joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496f23
Capabilities:
Write file on windows

Disassembly:
inc dword [ecx + 0x424ec]
add byte [ecx + 0x4c030c], ah
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x496ee8
xor eax, eax
jmp 0x497052
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x4c2600]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x496f26
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call 0x536224
add esp, 0x10
adc byte [ebx], dh
leave
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x496fc0
add byte [eax], al
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [0x4a6194]
xchg esp, eax
popal
dec edx
invalid
test eax, eax
je 0x496fe4
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp fcn.00496fed
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call 0x5362ba
add ebp, 0x3a4
leave
ret

Function at 0x496f93
Capabilities:
Write file on windows

Disassembly:
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
xor bh, bh
adc eax, 0x4a6194
test eax, eax
je 0x496fe4
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl fcn.00496fed
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
call dword [0x4a6498]
mov dword [ebp - 0x68], eax

Function at 0x496f9b
Capabilities:
Write file on windows

Disassembly:
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
xor bh, bh
adc eax, 0x4a6194
test eax, eax
je 0x496fe4
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl fcn.00496fed
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
call dword [0x4a6498]
mov dword [ebp - 0x68], eax

Function at 0x498f2d
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x498f58
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
or byte [ebx + 0x488b0845], cl
or byte [ebx], bh
invalid
mov dword [ebp - 4], ecx
jb 0x498f5f
cmp ebx, dword [eax + 4]
jae 0x498f5f
xor eax, eax
jmp 0x49914f
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne fcn.00498f70

Function at 0x498f8f
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x498f86
cmp ecx, edx
jae 0x4990cb
cmp dword [eax + 4], 0
je fcn.00498f8f
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x498f77
cmp dword [ebp + 8], 0
je 0x498fb1
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4990cb
cmp eax, esi
jae 0x4990cb
add byte [eax], al
mov eax, dword [0x4c1e00]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
invalid
Function at 0x498faf
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x498f86
cmp ecx, edx
jae 0x4990cb
cmp dword [eax + 4], 0
je fcn.00498f8f
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x498f77
cmp dword [ebp + 8], 0
je 0x498fb1
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4990cb
cmp eax, esi
jae 0x4990cb
add byte [eax], al
mov eax, dword [0x4c1e00]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
invalid

Function at 0x498fc3
Capabilities:
Parse pe header

Disassembly:
adc bh, byte [ecx]
cmp al, 0xb5
or byte [esi], bl
dec esp
add byte [edi], cl
test dh, bh
add byte [eax], al
add byte [eax], al
inc esi
cmp esi, eax

Function at 0x498fd6
Capabilities:
Parse pe header

Disassembly:
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4a63b0]
adc eax, 0x4a63b0
test eax, eax
je 0x49914b
cmp dword [ebp - 8], 0x1000000
jne 0x49914b
add byte [eax], al
test byte [ebp - 0xc], 0xcc
je 0x499054
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x49914b
mov eax, dword [ecx + 0x3c]
add eax, ecx

Function at 0x49f028
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x4c030c]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4c0320]
je 0x49f05f
inc eax
cmp eax, 0x13
clc
adc esi, dword [edx - 0xf]

Function at 0x49f05b
Capabilities:
Write file on windows

Disassembly:
clc
adc esi, dword [edx - 0xf]
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4c0320]
jne 0x49f182
mov eax, dword [0x4c1d88]
cmp eax, 1

