joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421ec8
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x531028
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x34]
cmp edi, 0xffffffff
je 0x421eeb
push 2
push edi
mov dword [esi + 0x34], 0xffffffff
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
call fcn.004225f0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x34], eax
jne 0x421f1b
pop edi
or eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
push ebx
push 4
lea ecx, [esp + 0x14]
push ecx
push 8
push 0xffff
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [esp + 0x34]
push edx
lea ecx, [esp + 0x10]
call fcn.00403380
lea ebx, [esp + 0xc]
mov dword [esp + 0x2c], 0
call fcn.004230f0
mov edi, eax
call fcn.00423140
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
mov word [esp + 0x14], 2
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x421fce
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
or ebx, 0xffffffff
cmp eax, ebx
jne 0x421fc8
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421fb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
mov dword [esp + 0x18], eax
jmp 0x421fd1
or ebx, 0xffffffff
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi + 0x34]
push 0x10
lea ecx, [esp + 0x18]
push ecx
push edx
mov word [esp + 0x22], ax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x421f91
mov eax, dword [esi + 0x1070]
test eax, eax
je 0x422013
push eax
call fcn.0051fe99
add esp, 4
mov dword [esi + 0x1070], 0
push 0x601c
call fcn.0051fe94
mov edi, eax
xor eax, eax
mov dword [esi + 0x1070], edi
add esp, 4
mov ecx, 0x1807
rep stosd dword es:[edi], eax
mov dword [esi + 0x1074], 0x1807
mov eax, dword [esi + 0x34]
push 0x7fffffff
push eax
call dword [sym.imp.WS2_32.dll_listen]
mov esi, eax
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x42206b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x24]
pop ebx
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x422e00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push esi
push edi
mov esi, ecx
mov ecx, dword [ebx + 0x34]
mov edi, eax
xor ebp, ebp
xor eax, eax
cmp ecx, 0xffffffff
je 0x422e5f
test edi, edi
jle 0x422e5f
cmp eax, 0xffffffff
je 0x422e5f
cmp edi, 0x400
mov eax, edi
jle 0x422e2b
mov eax, 0x400
mov ecx, dword [ebx + 0x1058]
test ecx, ecx
je 0x422e42
push eax
push esi
push ecx
call fcn.00503e30
add esp, 0xc
jmp 0x422e50
push 0
push eax
mov eax, dword [ebx + 0x34]
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x422e65
sub edi, eax
add esi, eax
add ebp, eax
test edi, edi
jg 0x422e17
pop edi
pop esi
mov eax, ebp
pop ebp
ret
mov ecx, ebx
call fcn.00422730
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret

Function at 0x430220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x530f00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push edi
lea eax, [esp + 0x24]
push eax
call dword [0x535340]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
xor ebx, ebx
push edx
mov word [esp + 0x3a], bx
call dword [0x5353d4]
mov ebp, dword [esp + 0x44]
mov eax, dword [ebp + 0x60]
add ebp, 0x60
cmp eax, ebx
jne 0x4302e4
push ebx
mov edi, ebp
call fcn.00430470
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 0xc], edx
movzx eax, word [esp + 0x30]
movzx ecx, word [esp + 0x2e]
movzx edx, word [esp + 0x2c]
push eax
movzx eax, word [esp + 0x28]
push ecx
movzx ecx, word [esp + 0x2e]
push edx
push eax
movzx eax, word [esp + 0x3a]
lea edx, [ecx*4 + 0x586df0]
movzx ecx, word [esp + 0x38]
push edx
push eax
mov eax, dword [ebp]
lea edx, [ecx*4 + 0x586dd8]
push edx
add eax, 0x10
push str._s___02d__s__d__02d:_02d:_02d_GMT
push eax
call fcn.0044c220
add esp, 0x24
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
call fcn.00419160
