joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401070
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xb0], 0x96
mov dword [ebp - 0xc4], 0xb29
mov dword [ebp - 0xbc], 0
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xb0]
push ecx
call fcn.00401040
add esp, 8
push str.Enter_password:
call fcn.00401300
add esp, 4
push 0
call fcn.0040289f
add esp, 4
push eax
mov edx, dword [ebp - 0xb0]
push edx
lea eax, [ebp - 0xac]
push eax
call fcn.00402a62
add esp, 0xc
mov ecx, dword [ebp - 0xb0]
push ecx
lea edx, [ebp - 0xac]
push edx
call section..text
add esp, 8
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xb4], 0
cmp dword [ebp - 0xb4], 3
jmp 0x4011d4
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push 0x4131b0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffff
je 0x4012a0
mov eax, dword [str.YOURE_FIRED___]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x4131c0]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x4131c4]
mov dword [ebp - 0xc], edx
mov eax, dword [0x4131c8]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00403dc0
add esp, 4
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xd4], 0
push 0
lea edx, [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
test ecx, ecx
je 0x4012a0
push 5
push 0
push 0
push str.fired.txt
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x401280
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040133f
mov esp, ebp
pop ebp
ret

Function at 0x40b64e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040b4c4
Function at 0x403530
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [section..data]
mov ecx, 0x5101
cdq
idiv ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0x61a7
push 0x1c55
push 0xe99
mov dword [section..data], edx
mov edx, dword [0x406494]
push edx
call esi
mov eax, dword [0x406494]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [esp + 0x14]
xor ebx, ebx
xor ecx, ecx
mov byte [ecx + edi], cl
mov eax, dword [section..data]
cdq
mov ebp, 0x3a57
idiv ebp
inc ecx
cmp ecx, 0x100
mov dword [0x406004], edx
jl 0x403579
mov byte [edi + 0x100], bl
mov ecx, dword [0x406008]
mov eax, 0x9c09c09d
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [0x406008], edx
mov byte [edi + 0x101], bl
mov edx, dword [0x406498]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x40649c]
push 0x6eb8
push 0x26a0
push 0x47f9
push eax
call esi
mov ebp, dword [esp + 0x1c]
xor esi, esi
mov eax, esi
xor ecx, ecx
cdq
idiv ebp
mov eax, dword [esp + 0x18]
push 0x4d
push 0x70f1
push 0x77da
push 0x7571
push 0x4366
mov cl, byte [edx + eax]
xor edx, edx
mov dl, byte [esi + edi]
mov eax, 0x8c8f4e1b
add edx, ebx
mov dword [0x40600c], 0x17a
lea ebx, [edx + ecx]
mov ecx, dword [0x406008]
imul ecx
add edx, ecx
and ebx, 0xff
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add edx, eax
xor eax, eax
mov dword [section..data], edx
mov cl, byte [ebx + edi]
mov al, byte [esi + edi]
mov byte [esi + edi], cl
mov byte [ebx + edi], al
mov edx, dword [0x40649c]
mov eax, dword [0x406494]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
inc esi
cmp esi, 0x100
jl 0x4035ed
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x403680
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [section..data]
mov eax, 0x60f25deb
imul ecx
sar edx, 6
mov eax, edx
push ebx
shr eax, 0x1f
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
push esi
add edx, eax
push edi
mov dword [section..data], edx
call ebp
mov esi, dword [esp + 0x18]
mov ecx, dword [0x406494]
xor eax, eax
xor ebx, ebx
mov al, byte [esi + 0x101]
mov bl, byte [esi + 0x100]
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [0x4064b0]
push 0x5cb0
push 0x4b53
push 0x2466
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jle 0x40375b
inc ebx
and ebx, 0xff
call ebp
mov al, byte [ebx + esi]
mov edx, dword [esp + 0x18]
mov ecx, dword [0x40649c]
add eax, edx
and eax, 0xff
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esp + 0x18]
xor eax, eax
mov al, byte [ebx + esi]
mov dl, byte [ecx + esi]
mov dword [esp + 0x10], eax
mov byte [ebx + esi], dl
mov byte [ecx + esi], al
call ebp
mov al, byte [ebx + esi]
mov edx, dword [esp + 0x10]
add eax, edx
and eax, 0xff
mov cl, byte [eax + esi]
mov eax, dword [esp + 0x1c]
mov dl, byte [edi + eax]
xor dl, cl
mov byte [edi + eax], dl
mov eax, dword [esp + 0x20]
inc edi
cmp edi, eax
jl 0x4036f5
mov dl, byte [esp + 0x18]
mov byte [esi + 0x100], bl
mov byte [esi + 0x101], dl
pop edi
pop esi
pop ebp
mov dword [0x40601c], 0x4fac
pop ebx
pop ecx
ret
Function at 0x418e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