Function at 0x49f078
Capabilities:
Write file on windows

Disassembly:
je 0x49f15d
cmp eax, edx
jne 0x49f08f
cmp dword [0x4bf90c], 1
je 0x49f15d
cmp ecx, 0xfc
je 0x49f182
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [0x4a6398]
test eax, eax
jne 0x49f0c5
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call 0x53140f
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call 0x5355ec
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x49f0f9
mov eax, edi
push eax
call 0x5355fb
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
call 0x34d5b25
clc
push 0x4b95e8
push edi
call 0x53fed2
or eax, 0xc483000a
invalid
push edi
call 0x53561b
push dword [esi + 0x4c0324]
mov ebx, eax
call 0x535628
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
rol byte [ebx], 0x59
and eax, 0xfffffffc
call 0x5316f9
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call 0x531476
push edi
push ebx
call 0x53148d
push 0x4b95c8
push ebx
call 0x531498
push dword [esi + 0x4c0324]
push ebx
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x4c0324]
push dword [esi]
call 0x53568b
pop ecx
push eax
push dword [esi]
invalid
Function at 0x442af0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov eax, dword [0x594180]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5973f0]
mov ecx, dword [0x5973f4]
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [ebp - 0x11]
cmp ecx, 0xa
setl byte [ebp - 0x12]
mov eax, 0x92a7de27
mov ebx, dword [sym.imp.WS2_32.dll_WSAStartup]
jmp 0x442b40
mov eax, 0xa6514bf3
nop dword [eax + eax]
cmp eax, 0x1cdeb619
jg 0x442b80
cmp eax, 0xa6514bf2
jle 0x442bb0
cmp eax, 0xad54be59
je 0x442b36
cmp eax, 0xf514436c
jne 0x442d00
cmp byte [ebp - 0x13], 0
mov eax, 0xa6514bf3
mov ecx, 0x68d0a0e9
cmovne eax, ecx
jmp 0x442b40
cmp eax, 0x51b214b7
jg 0x442bf0
cmp eax, 0x1cdeb61a
je 0x442c2b
cmp eax, 0x4b32d1ed
jne 0x442b40
mov eax, dword [ebp - 0x18]
mov byte [eax], 1
mov eax, 0x51b214b8
jmp 0x442b40
cmp eax, 0x92a7de27
je 0x442c8d
cmp eax, 0xa26e2de8
jne 0x442b40
push eax
sub esp, 0x18c
mov eax, esp
mov byte [esi], 0
push eax
push 2
call ebx
mov eax, 0x1cdeb61a
jmp 0x442b40
cmp eax, 0x51b214b8
je 0x442cbc
cmp eax, 0x68d0a0e9
jne 0x442b40
mov eax, dword [0x5973f0]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x4b32d1ed
mov edi, 0x51b214b8
jmp 0x442ce1
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
sub esp, 0x190
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x1c]
push 2
call ebx
test eax, eax
sete byte [ebp - 0x13]
mov eax, dword [0x5973f0]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xa26e2de8
mov edi, 0xf514436c
cmove eax, edi
cmp dword [0x5973f4], 0xa
mov edx, 0xa26e2de8
jmp 0x442cf0
movzx ecx, byte [ebp - 0x11]
movzx eax, byte [ebp - 0x12]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0xa26e2de8
mov edi, 0x1cdeb61a
cmovne eax, edi
test cl, cl
mov ecx, 0xa26e2de8
cmove eax, ecx
test dl, dl
cmovne eax, edi
jmp 0x442b40
mov eax, dword [ebp - 0x18]
mov byte [eax], 1
mov eax, dword [0x5973f0]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x4b32d1ed
mov edi, 0xad54be59
cmove eax, edi
cmp dword [0x5973f4], 0xa
mov edx, 0x4b32d1ed
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, edi
jmp 0x442b40
cmp eax, 0xa6514bf3
jne 0x442b40
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055d8e5
