joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67761b
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x10
mov eax, 0x6a1347
call fcn.0049be25
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1c
pop edx
lea ecx, [ebp - 0x10]
call fcn.0068a4ce
pop ecx
pop ecx
push 0x1a
xor ebx, ebx
lea ecx, [ebp - 0x10]
push str.VirtualStoreProgramData_
mov dword [ebp - 4], ebx
call fcn.0045234c
lea eax, [ebp - 0x14]
push eax
call fcn.00670e3b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045234c
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
push 5
push str.log_
lea ecx, [ebp - 0x10]
call fcn.0045234c
mov eax, dword [0x7af0e8]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.0045234c
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x677730
mov eax, dword [0x7af0e4]
add eax, 0xfffffff0
push eax
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
mov eax, dword [0x7af0e8]
push dword [eax - 0xc]
push eax
call fcn.0045234c
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.0045207b
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov esi, esp
mov dword [ebp - 0x18], esi
mov eax, dword [0x7af0e8]
add eax, 0xfffffff0
push eax
call fcn.0045207b
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.006895e2
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x14]
inc ebx
add ecx, 0xfffffff0
call fcn.0044ec01
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, ebx
call fcn.0049bdee
ret
Function at 0x67802b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x79b544]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [edx]
push ebx
mov ebx, ecx
test ax, ax
je 0x6780e3
push esi
push edi
mov edi, edx
mov ecx, edx
mov esi, eax
cmp si, 0x2f
je 0x678061
cmp si, 0x5c
jne 0x678063
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
mov esi, eax
test ax, ax
jne 0x678055
cmp edi, edx
je 0x6780ae
mov esi, edi
lea eax, [ebp - 0x20c]
sub esi, edx
and esi, 0xfffffffe
push esi
push edx
push eax
call fcn.00506640
add esp, 0xc
cmp esi, 0x208
jae 0x6780f0
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, ebx
mov word [ebp + esi - 0x20c], ax
call fcn.0067802b
add edi, 2
push ebx
mov esi, 0x104
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.005145bf
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00517586
add esp, 0x18
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0049b511
leave
ret
call fcn.0049bba2
int3

Function at 0x67853a
Capabilities:
Get common file path

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0x6785ce
cmp dword [esi + 4], 0xffffffff
jne 0x6785ce
lea edi, [esi + 0x240]
mov ebp, 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x67856a
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x23e]
cmp eax, 0x5c
je 0x67859a
cmp eax, 0x2f
je 0x67859a
push 0x7516bc
push ebp
push edi
call fcn.00517586
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00679313
pop ecx
pop ecx
test eax, eax
jne 0x6785b5
mov eax, dword [esp + 0x14]
jmp 0x6785d3
mov ecx, eax
call fcn.00678e8c
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
jmp 0x6785d3
mov eax, 0x1000000
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x6788c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x678a16
xor ebp, ebp
cmp dword [edi + 0x18], ebp
je 0x678a16
cmp dword [edi + 0x7c], ebp
je 0x6788f1
call fcn.00678671
lea eax, [esp + 0x14]
mov ecx, edi
push eax
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
call fcn.00678a21
pop ecx
pop ecx
test eax, eax
je 0x678913
push 0xffffffffffffff99
jmp 0x678a18
push 0x84
call fcn.00512439
mov esi, eax
pop ecx
test esi, esi
jne 0x67892b
push 0xffffffffffffff98
jmp 0x678a18
push 0x4000
call fcn.00512439
mov dword [esi], eax
mov dword [esi + 0x4c], ebp
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x44], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x48], ecx
test eax, eax
jne 0x678956
push esi
call fcn.00512434
pop ecx
jmp 0x678924
mov dword [esi + 0x40], ebp
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], ebp
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], ebp
test ecx, ecx
je 0x678999
lea ecx, [esi + 4]
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], ebp
call fcn.006796dc
test eax, eax
jne 0x678999
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x6789bc
mov al, byte [edi + 0x39]
jmp 0x6789bf
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x6789ff
mov dl, byte [ebx]
test dl, dl
je 0x6789ff
lea ecx, [esi + 0x70]