jmp 0x418e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x418e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418e70
mov eax, 1
add ebx, ebx
jne 0x418e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x418e88
jne 0x418ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418e88
xor ecx, ecx
sub eax, 3
jb 0x418eb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418f2a
mov ebp, eax
add ebx, ebx
jne 0x418ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x418ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418ef4
inc ecx
add ebx, ebx
jne 0x418ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x418ed5
jne 0x418ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418ed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418f14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418f05
jmp 0x418e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418f14
add edi, ecx
jmp 0x418e76
pop esi
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x418f7c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f524]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f560]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418f31
mov ecx, edi
jns 0x418f60
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f568]
or eax, eax
je 0x418f76
mov dword [ebx], eax
add ebx, 4
jmp 0x418f4e
call dword [esi + 0x1f564]
mov ebp, dword [esi + 0x1f56c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x418fb0
sub esp, 0xffffff80
jmp 0x4014bc
Function at 0x403805
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x40382e
cmp al, 0x22
je 0x403826
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x40381a
cmp byte [esi], 0x22
jne 0x403838
inc esi
jmp 0x403838
cmp al, 0x20
jle 0x403838
inc esi
cmp byte [esi], 0x20
jg 0x403832
mov al, byte [esi]
test al, al
je 0x403842
cmp al, 0x20
jle 0x40382b
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004038b0
push 0x405004
push section..data
call fcn.00403896
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403872
movzx eax, word [ebp - 0x14]
jmp 0x403875
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004038c8
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10019b85
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test eax, eax
je 0x10019bdd
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10019bdd
push edi
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x10019bcf
cmp esi, ecx
jae 0x10019bdd
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x10019bbd
cmp esi, ecx
jae 0x10019bdd
cmp word [esi], 0
je 0x10019bdd
mov eax, esi
jmp 0x10019bdf
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10020293
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor edx, edx
mov dword [ebp - 4], edi
push 0xc
mov esi, edx
mov ecx, edx
mov ebx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
movzx eax, word [ebx + 4]
mov dword [ebp - 0xc], eax
pop ebx
test eax, eax
je 0x1002030a
mov eax, dword [edi + 0x18]
mov edi, dword [ebp + 8]
cmp dword [eax], edi
mov edi, dword [ebp - 4]
jne 0x10020302
cmp dword [ebp + 0xc], edx
je 0x100202f1
cmp dword [edi + 0x20], edx
je 0x100202f1
test byte [eax + 4], 1
jne 0x10020302
imul esi, ecx, 0xc
lea edi, [ebp - 0x20]
add esi, dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x10020314
mov esi, eax
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
test byte [eax + 4], 1
jne 0x1002030a
inc ecx
add eax, ebx
cmp ecx, dword [ebp - 0xc]
jb 0x100202c9
mov eax, edx
test esi, esi
je 0x100203d5
cmp dword [ebp + 0xc], edx
je 0x10020321
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], edx
jne 0x10020324
push 8
pop ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebx + eax]
test al, 4
je 0x10020337
and ecx, 0xffffcfff
test al, 2
je 0x10020341
and ecx, 0xfffff3ff
test al, 1
je 0x1002034b
and ecx, 0xfffffcff
test al, 8
je 0x1002035a
and ecx, 0xc0ffffff
mov dword [ebp - 0xc], edx
jmp 0x10020360
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x20], edx
je 0x100203d3
mov ebx, ecx
mov edi, ecx
shr ebx, 0xc
mov esi, ecx
shr edi, 0xa
mov eax, ebx
shr esi, 8
or eax, edi
or eax, esi
test al, 3
jne 0x1002038b
test ecx, 0x3f000000
jne 0x1002038b
test cl, 2
je 0x100203d3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, ecx
mov edx, dword [ebp - 8]
shr eax, 0x1e
mov dword [edx + 8], eax
mov eax, ecx
shr eax, 0x18
and al, 0x3f
shr ecx, 1
mov byte [edx + 4], al
and ecx, 1
mov eax, edx
mov dword [eax + 0x14], ecx
and ebx, 3
je 0x100203bc
mov dword [eax], ebx
jmp 0x100203cc
and edi, 3
je 0x100203c5
mov dword [eax], edi
jmp 0x100203cc
and esi, 3
je 0x100203cc
mov dword [eax], esi
xor eax, eax
inc eax
xor edx, edx
jmp 0x100203d5
mov eax, edx
mov edi, dword [ebp - 0x10]
mov esi, edx