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x18]
add esp, 8
cmp ecx, edx
jne 0x430311
mov edx, dword [eax + 0xc]
cmp edx, dword [esp + 0x14]
je 0x430398
push esi
mov dword [esp + 0x10], ebx
push ebx
lea edi, [esp + 0x14]
mov dword [esp + 0x44], ebx
call fcn.00430470
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x18]
lea edx, [esi + 0x10]
push edx
lea eax, [esp + 0x2c]
mov dword [esi + 0xc], ecx
call fcn.004368d0
mov eax, dword [esp + 0x4c]
add esp, 4
push 1
add eax, 0x40
push eax
lea ecx, [esp + 0x24]
call fcn.004b93b1
mov ecx, edi
push ecx
mov edi, ebp
mov byte [esp + 0x44], 1
call fcn.0040e6c0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], bl
call fcn.004b938f
lea eax, [esi + 4]
mov dword [esp + 0x40], 0xffffffff
cmp dword [eax], ebx
je 0x430397
push eax
call dword [0x535428]
test eax, eax
jne 0x430397
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
pop esi
mov ecx, dword [esp + 0x34]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x4328c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x530948
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push edi
mov edi, ecx
xor ebp, ebp
cmp edi, ebp
je 0x432a57
mov ebx, dword [esp + 0x4c]
cmp ebx, ebp
je 0x432a57
push edi
mov dword [ebx], ebp
call dword [0x535464]
shl eax, 1
cmp eax, 0x64
jge 0x432908
mov eax, 0x3e8
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], eax
call dword [0x535754]
cmp eax, ebp
mov dword [esp + 0x18], eax
je 0x432922
mov byte [eax], 0
cmp eax, ebp
mov dword [esp + 0x44], ebp
jne 0x43294a
push ebp
call dword [0x53576c]
pop edi
pop ebp
mov eax, 0x8007000e
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
mov dword [esi], edi
cmp byte [edi], 0
mov dword [esp + 0xc], ebp
je 0x4329a3
mov ebp, dword [0x535630]
jmp 0x432960
mov edi, dword [esi]
cmp byte [edi], 0x25
push edi
jne 0x432974
call ebp
mov edi, eax
mov dword [esi], edi
cmp byte [edi], 0x25
jne 0x4329cc
push edi
call ebp
sub eax, edi
push eax
lea ebx, [esp + 0x14]
push edi
call fcn.004316b0
test eax, eax
je 0x432a4a
mov ecx, dword [esi]
push ecx
call ebp
mov edx, eax
mov dword [esi], eax
cmp byte [edx], 0
jne 0x432960
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x18]
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
push eax
call dword [0x53576c]
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
mov bl, 0x25
mov eax, edi
call fcn.004322f0
mov edi, eax
test edi, edi
je 0x432a3d
mov ecx, dword [esi]
sub eax, ecx
cmp eax, 0x1f
jg 0x432a30
inc eax
push eax
push ecx
lea eax, [esp + 0x24]
push eax
call dword [0x535328]
mov eax, dword [esi + 4]
lea ecx, [esp + 0x1c]
push ecx
call fcn.00432170
test eax, eax
je 0x432a3d
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00431720
test eax, eax
je 0x432a4a
cmp dword [esi], edi
je 0x43298b
lea ebx, [ebx]
mov eax, dword [esi]
push eax
call ebp
cmp eax, edi
mov dword [esi], eax
jne 0x432a20
jmp 0x43298b
mov dword [esp + 0xc], 0x80004005
jmp 0x4329a9
mov dword [esp + 0xc], 0x80020009
jmp 0x4329a9
mov dword [esp + 0xc], 0x8007000e
jmp 0x4329a9
mov ecx, dword [esp + 0x3c]
pop edi
pop ebp
mov eax, 0x80004003
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x435060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x530dd5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push esi
push edi
mov edi, dword [esp + 0x240]
mov esi, ecx
mov dword [esp + 0x14], 0
call fcn.0051ffd3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x244]
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
mov ebx, 1
push ecx
mov dword [esp + 0x24c], ebx
call fcn.004bc6da
lea edx, [esp + 0x40]
push edx
call fcn.004bae5d
add esp, 0x18
push ebx
lea eax, [esi + 0xbc]
push eax
lea ecx, [esp + 0x24]
call fcn.004b93b1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x30]
add esi, 0xdc
push edx