call fcn.0067995d
add ebx, 1
jne 0x6789ec
mov eax, dword [esp + 0x18]
add eax, 0x1e
add eax, dword [edi + 0x78]
and dword [esi + 8], ebp
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [edi + 0x7c], esi
jmp 0x678a19
push 0xffffffffffffff9a
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x6791df
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebx, edx
mov esi, ebx
mov ebp, ecx
imul esi, dword [esp + 0x14]
cmp byte [edi], 0
je 0x679217
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ebp
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x679211
mov byte [edi + 8], 1
mov eax, dword [esp + 0x14]
jmp 0x67923c
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x679227
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push ebp
call fcn.00506640
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop edi
pop esi
xor edx, edx
pop ebp
div ebx
pop ebx
ret
Function at 0x67995d
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x757920]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x6799a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jne 0x6799ab
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
not ecx
cmp esi, 8
jb 0x679a68
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
sub edi, 1
jne 0x6799c1
pop edi
test esi, esi
je 0x679a84
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x757920]
inc edx
sub esi, 1
jne 0x679a6c
not ecx
mov eax, ecx
pop esi
ret
Function at 0x67b705
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x1c
mov eax, 0x6a14ca
call fcn.0049be90
mov dword [ebp - 0x20], ecx
mov esi, str.RSUpdateRevertHandler::UpdateFallbackFolderBeforeUpdate
xor ebx, ebx
push esi
push str.:__s_:
mov dword [ebp - 4], ebx
call fcn.00677869
push 0x7516bc
lea eax, [ebp + 8]
mov byte [ebp - 0x12], bl
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
call fcn.00451281
add esp, 0x14
push str.Fallback
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
call fcn.00451281
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0044ec01
mov eax, dword [ebp - 0x18]
cmp dword [eax - 4], 1
jle 0x67b781
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00451ca4
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x67b7bf
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x67b7bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_:_CreateDirectory_failed_with_error____d
call fcn.00677869
mov ecx, dword [ebp - 0x18]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.0044ec01
jmp 0x67b854
mov eax, dword [ebp - 0x18]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x24], esp
mov edi, esp
push eax
mov dword [ebp - 0x28], edi
call fcn.0045207b
add eax, 0x10
pop ecx
mov dword [edi], eax
mov byte [ebp - 4], 5
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
mov dword [ebp - 0x28], edi
call fcn.0045207b
pop ecx
mov ecx, dword [ebp - 0x20]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
call fcn.0067b869
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x11], al
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov dword [ebp - 4], ebx
mov bl, byte [ebp - 0x11]
jmp 0x67b83b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
movzx eax, bl
push eax
push esi
push str._s_:_CopyFiles_return_Result___d___error___d
call fcn.00677869
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0044ec01
mov al, bl
call fcn.0049bdee
ret 4
Function at 0x67bc04
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x254]
sub esp, 0x254
push 0xffffffffffffffff
push 0x6a156e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x79b544]
xor eax, ebp
mov dword [ebp + 0x250], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
and dword [ebp - 4], 0
mov bl, 1
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], bl
call fcn.00474f38
push eax
lea ecx, [ebp - 0x18]
call fcn.00451c1b
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.0066f273
push 0x250
lea eax, [ebp]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.00506c70
push 0x7538c8
push dword [ebp + 0x25c]
lea eax, [ebp - 0x18]
push 0x751814
push eax
call fcn.00452465
mov esi, dword [ebp - 0x18]
lea eax, [ebp]
add esp, 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x67bd98
mov edx, 0x7538cc
lea ecx, [ebp + 0x2c]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x67bce0
test ax, ax
je 0x67bcdc
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x67bce0
add ecx, 4
add edx, 4
test ax, ax
jne 0x67bcba
xor eax, eax
