joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468190
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b8f18
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 8], 0xffffffff
jne 0x4681cb
mov esi, dword [ebx]
mov ecx, edi
call fcn.0045c920
push eax
mov ecx, ebx
call dword [esi + 0xa4]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, edi
call fcn.0045cc90
push eax
mov ecx, edi
call fcn.0045c8b0
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x46824d
call esi
cmp eax, 0x2714
je 0x4681d1
call esi
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x24]
push eax
call fcn.0045cdf0
push eax
push esi
mov dword [ebp - 4], 0
call fcn.00468530
mov edx, dword [ebp - 0x10]
add esp, 8
cmp edx, 0x10
jb 0x46824d
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x468243
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x468243
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00436511
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x468260
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4baf28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
cmp dword [edi + 8], 0xffffffff
jne 0x4682a1
mov esi, dword [edi]
mov ecx, ebx
call fcn.0045c920
push eax
mov ecx, edi
call dword [esi + 0xa4]
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x98]
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.0045cc90
mov ecx, ebx
mov esi, eax
call fcn.0045c8b0
push esi
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x468336
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2734
je 0x468310
cmp esi, 0x2733
je 0x468310
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.0045cdf0
push eax
push esi
mov byte [ebp - 4], 1
call fcn.00468530
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0040c180
mov eax, dword [edi]
mov ecx, edi
push 7
push dword [ebp + 0xc]
mov eax, dword [eax + 0x64]
call eax
test al, al
je 0x468372
mov ecx, edi
call fcn.00469b10
test eax, eax
je 0x468336
push eax
call fcn.004684a0
add esp, 4
mov eax, dword [edi]
mov ecx, edi
push 1
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x98]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.connect_timed_out
lea ecx, [ebp - 0x44]
call fcn.0040c140
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.0045cdf0
push 0
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x88]
call fcn.00438780
push 0x4f9eb8
lea eax, [ebp - 0x88]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4683c0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b8f18
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 8], 0xffffffff
jne 0x4683fb
mov esi, dword [edi]
mov ecx, ebx
call fcn.0045c920
push eax
mov ecx, edi
call dword [esi + 0xa4]
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x98]
mov ecx, ebx
call fcn.0045cc90
push eax
mov ecx, ebx
call fcn.0045c8b0
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x468460
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2734
je 0x468460
cmp esi, 0x2733
je 0x468460
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.0045cdf0
push eax
push esi
mov dword [ebp - 4], 0
call fcn.00468530
add esp, 8
lea ecx, [ebp - 0x24]
call fcn.0040c180
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x469270
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
push 1
mov edi, ecx
call fcn.004680c0
mov ebp, dword [esp + 0x44]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
nop word [eax + eax]
mov edx, dword [edi + 8]
push 0
cmp edx, 0xffffffff
je 0x46932c
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov ecx, dword [ebp]
push 0
push dword [esi]
mov esi, dword [esp + 0x54]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 4]
sub eax, ecx
mov dword [esp + 0x50], 0
push dword [esi]
lea esi, [esp + 0x20]
sar eax, 3
push esi
lea esi, [esp + 0x58]
push esi
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x4692e4
call fcn.00468b00
cmp byte [edi + 0x20], 0
mov esi, dword [esp + 0x44]
je 0x4692fb
test esi, esi
jns 0x469320
call ebx
cmp eax, 0x2714
je 0x469290
test esi, esi
jns 0x469320
call ebx
cmp eax, 0x2733
jne 0x469310
cmp byte [edi + 0x20], 0
jne 0x469344
jmp 0x469320
cmp eax, 0x274c
je 0x469344
push eax
call fcn.004684a0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x10
lea ecx, [esp + 0x18]
call fcn.00463790
push 0x4fcfa4
