joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42eab0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
push edi
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], edi
cmp ecx, 0x10
jb 0x42ead3
mov esi, dword [eax]
jmp 0x42ead5
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x42eaf1
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x42eae0
mov ecx, dword [ebx + 0x14]
mov edi, ecx
and edi, edx
cmp dword [ebx + 0x18], edi
ja 0x42eb06
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edi, eax
mov ecx, dword [ebx + 8]
lea eax, [edi + edi]
mov edx, dword [ebx]
lea eax, [eax + 1]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov esi, dword [ecx + edi*8]
mov edi, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
cmp edi, edx
jne 0x42eb2f
mov eax, edx
jmp 0x42eb33
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x42ec53
cmp dword [ebp - 8], 0x10
lea ecx, [esi + 8]
jb 0x42eb4b
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
jmp 0x42eb4e
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 4], eax
jb 0x42eb5c
mov ecx, dword [ecx]
cmp eax, ebx
mov edx, ebx
cmovb edx, eax
test edx, edx
je 0x42ebc3
sub edx, 4
jb 0x42eb81
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x42eb86
add ecx, 4
add edi, 4
sub edx, 4
jae 0x42eb70
cmp edx, 0xfffffffc
je 0x42ebba
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x42ebb3
cmp edx, 0xfffffffd
je 0x42ebba
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x42ebb3
cmp edx, 0xfffffffe
je 0x42ebba
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x42ebb3
cmp edx, 0xffffffff
je 0x42ebba
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x42ebba
sbb eax, eax
or eax, 1
jmp 0x42ebbc
xor eax, eax
test eax, eax
jne 0x42ebd3
mov eax, dword [ebp - 4]
cmp eax, ebx
jb 0x42ebd3
xor eax, eax
cmp dword [ebp - 4], ebx
setne al
test eax, eax
je 0x42ebe3
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x42eb27
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [ecx + 0x10]
jb 0x42ebf1
mov ecx, dword [ecx]
cmp dword [ebp - 8], 0x10
jb 0x42ebff
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push ecx
push dword [ebp + 0xc]
call fcn.00434af0
add esp, 0xc
test eax, eax
jne 0x42ec3a
cmp ebx, edi
jb 0x42ec3a
cmp ebx, edi
setne al
test eax, eax
jne 0x42ec3a
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x430bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x592988
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x611e60]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x611e60]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x14]
and eax, reloc.WS2_32.dll_connect
mov dword [esp + 0x10], 0
or eax, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x48], 0
lea edx, [esp + 0xc]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xb]
push 0
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x13], 0
push eax
call fcn.00432460
add esp, 0xc
cmp byte [esp + 0xb], 0
je 0x430c54
mov ecx, dword [esi]
and ecx, reloc.WS2_32.dll_connect
or ecx, 4
mov dword [esi], ecx
jmp 0x430c6c
mov eax, dword [esi]
mov ecx, esi
and eax, reloc.WS2_32.dll_connect
or eax, 4
mov dword [esi], eax
lea eax, [esp + 0x14]
push eax
call fcn.0042ba60
lea ecx, [esp + 0x14]
call fcn.0042bb60
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005571f4
mov esp, ebp
pop ebp
ret

Function at 0x4316d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591b10
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x611e60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00559432
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.boost::system::system_error.0
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00422850
mov dword [esi], vtable.boost::lock_error.0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x431764
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x432e20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592d60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x611e60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x432ea1
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea eax, [ecx*8]
mov esi, dword [ebx]
mov dword [ebp - 0x18], eax
add eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
cmp esi, eax
je 0x432edd
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x432edd
mov eax, dword [edi]
lea esp, [esp]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x432f27
cmp esi, dword [edx + ecx*8]
jne 0x432ed0
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x432f0e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x18]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x432f62
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x432f84
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.00433430
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x432f6a
mov dword [ecx], edi
jmp 0x432f84
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x432f84
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00433490
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x433e40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5919a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x611e60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00559432
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [edi], vtable.boost::system::system_error.0
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [esi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00422850
mov dword [edi + 0x30], vtable.boost::exception.0
mov eax, edi