mov ecx, esi
mov byte [esp + 0x240], 2
call fcn.0051f0d9
lea ecx, [esp + 0x1c]
call fcn.004b938f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x43515d
add eax, 0xfffffff0
push eax
call fcn.00401400
add eax, 0x10
add esp, 4
mov dword [edi], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x238], bl
call fcn.004b938f
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x435259
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x38]
push ecx
push 0x80000000
call dword [0x53501c]
test eax, eax
jne 0x4351cd
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
push str.Content_Type
push edx
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x40], ebx
call dword [0x535070]
test eax, eax
jne 0x4351c2
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x10]
call fcn.00402fe0
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x535074]
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 0xc]
test eax, eax
jne 0x4351e8
push 0x18
push str.application_octet_stream
lea ecx, [esp + 0x14]
call fcn.00403060
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.004b937a
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.0051f27b
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.004038f0
lea ecx, [esp + 0x1c]
call fcn.004b938f
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00401400
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [edi], eax
mov dword [esp + 0x14], ebx
mov byte [esp + 0x238], bl
call fcn.004b938f
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x435263
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x230]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret 8
Function at 0x4393c0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x2c
push esi
call fcn.0044d360
mov esi, eax
cmp dword [0x586fa8], esi
je 0x4393ee
push 1
push 0x586fac
call dword [0x535434]
test eax, eax
jne 0x4395b1
mov dword [0x586fa8], esi
inc dword [0x586fb0]
je 0x4395b1
mov eax, dword [0x572278]
test eax, eax
je 0x4395b1
push ebx
push 0x572260
call dword [0x535420]
mov eax, dword [0x586fa0]
xor ebx, ebx
test eax, eax
mov dword [esp + 0xc], ebx
jbe 0x439578
push ebp
push edi
push 0x1c
lea eax, [esp + 0x24]
push eax
push ebx
call dword [0x53534c]
cmp eax, 0x1c
jne 0x439576
cmp dword [esp + 0x30], 0x1000
jne 0x43955f
cmp dword [esp + 0x38], 0x40000
je 0x43955f
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x43955f
mov eax, dword [esp + 0x20]
cmp ecx, eax
jne 0x43955f
push 2
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [0x5353d8]
test eax, eax
je 0x43955f
mov edi, dword [esp + 0x20]
cmp word [edi], 0x5a4d
jne 0x43955f
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + edi]
add ecx, edi
cmp eax, 0x4550
jne 0x43955f
mov esi, dword [ecx + 0x80]
mov eax, 0xcccccccd
mul dword [ecx + 0x84]
shr edx, 4
add esi, edi
xor ebp, ebp
dec edx
mov dword [esp + 0x18], edx
je 0x43955f
lea ebx, [esi + 0x10]
jmp 0x4394d7
mov edi, dword [esp + 0x20]
mov eax, dword [ebx - 4]
test eax, eax
je 0x43955b
mov eax, dword [ebx]
test eax, eax
je 0x43955b
mov ecx, dword [edi + eax]
add edi, eax
test ecx, ecx
je 0x43954f
lea ecx, [ecx]
mov esi, dword [0x586fa4]
test esi, esi
je 0x439541
lea ebx, [ebx]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x43950c
mov eax, dword [esi]
jmp 0x43950f
mov eax, dword [esi + 4]
cmp ecx, eax
je 0x43951c
mov esi, dword [esi + 8]
test esi, esi
jne 0x439500
jmp 0x439541
lea edx, [esp + 0x1c]
push edx
push 0x40
push 4
push edi
call dword [0x5352f4]
test eax, eax
je 0x439541
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x43953c
mov esi, dword [esi]
jmp 0x43953f
mov esi, dword [esi + 4]
mov dword [edi], esi
mov ecx, dword [edi + 4]
add edi, 4
test ecx, ecx
jne 0x4394f0
mov edx, dword [esp + 0x18]
add ebx, 0x14
inc ebp
cmp ebp, edx
