joyce8/EMBER2024-capa huggingface dataset:
Function at 0x596f40
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638c88
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x596fb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
push eax
push 0x654f50
push 0x200
push str.utility::process::enumProcess
call fcn.00584a40
add esp, 0x10
jmp 0x597075
mov dword [ebp - 0x258], 0x22c
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x59700e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
push eax
push 0x654ef0
push 0x20d
push 0x654f30
call fcn.00584a40
add esp, 0x10
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x597075
lea ecx, [ebp - 0x2c]
call fcn.00597090
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00418f80
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00597260
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.005970b0
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x59700e
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret
Function at 0x5979f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x597a3f
lea eax, [ebp - 0x2c]
push eax
call dword [ebp - 8]
jmp 0x597a49
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x2c]
cmp edx, 9
je 0x597a5b
movzx eax, word [ebp - 0x2c]
cmp eax, 6
jne 0x597aaa
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x597aaa
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x597ac0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x597af4
xor al, al
jmp 0x597b2e
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x597b22
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x597b2e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x597df0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0xffffffff
jne 0x597e2c
xor al, al
jmp 0x597eac
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x597e4d
mov al, 1
jmp 0x597eac
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x597e74
jmp 0x597ea2
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x597e9a
jmp 0x597ea2
mov al, 1
jmp 0x597eac
mov ecx, dword [ebp - 4]
call fcn.00597ec0
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x5981f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00414c90
push eax
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x598218
mov al, 1
jmp 0x598254
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00414c90
push eax
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
push str.move_file_from____s___to____s___flag___d_failed__error___d.
push 0xf9
push str.utility::ufile::moveFile
call fcn.00584a40
add esp, 0x1c
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x598260
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00414c90
push eax
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x598289
mov al, 1
jmp 0x5982c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
movzx edx, byte [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00414c90
push eax
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
push str.copy_file_from____s___to____s___flag___d_failed__error___d.
push 0x103
push str.utility::ufile::copyFile
call fcn.00584a40
add esp, 0x1c
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x5988d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x5988eb
mov al, 1
jmp 0x59891a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
push 0x655760
push 0x15e
push str.utility::ufile::removeFile
call fcn.00584a40
add esp, 0x14
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x598a30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x208
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00415d10
lea ecx, [ebp - 0x228]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041af00
mov edx, dword [ebp - 0x22c]
or edx, 1
mov dword [ebp - 0x22c], edx
lea ecx, [ebp - 0x228]
call fcn.004148d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret

Function at 0x598d80
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0xffffffff
jne 0x598dbb
xor al, al
jmp 0x598de9
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x598dde
mov ecx, dword [ebp - 4]
call fcn.00598d50
xor al, al
jmp 0x598de9
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x598df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x598e27
xor eax, eax
jmp 0x598e2a
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x598ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x598f1f
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jne 0x598f1f
mov al, 1
jmp 0x598f21
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x59cec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x59ced4
xor al, al
jmp 0x59cf19
mov ecx, dword [ebp - 4]
mov byte [ecx + 0xc], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x59d050
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x59cf20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x59cf75
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x102
jne 0x59cf5e
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x59cf96
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov edx, dword [edx]
mov ecx, dword [eax]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x59cfb6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x59d1a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63921b
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x430], ecx
mov eax, dword [ebp - 0x430]
cmp dword [eax], 0
jne 0x59d242
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x428]
push edx
call fcn.00599320
add esp, 8
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x434], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x434]
call fcn.00414c90
push eax
push 0x655bc0
push 0x3e
push 0x655b58
call fcn.00584a40
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.004148d0
or eax, 0xffffffff
jmp 0x59d2c4
mov ecx, dword [ebp + 8]
call fcn.0041af70
mov dword [ebp - 0x43c], 0x400
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x440]
push ecx
push 0
mov ecx, dword [ebp + 8]
call fcn.004312f0
push eax
mov edx, dword [ebp - 0x430]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x59d2a3
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0043c0f0
jmp 0x59d2be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x655b74
push 0x51
push str.utility::RegKey::RegRead
call fcn.00584a40
add esp, 0x10
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 8

Function at 0x59d2e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6391e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
jne 0x59d364
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00599320
add esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
call fcn.00414c90
push eax
push 0x655c70
push 0x59
push 0x655c00
call fcn.00584a40
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004148d0
or eax, 0xffffffff
jmp 0x59d3c1
mov ecx, dword [ebp + 8]
call fcn.0041af70
mov ecx, dword [ebp + 0xc]
call fcn.00414900
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004312f0
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.004312f0
