joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe160
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5ac004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x14]
mov edi, ecx
push eax
push edi
mov esi, edx
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x4fe35f
mov eax, dword ds:[ebp - 8]
or eax, dword [ebp - 0x10]
or eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x14]
je 0x4fe35f
cmp dword [esi + 0x1b4], 0
jg 0x4fe20d
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
mov ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov eax, dword [esi + 0x1b8]
test eax, eax
jne 0x4fe1db
mov dword [esi + 0x1b8], ebx
jmp 0x4fe1ed
push 2
push ebx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x4fe200
test eax, eax
je 0x4fe35f
jmp 0x4fe354
test dword [esi + 0x20], 0x200000
je 0x4fe2cc
cmp dword [esi + 0x180], 0
jne 0x4fe2cc
push dword [esi]
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x4fe2cc
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0x180], eax
test eax, eax
je 0x4fe2cc
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x18c], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x190], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x194], eax
mov eax, dword [esi + 0x48]
push eax
mov dword [esi + 0x198], eax
mov eax, dword [esi + 0x194]
inc eax
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0x188], eax
test eax, eax
jne 0x4fe2aa
push dword [esi + 0x180]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0x180], 0
jmp 0x4fe2cc
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword ds:[esi + 0x188]
push dword [esi + 0x180]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x184], eax
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov ebx, eax
test ebx, ebx
je 0x4fe35f
mov ecx, dword [ebp - 0x50]
mov edx, esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x180]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x4fe348
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00502ea0
mov edx, dword ds:[ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
push 0xcc0020
push edx
push ecx
push dword [esi + 0x180]
sub eax, edx
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x4fe354
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
push ebx
call fcn.00502ea0
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e068
mov esp, ebp
pop ebp
ret
Function at 0x5020e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ac004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
cmp esi, 0x26
je 0x50212c
lea esp, [esp]
cmp esi, 0x28
je 0x50212c
cmp esi, 0x24
je 0x50212c
cmp esi, 0x23
je 0x50212c
cmp esi, 0x21
je 0x50212c
cmp esi, 0x22
je 0x50212c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xd0]
mov ecx, dword [eax]
test ecx, ecx
je 0x5022da
lea eax, ds:[esi - 0x21]
cmp eax, 7
ja case.0x502149.37
jmp dword [eax*4 + 0x5022f0]
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x502149.36
mov edi, dword [eax + 0x20]
test edi, edi
je case.0x502149.36
dec edi
jmp 0x5021f7
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x502149.36
mov eax, dword [eax + 0x20]
lea edi, [ecx - 1]
inc eax
cmp eax, ecx
cmovb edi, eax
jmp 0x5021f7
lea edi, [ecx - 1]
jmp 0x5021f7
mov edi, dword [ebx + 0x70]
test edi, edi
je 0x50218b
mov edi, dword [edi + 0x20]
jmp 0x50218d
xor edi, edi
test byte [ebx + 0x20], 8
je 0x502198
mov edx, dword [ebx + 0x58]
jmp 0x50219a
xor edx, edx
mov eax, dword [ebx + 0x48]
sub eax, dword [ebx + 0x4c]
sub eax, edx
js 0x5022da
cdq
idiv dword [ebx + 0x50]
mov edx, eax
sub edx, 1
js 0x5022da
mov eax, dword [ebx + 0x5c]
cmp esi, 0x21
jne 0x5021d4
nop
cmp edi, eax
jbe 0x5021c8
mov edi, eax
jmp 0x5021f7
cmp edi, edx
jb case.0x502149.36
sub edi, edx
jmp 0x5021f7
xor edi, edi
jmp 0x5021f7
add eax, edx
lea esi, [ecx - 1]
cmp eax, ecx
cmovb esi, eax
cmp edi, esi
jae 0x5021e8
mov edi, esi
jmp 0x5021f7
add edi, edx
lea eax, [ecx - 1]
cmp edi, ecx
cmovae edi, eax
jmp 0x5021f7
mov edi, dword [ebp - 0x1c]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0x10
sets byte [ebp - 0x15]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebx + 0xd0]
mov si, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + edi*4]
mov ecx, ebx
mov dword [ebx + 0x70], edx
call fcn.005019a0
test si, si
jns 0x50224d
mov edx, dword [ebx + 0x78]
cmp edx, 0xffffffff
je 0x50224d
lea eax, [ebp - 0x20]
cmp edi, edx
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, edi
cmovbe eax, edx
cmovbe edx, edi
push 4
push eax
jmp 0x502269
