joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471ff4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [edi + 8]
mov dword [ebp - 0x24], eax
cmp eax, dword [edx + 4]
jne 0x47206a
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
and ecx, 0x7ff
cmp ecx, dword [edi + 0x14]
jne 0x47206a
mov eax, dword [edi + 8]
inc dword [eax + 8]
test byte [0x60ab00], 0x80
je 0x472057
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x58ffd0
push dword [0x60ab0c]
push dword [0x60ab08]
call fcn.0047a366
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd104
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov byte [ebp - 8], 0
push ebx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x15], al
push esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
nop dword [eax]
mov eax, ecx
xor ebx, ebx
and eax, 0x7ff
mov edx, ecx
cmp eax, 0x7fb
sete bl
test ebx, ebx
jne 0x4720ba
test eax, eax
je 0x4720ba
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ebx
cmp byte [ebp - 0x15], bl
jne 0x4720e4
and ecx, 0xfffff800
add ecx, 0x800
and ecx, 0xfffff800
jmp 0x4720e2
mov eax, dword [edi + 0x14]
xor eax, ecx
mov dword [ebp - 0x20], 1
and eax, 0x7ff
xor ecx, eax
cmp byte [ebp - 0x15], 0
je 0x4720e4
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
and ecx, 0x7ff
or ecx, eax
mov esi, dword [edi + 8]
mov eax, edx
lock cmpxchg dword [esi], ecx
mov ecx, eax
cmp ecx, edx
jne 0x472080
cmp dword [ebp - 0x20], 0
mov eax, dword [edi + 8]
jne 0x4721a9
mov eax, dword [eax]
and eax, 0xfffff800
cmp eax, 0x28f5800
jb 0x472118
push 0x1c124c
call fcn.00503c15
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x472150
cmp byte [ebp - 0x15], 0
jne 0x472137
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [ebp - 0x1c], esi
test ebx, ebx
jne 0x472150
jmp 0x47213a
mov esi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, ebx
jae 0x47216d
sub ebx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x15], 1
mov dword [ebp - 0x10], ebx
call fcn.0047233e
jmp 0x472078
mov eax, dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [edi + 8]
mov ecx, eax
shr ecx, 0xb
mov edx, eax
dec ecx
and eax, 0x7ff
shl ecx, 0xb
or ecx, eax
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x472172
pop esi
pop ebx
mov eax, 0x102
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cd104
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov eax, dword [edi + 8]
mov dword [eax + 8], 1
test byte [0x60ab00], 0x80
je 0x4721e2
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x58ffd0
push dword [0x60ab0c]
push dword [0x60ab08]
call fcn.0047a366
mov ecx, dword [ebp - 4]
neg ebx
pop esi
sbb ebx, ebx
xor ecx, ebp
and ebx, 0x80
mov eax, ebx
pop ebx
pop edi
call fcn.004cd104
mov esp, ebp
pop ebp
ret 8
Function at 0x474932
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x60ab00], 0x20
push esi
push edi
mov esi, ecx
je 0x474973
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x58ff50
push dword [0x60ab0c]
push dword [0x60ab08]
call fcn.0048b69b
push 0x1c135e
call fcn.00503c15
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x10], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 4]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x4749bb
cmp ecx, edi
je 0x4749eb
mov esi, eax
mov dword [ebp - 0x10], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x4749bb
cmp ecx, dword [ebp - 0x10]
jne 0x4749bb
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x475ee5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
jne 0x475f00
mov eax, 0x80004005
jmp 0x4760d0
cmp byte [esi + 0x180], bl
je 0x475f0f
xor eax, eax
jmp 0x4760d0
mov ecx, dword [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
call fcn.0048e543
test al, al
jne 0x475f3c
mov eax, dword [esi]