lea eax, [esp + 0x18]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push eax
lea ecx, [esp + 0x18]
call fcn.004387b0
push 0x4f9eb8
lea eax, [esp + 0x18]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x469360
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
push 1
mov edi, ecx
call fcn.004680c0
mov ebp, dword [esp + 0x50]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
nop word [eax + eax]
mov eax, dword [edi + 8]
cmp eax, 0xffffffff
je 0x4693ea
mov ecx, dword [esp + 0x4c]
push dword [ecx]
mov ecx, dword [esp + 0x4c]
push dword [ecx]
push ebp
push dword [esp + 0x50]
push dword [esp + 0x50]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp byte [edi + 0x20], 0
mov esi, eax
je 0x4693b9
test esi, esi
jns 0x4693de
call ebx
cmp eax, 0x2714
je 0x469380
test esi, esi
jns 0x4693de
call ebx
cmp eax, 0x2733
jne 0x4693ce
cmp byte [edi + 0x20], 0
jne 0x469404
jmp 0x4693de
cmp eax, 0x274c
je 0x469404
push eax
call fcn.004684a0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x14
push 0
lea ecx, [esp + 0x14]
call fcn.00463790
push 0x4fcfa4
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push eax
lea ecx, [esp + 0x14]
call fcn.004387b0
push 0x4f9eb8
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x46ab50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb25e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [esi + 8]
call fcn.0046f460
mov dword [edi + 0x28], esi
lea esi, [edi + 0x30]
mov dword [edi], vtable.Poco::Net::WebSocketImpl.0
mov dword [edi + 0x2c], getpeername
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov al, byte [ebp + 0x10]
lea ecx, [edi + 0x4c]
push 0x100
mov byte [ebp - 4], 1
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov byte [edi + 0x48], al
call fcn.0048ae50
mov ecx, dword [edi + 0x28]
mov eax, 1
mov byte [ebp - 4], 2
add ecx, 4
lock xadd dword [ecx], eax
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00463240
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46b420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b8f18
push eax
mov dword fs:[0], esp
sub esp, 0x44
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.0046b380
mov edx, eax
test edx, edx
jle 0x46b484
cmp byte [ebp + 0x14], 0
je 0x46b471
xor ecx, ecx
test edx, edx
jle 0x46b471
push esi
mov esi, dword [ebp + 0x10]
nop
mov eax, ecx
and eax, 3
mov al, byte [eax + esi]
xor byte [ecx + edi], al
inc ecx
cmp ecx, edx
jl 0x46b460
pop esi
mov ecx, dword [ebp - 0xc]
mov eax, edx
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push str.Incomplete_frame_received
lea ecx, [ebp - 0x24]
call fcn.0040c140
push 0xb
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.00463980
push 0x4fcb78
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x46b520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba7db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], ecx
lea esi, [ebx + 0xe]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x20], 1
test esi, esi
je 0x46b56b
push esi
call fcn.004369a1
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
push 1
push 0
push esi
push edi
lea ecx, [ebp - 0xd4]
mov dword [ebp - 4], 0
call fcn.0048a9f0
push 2
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1c]
call fcn.00487f70
mov eax, dword [ebp + 0x10]
mov edx, 0x82
movzx ecx, al
test eax, eax
mov byte [ebp - 4], 2
cmovne edx, ecx
lea ecx, [ebp - 0x1c]
movzx eax, dl
push eax
call fcn.004880f0
mov ecx, dword [ebp - 0x10]
mov cl, byte [ecx + 0x48]
neg cl
sbb cl, cl
and cl, 0x80
cmp ebx, 0x7e
jge 0x46b5da
or cl, bl
movzx eax, cl
lea ecx, [ebp - 0x1c]
push eax
call fcn.004880f0
jmp 0x46b616
cmp ebx, 0x10000
jge 0x46b5fb
or cl, 0x7e
movzx eax, cl
lea ecx, [ebp - 0x1c]
push ebx
push eax
call fcn.004880f0
mov ecx, eax
call fcn.00488110
jmp 0x46b616
mov eax, ebx
or cl, 0x7f
cdq
push edx
push eax
movzx eax, cl
lea ecx, [ebp - 0x1c]
push eax
call fcn.004880f0
mov ecx, eax
call fcn.004881a0
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x48], 0
je 0x46b672
lea ecx, [eax + 0x4c]
call fcn.0048afe0
push 0
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x1c]
push 4
lea eax, [ebp + 0xc]
push eax
call fcn.00488210
mov eax, dword [ebp - 0xac]
xor edx, edx
mov esi, dword [eax]
mov eax, dword [ebp - 0xbc]
sub esi, dword [eax]
add esi, edi
test ebx, ebx
jle 0x46b691
