2d14], xmm0
mov dword [ebp - 0x2d0c], esi
mov eax, 0x2710
push eax
push esi
lea eax, [ebp - 0x2920]
push eax
call fcn.00463600
add esp, 0xc
push esi
lea eax, [ebp - 0x2d18]
push eax
mov eax, 0x2710
push eax
lea eax, [ebp - 0x2920]
push eax
push 0xc
lea eax, [ebp - 0x2d14]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4aecc3
push 0x3e8
push 0
lea esi, [ebp - 0x2d08]
push esi
call fcn.00463600
add esp, 0xc
push esi
push 1
push dword [ebp - 0x2908]
lea eax, [ebp - 0x2920]
push eax
call fcn.004bb0f0
add esp, 0x10
cmp dword [ebp + 0xc], 0
jle 0x4aecbd
xor eax, eax
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x2d1c]
mov cl, byte [ebp + eax - 0x2d08]
test cl, cl
je 0x4aedfc
mov byte [edx + eax], cl
inc eax
cmp esi, eax
jne 0x4aedcc
mov esi, dword [ebp + 0xc]
cmp esi, eax
mov ecx, 0
sete cl
sub edx, ecx
mov byte [edx + eax], 0
cmp esi, eax
je 0x4aecc3
jmp 0x4aee00
mov byte [edx + eax], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x4aeca6
Function at 0x4af850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1068
call fcn.00460860
mov esi, dword [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
test esi, esi
je 0x4af879
mov edx, dword [ebp + 0xc]
cmp edx, 0x20
jge 0x4af88e
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
add esp, 0x1068
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.004afa80
test al, al
jne 0x4af879
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0x1074]
movdqu xmmword [ebx + 0x50], xmm0
movdqu xmmword [ebx + 0x40], xmm0
movdqu xmmword [ebx + 0x30], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
mov dword [ebx + 0x60], 0xffffffff
mov edi, 0x1000
lea eax, [ebp - 0x1010]
push edi
push 0
push eax
call fcn.00463600
add esp, 0xc
push edi
lea eax, [ebp - 0x1010]
push eax
call fcn.004af610
add esp, 8
push 0x64
push ebx
call fcn.004ae5c0
add esp, 8
test al, al
jne 0x4af92a
push 0x64
push ebx
call fcn.004ae8b0
add esp, 8
test al, al
jne 0x4af92a
push 0x64
push ebx
call fcn.004aec60
add esp, 8
test al, al
jne 0x4af92a
push 0x64
push ebx
call fcn.004aee10
add esp, 8
test al, al
je 0x4af95d
lea edi, [ebp - 0x1074]
push edi
call fcn.0047d960
add esp, 4
test eax, eax
je 0x4af9f6
jmp 0x4af9e1
mov eax, 0x1000
xor ecx, ecx
add eax, ebp
add eax, 0xffffeff0
cmp ecx, 1
sbb eax, 0
mov byte [eax], 0
push 0x64
push ebx
call fcn.004af0a0
add esp, 8
test al, al
mov edi, dword [ebp + 0xc]
jne 0x4afa0f
push 0x64
push ebx
call fcn.004af440
add esp, 8
test al, al
je 0x4af99e
jmp 0x4afa0f
mov eax, 0x1000
xor ecx, ecx
add eax, ebp
add eax, 0xffffeff0
cmp ecx, 1
sbb eax, 0
mov byte [eax], 0
cmp byte [ebp - 0x1010], 0
jne 0x4af9cb
mov dword [ebp - 0x1010], 0x3264694d
mov dword [ebp - 0x100c], 0x6c696146
mov word [ebp - 0x1008], 0x6465
mov byte [ebp - 0x1006], 0
lea ecx, [ebp - 0x1010]
mov edx, esi
push edi
call fcn.004af6c0
add esp, 4
jmp 0x4af879
cmp byte [ebp + eax - 0x1075], 0x20
jne 0x4af9f6
mov byte [ebp + eax - 0x1075], 0
dec eax
jne 0x4af9e1
xor eax, eax
cmp byte [ebp + eax - 0x1010], 0
je 0x4afa28
inc eax
cmp eax, 0x1000
jne 0x4af9f8
jmp 0x4af95d
xor eax, eax
cmp byte [ebp + eax - 0x1010], 0
je 0x4afa4f
inc eax
cmp eax, 0x1000
jne 0x4afa11
jmp 0x4af99e
mov ecx, 0x1000
sub ecx, eax
mov dl, byte [edi]
test dl, dl
je 0x4af94d
inc edi
mov byte [ebp + eax - 0x1010], dl