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x462490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [0x597938]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
setne al
sete cl
cmp dword [0x59793c], 0xa
setge dl
setl ah
xor ah, cl
or dl, al
xor dl, 1
or dl, ah
mov ebx, 0x6d96bcc4
mov eax, 0x1b734ef1
cmove ebx, eax
mov edi, 0xe763131d
cmove edi, eax
mov ecx, 0x71f63d76
mov eax, 0x34a21228
cmove ecx, eax
mov dword [esp + 4], ecx
mov ebp, 0x3aa05b3d
cmove ebp, eax
mov esi, 0x91fd7daf
xor ecx, ecx
mov eax, 0x811c9dc5
jmp 0x462520
mov esi, 0x3aa05b3d
nop word cs:[eax + eax]
mov edx, esi
cmp esi, 0x34a21227
jg 0x462560
cmp edx, 0xe763131c
jle 0x4625a0
mov esi, ebx
cmp edx, 0xe763131d
je 0x462520
cmp edx, 0xf5d08fbc
je 0x4625fc
mov esi, edx
cmp edx, 0x1b734ef1
jne 0x462520
mov esi, 0xe763131d
jmp 0x462520
cmp edx, 0x6d96bcc3
jle 0x4625d0
cmp edx, 0x6d96bcc4
je 0x462620
cmp edx, 0x6ef429d5
je 0x46262a
mov esi, edx
cmp edx, 0x71f63d76
jne 0x462520
cmp byte [esp + 3], 0
mov esi, 0xbe5b871b
mov edx, 0xf5d08fbc
cmovne esi, edx
jmp 0x462520
mov esi, ebp
cmp edx, 0x91fd7daf
je 0x462520
mov esi, edi
cmp edx, 0xbe5b871b
je 0x462520
mov esi, edx
cmp edx, 0x95efe95a
jne 0x462520
jmp 0x462635
cmp edx, 0x34a21228
je 0x46250d
mov esi, edx
cmp edx, 0x3aa05b3d
jne 0x462520
cmp ecx, dword [esp + 8]
setb byte [esp + 3]
mov esi, dword [esp + 4]
jmp 0x462520
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ecx]
andn esi, eax, edx
andn eax, edx, eax
or eax, esi
imul eax, eax, 0x1000193
mov esi, 0x6ef429d5
jmp 0x462520
mov esi, 0x95efe95a
jmp 0x462520
inc ecx
mov esi, 0x91fd7daf
jmp 0x462520
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x462b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x55cb00
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], edx
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 0x30], ecx
lea esi, [ecx + 0x14]
mov byte [ebp - 0x1e], 0
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x1e]
mov ecx, esi
push eax
push edx
push 0
call fcn.004640c0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], esi
mov ecx, esi
push 0
call fcn.00464240
mov dword [ebp - 0x10], 1
push 0x24
call fcn.0055d87a
add esp, 4
mov dword [ebp - 0x10], 2
mov ecx, eax
mov dword [ebp - 0x24], eax
call fcn.00466e40
mov eax, dword [ebp + 0x14]
mov edx, eax
xor edx, 0xfffff7ff
and edx, eax
mov esi, edx
shr esi, 3
mov ecx, esi
not ecx
and ecx, 0x731c1b21
and esi, 0xce3e4de
or esi, ecx
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x24]
mov dword [ecx + 0x24], ebx
mov dword [ecx + 0x28], ebx
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], edi
xor esi, 0x731c1a21
mov dword [ecx + 0x34], esi
shr edx, 9
mov esi, edx
not esi
and esi, 0xac84e4cf
and edx, 0x7b1b30
or edx, esi
xor edx, 0xac84e4cb
mov dword [ecx + 0x38], edx
mov edx, dword [0x5979c0]
lea ebx, [edx + 1]
imul ebx, edx
test bl, 1
sete byte [ebp - 0x1d]
cmp dword [0x5979c4], 0xa
setge dl
setl dh
or dl, bl
xor dh, byte [ebp - 0x1d]
xor dl, 1
or dl, dh
test dl, 1
jne 0x462c9b
jmp 0x462ca6
mov dword [ecx + 0x3c], edi
mov dword [ecx + 0x40], eax
test dl, 1
jne 0x462cae
mov dword [ecx + 0x3c], edi
mov dword [ecx + 0x40], eax
jmp 0x462c9b
mov edx, eax
xor edx, 0xffffffc0
and edx, eax
cmp edx, 1
ja 0x462cc3
mov dword [ecx + 0x50], 0x8775dfb