mov ecx, dword [ebp - 4]
movzx edi, word [edi + 6]
mov ecx, dword [ecx + 0x1c]
test edi, edi
je 0x100203fc
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x100203f9
inc esi
add ecx, 0x10
cmp esi, edi
jb 0x100203eb
jmp 0x100203fc
xor edx, edx
inc edx
mov ecx, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 0x10], edx
leave
ret 8
Function at 0x10020bb7
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x1004e214]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x24]
call fcn.1001ed46
push 0x10002dd4
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.1001ec94
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x10020c3b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x10020c71
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc9
call fcn.1001fc53
mov edi, eax
jmp 0x10020c71
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.10020aa2
mov ebx, eax
test ebx, ebx
jns 0x10020c63
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xcf
call fcn.1001fc34
mov edi, ebx
jmp 0x10020c71
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x10020c7b
push esi
call fcn.100208bc
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100468a0
mov esp, ebp
pop ebp
ret 8

Function at 0x10023df5
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x10047ea8
call fcn.100472cf
mov esi, ecx
mov ebx, 0x10002fa4
xor edi, edi
mov ecx, ebx
mov dword [ebp - 0x10], edi
call fcn.1002d054
mov edx, 0x10002fd8
mov dword [ebp - 0x20], eax
push edx
push eax
push 0x10001c9c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x1c], edx
push edi
push 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
call fcn.1002d079
add esp, 0x14
mov dword [ebp - 4], edi
cmp dword [esi + 0x18], edi
jne 0x10023e76
push 0x1000204c
push 0x10001f48
mov esi, 0x80070057
push 0xa3
mov ecx, ebx
mov dword [ebp - 0x10], esi
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push edi
push 2
call fcn.1002d079
add esp, 0x24
jmp 0x10023eb0
mov ecx, esi
call fcn.100246f4
test eax, eax
je 0x10023e97
push 0x1000204c
push 0x10001f48
mov esi, 0x80048572
push 0xa8
jmp 0x10023e56
push esi
push edi
push 0x10023b40
call dword [sym.imp.msvcrt.dll__beginthread]
add esp, 0xc
mov ecx, esi
push 2
call fcn.100244fc
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
call fcn.100185c5
mov eax, esi
call fcn.1004729d
ret
Function at 0x100248dd
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
xor esi, esi
mov ecx, 0x100030f0
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.1002d054
mov edx, 0x10003150
mov dword [ebp - 0x18], eax
push edx
push eax
push 0x10001c9c
lea ecx, [ebp - 4]
mov dword [ebp - 0x14], edx
push esi
push 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], esi
call fcn.1002d079
add esp, 0x14
cmp dword [edi + 0x1c], esi
je 0x1002492f
push dword [edi + 0x1c]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea eax, [ebp - 8]
push eax
push esi
push edi
push 0x10024730
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [edi + 0x1c], eax
test eax, eax
jne 0x10024961
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10024961
movzx esi, si
or esi, 0x80070000
lea ecx, [ebp - 0x18]
call fcn.100185c5
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x10027aa5
Capabilities:
Prepare http request

Disassembly:
push 0x1c
mov eax, 0x10048241
call fcn.100472cf
mov ebx, ecx
and dword [ebp - 0x14], 0
mov edi, 0x100034e0
mov ecx, edi
xor esi, esi
call fcn.1002d054
and dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x14]
mov edx, 0x10003568
mov dword [ebp - 0x28], eax
push edx
push eax
push 0x10001c9c
push esi
push 4
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
call fcn.1002d079
add esp, 0x14
and dword [ebp - 4], esi
cmp dword [ebx + 0xc], esi
jne 0x10027b1b
push 0x1000204c
push 0x10001f48
mov esi, 0x80048483
mov ecx, edi
push 0xac
mov dword [ebp - 0x14], esi
call fcn.1002d054
push eax
push esi
push 2
pop edi
jmp 0x10027bcd
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 8]
push 2
pop edi
mov al, byte [eax + 0x19]
test al, al
je 0x10027b4e
cmp dword [ecx + 0xc], edi
je 0x10027b49
push 0x1000204c
mov esi, 0x80048488
push 0x10001f48
mov dword [ebp - 0x14], esi
push 0xb3
jmp 0x10027bc1
mov esi, 0x800000
mov eax, dword [ecx + 0x38]
add eax, dword [ecx + 0x30]
push 0x1004e12c
push eax
push dword [ecx + 0x2c]
lea ecx, [ebp - 0x18]
call fcn.100252c6
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
push ecx
push ecx
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x18]
push ecx
push esi
push dword [eax]
push dword [ebx + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebx + 0x10], eax
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.1001a0c4
