joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a6b69
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100a6c58
mov eax, dword [ebp - 4]
push eax
call fcn.100729e4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100a6c44
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
cmp edx, dword [ebp - 4]
je 0x100a6c44
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.100a6781
test eax, eax
je 0x100a6c44
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x100a6c0a
mov ecx, dword [ebp - 0xc]
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x100a6c0a
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
or ecx, 2
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], ecx
jmp 0x100a6c44
cmp dword [ebp + 8], 0
je 0x100a6c44
mov eax, dword [ebp - 0xc]
and eax, 0x18000000
test eax, eax
jne 0x100a6c44
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 2
test edx, edx
je 0x100a6c44
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffd
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], edx
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x100a6b84
mov esp, ebp
pop ebp
ret 4
Function at 0x100b732f
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x100b7356
push 0x3cc
push str.afxwin2.inl
call fcn.100b0670
test eax, eax
je 0x100b7356
int3
xor ecx, ecx
test ecx, ecx
jne 0x100b7339
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100bf46c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d5f2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1007b350
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x1c], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.100acad7
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov dword [edx], vtable.CInternetFile.0
push 0xffffffffffffffff
mov eax, dword [ebp + 0x14]
push eax
call fcn.10050cc0
test eax, eax
jne 0x100bf4de
push 0x2e0
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100bf4de
int3
xor ecx, ecx
test ecx, ecx
jne 0x100bf4bb
push 0xffffffffffffffff
mov edx, dword [ebp + 0x10]
push edx
call fcn.10050cc0
test eax, eax
jne 0x100bf507
push 0x2e1
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100bf507
int3
xor eax, eax
test eax, eax
jne 0x100bf4e4
cmp dword [ebp + 8], 0
jne 0x100bf527
push 0x2e2
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100bf527
int3
xor ecx, ecx
test ecx, ecx
jne 0x100bf50d
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.1006a387
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.1006a387
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x1c]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100bf5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d5f57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.1007b350
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.100acad7
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CInternetFile.0
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10050cc0
test eax, eax
jne 0x100bf62b
push 0x2f7
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100bf62b
int3
xor edx, edx
test edx, edx
jne 0x100bf608
cmp dword [ebp + 0x10], 0
jne 0x100bf64b
push 0x2f8
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100bf64b
int3
xor eax, eax
test eax, eax
jne 0x100bf631
push 0x2f9
push str.inet.cpp
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.1006f210
cmp dword [ebp + 8], 0
jne 0x100bf67e
push 0x2fa
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100bf67e
int3
xor edx, edx
test edx, edx
jne 0x100bf664
mov ecx, dword [ebp + 0x10]
call fcn.100c4e64
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x10107d48
call fcn.100c50b0
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.1006a387
mov ecx, dword [ebp + 0x10]
call fcn.100c4f97
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x1c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.100c4e33
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x24
call fcn.1006a2d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.1006a0d0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100bff4c
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x30], 0
je 0x100bffbb
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x2c], 0
jbe 0x100bffbb
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x100bff98
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.100c4b29
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x2c]
je 0x100bffb1
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.100c4b29
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0
mov esp, ebp
pop ebp
ret
Function at 0x100c0323
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0x43f
push str.inet.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.1006f210
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], 0
jne 0x100c035f
push 0x440
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c035f
int3
xor edx, edx
test edx, edx
jne 0x100c0342
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10050d26
test eax, eax
jne 0x100c038c
push 0x441
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c038c
int3
xor edx, edx
test edx, edx
jne 0x100c0365
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
je 0x100c03b8
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
je 0x100c03b8
push 0x442
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c03b8
int3
xor edx, edx
test edx, edx
jne 0x100c0392
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 1
je 0x100c03d0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], 0
jne 0x100c03de
push 6
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call fcn.100c4b29
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x30], 0
jne 0x100c042d
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x100c0412
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.100c4b29
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x100c0428
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.100c4b29
jmp 0x100c04dd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
add ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [edx + 0x28]
jb 0x100c0479
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x100c046f
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.100c4b29
mov eax, dword [ebp - 8]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0x28]
jb 0x100c04b1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x100c04af
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call fcn.100c4b29
jmp 0x100c04dd
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 0x2c]
push ecx
call fcn.100223f0
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
add ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c08ce
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push 0x4dd
push str.inet.cpp
mov eax, dword [ebp - 8]
push eax
call fcn.1006f210
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x14], 0
jne 0x100c090a
push 0x4de
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c090a
int3
xor edx, edx
test edx, edx
jne 0x100c08ed
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
je 0x100c0940
push 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x100c0940
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100c1271
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d6005
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x18]
push eax