jmp 0x462d25
add edx, 0xfffffffe
cmp edx, 0x1e
ja case.0x462cd0.3
mov eax, 0x6e000300
jmp dword [edx*4 + 0x462dd4]
mov eax, 0x7080001b
jmp case.0x462cd0.2
mov dword [ecx + 0x50], 0
jmp 0x462d25
mov eax, 0x7181a01b
jmp case.0x462cd0.2
mov eax, 0x6e080304
jmp case.0x462cd0.2
mov eax, 0x7088001f
mov dword [ecx + 0x50], eax
mov edi, dword [ebp - 0x24]
mov eax, dword [edi + 8]
mov esi, eax
not esi
and esi, 0x5ab847e9
mov edx, eax
and edx, 0xa547b816
or edx, esi
xor edx, 0x5ab847e1
and eax, 8
or eax, edx
mov dword [edi + 8], eax
mov dword [ebp - 0x10], 1
call fcn.004630d0
mov eax, dword [0x5979c0]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete dl
setne al
cmp dword [0x5979c4], 0xa
setl ah
setge cl
cmp ah, dl
jne 0x462d62
or cl, al
je 0x462d62
nop
jmp 0x462d60
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x30]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x46dee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x597b48]
lea edi, [eax + 1]
imul edi, eax
mov ebx, edi
xor ebx, 0xfffffffe
mov esi, dword [0x597b4c]
mov edx, dword [0x597b50]
lea eax, [esi + 1]
imul eax, esi
and eax, 1
mov dword [esp + 0xc], eax
mov ebp, 0x2427aedf
mov esi, 0xd7c14be3
cmove esi, ebp
sete al
mov dword [esp + 0x10], edx
cmp edx, 0xa
mov edx, 0xd7c14be3
cmovge esi, edx
setl ah
xor ah, al
cmovne esi, ebp
test ebx, edi
sete byte [esp + 1]
mov ebx, 0x31fab758
mov edi, 0x19cd949b
cmove edi, ebx
sete al
mov ebp, dword [0x597b54]
cmp ebp, 0xa
setl byte [esp + 2]
movzx edx, byte [ecx + 4]
mov ebp, 1
shlx edx, ebp, edx
mov dword [esp + 8], edx
mov edx, 0x19cd949b
cmovge edi, edx
setl dl
xor dl, al
cmovne edi, ebx
mov eax, dword [ecx]
mov dword [esp + 0x14], eax
mov ebx, 0x22dfefdd
nop dword [eax]
cmp ebx, 0x22dfefdc
jg 0x46e040
cmp ebx, 0xa54abf57
je 0x46e089
cmp ebx, 0x19cd949b
jne 0x46df90
cmp dword [esp + 0xc], 0
sete byte [esp + 6]
cmp dword [esp + 0x10], 0xa
setl byte [esp + 7]
mov ebx, 0xfce89c62
nop dword [eax]
cmp ebx, 0xfce89c61
jg 0x46dff0
cmp ebx, 0x89cfe99a
je 0x46e032
cmp ebx, 0xd7c14be3
jne 0x46dfd0
mov ebx, 0x89cfe99a
jmp 0x46dfd0
cmp ebx, 0x2427aedf
je 0x46e112
cmp ebx, 0xfce89c62
jne 0x46dfd0
movzx eax, byte [esp + 6]
movzx edx, byte [esp + 7]
mov ah, dl
xor ah, al
test dl, dl
mov ebx, 0xd7c14be3
mov ebp, 0x89cfe99a
cmovne ebx, ebp
test al, al
mov edx, 0xd7c14be3
cmove ebx, edx
test ah, ah
cmovne ebx, ebp
jmp 0x46dfd0
mov ebx, esi
jmp 0x46dfd0
cmp ebx, 0x31fab758
je 0x46e145
cmp ebx, 0x22dfefdd
jne 0x46df90
movzx eax, byte [esp + 1]
movzx edx, byte [esp + 2]
mov ah, dl
xor ah, al
test dl, dl
mov ebx, 0x19cd949b
mov ebp, 0xa54abf57
cmovne ebx, ebp
test al, al
mov edx, 0x19cd949b
cmove ebx, edx
test ah, ah
cmovne ebx, ebp
jmp 0x46df90
cmp dword [esp + 0xc], 0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
sete byte [esp + 4]
cmp dword [esp + 0x10], 0xa
setl byte [esp + 5]
mov ebx, 0xfce89c62
nop dword [eax + eax]
cmp ebx, 0xfce89c61
jg 0x46e0d0
cmp ebx, 0x89cfe99a
je 0x46e10e
cmp ebx, 0xd7c14be3
jne 0x46e0b0
mov ebx, 0x89cfe99a
jmp 0x46e0b0
cmp ebx, 0x2427aedf
je 0x46e128
cmp ebx, 0xfce89c62
jne 0x46e0b0
movzx eax, byte [esp + 4]
movzx edx, byte [esp + 5]
mov ah, dl
xor ah, al
test dl, dl
mov ebx, 0xd7c14be3
mov ebp, 0x89cfe99a
cmovne ebx, ebp
test al, al
mov edx, 0xd7c14be3
cmove ebx, edx
test ah, ah
cmovne ebx, ebp