jmp 0x67bce5
sbb eax, eax
or eax, 1
test eax, eax
je 0x67bd85
mov ecx, 0x7538d0
lea eax, [ebp + 0x2c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x67bd1b
test dx, dx
je 0x67bd17
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x67bd1b
add eax, 4
add ecx, 4
test dx, dx
jne 0x67bcf5
xor eax, eax
jmp 0x67bd20
sbb eax, eax
or eax, 1
test eax, eax
je 0x67bd85
call fcn.00474f38
push eax
lea ecx, [ebp - 0x1c]
call fcn.00451c1b
lea eax, [ebp + 0x2c]
mov byte [ebp - 4], 4
push eax
push dword [ebp + 0x25c]
lea eax, [ebp - 0x1c]
push 0x751814
push eax
call fcn.00452465
mov edi, dword [ebp - 0x1c]
add esp, 0x10
add edi, 0xfffffff0
push ecx
mov dword [ebp - 0x20], esp
push edi
call fcn.0045207b
pop ecx
mov ecx, dword [ebp - 0x20]
add eax, 0x10
mov dword [ecx], eax
lea ecx, [ebp - 0x34]
call fcn.0066f1c7
and bl, al
mov byte [ebp - 4], 3
mov ecx, edi
mov byte [ebp - 0x11], bl
call fcn.0044ec01
mov edi, dword [ebp - 0x24]
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x67bca9
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
movzx eax, bl
push eax
push dword [ebp + 0x25c]
push str.RSUpdateRevertHandler::DeleteFolderOrFile
push str._s____s___::_Result___d__error___d
call fcn.00677869
mov ecx, dword [ebp - 0x34]
add esp, 0x14
lea ecx, [ecx - 0x10]
call fcn.0044ec01
lea ecx, [esi - 0x10]
call fcn.0044ec01
jmp 0x67bdf1
mov ecx, dword [ebp + 0x25c]
add ecx, 0xfffffff0
call fcn.0044ec01
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.0049b511
add ebp, 0x254
leave
ret 4
Function at 0x67c658
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
lea eax, [ebp - 4]
xor ecx, ecx
push ecx
push ecx
push eax
push 0x400
push dword [esi + 0x48]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 0x50]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 4]
mov edi, eax
push dword [esi + 0x48]
push str.CustomURLProtocol::Failed_with_error__d:__s
push edi
call dword [sym.imp.KERNEL32.dll_LocalSize]
shr eax, 1
push eax
push edi
call fcn.0045ae63
add esp, 0x14
lea ecx, [esi + 0x4c]
push edi
call fcn.0045549f
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x67c6d6
push dword [ebp - 4]
call esi
test edi, edi
je 0x67c6dd
push edi
call esi
pop edi
pop esi
leave
ret
Function at 0x67cdf0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 0xc], 0xc
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x24], 4
lea ebp, [ebx + 0x40]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
jne 0x67ce54
mov esi, dword [ebx + 0x3c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x67ce1a
sub esi, ecx
mov ecx, ebp
sar esi, 1
add esi, 6
mov edx, esi
call fcn.0067ef65
push dword [ebx + 0x3c]
push esi
push dword [ebp]
call fcn.005145bf
push str..tmp
push esi
push dword [ebp]
call fcn.00517586
add esp, 0x18
jmp 0x67ceb2
push 0xff
push 1
call fcn.0050e2b0
pop ecx
pop ecx
mov ebx, eax
push 0xfe
push ebx
push str.TEMP
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, di
jne 0x67ce7c
sub ebx, ecx
sar ebx, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [ebx + 0x14]
mov ecx, ebp
mov esi, eax
call fcn.0067ef65
push esi
push dword [esp + 0x14]
push str._sdc_d.tmp
push dword [ebp]
call fcn.0045aeee
add esp, 0x10
push edi
push 0x80
push 2
lea eax, [esp + 0x20]
push eax
push 1
push 0x40000000
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x67cef1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.InternetGetRequestEx_:_Error_occured_while_creating_the_file______d
call fcn.006778de
pop ecx
pop ecx
mov ecx, edi
call fcn.0067ef87
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x67cf96
Capabilities:
Set http header

Disassembly:
push ecx
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
je 0x67cfc9
push 0x20000000
push 0xffffffffffffffff
push dword [esp + 0x14]
push dword [ecx + 0x80]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x67cfc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.0067e75e
mov eax, esi
pop esi
pop ecx
ret 4
Function at 0x67d013
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x79b544]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov ebx, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
cmp dword [ebx], edi
je 0x67d096
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x64
pop edx
lea ecx, [esp + 0x10]
call fcn.0067ef65
push 0x7a120
push edi
push str.Range:_bytes_u__u
push dword [esp + 0x1c]
call fcn.0045aeee
push dword [esp + 0x20]
push str.HttpReadResponseDataInChunkedWay:_Content_Range_Header_message:__s
