joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4608f1
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x5f6060
call fcn.005bb551
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.00460c84
call fcn.0044a4bd
push eax
lea ecx, [ebp - 0x94]
call fcn.00447ef8
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044a4c3
mov ecx, eax
call fcn.0044875d
test al, al
je 0x460a07
push ebx
lea ecx, [ebp - 0x94]
call fcn.004481ea
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00448600
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x460978
push str.Error_opening_file
jmp 0x460ae8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x460a81
cmp edi, 0x400000
ja 0x460a92
and dword [ebp - 0x2c8], 0
push edi
call fcn.005a2805
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x4609f0
push ebx
call fcn.005b95c2
pop ecx
mov ecx, esi
call fcn.00460c84
push 0
push str.Could_not_read_file
jmp 0x460ae8
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.00460b37
push dword [ebp - 0x2cc]
jmp 0x460b16
call fcn.0044a4c3
push eax
lea ecx, [ebp - 0x94]
call fcn.00448165
call fcn.0044a685
test al, al
je 0x460a28
call fcn.0044a4c9
jmp 0x460a3f
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00448600
push eax
call fcn.0045d0e5
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x460a50
push eax
push str.Error_opening_zip_file
jmp 0x460ae8
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.0045ca3d
add esp, 0x14
test eax, eax
je 0x460a77
push 0
push str.Could_not_find_ziped_file
jmp 0x460ae8
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x460a8a
push 0
push str.File_is_empty
jmp 0x460ae8
cmp ebx, 0x400000
jbe 0x460a9b
push 0
push 0x60cee0
jmp 0x460ae8
push ebx
call fcn.005a2805
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.0045d49a
add esp, 0x18
test eax, eax
je 0x460af3
cmp eax, 0x600
je 0x460af3
push dword [ebp - 0x2c8]
call fcn.005b95c2
pop ecx
call fcn.0044a685
test al, al
jne 0x460ae1
push edi
call fcn.0045c89f
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.00460cac
mov bl, al
jmp 0x460b1e
call fcn.0044a685
test al, al
jne 0x460b03
push edi
call fcn.0045c89f
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.00460b37
push edi
mov bl, al
call fcn.005b95c2
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00447fe0
mov al, bl
call fcn.005bb500
ret 8
Function at 0x46dddb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x46ddff
cmp dword [esi + 8], edi
jge 0x46ddf7
push esi
call fcn.0046a1e3
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x46de25
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x46de0b
mov dword [esi + 8], edx
jmp 0x46de3a
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x46de30
xor dl, dl
jmp 0x46de35
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x46de25
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x46de74
push str.zlib_corrupt
call fcn.0046a10c
add esp, 4
jmp 0x46deb4
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46de84
push str.read_past_buffer
jmp 0x46de6a
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x46de9e
push edi
push ecx
push esi
call fcn.00470942
add esp, 0xc
test eax, eax
je 0x46deb4
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005b8230
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x481101
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x5f6bbc
call fcn.005bb551
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x6e8], ebx
cmp dword [edi + 4], ebx
jne 0x481193
lea eax, [ebp - 0xa8]
push eax
call fcn.00480d6e
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xa8]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x24]
mov ecx, eax
call fcn.00421590
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.004476c1
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00465b7b
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov ecx, eax
call fcn.0044a04e
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0044875d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.00447fe0
mov esi, 0x6d8
test bl, bl
je 0x4811d2
mov eax, dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.005bb500
ret 4