mov cx, word [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.100c0c14
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.100acad7
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CFtpConnection.0
cmp dword [ebp + 8], 0
jne 0x100c12e2
push 0x5c5
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c12e2
int3
xor edx, edx
test edx, edx
jne 0x100c12c8
push 0x100dba90
mov ecx, dword [ebp + 8]
call fcn.1006f140
test eax, eax
jne 0x100c130d
push 0x5c6
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c130d
int3
xor eax, eax
test eax, eax
jne 0x100c12e8
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10050cc0
test eax, eax
jne 0x100c1336
push 0x5c7
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c1336
int3
xor edx, edx
test edx, edx
jne 0x100c1313
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.1006a387
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x20]
neg eax
sbb eax, eax
and eax, 0x8000000
push eax
push 1
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ax, word [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100c4e75
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jne 0x100c13a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call fcn.100c4b29
jmp 0x100c13bd
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
mov ecx, 0x10107d48
call fcn.100c50b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100c1e9b
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d6065
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x18]
push eax
mov cx, word [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.100c0c14
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CGopherConnection.0
cmp dword [ebp + 8], 0
jne 0x100c1efd
push 0x6a6
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c1efd
int3
xor edx, edx
test edx, edx
jne 0x100c1ee3
push 0x100dba90
mov ecx, dword [ebp + 8]
call fcn.1006f140
test eax, eax
jne 0x100c1f28
push 0x6a7
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c1f28
int3
xor eax, eax
test eax, eax
jne 0x100c1f03
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10050cc0
test eax, eax
jne 0x100c1f51
push 0x6a8
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c1f51
int3
xor edx, edx
test edx, edx
jne 0x100c1f2e
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
push 0
push 2
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov cx, word [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.100c4e75
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jne 0x100c1fa1
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call fcn.100c4b29
jmp 0x100c1fb9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x10107d48
call fcn.100c50b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100c27d2
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d617e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x1c]
push eax
mov cx, word [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.100c0c14
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.100acad7
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CHttpConnection.0
cmp dword [ebp + 8], 0
jne 0x100c2843
push 0x75c
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c2843
int3
xor edx, edx
test edx, edx
jne 0x100c2829
push 0x100dba90
mov ecx, dword [ebp + 8]
call fcn.1006f140
test eax, eax
jne 0x100c286e
push 0x75d
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c286e
int3
xor eax, eax
test eax, eax
jne 0x100c2849
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10050cc0
test eax, eax
jne 0x100c2897
push 0x75e
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c2897
int3
xor edx, edx
test edx, edx
jne 0x100c2874
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
push 0
push 3
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov cx, word [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.100c4e75
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jne 0x100c28e7
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call fcn.100c4b29
jmp 0x100c28ff
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x10107d48
call fcn.100c50b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100c291c
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d619d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x20]
push eax
mov cx, word [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.100c0c14
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.100acad7
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx], vtable.CHttpConnection.0
cmp dword [ebp + 8], 0
jne 0x100c298d
push 0x772
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c298d
int3
xor edx, edx
test edx, edx
jne 0x100c2973
push 0x100dba90
mov ecx, dword [ebp + 8]
call fcn.1006f140
test eax, eax
jne 0x100c29b8
push 0x773
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c29b8
int3
xor eax, eax
test eax, eax
jne 0x100c2993
mov ecx, dword [ebp + 0x10]
and ecx, 0x10000000
test ecx, ecx
je 0x100c29df
push 0x774
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c29df
int3
xor edx, edx
test edx, edx
jne 0x100c29be
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.10050cc0
test eax, eax
jne 0x100c2a08
push 0x775
push str.inet.cpp
call fcn.100b0670
test eax, eax
je 0x100c2a08
int3
xor ecx, ecx
test ecx, ecx
jne 0x100c29e5
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 3
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov cx, word [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.100c4e75
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
jne 0x100c2a5a
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call fcn.100c4b29
jmp 0x100c2a72
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x10107d48
call fcn.100c50b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100c655c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x100c6582
push 0x146
push str.afxtls.cpp
call fcn.100b0670
test eax, eax
je 0x100c6582
int3
xor eax, eax
test eax, eax
jne 0x100c6568
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x100c65a1
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x100c6624
cmp dword [ebp + 0xc], 0
je 0x100c65c4
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x100c6609
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100c65f0
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x100c65f7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x100c661f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x100c661f
mov dword [ebp - 4], 0
jmp 0x100c6598
cmp dword [ebp - 4], 0
je 0x100c6698
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.100c6c20
mov edx, dword [ebp - 0x1c]
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100c6683
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx]
mov dword [ebp - 0x24], eax
jmp 0x100c668a
mov dword [ebp - 0x24], 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c66a1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x100c66e4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100c66e2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.100c655c
jmp 0x100c6719
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100c6c40
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100c6719
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.100c655c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x100c66f2
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8