call fcn.006778de
add esp, 0x18
mov ecx, ebx
push dword [esp + 0x10]
call fcn.0067cfd0
test eax, eax
je 0x67d096
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x67d1a5
mov eax, dword [ebx + 8]
cmp eax, 0xc8
je 0x67d0cb
cmp eax, 0xce
je 0x67d0cb
push eax
push str.HttpReadResponseDataInChunkedWay_:_Failed_with_the_http_status_code__d
call fcn.006778de
pop ecx
pop ecx
push 1
push edi
call fcn.0066c2c9
mov ecx, eax
call fcn.0066c1d2
push 0xd
pop edi
jmp 0x67d1ba
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edi
push eax
push dword [ebx + 0x80]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x67d190
mov eax, dword [esp + 0x14]
test eax, eax
je 0x67d15f
inc eax
push eax
push 2
call fcn.0050e2b0
pop ecx
pop ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
push ecx
push dword [esp + 0x18]
push eax
push dword [ebx + 0x80]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x67d17b
cmp dword [esp + 0x18], edi
je 0x67d14c
cmp dword [ebx + 0x24], 2
jne 0x67d155
push dword [esp + 0x10]
call fcn.004522e3
pop ecx
push eax
push dword [esp + 0x14]
lea ecx, [ebx + 0xc]
call fcn.0045970a
push edi
push 0x750660
lea ecx, [ebx + 0xc]
call fcn.0045970a
jmp 0x67d155
push ecx
lea ecx, [ebx + 0xc]
call fcn.0045b262
cmp dword [esp + 0x18], edi
jne 0x67d0cb
cmp dword [ebx], edi
je 0x67d1ba
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x67d1ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.HttpReadResponseDataInChunkedWay_:_Error_occured_in_WinHttpReadData______d
call fcn.00677763
jmp 0x67d1a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.HttpReadResponseDataInChunkedWay_:_Error_occured_in_WinHttpQueryDataAvailable______d
call fcn.006778de
pop ecx
pop ecx
push edi
call fcn.0067e75e
push 2
push edi
call fcn.0066c2c9
mov ecx, eax
call fcn.0066c1d2
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049b511
mov esp, ebp
pop ebp
ret
Function at 0x67da6e
Capabilities:
Check http status code
Read http header

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea eax, [esp + 0x10]
push edi
xor ebp, ebp
mov ebx, ecx
push ebp
push eax
push ebp
push ebp
push 0x16
push dword [ebx + 0x80]
mov edi, ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
call esi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.0067ef65
push ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
push ebp
push 0x16
push dword [ebx + 0x80]
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x67dade
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:__Error_in_WinHttpQueryHeaders______d
call fcn.006778de
pop ecx
pop ecx
push edi
call fcn.0067e75e
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 4
push ecx
lea eax, [ebx + 8]
push eax
push 0
push 0x20000013
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x67db1b
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:_WinHttpQueryHeaders_failed_with_the_error_code_while_getting_http_status_code__d
call fcn.006778de
pop ecx
pop ecx
push edi
call fcn.0067e75e
push dword [ebx + 8]
push str.DCGetResponseStatusCode_:_Status_code_:__d
call fcn.006778de
cmp dword [ebx + 8], 0xc8
pop ecx
pop ecx
jne 0x67dbd4
xor ecx, ecx
lea eax, [esp + 0x14]
push ecx
push eax
push ecx
push ecx
push 1
push dword [ebx + 0x80]
mov dword [esp + 0x2c], ecx
call esi
mov edx, dword [esp + 0x14]
lea ecx, [ebx + 0x5c]
call fcn.0067ef65
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea eax, [esp + 0x14]
push 0
push eax
push dword [ebx + 0x5c]
push 0
push 1
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x67db92
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:__Error_in_WinHttpQueryHeaders______d
call fcn.006778de
pop ecx
pop ecx
push edi
call fcn.0067e75e
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 4
push eax
lea eax, [ebx + 0x4c]
push eax
push 0
push 0x20000005
push dword [ebx + 0x80]
call esi
test eax, eax
jne 0x67dbcf
call ebp
mov edi, eax
push edi
push str.DCGetResponseStatusCode_:_WinHttpQueryHeaders_failed_with_the_error_code_while_getting_http_status_code__d
call fcn.006778de
pop ecx
pop ecx
push edi
call fcn.0067e75e
and dword [esp + 0x14], 0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x67dbe5
Capabilities:
Prepare http request

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x80]
test eax, eax
je 0x67dc00
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
and dword [esi + 0x80], 0
mov ecx, esi
pop esi
jmp fcn.0067dfbf