jmp 0x46e0b0
mov ebx, esi
jmp 0x46e0b0
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ebx, 0xa54abf57
jmp 0x46df90
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
xor ecx, eax
andn eax, ecx, eax
setne cl
mov ebx, edi
jmp 0x46df90
and cl, 1
mov byte [esp + 3], cl
movzx eax, byte [esp + 3]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a71f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
lea eax, [esi + 0x50]
mov dword [esi + 0x54], 0x55ccb0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], vtable.httplib::detail::SocketStream.0
mov dword [esi + 0xc], eax
vmovups ymm0, ymmword [ebp + 0xc]
vmovups ymmword [esi + 0x10], ymm0
lea ecx, [esi + 0x30]
mov byte [esi + 3], 0
mov dword [esi + 0x58], 0
lea eax, [esi + 4]
lea edx, [esi + 3]
push eax
push edx
push 0x1000
vzeroupper
call fcn.004a7700
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x58], 1
lea eax, [esi + 8]
lea ecx, [ebp + 0x2c]
push eax
call fcn.004a73e0
mov ebx, eax
mov dword [esi + 8], vtable.httplib::detail::SocketStream.0
mov eax, dword [0x597c88]
mov ecx, dword [0x597c8c]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [esi + 3]
cmp ecx, 0xa
setl byte [esi + 4]
mov eax, 0x15ca98cd
lea ecx, [ebp + 0x2c]
nop word cs:[eax + eax]
cmp eax, 0x15ca98cc
jg 0x4a72e0
cmp eax, 0xf3b2e78c
je 0x4a7382
cmp eax, 0xb820abd
jne 0x4a72c0
jmp 0x4a7320
cmp eax, 0x532e9065
je 0x4a7370
cmp eax, 0x15ca98cd
jne 0x4a72c0
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 4]
mov edx, ecx
xor dl, al
mov edx, 0x532e9065
mov edi, 0xb820abd
cmovne edx, edi
test al, al
mov eax, edx
cmovne eax, edi
test cl, cl
cmove eax, edx
jmp 0x4a72b1
lea ecx, [esi + 0x30]
call fcn.004796e0
mov eax, dword [0x597c88]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x532e9065
mov edi, 0xf3b2e78c
cmove eax, edi
cmp dword [0x597c8c], 0xa
mov edx, 0x532e9065
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, edi
jmp 0x4a72b1
lea ecx, [esi + 0x30]
call fcn.004796e0
mov eax, 0xb820abd
jmp 0x4a72b1
call fcn.004ab9c0
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4aaee0
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x418
mov ebp, dword [esp + 0x42c]
mov eax, dword [0x594180]
xor eax, esp
mov dword [esp + 0x414], eax
movzx eax, word [ebp]
mov dword [esp + 8], eax
mov eax, 0xf9190248
mov edi, dword [sym.imp.WS2_32.dll_ntohs]
jmp 0x4aaf20
mov eax, 0xbb12adbe
nop dword [eax]
cmp eax, 0x39c0e5fe
jg 0x4aafa0
cmp eax, 0xf9190247
jle 0x4aaff0
cmp eax, 0xf9190248
je 0x4ab11c
cmp eax, 0xf95d4151
je 0x4ab135
cmp eax, 0x8e811a1
jne 0x4aaf20
push 0x401
push 0
lea esi, [esp + 0x18]
push esi
call fcn.00562890
sub esp, 0x10
vmovaps xmm0, xmmword [0x57ffc0]
vmovups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], esi
mov eax, dword [esp + 0x44c]
mov dword [esp + 4], eax
mov dword [esp], ebp
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
mov eax, 0x577d9a89
mov ecx, 0x45d88768
cmove eax, ecx
jmp 0x4aaf20
cmp eax, 0x4c4c1ee8
jle 0x4ab030
cmp eax, 0x4c4c1ee9
je 0x4ab13f
cmp eax, 0x577d9a89
je 0x4ab156
cmp eax, 0x6e6f65ea
jne 0x4aaf20
movzx eax, word [ebp + 2]
push eax
call edi
movzx eax, ax
mov ecx, dword [esp + 0x438]
mov dword [ecx], eax
mov eax, 0xf95d4151
jmp 0x4aaf20
cmp eax, 0xaf2f4536
je 0x4ab162
cmp eax, 0xb82a902d
jne 0x4ab197
movzx eax, word [ebp + 2]