push eax
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x59d3be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x655c1c
push 0x64
push 0x655d04
call fcn.00584a40
add esp, 0x10
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 8
Function at 0x59d4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
mov eax, dword [ebp - 0x80c]
cmp dword [eax], 0
jne 0x59d53c
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
push 0x655f7c
push 0xd9
push 0x655f14
call fcn.00584a40
add esp, 0x10
or eax, 0xffffffff
jmp 0x59d5c1
mov ecx, dword [ebp + 8]
call fcn.0041af70
mov dword [ebp - 0x810], 0x800
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x814]
push ecx
push 0
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
mov edx, dword [ebp - 0x80c]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jne 0x59d59d
lea ecx, [ebp - 0x804]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00418f80
jmp 0x59d5bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.read_reg_lastError___d
push 0xec
push str.utility::RegKeyEx::RegRead
call fcn.00584a40
add esp, 0x10
mov eax, dword [ebp - 0x808]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 8
Function at 0x59d6a0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62a430
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x54], ecx
push 0
push 0
push 0
push 0
push 0x6561b0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edx, dword [ebp - 0x44]
mov dword [edx], eax
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0
jne 0x59d705
push 0
mov ecx, dword [ebp - 0x44]
call fcn.0059dbb0
xor al, al
jmp 0x59d7eb
lea ecx, [ebp - 0x28]
call fcn.0041b010
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0041b010
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.0059e130
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x59d76d
push 1
mov ecx, dword [ebp - 0x44]
call fcn.0059dbb0
mov byte [ebp - 0x45], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004148d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004148d0
mov al, byte [ebp - 0x45]
jmp 0x59d7eb
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.0041b030
mov ecx, dword [ebp - 0x44]
mov dx, word [ebp - 0x4c]
mov word [ecx + 0x1c], dx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x20
call fcn.0041b030
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x38
call fcn.0041b030
push 8
push str.https:__
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
call dword [sym.imp.MSVCR120.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x59d7c9
mov edx, dword [ebp - 0x44]
mov byte [edx + 0x50], 1
mov byte [ebp - 0x46], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004148d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004148d0
mov al, byte [ebp - 0x46]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x59dd40
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
push eax
push 0
push 3
push 0
push 0
movzx ecx, word [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00414c90
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x59dd85
xor al, al
jmp 0x59dd87
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x59de40
Capabilities:
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2824
call fcn.00611ec0
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x280c], ecx
mov dword [ebp - 0x2824], 1
mov dword [ebp - 0x2820], 0x6561b4
mov dword [ebp - 0x281c], 0
mov dword [ebp - 0x2814], 0x84001081
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x59de9f
mov ecx, dword [ebp - 0x2814]
or ecx, 0x800000
mov dword [ebp - 0x2814], ecx
push 0
mov edx, dword [ebp - 0x2814]
push edx
push 0
push 0
push 0x6561bc
mov ecx, dword [ebp + 8]
call fcn.00414c90
push eax
push 0x65622c
mov eax, dword [ebp - 0x280c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edx, dword [ebp - 0x280c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x280c]
cmp dword [eax + 4], 0
jne 0x59df08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.post_error__d
push 0xfc
push 0x6561ec
call fcn.00584a40
add esp, 0x10
xor al, al
jmp 0x59e028
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00414900
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00414c90
push eax
mov eax, dword [ebp - 0x280c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x59df3f
mov byte [ebp - 0x2805], 1
jmp 0x59df46
mov byte [ebp - 0x2805], 0
mov dl, byte [ebp - 0x2805]
mov byte [ebp - 0x2806], dl
movzx eax, byte [ebp - 0x2806]
test eax, eax
jne 0x59df82
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.post_error2__d
push 0x102
push str.utility::CHttpConnection::post
call fcn.00584a40
add esp, 0x10
xor al, al
jmp 0x59e028
mov dword [ebp - 0x2818], 0
mov byte [ebp - 0x2804], 0
push 0x27ff
push 0
lea ecx, [ebp - 0x2803]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x2810], 0
lea edx, [ebp - 0x2810]
push edx
push 0x2800
lea eax, [ebp - 0x2804]
push eax
mov ecx, dword [ebp - 0x280c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x59dffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.post_error3__d
push 0x10f
push 0x656254
call fcn.00584a40
add esp, 0x10
xor al, al
jmp 0x59e028
cmp dword [ebp - 0x2810], 0
jne 0x59e007
jmp 0x59e026
mov eax, dword [ebp - 0x2810]
push eax
lea ecx, [ebp - 0x2804]
push ecx
mov ecx, dword [ebp + 0x1c]
call fcn.0043c000
mov edx, 1
test edx, edx
jne 0x59dfa9
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret 0x18
Function at 0x59e040
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x20000013
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x59e07b
xor al, al
jmp 0x59e0d0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 4
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
push 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x20000005
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x59e0ce
mov edx, dword [ebp - 4]
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov al, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x59e130
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x6d8314]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x204], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x202]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x240], 0
push 0x38
push 0
lea edx, [ebp - 0x23c]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x240], 0x3c
lea eax, [ebp - 0x204]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 0xff
mov dword [ebp - 0x210], 1
lea ecx, [ebp - 0x240]
push ecx
push 0
mov ecx, dword [ebp + 0x14]
call fcn.00414900
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00414c90
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x59e1d2
xor al, al
jmp 0x59e1ff
mov edx, dword [ebp - 0x230]
push edx
mov ecx, dword [ebp + 8]
call fcn.00418f80
mov eax, dword [ebp + 0xc]
mov cx, word [ebp - 0x228]
mov word [eax], cx
mov edx, dword [ebp - 0x214]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.00418f80
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006116d0
mov esp, ebp
pop ebp
ret