push esi
call dword [eax + 0x30]
test eax, eax
je 0x475f3c
push 0x1c1417
call fcn.00503c15
push edi
call fcn.0041e60f
test al, al
jne 0x475fbe
push 0x2710
lea ecx, [esi + 0x38]
call fcn.00473800
test eax, eax
je 0x475fbe
mov ecx, dword [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [ebp + 8]
sub eax, ebx
je 0x475f99
sub eax, 1
je 0x475fb4
sub eax, 1
je 0x475f99
sub eax, 1
je 0x475f81
push 0x1c1418
call fcn.00503c15
jmp 0x475f8f
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x80004005
jmp 0x4760cf
or ecx, 0xffffffff
mov eax, 0x4e20
cmp dword [ebp + 8], ebx
cmove eax, ecx
lea ecx, [esi + 0x38]
push eax
call fcn.00473800
test eax, eax
je 0x475fbe
mov eax, 0x80004004
jmp 0x4760cf
mov ecx, dword [esi + 0x24]
mov byte [esi + 0x180], 1
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edi, [esi + 0x124]
cmp dword [edi + 8], ebx
je 0x476000
cmp dword [edi], ebx
je 0x476000
jmp 0x475ff1
mov ecx, dword [ebp - 8]
push 1
mov eax, dword [ecx]
call dword [eax + 0x7c]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.0048e296
test al, al
jne 0x475fde
push 0x590520
lea eax, [esi + 0x10]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 4]
call fcn.004b0788
test eax, eax
js 0x476024
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x90]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x476034
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x476040
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x47604c
call fcn.004733a8
lea edi, [esi + 0x7c]
cmp dword [edi + 8], ebx
je 0x47607b
cmp dword [edi], ebx
je 0x47607b
jmp 0x47606c
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.0048e296
test al, al
jne 0x47605a
lea edi, [esi + 0xd0]
cmp dword [edi + 8], ebx
je 0x4760a4
cmp dword [edi], ebx
je 0x4760a4
jmp 0x476095
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.0048e296
test al, al
jne 0x47608c
cmp dword [esi + 0x17c], ebx
je 0x4760cd
call fcn.0048e543
test al, al
je 0x4760c3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esi + 0x17c], ebx
jmp 0x4760cd
push 0x1c141d
call fcn.00503c15
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x478a6d
Capabilities:
Encode data using xor

Disassembly:
push esi
lea esi, [ecx + 0x10]
mov edx, dword [esi]
mov eax, edx
mov ecx, edx
and eax, 0xffffc000
add eax, 0x4000
xor eax, edx
and eax, 0xfffc000
xor edx, eax
mov eax, ecx
lock cmpxchg dword [esi], edx
mov edx, eax
cmp edx, ecx
jne 0x478a73
pop esi
ret

Function at 0x479940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x47995c
mov ebx, 0x80004005
jmp 0x479a14
mov eax, dword [esi + 0x38]
push edi
cmp eax, dword [esi + 0x34]
ja 0x47998c
lea eax, [eax*4 + 0x14]
push eax
lea edi, [esi + 0x2c]
push edi
call fcn.004096d9
pop ecx
pop ecx
test eax, eax
jne 0x479986
mov ebx, 0x8007000e
jmp 0x479a13
add dword [esi + 0x38], 5
mov dword [edi], eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00479a1c
mov ebx, eax
test ebx, ebx
js 0x479a05
mov ecx, dword [esi + 0x40]
or ecx, dword [esi + 0x44]
jne 0x4799b1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edx
mov edi, dword [ebp - 4]
lock inc dword [edi + 0x908]
lea eax, [edi + 0x8f0]
push eax
xor eax, eax
push eax
push edi
push 0x479dc5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4799e5
mov ecx, edi
call fcn.00479bdd
mov ebx, 0x80004005
jmp 0x479a08
mov dword [edi + 0x8ec], eax
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x2c]
push 0x3e
mov dword [eax + ecx*4], edi
xor edi, edi
inc dword [esi + 0x34]
lea eax, [esi + 0x30]
pop ecx
lock xadd dword [eax], ecx
jmp 0x479a08
mov edi, dword [ebp - 4]
test edi, edi
je 0x479a13
mov ecx, edi
call fcn.00479bdd
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47d0b1
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