push eax
call edi
movzx eax, ax
mov ecx, dword [esp + 0x438]
mov dword [ecx], eax
mov eax, 0x8e811a1
jmp 0x4aaf20
cmp eax, 0x39c0e5ff
je 0x4aaf14
cmp eax, 0x45d88768
jne 0x4aaf20
mov eax, dword [0x5974e8]
mov ecx, dword [0x5974ec]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [esp + 2]
sete al
mov ebx, 0xe2a1ad2c
mov edx, 0x67a8215d
cmove ebx, edx
cmp ecx, 0xa
setl byte [esp + 3]
setl cl
mov esi, 0xe2a1ad2c
cmovge ebx, esi
xor cl, al
cmovne ebx, edx
mov ecx, 0x48a73950
nop word cs:[eax + eax]
cmp ecx, 0x48a7394f
jg 0x4ab0d0
cmp ecx, 0xe2a1ad2c
je 0x4ab115
cmp ecx, 0x255a5ce
jne 0x4ab0a0
lea eax, [esp + 0x10]
push eax
call fcn.0056a470
add esp, 4
mov dword [esp + 4], eax
mov ecx, ebx
jmp 0x4ab0a0
cmp ecx, 0x67a8215d
je 0x4ab16e
cmp ecx, 0x48a73950
jne 0x4ab0a0
movzx edx, byte [esp + 2]
movzx ecx, byte [esp + 3]
mov ch, dl
xor ch, cl
mov eax, edi
mov edi, ebp
mov esi, 0xe2a1ad2c
mov ebp, 0x255a5ce
cmovne esi, ebp
test cl, cl
mov ecx, esi
cmovne ecx, ebp
test dl, dl
cmove ecx, esi
mov ebp, edi
mov edi, eax
jmp 0x4ab0a0
mov ecx, 0x255a5ce
jmp 0x4ab0a0
mov eax, dword [esp + 8]
cmp eax, 2
mov eax, 0x4c4c1ee9
mov ecx, 0xb82a902d
cmove eax, ecx
jmp 0x4aaf20
mov eax, 0x8e811a1
jmp 0x4aaf20
cmp word [ebp], 0x17
mov eax, 0xaf2f4536
mov ecx, 0x6e6f65ea
cmove eax, ecx
jmp 0x4aaf20
mov eax, 0x39c0e5ff
xor ebx, ebx
jmp 0x4aaf20
mov eax, 0xbb12adbe
xor ebx, ebx
jmp 0x4aaf20
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x434]
push dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
call fcn.00407e00
mov eax, 0x39c0e5ff
mov bl, 1
jmp 0x4aaf20
cmp eax, 0xbb12adbe
jne 0x4aaf20
and bl, 1
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0055d8e5
mov eax, ebx
add esp, 0x418
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ce790
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
lea ecx, [esi + 0x38]
mov dword [esi + 0x3c], 0x55d0e0
mov edx, dword fs:[0]
mov dword [esi + 0x38], edx
mov dword fs:[0], ecx
mov dword [esi + 0x2c], 0
mov dword [esi + 0x40], 0
lea ecx, [esi + 8]
push eax
call fcn.004d2290
lea ebx, [esi + 8]
mov ecx, ebx
push dword [esi + 4]
call fcn.004d4320
mov eax, dword [0x5985d8]
mov ecx, dword [0x5985dc]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [esi + 2]
cmp ecx, 0xa
setl byte [esi + 3]
mov edx, 0x2c7e96b9
mov eax, dword [esi + 4]
nop dword [eax + eax]
cmp edx, 0x2c7e96b8
jg 0x4ce840
cmp edx, 0xcb129011
je 0x4ce8f1
cmp edx, 0xd5a5c0a0
jne 0x4ce820
jmp 0x4ce880
cmp edx, 0x6fcd79ee
je 0x4ce8e0
cmp edx, 0x2c7e96b9
jne 0x4ce820
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
mov ah, cl
xor ah, al
test al, al
mov edx, 0x6fcd79ee
mov edi, 0xd5a5c0a0
cmovne edx, edi
test cl, cl
mov ecx, 0x6fcd79ee
cmove edx, ecx
test ah, ah
cmovne edx, edi
jmp 0x4ce818
mov ecx, ebx
call fcn.004b6dc0
mov edx, dword [0x5985d8]
mov ecx, dword [0x5985dc]
lea eax, [edx + 1]
imul eax, edx
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
sete dl
cmp ecx, 0xa
setl dh
xor dh, dl
mov edi, ebx
mov ebx, 0x6fcd79ee
mov edx, 0xcb129011
cmovne ebx, edx
cmp eax, 0xffffffff
mov edx, ebx
mov eax, 0xcb129011
cmove edx, eax
cmp ecx, 0xa
cmovge edx, ebx
mov ebx, edi
jmp 0x4ce818
mov ecx, ebx
call fcn.004b6dc0
mov edx, 0xd5a5c0a0
jmp 0x4ce818
mov ecx, dword [esi + 0x38]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4