mov edi, dword [ebp + 8]
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
inc edx
mov al, byte [ebp + eax + 0xc]
xor al, byte [edi + ecx]
mov byte [ecx], al
cmp edx, ebx
jl 0x46b657
mov edi, dword [ebp - 0x24]
jmp 0x46b691
mov eax, dword [ebp - 0xac]
push ebx
push dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xbc]
sub ecx, dword [eax]
add ecx, edi
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x10]
push 0
mov edx, dword [eax]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ecx + 0x28]
sub edx, dword [eax]
mov esi, dword [ecx]
add edx, ebx
push edx
push edi
call dword [esi + 0x3c]
lea ecx, [ebp - 0x1c]
call fcn.00487f90
lea ecx, [ebp - 0x74]
call fcn.0048aaf0
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
push edi
call fcn.004369aa
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, ebx
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46e600
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bb718
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
push esi
cmp dword [eax + 0x10], 0
je 0x46e69f
cmp dword [eax + 0x14], 0x10
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x48], 4
movups xmmword [ebp - 0x38], xmm0
jb 0x46e63f
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x46e69f
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov eax, dword [eax + 0x18]
push dword [eax + 0x18]
add eax, 8
push eax
call fcn.0046dee0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.0046de80
lea ecx, [ebp - 0x28]
call fcn.0046df40
mov eax, dword [ebp + 8]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
call fcn.0046df10
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x470b50
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
call fcn.00470bf0
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x30]
call fcn.0046ff60
mov ecx, dword [ebp + 8]
push eax
push 0x506fc0
mov dword [ebp - 4], 0
call fcn.00462b50
mov edx, dword [ebp - 0x10]
pop esi
cmp edx, 0x10
jb 0x470bd1
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x470bc7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x470bc7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00436511
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x471100
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
call fcn.00470bf0
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x30]
call fcn.0046ff60
mov ecx, dword [ebp + 8]
push eax
push 0x506fc0
mov dword [ebp - 4], 0
call fcn.00462d00
mov edx, dword [ebp - 0x10]
pop esi
cmp edx, 0x10
jb 0x471181
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x471177
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x471177
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00436511
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x471ba0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.00471200
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x30]
call fcn.0046ff60
mov ecx, dword [ebp + 8]
push eax
push 0x506fc0
mov dword [ebp - 4], 0
call fcn.00462d00
mov edx, dword [ebp - 0x10]
pop esi
cmp edx, 0x10
jb 0x471c1e
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x471c14
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x471c14
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00436511
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x472dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b96b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0x1000
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::Net::HTTPBufferAllocator_.0
mov dword [esi + 0x38], 0x1000
mov dword [esi + 0x3c], 0
call fcn.0046dcb0
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, esi
mov dword [esi], vtable.Poco::Net::HTTPHeaderStreamBuf.0
mov byte [esi + 0x4c], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x473450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b96b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0x1000
mov dword [ebp - 4], 0
mov dword [edi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::Net::HTTPBufferAllocator_.0
mov dword [edi + 0x38], 0x1000
mov dword [edi + 0x3c], 0
call fcn.0046dcb0
mov esi, dword [ebp + 0xc]
add esp, 8
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], esi
lea ecx, [eax + 4]
mov eax, dword [edi + 0xc]
mov dword [eax], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x40]