Function at 0x481208
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x686300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044f67a
mov ecx, dword [esi + 0x6f0]
test ecx, ecx
je 0x481284
lea eax, [ebp - 0x14]
push eax
call fcn.00480d6e
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x6f0]
test eax, eax
je 0x481260
push 0
call fcn.004215c0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x481284
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.004215c0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005b7dc4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48136c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x686300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
mov ebx, ecx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00450c0b
mov ecx, dword [ebx + 0x6f0]
test ecx, ecx
je 0x4813f0
lea eax, [ebp - 0x14]
push eax
call fcn.00480d6e
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x6f0]
test eax, eax
je 0x4813cc
push 0
call fcn.004215c0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4813f0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.004215c0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b7dc4
mov esp, ebp
pop ebp
ret 0x14
Function at 0x484206
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x5f6d97
call fcn.005bb551
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2d0], ebx
call fcn.0044a4bd
push eax
lea ecx, [ebp - 0x94]
call fcn.00447ef8
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044a4c3
mov ecx, eax
call fcn.0044875d
test al, al
je 0x4842fd
push ebx
lea ecx, [ebp - 0x94]
call fcn.004481ea
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00448600
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x484297
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00447fe0
jmp 0x4843de
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x4842ae
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484283
push esi
mov dword [ebp - 0x2cc], edi
call fcn.005a2805
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2cc]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2cc], esi
je 0x4843c9
push edi
call fcn.005b95c2
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00447fe0
jmp 0x4843dc
call fcn.0044a4c3
push eax
lea ecx, [ebp - 0x94]
call fcn.00448165
call fcn.0044a685
test al, al
je 0x48431e
call fcn.0044a4c9
jmp 0x484335
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.00448600
push eax
call fcn.0045d0e5
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x484283
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2d0]
push ebx
call fcn.0045ca3d
add esp, 0x14
test eax, eax
jne 0x484283
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x484283
push esi
call fcn.005a2805
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.0045d49a
add esp, 0x18
test eax, eax
je 0x4843b9
cmp eax, 0x600
je 0x4843b9
push edi
call fcn.005b95c2
pop ecx
call fcn.0044a685
test al, al
jne 0x4842e9
push ebx
call fcn.0045c89f
jmp 0x4842e8
call fcn.0044a685
test al, al
jne 0x4843c9
push ebx
call fcn.0045c89f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00447fe0
test edi, edi
jne 0x484459
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x484455
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x484418
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484455
push esi
mov dword [ebp - 0x2c8], edi
call fcn.005a2805
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x484451
push edi
call fcn.005b95c2
pop ecx
xor edi, edi
test edi, edi
jne 0x484459
xor eax, eax
jmp 0x484471
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.00484479
push edi
mov esi, eax
call fcn.005b95c2
pop ecx
mov eax, esi
call fcn.005bb500
ret 4
Function at 0x485920
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x485963
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERR:InternetGetConnectedState_fail_0x_x
push 1
push 0x32
push str.toolBaseRequest.cpp
push str.CBaseRequest::IsUseProxyConnect
call fcn.004f4980
add esp, 0x18
xor al, al
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 4]
shr al, 2
and al, 1
mov esp, ebp
pop ebp
ret

Function at 0x485d20
Capabilities:
Receive http response
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.005b9970
mov eax, dword [0x686300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor bl, bl
cmp dword [eax + 0x14], 8
push edi
mov edi, ecx
jb 0x485d49
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x485dfb
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x485df4
jmp 0x485da0
mov eax, dword [ebp - 0x1008]
test eax, eax
je 0x485df2
push 0
lea ecx, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0
push ecx
push eax
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x485df4
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x485da0
jmp 0x485df4
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b7dc4
mov esp, ebp
pop ebp
ret 4
Function at 0x485e10
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f701d
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x686300]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x834], esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov dword [ebp - 4], 0
mov dword [ebp - 0x830], 1
mov dword [ebp - 0x82c], 0
jmp 0x485e90
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.005b99a0
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
push 0x7ff
lea eax, [ebp - 0x810]
push eax
push dword [edi + 0x6c]
call ebx
test eax, eax
je 0x485f36
push dword [ebp - 0x82c]
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], 0xf
push eax
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov byte [ebp - 0x828], 0
call fcn.00421120
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00423410
cmp dword [ebp - 0x814], 0x10
mov byte [ebp - 4], 0
jb 0x485f29
push dword [ebp - 0x828]
call fcn.005b7634
add esp, 4
cmp dword [ebp - 0x82c], 0
ja 0x485e90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b7dc4
mov esp, ebp
pop ebp
ret 4