inc ecx
cmp byte [ebp + 0xc], 0
mov word [ebp - 0x28], cx
je 0x47d0e0
xor eax, eax
mov dword [ebp - 0x24], 0x20
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 8]
jmp 0x47d11a
and dword [ebp - 0x24], 0
and dword [ebp - 0x18], 0
push 2
pop eax
push 6
mov word [ebp - 0x1c], cx
pop ecx
push 0xd
mov word [ebp - 0x1a], cx
pop ecx
mov word [ebp - 0x10], cx
xor ecx, ecx
mov word [ebp - 0x26], ax
mov eax, dword [ebp + 8]
push 3
mov word [ebp - 0xe], cx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], eax
pop ecx
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.004cd104
mov esp, ebp
pop ebp
ret 8
Function at 0x489d78
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x408], eax
test esi, esi
jne 0x489dc1
xor eax, eax
jmp 0x489f26
and dword [esi], 0
push ebx
push edi
xor edi, edi
inc edi
push edi
push eax
push ecx
push 0x400
lea eax, [ebp - 0x404]
push eax
call fcn.0048b3af
mov edx, dword [ebp - 0x408]
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x418], ecx
shr eax, 0x1a
xor ebx, ebx
and dword [ebp - 0x41c], ebx
not eax
and eax, edi
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x489e28
mov eax, edx
shr eax, 0x17
push ecx
and eax, edi
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edx, dword [ebp - 0x408]
mov dword [esi], eax
mov eax, dword [ebp - 0x414]
cmp dword [esi], ebx
jne 0x489ecb
test eax, eax
je 0x489ecb
xor eax, eax
push edi
lea eax, [ebp - 0x40c]
push eax
push edx
call fcn.0048b0ec
test eax, eax
je 0x489ebb
mov eax, dword [ebp - 0x408]
push dword [ebp - 0x418]
shr eax, 0x19
and eax, edi
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x40c]
push edi
push eax
push dword [ebp - 0x408]
call fcn.0048b299
mov eax, dword [ebp - 0x410]
cmp eax, 5
jne 0x489ebd
cmp dword [ebp - 0x41c], ebx
jne 0x489ebd
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x41c], edi
jmp 0x489e02
mov eax, ebx
cmp dword [esi], ebx
je 0x489ecb
xor ebx, ebx
cmp eax, 0xb7
setne bl
cmp dword [esi], 0
je 0x489ed5
cmp dword [esi], 0xffffffff
jne 0x489eef
cmp dword [ebp - 0x414], 0
je 0x489ee8
push 0x1631e1
call fcn.00503c15
and dword [esi], 0
xor ebx, ebx
xor edi, edi
mov edx, dword [ebp - 0x420]
test edx, edx
je 0x489f16
mov ecx, dword [ebp - 0x418]
mov eax, 0x56e14b
test ecx, ecx
cmovne eax, ecx
push eax
push dword [ebp + 0x14]
push edx
call fcn.004f44c5
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x489f22
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cd104
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x48af49
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], esi
push edi
test ebx, ebx
jne 0x48af75
push 0x15b3c8
jmp 0x48afad
cmp dword [0x61ad6c], esi
je 0x48af8c
mov eax, dword [0x602238]
xor edi, edi
mov dword [ebx], eax
inc edi
jmp 0x48b0b8
lea eax, [ebp - 0x50]
mov dword [ebx], esi
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x48afb9
push 0x15b3c9
call fcn.00503c15
mov edi, esi
jmp 0x48b0b8
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x48afd7
push 0x15b3ca
jmp 0x48afad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x48afe9
push 0x15b3cb
jmp 0x48afad
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c]
call fcn.00467064
mov esi, dword [ebp - 0x4c]
test al, al
jne 0x48b00c
push 0x15b3cc
call fcn.00503c15
xor edi, edi
jmp 0x48b0ab
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x48b026
push 0x15b3cd
jmp 0x48b000
push 0x44
pop edi
push edi
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.004d19ad
add esp, 0xc
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x48b058
push 0x15b3ce
jmp 0x48b000
xor ecx, ecx
mov dword [ebp - 0x58], ecx
test esi, esi
je 0x48b0de
lea eax, [esi + 4]
xor edi, edi
mov dword [ebp - 0x4c], eax
inc edi
cmp ecx, dword [esi]