jb 0x4394d3
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov eax, dword [0x586fa0]
add ebx, ecx
cmp ebx, eax
mov dword [esp + 0x14], ebx
jb 0x439428
pop edi
pop ebp
mov eax, dword [0x586fb0]
dec eax
pop ebx
mov dword [0x586fb0], eax
jne 0x43959d
push 0
push 0x586fac
mov dword [0x586fa8], 0
call dword [0x535434]
mov eax, dword [0x572278]
test eax, eax
je 0x4395b1
push 0x572260
call dword [0x53541c]
pop esi
add esp, 0x2c
ret
Function at 0x43b320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52bee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
xor edi, edi
push eax
mov esi, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call dword [0x535498]
mov dword [esp + 0x2c], edi
mov ecx, dword [esi]
push edi
lea edx, [esp + 0x38]
push edx
push esi
mov dword [esp + 0x90], edi
call dword [ecx + 0x30]
test eax, eax
jge 0x43b375
xor eax, eax
mov dword [esp + 0x10], edi
jmp 0x43b381
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
push eax
lea ecx, [esp + 0x18]
call fcn.0043b260
mov ebx, eax
cmp ebx, edi
jge 0x43b3d8
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x43b3b7
push eax
call dword [0x5354a8]
test eax, eax
jl 0x43b3b7
mov edx, dword [esp + 0x2c]
push edx
call dword [0x5354a0]
test eax, eax
jl 0x43b3b7
mov dword [esp + 0x2c], edi
lea eax, [esp + 0x1c]
push eax
call dword [0x535490]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
add esp, 0x7c
ret 4
mov edx, dword [esi]
lea ebx, [esp + 0xc]
push ebx
push edi
xor ecx, ecx
push ecx
xor eax, eax
push eax
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call dword [edx + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esi]
push edi
push ecx
push edx
push esi
call dword [eax + 0xc]
mov eax, dword [esp + 0x2c]
push eax
call dword [0x5354a8]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x8c]
mov dword [ecx + 8], eax
mov word [ecx], 0x2011
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x30], edi
call dword [0x535490]
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x7c
ret 4
Function at 0x4490a6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52c8ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], 1
mov dword [esi], 0x535e90
mov eax, dword [0x58ada8]
xor edi, edi
mov ecx, 0x58ada8
mov dword [esp + 0x14], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 8], eax
push str.Unknown_Browser
lea ecx, [esi + 0xc]
mov byte [esp + 0x18], 1
call fcn.0040e1f0
push str.Unknown_Browser
lea ecx, [esi + 0x10]
mov byte [esp + 0x18], 2
call fcn.0040e1f0
mov edx, dword [0x58ada8]
mov ecx, 0x58ada8
mov byte [esp + 0x14], 3
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [0x58ada8]
mov ecx, 0x58ada8
mov byte [esp + 0x14], 4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x18], eax
mov edx, dword [0x58ada8]
mov ecx, 0x58ada8
mov byte [esp + 0x14], 5
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
push 0x535e60
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 6
call fcn.0040e1f0
mov ecx, dword [esp + 0xc]
mov word [esi + 0x24], di
mov word [esi + 0x26], di
mov word [esi + 0x28], di
mov word [esi + 0x2c], di
mov word [esi + 0x2e], di
mov word [esi + 0x30], di
mov word [esi + 0x32], di
mov word [esi + 0x34], di
mov word [esi + 0x36], di
mov word [esi + 0x38], di
mov word [esi + 0x3a], di
mov word [esi + 0x3c], di
mov word [esi + 0x3e], di
mov word [esi + 0x40], di
mov word [esi + 0x42], di
mov word [esi + 0x44], di
mov word [esi + 0x2a], 0xffff
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x459849
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x52d2f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], 1
xor edi, edi
lea ebp, [esi + 0x18]
mov dword [esi], 0x536e8c
mov dword [esp + 0x28], edi
mov dword [ebp], edi
push 0x88
mov byte [esp + 0x2c], 1
call fcn.0051fe69