Function at 0x485f70
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x6c]
sub esp, 0xc
test eax, eax
je 0x485fd5
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], 4
push ecx
push 0
push 0x20000005
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x485fdd
push str.CWinHttpRequest::GetUrlFileSize
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6126c4
call fcn.00486220
add esp, 0x10
xor al, al
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x485ff0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x486040
push str.CWinHttpRequest::HttpRead
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6126f4
call fcn.00486220
add esp, 0x10
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x486050
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0x612600
cmp dword [esi + 0x48], 8
lea edx, [esi + 0x34]
push edi
mov dword [ebp - 4], 0
jb 0x486073
mov edx, dword [edx]
cmp dword [esi + 0x18], 8
lea ecx, [esi + 4]
jb 0x48607e
mov ecx, dword [ecx]
cmp byte [ebp + 8], 0
mov eax, 0x100
mov edi, 0x800100
cmovne eax, edi
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x65b898
push edx
push ecx
push dword [esi + 0x68]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 0x6c], eax
pop edi
pop esi
test eax, eax
jne 0x4860dc
push str.CWinHttpRequest::OpenRequest
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x612628
call fcn.00486220
add esp, 0x10
xor al, al
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4860f0
Capabilities:
Initialize winhttp library

Disassembly:
push esi
mov esi, ecx
call fcn.00485920
push 0
push 0
push 0
test al, al
je 0x486106
push 0
jmp 0x486108
push 1
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0x64], eax
pop esi
test eax, eax
jne 0x486140
push str.CWinHttpRequest::OpenSession
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6125c4
call fcn.00486220
add esp, 0x10
xor al, al
ret
mov al, 1
ret

Function at 0x486150
Capabilities:
Receive http response
Set http header

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x4861a2
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x486165
mov eax, dword [eax]
push 0x20000000
push ecx
push eax
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x4861a2
push str.CWinHttpRequest::SendRequest
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x61265c
call fcn.00486220
add esp, 0x10
xor al, al
pop esi
ret
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x4861e4
push str.CWinHttpRequest::SendRequest
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x612678
call fcn.00486220
add esp, 0x10
xor al, al
pop esi
ret
push 0
push dword [esi + 0x6c]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x48621c
push str.CWinHttpRequest::SendRequest
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x61268c
call fcn.00486220
add esp, 0x10
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x487570
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f73a0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x686300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.005ba0e2
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x18]
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.00420f90
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [ebp - 4], 1
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x4875fe
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x487700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f73a0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x686300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.005ba0e2
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x18]
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.00420f90
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [ebp - 4], 1
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x487794
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48ab40
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48abb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x68f4b8]
mov edx, eax
test cl, 1
jne 0x48ab90
or ecx, 1
mov dword [0x68f4b0], 0x25c5e09b
mov eax, vtable.boost::system::detail::system_error_category.0
mov dword [0x68f4b8], ecx
mov dword [0x68f4b4], 0x8fafd21e
mov dword [0x68f4a8], eax
jmp 0x48ab95
mov eax, dword [0x68f4a8]
mov eax, dword [eax + 0x18]
mov ecx, 0x68f4a8
push edx
mov dword [ebp - 0xc], edx
call eax
mov byte [ebp - 8], al
mov dword [ebp - 4], 0x68f4a8
test al, al
jne 0x48abb8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x612d54
lea eax, [ebp - 0xc]
push eax
call fcn.00489420
int3

Function at 0x48dfd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f7a7b
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push esi
mov eax, dword [0x686300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x60]
mov eax, dword [esi + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [esi + 0xc]
push 0xffffffffffffffff
mov dword [ebp - 0x64], eax
lea eax, [esi + 0x10]
push 0
push eax
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x60], 0
call fcn.00420f90
mov eax, dword [esi + 0x28]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x44], eax
lea eax, [esi + 0x30]
push eax
mov dword [ebp - 4], 0
call fcn.004b55f0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x68]
push eax
push dword [esi]
mov dword [ebp - 4], 1
lea ecx, [ecx + 0x10]
call fcn.00498370
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 2
test eax, eax
je 0x48e091
test al, 1
jne 0x48e08a
and eax, 0xfffffffe
mov eax, dword [eax]
test eax, eax
je 0x48e08a
lea ecx, [ebp - 0x28]
push 2
push ecx
push ecx
call eax
add esp, 0xc
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x4c], 0x10
jb 0x48e0a2
push dword [ebp - 0x60]
call fcn.005b7634
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4