inc eax
dec ecx
cmp eax, 0x1000
jne 0x4afa2f
jmp 0x4af946
mov ecx, 0x1000
sub ecx, eax
mov dl, byte [ebx]
test dl, dl
je 0x4af98e
inc ebx
mov byte [ebp + eax - 0x1010], dl
inc eax
dec ecx
cmp eax, 0x1000
jne 0x4afa56
jmp 0x4af987
Function at 0x4afa80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x514
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x4afaed
mov dword [ebp - 0x51c], ecx
mov dword [ebp - 0x520], edx
lea ebx, [ebp - 0x514]
mov dword [ebx], 1
mov eax, 0x400
lea esi, [ebp - 0x518]
mov dword [esi], eax
lea edi, [ebp - 0x410]
push eax
push 0
push edi
call fcn.00463600
add esp, 0xc
push esi
push edi
push ebx
push 0x4dd851
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x4afb06
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x514
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.0047d960
add esp, 4
xor ebx, ebx
cmp eax, 0x40
jne 0x4afaef
pcmpeqd xmm0, xmm0
movdqu xmmword [ebp - 0x420], xmm0
movdqu xmmword [ebp - 0x430], xmm0
movdqu xmmword [ebp - 0x440], xmm0
movdqu xmmword [ebp - 0x450], xmm0
movdqu xmmword [ebp - 0x460], xmm0
movdqu xmmword [ebp - 0x470], xmm0
movdqu xmmword [ebp - 0x480], xmm0
movdqu xmmword [ebp - 0x490], xmm0
movdqu xmmword [ebp - 0x4a0], xmm0
movdqu xmmword [ebp - 0x4b0], xmm0
movdqu xmmword [ebp - 0x4c0], xmm0
movdqu xmmword [ebp - 0x4d0], xmm0
movdqu xmmword [ebp - 0x4e0], xmm0
movdqu xmmword [ebp - 0x4f0], xmm0
movdqu xmmword [ebp - 0x500], xmm0
movdqu xmmword [ebp - 0x510], xmm0
mov eax, 0x80
mov cl, byte [ebp + ebx - 0x410]
test cl, cl
je 0x4afbc2
mov byte [ebp + ebx - 0x490], cl
inc ebx
dec eax
cmp ebx, 0x20
jne 0x4afb9f
mov ebx, 0x20
mov eax, 0x60
lea ecx, [ebx + ebp]
add ecx, 0xfffffb70
cmp eax, 1
sbb ecx, 0
mov byte [ecx], 0
mov eax, 0x80
xor ecx, ecx
mov dl, byte [ebp + ecx - 0x3f0]
test dl, dl
je 0x4afc02
mov byte [ebp + ecx - 0x510], dl
inc ecx
dec eax
cmp ecx, 0x80
jne 0x4afbdb
mov ebx, edi
mov ecx, 0x80
xor eax, eax
jmp 0x4afc04
mov ebx, edi
add ecx, ebp
add ecx, 0xfffffaf0
cmp eax, 1
sbb ecx, 0
mov byte [ecx], 0
mov edi, 0x400
push edi
push 0
push ebx
call fcn.00463600
add esp, 0xc
lea ecx, [ebp - 0x490]
mov edx, ebx
push edi
call fcn.004af6c0
add esp, 4
lea eax, [ebp - 0x510]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4afaed
mov edi, dword [ebp - 0x520]
test edi, edi
jle 0x4afc9b
lea ecx, [edi - 1]
mov eax, 0x7ffffffd
cmp ecx, 0x7ffffffd
cmovb eax, ecx
inc eax
xor ecx, ecx
mov esi, dword [ebp - 0x51c]
mov dl, byte [ebp + ecx - 0x490]
test dl, dl
je 0x4afc85
mov byte [esi + ecx], dl
dec edi
inc ecx
cmp eax, ecx
jne 0x4afc71
add esi, ecx
xor eax, eax
test edi, edi
setne bl
sete al
sub esi, eax
mov byte [esi], 0
jmp 0x4afaef
mov eax, dword [ebp - 0x51c]
je 0x4afaed
mov byte [eax], 0
jmp 0x4afaed
Function at 0x4b0180
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xorps xmm0, xmm0
lea ebx, [ebp - 0x4c]
movups xmmword [ebx + 0xc], xmm0
push 0x2454
push 0
push esi
call fcn.00463600
add esp, 0xc
mov dword [ebx], 0x3c
lea eax, [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0x20
lea eax, [esi + 0x2148]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], 0x100
lea eax, [esi + 0x48]
mov dword [ebx + 0x2c], eax
mov eax, 0x800
mov dword [ebx + 0x30], eax
lea ecx, [esi + 0x1048]