mov edx, dword [edi + 0x38]
mov dword [eax], ecx
mov eax, dword [edi + 0x20]
mov dword [eax], ecx
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [edi + 0x48], eax
mov eax, edi
mov dword [edi + 0x4c], esi
mov dword [edi], vtable.Poco::Net::HTTPStreamBuf.0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4739e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b96b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0x1000
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::Net::HTTPBufferAllocator_.0
mov dword [esi + 0x38], 0x1000
mov dword [esi + 0x3c], 0
call fcn.0046dcb0
mov ecx, dword [ebp + 0x14]
add esp, 8
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x54], eax
mov eax, esi
mov dword [esi], vtable.Poco::Net::HTTPFixedLengthStreamBuf.0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x474020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b96b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0x1000
mov dword [ebp - 4], 0
mov dword [edi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::Net::HTTPBufferAllocator_.0
mov dword [edi + 0x38], 0x1000
mov dword [edi + 0x3c], 0
call fcn.0046dcb0
mov esi, dword [ebp + 0xc]
add esp, 8
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], esi
lea ecx, [eax + 4]
mov eax, dword [edi + 0xc]
mov dword [eax], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x40]
mov edx, dword [edi + 0x38]
mov dword [eax], ecx
mov eax, dword [edi + 0x20]
mov dword [eax], ecx
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [edi + 0x48], eax
mov eax, edi
mov dword [edi + 0x4c], esi
mov dword [edi], vtable.Poco::Net::HTTPChunkedStreamBuf.0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0xf
mov byte [edi + 0x58], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x476730
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x40
mov dword [esp + 0x14], esi
lea edi, [esi + 0x6c]
call fcn.004369a1
push 0x40
mov dword [edi], eax
lea ebx, [esi + 0x70]
call fcn.004369a1
push 0x40
push 0
push dword [edi]
mov dword [ebx], eax
call sub.VCRUNTIME140.dll_memset
push 0x40
push 0
push dword [ebx]
call sub.VCRUNTIME140.dll_memset
mov ebp, dword [esp + 0x3c]
add esp, 0x20
cmp ebp, 0x40
jbe 0x4767c7
mov eax, dword [esi + 4]
add esi, 4
mov ecx, esi
call dword [eax + 8]
mov eax, dword [esi]
mov ecx, esi
push ebp
push dword [esp + 0x1c]
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov esi, dword [edi]
mov edx, 0x40
mov ebp, dword [ebx]
mov dword [esp + 0x18], eax
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x4767e0
mov eax, edx
dec edx
test eax, eax
jle 0x4767e0
movzx eax, byte [ecx]
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
mov byte [ebp], al
inc ebp
mov eax, dword [esp + 0x18]
cmp ecx, dword [eax + 4]
jne 0x4767a7
jmp 0x4767e0
mov esi, dword [esp + 0x18]
push ebp
push esi
push dword [edi]
call sub.VCRUNTIME140.dll_memcpy
push ebp
push esi
push dword [ebx]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
mov ecx, dword [edi]
xor eax, eax
mov edx, dword [ebx]
lea ebp, [ecx + 0x3f]
lea esi, [edx + 0x3f]
cmp edx, ebp
ja 0x4767f4
cmp esi, ecx
jae 0x476814
cmp edx, edi
ja 0x4767fc
cmp esi, edi
jae 0x476814
cmp edx, ebx
ja 0x476804
cmp esi, ebx
jae 0x476814
cmp ecx, edi
ja 0x47680c
cmp ebp, edi
jae 0x476814
cmp ecx, ebx
ja 0x476837
cmp ebp, ebx
jb 0x476837
mov ecx, dword [edi]
xor byte [eax + ecx], 0x36
mov ecx, dword [ebx]
xor byte [ecx + eax], 0x5c
inc eax
cmp eax, 0x40
jl 0x476814
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
movups xmm0, xmmword [ecx]
movaps xmm2, xmmword [str.6666666666666666HTTP]
movaps xmm3, xmmword [0x4e4f80]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [edx]
movups xmmword [ecx], xmm1
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [edx], xmm1
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [edx + 0x10]
movups xmmword [ecx + 0x10], xmm1
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [edx + 0x10], xmm1
pxor xmm0, xmm2
movaps xmm1, xmm3
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [edx + 0x20], xmm1
pxor xmm2, xmm0
movups xmm0, xmmword [edx + 0x30]
movups xmmword [ecx + 0x30], xmm2
mov ecx, dword [esp + 0x10]
pxor xmm3, xmm0
movups xmmword [edx + 0x30], xmm3
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8