add esp, 4
cmp eax, edi
je 0x4598ad
mov dword [eax + 4], 1
mov dword [eax], 0x536e28
mov dword [eax + 0x68], edi
mov dword [eax + 0x6c], edi
mov dword [eax + 0x70], edi
mov dword [eax + 0x74], edi
mov dword [eax + 0x78], edi
mov dword [eax + 0x7c], edi
mov dword [eax + 0x80], edi
mov dword [eax + 0x84], edi
jmp 0x4598af
xor eax, eax
push eax
push ebp
call dword [0x535434]
cmp eax, edi
je 0x4598c1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [ebp]
push edx
push eax
lea edx, [esp + 0x18]
push edx
call fcn.004592c0
mov edx, dword [eax]
lea ecx, [esi + 8]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x4675d8
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x52de38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], 1
mov dword [esi + 0xc], edi
push edi
push 1
lea ecx, [esi + 0x28]
mov dword [esp + 0x20], edi
mov dword [esi], 0x537768
mov dword [esi + 8], 0x537744
mov dword [esi + 0x10], 0x5376e0
mov dword [esi + 0x14], 0x5376a8
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
call fcn.00466100
mov dword [esi + 0x430], edi
mov dword [esi + 0x438], edi
mov dword [esi + 0x43c], edi
mov dword [esi + 0x440], 0xa0404000
mov dword [esi + 0x444], edi
mov dword [esi + 0x44c], 1
mov dword [esi + 0x448], 0x537620
mov dword [esi + 0x450], edi
mov dword [esi + 0x454], edi
mov dword [esi + 0x458], edi
mov dword [esi + 0x45c], edi
mov dword [esi + 0x460], edi
mov dword [esi + 0x464], edi
cmp dword [0x587a88], edi
jne 0x4676f0
lea eax, [esp + 8]
push eax
push 1
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
mov dword [esp + 0x20], 0x40
call dword [0x53501c]
test eax, eax
jne 0x4676cc
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x587a48
push edi
push edi
push 0x537660
push edx
call dword [0x535070]
mov eax, dword [esp + 8]
push eax
call dword [0x535074]
push 0x10000000
push edi
push edi
push edi
push 0x587a48
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0x467330
push eax
mov dword [0x587a88], eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallback]
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46d400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
xor eax, eax
mov dword [esp + 0x28], eax
push ebx
mov bl, byte [ebp + 0xc]
mov dword [esp + 0x30], eax
push edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x18
lea edx, [esp + 0x3c]
push edx
push eax
push eax
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 8]
push 0x74080
push eax
call dword [0x535164]
test eax, eax
je 0x46d4d9
mov cl, byte [esp + 0x34]
mov al, 1
test al, cl
je 0x46d4d9
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x1c], bl
and bl, al
mov dword [esp + 0x28], ecx
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
xor eax, eax
push eax
mov dword [esp + 0x30], ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [ebp + 8]
push 0x210
mov ecx, 0x84
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x54]
push eax
push 0x20
lea ecx, [esp + 0x24]
push ecx
or bl, 0xfa
push 0x7c088
shl bl, 4
push edx
mov byte [esp + 0x3a], 0xec
mov byte [esp + 0x39], bl
mov dword [esp + 0x30], 0x200
call dword [0x535164]
test eax, eax
jne 0x46d4e1
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov eax, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x74]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x78]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x7c]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov byte [esi + 0x14], 0
lea eax, [esi + 1]
mov edi, 0xa
mov cl, byte [eax - 1]
mov dl, byte [eax]
mov byte [eax - 1], dl
mov byte [eax], cl
add eax, 2
dec edi
jne 0x46d511
xor eax, eax
cmp byte [eax + esi], 0x20
jge 0x46d52d
mov byte [eax + esi], 0x20
inc eax
cmp eax, 0x14
jl 0x46d523
pop edi
mov eax, 0x14
pop ebx
mov esp, ebp
pop ebp
ret