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], eax
lea eax, [esi + 0x2348]
mov dword [ebx + 0x1c], eax
mov eax, 0x80
mov dword [ebx + 0x20], eax
lea ecx, [esi + 0x2048]
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], eax
push edi
call fcn.0047e4dc
add esp, 4
push ebx
push dword [ebp + 0x10]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4b0275
mov eax, dword [ebp - 0x40]
xor ebx, ebx
cmp eax, 4
ja 0x4b0261
mov ecx, 0x1a
bt ecx, eax
jae 0x4b0261
mov dword [esi + 0x2448], 0
mov byte [esi + 0x244c], 0
movzx ecx, word [ebp - 0x34]
mov word [esi], cx
mov dword [esi + 4], eax
mov dword [esi + 0x2450], 0xffffffff
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x4b0261

Function at 0x4b0280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0xc], 0
je 0x4b02af
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ecx
lea edi, [ecx + 0x5d530]
push str.MetalinkFile
push edi
call fcn.00463ceb
add esp, 8
test eax, eax
je 0x4b02e0
mov word [eax], 0
add eax, 0x1a
push eax
call fcn.0047a68a
add esp, 4
mov dword [esi + 0x2694], eax
mov eax, dword [esi + 0x62ce0]
cmp eax, dword [esi + 0x62cdc]
je 0x4b0339
sub esp, 0x10
movaps xmm0, xmmword [0x4dd950]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2464], eax
mov bl, 1
test eax, eax
je 0x4b029b
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
mov dword [esi + 0x5d0f8], 8
push ecx
push eax
push esi
push 0x4b0370
push eax
push eax
call fcn.00471097
add esp, 0x18
mov dword [esi + 0xc], eax
jmp 0x4b029b
lea eax, [esi + 0x10]
push 0
push eax
push edi
call fcn.004b0180
add esp, 0xc
test al, al
je 0x4b0299
jmp 0x4b02ee
Function at 0x4b1ab0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, esp
mov edi, ecx
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [esi + 0x28], eax
lea eax, [ecx + 0x61850]
xor ebx, ebx
cmp word [ecx + 0x61850], 0
cmove eax, ebx
sub esp, 0x14
movaps xmm0, xmmword [0x4dd980]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
test eax, eax
je 0x4b1c4d
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + 0x2048]
cmp word [ecx + 0x2348], 0
je 0x4b1b23
mov edx, ecx
add edx, 0x2348
mov dword [esi + 0xc], edx
jne 0x4b1b3d
lea edx, [edi + 0x60608]
mov dword [esi + 0xc], edx
xor edx, edx
cmp word [edi + 0x60608], 0
cmovne edx, dword [esi + 0xc]
mov dword [esi + 0xc], edx
test ebx, ebx
je 0x4b1b4b
cmp word [ecx + 0x2048], 0
jne 0x4b1b5e
lea edx, [edi + 0x60708]
xor ebx, ebx
cmp word [edi + 0x60708], 0
cmovne ebx, edx
xor edx, edx
cmp dword [ecx + 4], 1
setne dl
lea ecx, [edx*2 + 1]
mov dword [esi + 0x10], ecx
push 0x4b0c50
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov edx, ebx
mov ebx, edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x20]
movzx ecx, word [eax]
add eax, 0x2148
push edi
push dword [ebx + 0x26d4]
push dword [esi + 0x10]
push edx
push dword [esi + 0xc]
push ecx
push eax
push dword [edi + 0x14]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi + 0x18], eax
test eax, eax
je 0x4b1c63
cmp word [ebx + 0x60808], 0
je 0x4b1c4b
mov edi, ebx
add edi, 0x60808
mov dword [esi + 0x14], 3
push edi
call fcn.0047e4dc
add esp, 4
xor ebx, ebx
cmp eax, 0x3ffffffe
jg 0x4b1c2d
lea ecx, [eax*2 + 2]
mov dword [esi + 0xc], ecx
lea eax, [eax*2 + 5]
and eax, 0xfffffffc
call fcn.00460860