jae 0x48b09e
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x48b08d
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x48b09c
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x58], ecx
add eax, 8
jmp 0x48b064
mov dword [ebx], edi
mov dword [0x61ad6c], edi
mov eax, dword [ebx]
mov dword [0x602238], eax
test esi, esi
je 0x48b0b6
push esi
call fcn.004f6c27
pop ecx
xor esi, esi
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x48b0c9
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cd104
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov dword [0], 1
int 0x29
Function at 0x48b796
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x6029bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
mov dword [ebp - 0x230], ecx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004d19ad
add esp, 0xc
mov dword [ebp - 0x218], esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], esi
mov ebx, esi
mov dword [ebp - 0x21c], esi
mov edi, esi
mov dword [ebp - 0x228], esi
push 0x104
push eax
push esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x48b8d1
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004d1ccf
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x48b832
lea ebx, [ebp - 0x20c]
jmp 0x48b837
push 2
pop eax
add ebx, eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 3
call sub.VERSION.dll_GetFileVersionInfoSizeExW
mov dword [ebp - 0x214], eax
test eax, eax
je 0x48b8cb
push eax
call fcn.00409735
mov edi, eax
pop ecx
test edi, edi
je 0x48b8cb
push edi
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push esi
push eax
push 3
call sub.VERSION.dll_GetFileVersionInfoExW
test eax, eax
je 0x48b8cb
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x56d030
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x48b8cb
cmp dword [ebp - 0x218], 0x34
jne 0x48b8cb
mov eax, dword [ebp - 0x21c]
movzx ecx, word [eax + 8]
movzx esi, word [eax + 0xa]
mov dword [ebp - 0x228], ecx
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x210]
test ecx, ecx
lea eax, [ecx + 0x19]
push 0x20
pop edx
cmove eax, edx
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x214], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00409735
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x230]
mov dword [eax + 4], ecx
test ecx, ecx
jne 0x48b90d
mov esi, 0x8007000e
jmp 0x48b955
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x210], 0
movzx eax, ax
push eax
mov eax, dword [ebp - 0x224]
movzx eax, ax
push eax
mov eax, dword [ebp - 0x228]
movzx eax, ax
push eax
movzx eax, si
push eax
mov eax, 0x5713c4
cmovne eax, ebx
push eax
push str._s__d._d._d._d
push dword [ebp - 0x214]
push ecx
call fcn.0048bb05
add esp, 0x20
mov esi, eax
test edi, edi
je 0x48b960
push edi
call fcn.004f6c27
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cd104
mov esp, ebp
pop ebp
ret
Function at 0x492dd7
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [eax]
call fcn.004930bb
mov esi, dword [ebp + 8]
test al, al
je 0x492e11
mov eax, dword [esi + 8]
mov eax, dword [eax + 4]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x492dfe
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push str.Mso::Http__s_:_calling_WinHttpReadData
push 3
call fcn.00492c97
mov eax, dword [esi + 8]
push 0
push dword [esi + 4]
push dword [eax + 8]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
mov eax, dword [esi]
pop edi
setne cl
pop esi
mov byte [eax], cl
pop ebp
ret 8
Function at 0x499fe6
Capabilities:
Receive http response

Disassembly:
push 0x5c
mov eax, 0x55e13e
call fcn.004cd142
mov esi, ecx
cmp byte [esi + 0x4c], 0
je 0x49a01c
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x98]
mov dword [eax], edx
mov ecx, dword [esi + 0xa0]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xa4]