cmp byte [ebp - 0x15], 0
jne 0x502297
mov eax, dword [ebx + 0x70]
mov edx, edi
mov eax, dword [eax + 0x20]
mov dword [ebx + 0x78], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 4
push edi
mov ecx, ebx
call fcn.00501820
mov edx, dword ds:[ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp - 0x20]
mov ecx, ebx
call fcn.00501560
test al, al
je 0x502297
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, edi
mov ecx, ebx
call fcn.00501b80
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x5022da
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0xf4], 0xffffffff
mov dword [ebx + 0xf8], 0xffffffff
mov dword [ebx + 0x118], 0xffffffff
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e068
mov esp, ebp
pop ebp
ret
Function at 0x50217f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ac004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
cmp esi, 0x26
je 0x50212c
lea esp, [esp]
cmp esi, 0x28
je 0x50212c
cmp esi, 0x24
je 0x50212c
cmp esi, 0x23
je 0x50212c
cmp esi, 0x21
je 0x50212c
cmp esi, 0x22
je 0x50212c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xd0]
mov ecx, dword [eax]
test ecx, ecx
je 0x5022da
lea eax, ds:[esi - 0x21]
cmp eax, 7
ja case.0x502149.37
jmp dword [eax*4 + 0x5022f0]
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x502149.36
mov edi, dword [eax + 0x20]
test edi, edi
je case.0x502149.36
dec edi
jmp 0x5021f7
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x502149.36
mov eax, dword [eax + 0x20]
lea edi, [ecx - 1]
inc eax
cmp eax, ecx
cmovb edi, eax
jmp 0x5021f7
lea edi, [ecx - 1]
jmp 0x5021f7
mov edi, dword [ebx + 0x70]
test edi, edi
je 0x50218b
mov edi, dword [edi + 0x20]
jmp 0x50218d
xor edi, edi
test byte [ebx + 0x20], 8
je 0x502198
mov edx, dword [ebx + 0x58]
jmp 0x50219a
xor edx, edx
mov eax, dword [ebx + 0x48]
sub eax, dword [ebx + 0x4c]
sub eax, edx
js 0x5022da
cdq
idiv dword [ebx + 0x50]
mov edx, eax
sub edx, 1
js 0x5022da
mov eax, dword [ebx + 0x5c]
cmp esi, 0x21
jne 0x5021d4
nop
cmp edi, eax
jbe 0x5021c8
mov edi, eax
jmp 0x5021f7
cmp edi, edx
jb case.0x502149.36
sub edi, edx
jmp 0x5021f7
xor edi, edi
jmp 0x5021f7
add eax, edx
lea esi, [ecx - 1]
cmp eax, ecx
cmovb esi, eax
cmp edi, esi
jae 0x5021e8
mov edi, esi
jmp 0x5021f7
add edi, edx
lea eax, [ecx - 1]
cmp edi, ecx
cmovae edi, eax
jmp 0x5021f7
mov edi, dword [ebp - 0x1c]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0x10
sets byte [ebp - 0x15]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebx + 0xd0]
mov si, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + edi*4]
mov ecx, ebx
mov dword [ebx + 0x70], edx
call fcn.005019a0
test si, si
jns 0x50224d
mov edx, dword [ebx + 0x78]
cmp edx, 0xffffffff
je 0x50224d
lea eax, [ebp - 0x20]
cmp edi, edx
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, edi
cmovbe eax, edx
cmovbe edx, edi
push 4
push eax
jmp 0x502269
cmp byte [ebp - 0x15], 0
jne 0x502297
mov eax, dword [ebx + 0x70]
mov edx, edi
mov eax, dword [eax + 0x20]
mov dword [ebx + 0x78], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 4
push edi
mov ecx, ebx
call fcn.00501820
mov edx, dword ds:[ebp - 0x1c]
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp - 0x20]
mov ecx, ebx
call fcn.00501560
test al, al
je 0x502297
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, edi
mov ecx, ebx
call fcn.00501b80
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x5022da
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0xf4], 0xffffffff
mov dword [ebx + 0xf8], 0xffffffff
mov dword [ebx + 0x118], 0xffffffff
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e068
mov esp, ebp
pop ebp
ret
Function at 0x507ba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a0568
push 0x51ed20
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5ac004]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebp + 0x10]
mov dword [esi + 8], ebx
mov dword [ebp - 4], 0
push 0x40
mov edx, edi
mov ecx, esi
call fcn.00508000
mov dword [ebp - 4], 0xfffffffe
mov eax, 0x5a4d
cmp word [edi], ax
je 0x507c1e
mov eax, 0xc000012f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x507cf8
cmp eax, 0x10000000
jae 0x507cf8
cmp eax, ebx
jae 0x507cf8
lea edx, [eax + edi]
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
push 0x18
mov ecx, esi
call fcn.00508000
mov edx, dword [esi + 0xc]
movzx eax, word [edx + 6]
lea ecx, [eax + eax*4]
movzx eax, word [edx + 0x14]
lea eax, [eax + ecx*8]
add eax, 0x18
push eax
mov ecx, esi
call fcn.00508000
mov dword ds:[ebp - 4], 0xfffffffe