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push ecx
push 0xff
push ebx
call fcn.00463600
add esp, 0xc
mov byte [ebx], 0
xor eax, eax
push eax
push eax
push dword [esi + 0xc]
push ebx
push 0xffffffffffffffff
push edi
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove ebx, eax
lea eax, [esi + 0x14]
mov dword [eax + 4], ebx
mov dword [eax + 8], 0x4d937b
push 0xc
push eax
push 0x26
mov eax, dword [ebp + 8]
push dword [eax + 0x14]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov bl, 1
mov ecx, dword [esi + 0x28]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x4b1c4d
Function at 0x4b1d10
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x4ef418]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0x26d8]
mov edx, dword [esi + 0x26dc]
sub edx, ecx
sar edx, 2
cmp edx, eax
jbe 0x4b1deb
mov edi, dword [ecx + eax*4]
mov dword [edi + 0x28], 2
mov ecx, dword [edi + 0x20]
cmp dword [ecx + 4], 1
je 0x4b1d9a
mov bl, 1
cmp dword [esi + 0x2480], 0
je 0x4b1dab
lea eax, [ebp - 0x14]
mov dword [eax], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x2484]
push dword [esi + 0x2480]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4b1dc1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4b1dab
cmp dword [edi], 0
jne 0x4b1dd2
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4b1dd2
mov dword [edi + 0x18], ecx
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4b1dab
xor ebx, ebx
jmp 0x4b1dab
mov dword [edi + 0x28], 0
mov ecx, esi
push 1
push eax
call fcn.004b31c0
mov bl, 1
test al, al
jne 0x4b1dab
jmp 0x4b1dce
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d745c
call fcn.00492230
int3
Function at 0x4b2540
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x26d8]
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edx
jbe 0x4b2623
mov edi, dword [eax + edx*4]
mov dword [edi + 0x28], 6
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 1
je 0x4b25d9
mov bl, 1
cmp dword [esi + 0x2480], 0
je 0x4b25ea
lea eax, [ebp - 0x14]
mov dword [eax], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x2484]
push dword [esi + 0x2480]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4b25c9
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4b25ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
sete bl
jmp 0x4b25ea
cmp dword [edi], 0
jne 0x4b2600
mov eax, dword [edi + 4]
test eax, eax
je 0x4b2600
mov dword [edi + 0x18], eax
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [edi + 0x28], 4
mov ecx, esi
push 1
push edx
mov edi, edx
call fcn.004b31c0
mov bl, 1
test al, al
jne 0x4b25ea
mov ecx, esi
push edi
call fcn.004b30c0
jmp 0x4b25ea
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d745c
call fcn.00492230
int3
Function at 0x4b2a70
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x26d8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edx
jbe 0x4b2ba5
mov ebx, dword [eax + edx*4]
xor eax, eax
mov dword [ebx + 0x8068], eax
xorps xmm0, xmm0
movups xmmword [ebx + 0x8058], xmm0
movups xmmword [ebx + 0x8048], xmm0
mov dword [ebx + 0x8044], 0x28
lea edi, [ebx + 0x40]
mov esi, 0x8000
push esi
push eax
push edi
call fcn.00463600
add esp, 0xc
mov dword [ebx + 0x8058], edi
lea edi, [ebx + 0x805c]
mov dword [ebx + 0x805c], esi
mov ecx, dword [ebx + 0x8040]
test ecx, ecx
je 0x4b2b34