cmp dword [ebx + 0x10], 0
jne 0x10027bde
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10027bab
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x14], esi
test esi, esi
jns 0x10027bde
push 0x1000204c
push 0x10001f48
push 0xc4
mov ecx, 0x100034e0
call fcn.1002d054
push eax
push esi
push edi
push 0x10002030
push 0
push edi
call fcn.1002d079
add esp, 0x24
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
or dword [ebp - 4], 0xffffffff
call fcn.100185c5
mov eax, esi
call fcn.1004729d
ret 8
Function at 0x10027bf7
Capabilities:
Set http header

Disassembly:
push 0x14
mov eax, 0x1004826c
call fcn.100472cf
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
cmp dword [ebx + 0x10], eax
jne 0x10027c5b
push 0x1000204c
push 0x10001f48
mov esi, 0x80048481
push 0xd2
mov ecx, 0x100034e0
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push 0
push 2
call fcn.1002d079
add esp, 0x24
lea ecx, [ebp - 0x1c]
call fcn.10028c16
mov eax, esi
call fcn.1004729d
ret
mov edi, dword [ebx + 4]
lea ecx, [ebp - 0x1c]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x1004f3f8]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
jns 0x10027c8a
push 0x1000204c
push 0x10001f48
push 0xd5
jmp 0x10027c2c
xor edi, edi
cmp dword [ebp - 0x14], edi
jle 0x10027c4b
push 0x1004e12c
lea ecx, [ebp - 0x10]
call fcn.1001a089
mov byte [ebp - 4], 1
test edi, edi
js 0x10027d6e
cmp edi, dword [ebp - 0x14]
jge 0x10027d6e
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + edi*4]
mov eax, dword [ebp - 0x1c]
push ecx
push dword [eax + edi*4]
lea eax, [ebp - 0x10]
push 0x10003580
push eax
call fcn.1002db71
mov esi, eax
add esp, 0x10
test esi, esi
js 0x10027d33
push 0x20000000
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebx + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x10027d07
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10027d05
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10027d22
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.1001e980
inc edi
cmp edi, dword [ebp - 0x14]
jl 0x10027c91
jmp 0x10027c4b
push 0x1000204c
push 0x10001f48
push 0xdd
jmp 0x10027d42
push 0x1000204c
push 0x10001f48
push 0xdb
mov ecx, 0x100034e0
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push 0
push 2
call fcn.1002d079
add esp, 0x24
lea ecx, [ebp - 0x10]
call fcn.1001e980
jmp 0x10027c4b
call fcn.1002906c
int3
Function at 0x10027f59
Capabilities:
Check http status code

Disassembly:
push 0x14
mov eax, 0x100482af
call fcn.100472cf
mov ebx, ecx
mov edi, 0x1004e12c
lea ecx, [ebp - 0x10]
push edi
xor esi, esi
call fcn.1001a089
and dword [ebp - 4], esi
lea eax, [ebp - 0x10]
push eax
push ecx
push 0x13
mov ecx, ebx
call fcn.100281c1
test eax, eax
js 0x10027f9e
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
je 0x10027f9e
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1001e980
push 0x1000204c
push 0x100035fc
push 0x118
mov ecx, 0x100034e0
mov dword [ebx + 0x38], esi
call fcn.1002d054
push eax
push esi
push 4
push 0x10002030
push 0
push 4
call fcn.1002d079
add esp, 0x24
cmp dword [ebx + 0x38], 0x190
jb 0x100280d6
cmp dword [ebx + 4], 0
je 0x100280c0
push edi
lea ecx, [ebp - 0x18]
call fcn.1001a089
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.1001a089
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.1001a089
mov byte [ebp - 4], 3
mov eax, dword [ebx + 4]
mov esi, dword [eax + 4]
mov ecx, esi
call fcn.10019f75
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.10019efe
mov edi, dword [ebx + 4]
lea ecx, [ebp - 0x1c]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1004f3f8]
mov ecx, edi
call esi
mov byte [ebp - 4], 4
mov esi, dword [eax]
mov ecx, esi
call fcn.10019f75
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.10019efe
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1001a0c4
mov eax, dword [ebx + 4]
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.10019f75
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.10019efe
test byte [0x1004e800], 2
je 0x100280a2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebx + 0x38]
call fcn.1002537a
lea ecx, [ebp - 0x10]
call fcn.1001e980
lea ecx, [ebp - 0x14]
call fcn.1001e980
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1001e980
jmp 0x100280d6
test byte [0x1004e800], 2
je 0x100280d6
push dword [ebx + 0x38]
mov edx, 0x10001e50
call fcn.1001eb65
mov ecx, ebx
call fcn.10028306
mov esi, eax
test esi, esi
jns 0x10028111
push 0x1000204c
push 0x10001f48
push 0x12c
mov ecx, 0x100034e0
call fcn.1002d054
push eax
push esi
push 2
push 0x10002030
push 0
push 2
call fcn.1002d079
add esp, 0x24
mov eax, esi
call fcn.1004729d
ret