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov dword [edi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4342d0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor eax, eax
push esi
mov dword [ebp - 8], eax
push edi
mov edi, edi
movzx edi, ax
xor edx, edx
mov eax, 0x80
mov esi, 1
mov dword [ebp - 4], eax
mov cx, ax
or eax, esi
movzx ebx, ax
mov eax, ebx
and eax, edi
movzx eax, ax
cmp ax, cx
je 0x43430b
cmp ax, si
jne 0x43430d
xor edi, ebx
shr cx, 1
add esi, esi
mov word [ebp - 4], cx
cmp cx, si
jbe 0x434320
mov eax, dword [ebp - 4]
jmp 0x4342f5
movzx eax, di
mov esi, 8
mov dword [ebp - 4], eax
mov di, ax
mov edi, edi
movzx eax, di
shl eax, 0x1f
xor edx, eax
mov ecx, edx
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add edx, edx
and ecx, 0x4c11db7
shr di, 1
xor edx, ecx
dec esi
jne 0x434330
mov eax, 1
mov ecx, SysReAllocString
mov edi, edi
mov esi, ecx
or esi, eax
mov edi, esi
and edi, edx
cmp edi, ecx
je 0x434370
cmp edi, eax
jne 0x434372
xor edx, esi
shr ecx, 1
add eax, eax
cmp ecx, eax
ja 0x434360
mov eax, dword [ebp - 8]
mov esi, 1
movzx edi, ax
mov eax, 0x80
mov dword [ebp - 4], eax
mov cx, ax
or eax, esi
movzx ebx, ax
mov eax, ebx
and eax, edi
movzx eax, ax
cmp ax, cx
je 0x4343a6
cmp ax, si
jne 0x4343a8
xor edi, ebx
shr cx, 1
add esi, esi
mov word [ebp - 4], cx
cmp cx, si
jbe 0x4343bb
mov eax, dword [ebp - 4]
jmp 0x434390
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
movzx ecx, di
inc eax
mov dword [ebp - 8], eax
mov dword [ebx + ecx*4], edx
mov ecx, 0x100
cmp ax, cx
jb 0x4342e0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435dc0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x593198
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x611e60]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x611e60]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00422850
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.00435ce0
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x435e3d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.005593f2
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x435e66
push dword [esp + 0x10]
call fcn.00556a60
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005571f4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436430
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593238
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x611e60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x6c], edi
mov byte [ebp - 0x65], 0
cmp dword [eax + 0x14], 0x10
jb 0x436479
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x436499
push 0x6063fc
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 9
push eax
call fcn.00557203
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x24], xmm0
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
lea eax, [ebp - 0x24]
push str._d._d._d._d
push eax
call fcn.00437e60
add esp, 0x18
mov dword [ebp - 0x28], 0xf
cmp byte [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
jne 0x4364e6
xor ecx, ecx
jmp 0x4364f9
lea ecx, [ebp - 0x24]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4364f0
sub ecx, edx
push ecx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00422c20
lea edx, [ebp - 0x3c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.004386f0
mov ebx, eax
lea esi, [edi + 0xc]
cmp esi, ebx
je 0x436549
cmp dword [esi + 0x14], 8
jb 0x43652e
push dword [esi]
call fcn.00556a60
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
push ebx
mov word [esi], ax
call fcn.00421f00
cmp dword [ebp - 0x40], 8
jb 0x43655a
push dword [ebp - 0x54]
call fcn.00556a60
add esp, 4
xor eax, eax
mov dword [ebp - 0x40], 7
mov byte [ebp - 4], al
cmp dword [ebp - 0x28], 0x10
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
jb 0x436582
push dword [ebp - 0x3c]
call fcn.00556a60
add esp, 4
mov eax, dword [edi + 8]
cmp eax, 0xffffffff
je 0x436591
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 8], eax
cmp eax, 0xffffffff
jne 0x4365ba
push 0x6063fc
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], 0xa
push eax
call fcn.00557203
push 4
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x2710
push ecx
push 0x1006
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x64], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x62], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push 0x10
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x436624
push 0x6063fc
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 2
push eax
call fcn.00557203
mov al, 1
jmp 0x43663d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005571f4
mov esp, ebp
pop ebp
ret 8
Function at 0x43a1c0
Capabilities:
Initialize winhttp library

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x24]
mov dword [esi], vtable.CWinHttp.0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x1388
mov dword [esi + 0x1c], 0x1388
mov dword [esi + 0x20], 0x1388
call fcn.0043b160
push 0
push 0
push 0
xorps xmm0, xmm0
push 0
movq qword [esi + 0x7c], xmm0
push 0x5f2bc0
mov dword [esi + 0x84], 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x43a240
mov dword [esi + 0x84], 1
mov eax, esi
pop esi
ret
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov eax, esi
pop esi
ret
Function at 0x43a5a0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5936e0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x611e60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x4c], ebx
xor ecx, ecx
mov byte [ebp - 0x11], 0
push ecx
push ecx
push ecx
push dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], ecx
mov ecx, ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
call fcn.0043ae20
test al, al
jne 0x43a625
push 0x6063fc
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push eax
call fcn.00557203
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.0043acf0
test al, al
jne 0x43a649
push 0x6063fc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 4
push eax
call fcn.00557203
mov ecx, ebx
call fcn.0043ad90
mov dword [ebx + 4], eax
cmp eax, 0x194
jne 0x43a66f
push 0x6063fc
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 5
push eax
call fcn.00557203
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x43a695
push 0x6063fc
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 4
push eax
call fcn.00557203
mov eax, dword [ebp - 0x2c]
cmp eax, 0x800000
jbe 0x43a6b4
push 0x6063fc
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0xc
push eax
call fcn.00557203
push eax
call fcn.00558db8
push 0x1000
mov dword [ebp - 0x1c], eax
call fcn.00558db8
mov esi, dword [ebp - 0x18]
mov edi, eax
add esp, 8
mov dword [ebp - 0x24], edi
cmp esi, 0x1000
jbe 0x43a6f1
push edi
call fcn.00558d80
mov esi, dword [ebp - 0x18]
push esi
call fcn.00558db8
mov edi, eax
add esp, 8
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x20]
push eax
push esi
push edi
push dword [ebx + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x43a719
push 0x6063fc
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 8
push eax
call fcn.00557203
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
add eax, esi
push edi
push eax
call fcn.00557660
add esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x28], esi
push eax
push dword [ebx + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x43a75a
push 0x6063fc
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 8
push eax
call fcn.00557203
mov esi, dword [ebp - 0x18]
test esi, esi
jne 0x43a6d2
mov bl, 1
jmp 0x43a781
test edi, edi
je 0x43a78e
push edi
call fcn.00558d80
add esp, 4
test bl, bl
je 0x43a7a4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
jmp 0x43a7af
push dword [ebp - 0x1c]
call fcn.00558d80
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43ab30
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x593798
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x611e60]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, dword [0x611e60]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
push eax
push edx
push dword [ebp + 0x10]
mov dword [esp + 0x5c], 0
push esi
call fcn.0043ae20
test al, al
jne 0x43abd3
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.004226c0
cmp dword [esp + 0x3c], 0x10
jb 0x43abcc
push dword [esp + 0x28]
call fcn.00556a60
add esp, 4
mov eax, edi
jmp 0x43accf
mov ecx, ebx
call fcn.0043ad90
mov dword [ebx + 4], eax
cmp eax, 0x194
jne 0x43abfb
push 0x6063fc
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 5
push eax
call fcn.00557203
push 0x1000
call fcn.00558db8
add esp, 4
mov byte [esp + 0x17], 0
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x43ac81
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x43ac7c
cmp esi, 0x1000
jbe 0x43ac46
push edi
call fcn.00558d80
mov esi, dword [esp + 0x20]
push esi
call fcn.00558db8
add esp, 8
mov edi, eax
lea eax, [esp + 0x20]
push eax
push esi
push edi
push dword [ebx + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x43ac81
push dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push edi
call fcn.00429060
lea eax, [esp + 0x1c]
push eax
push dword [ebx + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x43ac21
jmp 0x43ac81
mov byte [esp + 0x17], 1
push edi
call fcn.00558d80
add esp, 4
cmp byte [esp + 0x17], 0
jne 0x43acaa
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
mov dword [esp + 0x38], 0
cmovae eax, dword [esp + 0x28]
mov byte [eax], 0
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call fcn.004226c0
cmp dword [esp + 0x3c], 0x10
jb 0x43accd
push dword [esp + 0x28]
call fcn.00556a60
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005571f4
mov esp, ebp
pop ebp
ret 0x14
Function at 0x43acf0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x611e60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x2e
push eax
mov word [ebp - 0x34], ax
mov esi, ecx
lea eax, [ebp - 0x32]
xor bl, bl
push eax
call fcn.00558cf0
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
lea eax, [ebp - 0x3c]
push 0
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 5
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x43ad71
push 0xa
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0055b2c7
add esp, 0xc
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005571f4
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005571f4
mov esp, ebp
pop ebp
ret 4

Function at 0x43ad90
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x611e60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
push 0x2e
push eax
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x32]
push eax
call fcn.00558cf0
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
lea eax, [ebp - 0x3c]
push 0
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x13
push dword [esi + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
pop esi
test eax, eax
je 0x43ae02
push 0xa
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0055b2c7
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005571f4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.005571f4
mov esp, ebp
pop ebp
ret