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 0x10]
add edx, dword [ecx + 0x18]
sub eax, edx
inc eax
mov ecx, 0x8000
cmp eax, 0x8000
cmovl ecx, eax
mov dword [edi], ecx
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 9
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
je 0x4b2b55
lea eax, [ebx + 0x8044]
push ebx
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
jmp 0x4b2b6b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x5d100]
mov ecx, dword [ecx + 0x5d104]
and ecx, eax
cmp ecx, 0xffffffff
je 0x4b2b06
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx + 0x5d110]
jmp 0x4b2af7
push edi
push dword [ebx + 0x805c]
push dword [ebx + 0x8058]
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4b2b84
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov al, 1
cmp ecx, 0x3e5
je 0x4b2b7a
mov ecx, dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004b30c0
xor eax, eax
jmp 0x4b2b7a
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d745c
call fcn.00492230
int3
Function at 0x4b2ee0
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1040
call fcn.00460860
mov esi, ecx
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp dword [ecx + 0x2480], ebx
mov eax, 0x4dd9fc
mov edi, str.POST
cmove edi, eax
lea eax, [ebp - 0x18]
mov dword [eax], 0x4dda0e
mov dword [eax + 4], ebx
lea eax, [ebp - 0x1018]
push 0x1000
push ebx
push eax
call fcn.00463600
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
lea ecx, [eax + 0x1048]
add eax, 0x48
push ecx
push eax
push str._s_s
push 0x7ff
lea eax, [ebp - 0x1018]
push eax
call fcn.004b3b70
add esp, 0x14
xor eax, eax
mov dword [ebp - 0x104c], esi
cmp dword [esi + 0x62cb4], ebx
setne al
shl eax, 0x13
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 4], 4
mov ecx, 0x8480f300
mov edx, 0x8400c300
cmove edx, ecx
or edx, eax
push esi
push edx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push str.HTTP_1.1
lea ecx, [ebp - 0x1018]
push ecx
push edi
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4b303e
lea ecx, [ebp - 0x101c]
mov dword [ecx], 0x3a98
mov edi, 4
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push edi
push ecx
push 2
push eax
call esi
lea eax, [ebp - 0x1020]
mov dword [eax], 1
push edi
push eax
push 0x41
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call esi
mov esi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1034], xmm0
movups xmmword [ebp - 0x1044], xmm0
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1048], 0x28
push 0xa2d0
call fcn.00459b73
add esp, 4
test eax, eax
jne 0x4b3057
lea eax, [ebp - 0x1048]
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
push eax
push dword [ecx + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x1040
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ebx, eax
xor eax, eax
test esi, esi
setne al
mov esi, eax
xor eax, eax
push 0xa2d0
push eax
push ebx
call fcn.00463600
add esp, 0xc
mov ecx, dword [ebp - 0x104c]
push esi
push 0x5167
push ebx
mov esi, dword [ebp + 8]
push esi
call fcn.004b3bd0
lea edi, [ebp - 0x1048]
mov dword [edi + 8], ebx
push ebx
call fcn.0047e4dc
add esp, 4
mov dword [edi + 0xc], eax
push esi
push 1
xor eax, eax
push eax
push edi
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
push ebx
call fcn.00459b7c
add esp, 4
jmp 0x4b3039