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0x4550
jne 0x507cf8
movzx eax, word [ecx + 0x18]
mov word [esi + 0x18], ax
mov edx, 0x10b
cmp ax, dx
je 0x507c9e
mov edx, 0x20b
cmp ax, dx
jne 0x507cf8
movzx eax, word [ecx + 6]
mov dword [esi + 0x10], eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc000007b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x507e80
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x5ac004]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
xor bl, bl
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], 0
push edi
test esi, esi
jne 0x507f12
test ecx, ecx
jne 0x507ed6
mov eax, 0xc0000030
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 8
push 0x60
push 1
push 1
push 0x80
push 0x100081
push ecx
lea eax, [esp + 0x3c]
push eax
call sym.ProcessHacker.exe_PhCreateFileWin32
test eax, eax
jns 0x507f0c
lfence
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x24]
mov bl, 1
push 5
push 0x18
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test edi, edi
js 0x507fb8
mov eax, dword ds:[esp + 0x40]
mov ecx, dword [esp + 0x44]
push esi
push 0x8000000
push 2
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0xf001f
lea eax, [esp + 0x28]
mov dword [esp + 0x34], ecx
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
js 0x507fb8
mov eax, dword [esp + 0x18]
push 2
push 0
push 1
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test edi, edi
js 0x507fb8
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword ds:[esp + 0x10]
test eax, eax
je 0x507fcb
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test bl, bl
je 0x507fd6
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x54]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 8
Function at 0x508300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x5ac004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x48]
push edi
push 0
push 0x40
push ecx
mov edi, edx
mov dword [ebp - 0x144], eax
push edi
push eax
mov ecx, ebx
mov dword [esi], edi
call dword [0x5404bc]
call ebx
lea esp, [esp]
test eax, eax
jns 0x50835a
lfence
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 8
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
je 0x50837e
mov eax, 0xc000012f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x50849f
cmp eax, 0x10000000
jae 0x50849f
push 0
push 0xf8
lea ecx, [ebp - 0x140]
add eax, edi
push ecx
push eax
push dword [ebp - 0x144]
mov ecx, ebx
mov dword [ebp - 0x148], eax
lfence
call dword [0x5404bc]
call ebx
mov edi, edi
test eax, eax
js 0x508344
cmp dword [ebp - 0x140], 0x4550
jne 0x50849f
mov ax, word [ebp - 0x128]
mov ecx, 0x10b
mov word [esi + 0x10], ax
cmp ax, cx
je 0x5083f7
mov ecx, 0x20b
cmp ax, cx
jne 0x50849f
movzx eax, word [ebp - 0x13a]
mov dword [esi + 8], eax
lea edi, [eax + eax*4]
movzx eax, word [ebp - 0x12c]
lea edi, [edi + 3]
lea edi, [eax + edi*8]
cmp edi, 0x100000
ja 0x50849f
push edi
push 4
lfence
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0
push edi
push eax
push dword [ebp - 0x148]
mov ecx, ebx
mov dword [esi + 4], eax
push dword [ebp - 0x144]
call dword [0x5404bc]
call ebx
mov edi, eax
test edi, edi
jns 0x50847b
lfence
push dword [esi + 4]
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0xc], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, 0xc000007b
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e068
mov esp, ebp
pop ebp
ret 8
Function at 0x5097c0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x10
push 4
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
xor eax, eax
push eax
push eax
push eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], eax
test eax, eax
jne 0x509823
push esi
push eax
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
lea ecx, [ebp - 4]
push 4
push ecx
push 0x54
push eax
jae 0x509854
mov dword ds:[ebp - 4], 0xa00
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword ds:[ebp - 4], 0x2a00
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 3
push eax
push 0x76
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jb 0x5098a6
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 0x85
push dword [esi]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x509940
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, ecx
and edx, 1
shl edx, 0x17
push esi
mov esi, dword [ebp + 8]
mov eax, edx
or eax, 0x100
and cl, 2
cmove eax, edx
push eax
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 8], eax
pop esi
test eax, eax
jne 0x509986
xor al, al