mov dword [eax + 0xc], ecx
jmp 0x49a187
cmp byte [esi + 0x11], 0
jne 0x49a048
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 6
push eax
push dword [ebp + 8]
xorps xmm0, xmm0
lea ecx, [esi + 0x84]
movlpd qword [ebp - 0x30], xmm0
call fcn.00490143
jmp 0x49a184
mov eax, dword [esi + 0x3c]
xor ebx, ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov edi, ebx
cmp dword [esi + 0x34], 0
mov dword [ebp - 0x18], ebx
je 0x49a13e
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x34]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x49a08f
xorps xmm0, xmm0
mov dword [ebp - 0x38], ebx
movlpd qword [ebp - 0x30], xmm0
lea ecx, [ebp - 0x38]
jmp 0x49a0a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00495240
mov ecx, eax
mov eax, dword [ecx + 8]
mov ebx, dword [ecx]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x49a155
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
test eax, eax
je 0x49a127
add eax, edi
push eax
call fcn.0043ccf1
and dword [ebp - 0x1c], ebx
cmp dword [esi + 0x34], ebx
je 0x49a13e
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
add eax, edi
push eax
push dword [esi + 0x34]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x49a0fb
and dword [ebp - 0x48], ebx
lea ecx, [ebp - 0x48]
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
jmp 0x49a10d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00495240
mov ecx, eax
mov eax, dword [ecx + 8]
mov ebx, dword [ecx]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x14], eax
test ebx, ebx
jne 0x49a155
add edi, dword [ebp - 0x1c]
jmp 0x49a061
push edi
call fcn.0043ccf1
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x3c]
call fcn.0040f414
mov dword [esi + 0x48], edi
jmp 0x49a155
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
push 6
mov dword [ebp - 0x10], eax
pop ebx
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x98]
mov byte [esi + 0x4c], 1
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x14]
push eax
push dword [ebp + 8]
mov dword [eax + 0xc], ecx
lea ecx, [esi + 0x84]
mov dword [eax], ebx
call fcn.00490143
lea ecx, [ebp - 0x28]
call fcn.0041193a
mov eax, dword [ebp + 8]
call fcn.004cd113
ret 4
Function at 0x49bba0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [eax]
call fcn.004930bb
mov esi, dword [ebp + 8]
test al, al
je 0x49bbda
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x28]
add eax, 0x1c
cmp dword [eax + 0x14], 8
jb 0x49bbc7
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push str.Mso::Http__s_:_calling_WinHttpReceiveResponse
push 3
call fcn.0049b9c9
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
mov eax, dword [esi]
pop edi
setne cl
pop esi
mov byte [eax], cl
pop ebp
ret 8

Function at 0x49dca5
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push dword [ecx + 0x3c]
lea ecx, [ebp - 0x14]
call fcn.0049d2ca
lea ecx, [ebp - 0x14]
call fcn.0049efe7
xor edi, edi
test al, al
je 0x49dd4b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
test eax, eax
je 0x49dd4b
push ebx
mov ebx, dword [ebp - 0xc]
cmp ebx, 1
jbe 0x49dd4a
push esi
push SysReAllocString
push edi
add ebx, 0xb
mov dword [ebp - 4], edi
push ebx
call fcn.0045facc
push eax
lea ecx, [ebp - 4]
call fcn.00467064
mov esi, dword [ebp - 4]
test al, al
je 0x49dd3e
push ebx
push esi
push str.Cookie:
call fcn.004600f8
push ebx
push esi
push dword [ebp - 8]
call fcn.004616c0
push ebx
push esi
push 0x582094
call fcn.004616c0
push 0xa0000000
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x49dd3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x49dd49
push esi
call fcn.004f6c27
pop ecx
pop esi
pop ebx
lea ecx, [ebp - 0x14]
call fcn.0049d34f
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4