mov esp, ebp
pop ebp
ret 0x10
push 4
lea ecx, [ebp - 4]
mov dword [ebp - 4], 8
push ecx
push 0x3f
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov al, 1
mov esp, ebp
pop ebp
ret 0x10

Function at 0x509c20
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov eax, edx
and al, 1
mov dword [ebp - 4], 0
movzx ecx, al
lea eax, [ebp - 8]
push 0
push eax
neg ecx
mov dword [ebp - 8], 4
lea eax, [ebp - 4]
push eax
sbb ecx, ecx
and ecx, 5
mov eax, ecx
or eax, 0x13
and dl, 2
push 0
cmove eax, ecx
or eax, 0x20000000
push eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x509c83
mov ecx, dword ds:[ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
xor al, al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x509da0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0053da50
mov eax, dword [0x5ac004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, 0x1000
mov dword [ebp - 0x100c], eax
mov eax, dword [ebp + 0xc]
push ebx
push 4
push dword [0x5b1dac]
mov dword [ebp - 0x1010], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1014], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x1008]
push eax
push ebx
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x100c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x509e9c
mov ecx, dword [ebp - 0x1008]
test ecx, ecx
je 0x509e7b
lea eax, ds:[ecx + esi]
cmp ebx, eax
jae 0x509e3e
add ebx, ebx
push ebx
push edi
push 4
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ecx, dword [ebp - 0x1008]
mov edi, eax
push ecx
lea eax, [ebp - 0x1004]
push eax
lea eax, [esi + edi]
push eax
call fcn.00521a30
add esi, dword [ebp - 0x1008]
lea eax, [ebp - 0x1008]
add esp, 0xc
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x100c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x509e10
lea eax, ds:[esi + 1]
cmp ebx, eax
jae 0x509e9c
lea eax, [ebx + 1]
push eax
push edi
push 4
lfence
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov edi, eax
mov byte [esi + edi], 0
test esi, esi
je 0x509eeb
mov eax, dword [ebp - 0x1010]
test eax, eax
je 0x509eb2
mov dword [eax], edi
jmp 0x509ec6
push edi
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x1014]
test eax, eax
je 0x509ed2
mov dword [eax], esi
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051e068
mov esp, ebp
pop ebp
ret 0xc
push edi
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e068
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50a2a0
Capabilities:
Initialize winhttp library
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
test byte [0x5b080c], 1
push ebx
push edi
mov edi, ecx
mov ebx, str.1.1.1.1
jne 0x50a41d
push esi
mov esi, 0x5b080c
lock bts dword [esi], 0x1f
jae 0x50a2e5
test byte [0x5b080c], 1
jne 0x50a41c
xor edx, edx
mov ecx, esi
call sym.ProcessHacker.exe_PhfWaitForEvent
nop
jmp 0x50a41c
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
push 0
sbb eax, eax
push 0
and eax, 0xfffffffc
push 0
add eax, 4
push eax
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [0x5b3fe4], eax
test eax, eax
je 0x50a3d1
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
push 4
jae 0x50a32e
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0xa00
push ecx
push 0x54
push eax
jmp 0x50a387
lea ecx, ds:[ebp - 8]
mov dword [ebp - 8], 0x2a00
push ecx
push 0x54
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 3
push eax
push 0x76
push dword [0x5b3fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jb 0x50a38d
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push 0x85
push dword [0x5b3fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0x49
push dword [0x5b3fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jb 0x50a3d1
push 0
test edi, edi
mov eax, ebx
push 0x1bb
cmovne eax, edi
push eax
push dword [0x5b3fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [0x5b3fdc], eax
lock bts dword [esi], 0
jb 0x50a41c
mov esi, dword [0x5b0810]
mov edi, edi
test esi, esi
je 0x50a3ed
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x5b080c
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x50a41c
test esi, esi
je 0x50a41c
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x5b0810], 0
pop esi
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jae 0x50a44a
push 0
test edi, edi
push 0x1bb
cmovne ebx, edi
push ebx
push dword [0x5b3fe4]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
pop edi
mov dword [0x5b3fdc], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b3fdc]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret