joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4081f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40f958
cmp edx, dword [eax]
je 0x40821b
add eax, 8
inc ecx
cmp eax, 0x40f9e8
jl 0x40820c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40f958]
jne 0x408349
mov eax, dword [0x40ffb8]
cmp eax, 1
je 0x408323
test eax, eax
jne 0x40824c
cmp dword [0x40d3c4], 1
je 0x408323
cmp edx, 0xfc
je 0x408349
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408283
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408970
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408fa0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4082c6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408fa0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c53c
push edi
call fcn.0040a2f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408970
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408980
lea eax, [ebp - 0xa0]
push 0x40c51c
push eax
call fcn.00408980
push dword [esi + 0x40f95c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408980
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040a25b
add esp, 0x2c
pop edi
jmp 0x408349
lea eax, [ebp + 8]
lea esi, [esi + 0x40f95c]
push 0
push eax
push dword [esi]
call fcn.00408fa0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406f64
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, dword [0x42ca30]
or eax, eax
je 0x406f6f
jmp eax
push 0x40614c
mov eax, 0x403340
call eax
jmp eax
Function at 0x4203c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4032b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x38
call fcn.004040b0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x402a18
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x38]
call dword [fcn.004011d4]
lea eax, [ebp - 0x34]
push eax
push 0x100
call dword [0x401130]
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [fcn.004010ac]
mov dword [ebp - 4], 3
push 0
push 0
push 0
push 1
push 0x405374
lea ecx, [ebp - 0x3c]
push ecx
call dword [fcn.00401218]
push eax
call fcn.0040818c
mov dword [ebp - 0x44], eax
call dword [fcn.00401074]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], edx
lea ecx, [ebp - 0x3c]
call dword [fcn.00401274]
mov dword [ebp - 4], 4
cmp dword [ebp - 0x30], 0
je 0x4205ba
mov dword [ebp - 4], 5
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 0x38]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call dword [fcn.00401218]
push eax
mov edx, dword [ebp - 0x30]
push edx
call fcn.004081d8
mov dword [ebp - 0x44], eax
call dword [fcn.00401074]
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
call dword [fcn.00401168]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x3c]
call dword [fcn.00401274]
mov dword [ebp - 4], 6
cmp dword [ebp - 0x28], 0
je 0x4205a4
mov dword [ebp - 4], 7
lea eax, [ebp - 0x24]
push eax
push 0x100
mov ecx, dword [ebp - 0x34]
push ecx
lea edx, [ebp - 0x3c]
push edx
call dword [fcn.00401218]
push eax
mov eax, dword [ebp - 0x28]
push eax
call fcn.00408224
call dword [fcn.00401074]
mov ecx, dword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call dword [fcn.00401168]
push eax
mov eax, dword [ebp - 0x34]
push eax
push 0
call dword [fcn.0040106c]
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x3c]
push edx
push 2
call dword [fcn.004011dc]
add esp, 0xc
mov dword [ebp - 4], 8
cmp dword [ebp - 0x24], 0
je 0x4205a4
mov dword [ebp - 4], 9
lea eax, [ebp - 0x24]
push eax
push 0x100
mov ecx, dword [ebp - 0x34]
push ecx
lea edx, [ebp - 0x3c]
push edx
call dword [fcn.00401218]
push eax
mov eax, dword [ebp - 0x28]
push eax
call fcn.00408224
call dword [fcn.00401074]
mov ecx, dword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call dword [fcn.00401168]
push eax
mov eax, dword [ebp - 0x34]
push eax
push 0
call dword [fcn.0040106c]
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x3c]
push edx
push 2
call dword [fcn.004011dc]
add esp, 0xc
jmp 0x420539
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x28]
push eax
call fcn.00408270
call dword [fcn.00401074]
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00408270
call dword [fcn.00401074]
push 0x41f811
jmp 0x4205fe
lea ecx, [ebp - 0x34]
call dword [fcn.00401274]
lea ecx, [ebp - 0x38]
call dword [fcn.00401274]
ret
Function at 0x40a9b0
Capabilities:
Encode data using xor

Disassembly:
dec eax
fstp dword [esi]
push ds
fcom qword [ebx + ebx*4]
jl 0x40a973
mov ebx, 0x7a0155eb
out dx, eax
sub al, 0xfc
fnsave dword [edx - 0x2713da40]
mov dh, 0x3b
mov dword [edi], edi
mov esp, 0x42c4e3e9
jns 0x40a9b3
and ebp, dword [eax - 0x7e]
or dword [eax - 0x7f], edi
xchg ebx, eax
inc esi
imul dword [eax - 0x2d]
or eax, dword [edx - 0x5ff32800]
cmp dword [edi], edi
shl byte [ebx], 0xcf
sub byte [ebx - 0x20a5ab6d], ch
invalid
jnp 0x40a971
wait
push edi
in eax, 0x48
je 0x40aa28
mov ds, word [edi - 0x73]
int3
les eax, [edx + 0x6d]
mov ecx, 0x14432d7a
push edx
push 0xe8a1fba
mov dl, 0x97
mov edx, 0x958fb04
push 0x1210c28b
sub eax, edi
xchg eax, ebp
invalid

Function at 0x43eb6b
Capabilities:
Encode data using xor

Disassembly:
je 0x43ebe6
push esp
sub dword [ebx + 0x9a948c2], ebp
fninit
add al, byte [edi]
add ch, cl
fld xword [edi]
sbb ebp, dword [esi + 0x26]
wait
cli
cld
push edx
fcomp dword [eax - 0x22]
or edx, ecx
xor al, 0xf8
out 0x98, al
ficomp dword [ecx + 0x41]
mov al, byte [0xb9ed47a1]
test dword [ecx - 0x75], esp
mov eax, 0x391bff3e
invalid
cmp byte [ebp - 0x7aa0263d], al
outsb dx, byte [esi]
inc eax
inc byte [ecx - 0x4fbb6b7e]
push ds
push edx
or eax, 0xd4b09
adc byte [esi + 0x48], bl
aad 6
xor eax, 0x92f92b20
stosb byte es:[edi], al
stosd dword es:[edi], eax
cmp dword [eax + 0x7dbe44ca], esp
mov edx, 0xab0bfe8
jg 0x43ec5e
mov ch, ch
add byte [edi + 0x6a], dh
add bl, bh
nop
sbb bh, byte [ebx]
fisubr dword [esi + 0x5035189e]
jbe 0x43ec4b
add byte [ebx - 0x3d], dl
sahf
sbb byte [ecx + ebp - 0x67587ff5], cl
push edi
jmp 0xf3e3646d
push 0x18591f87
add ah, byte [esi + edx*4 + 0x66]
mov ah, 0x90
push esp
stosb byte es:[edi], al
sbb edx, ebx
xchg ebx, eax
sbb edi, ebp
sub ebp, ecx
mov bl, 0xf4
cmp bh, 0xbe
pop ds
pop ebp
push edx
or al, 9
outsd dx, dword [esi]
xchg esi, eax
dec ebx
sub byte [edi + 0x46], bh
in al, 0xc6
stosd dword es:[edi], eax
loopne 0x43ebfe
int 0xb3
hlt
push ebx
sub dl, bh
cmp cl, byte [edi]
jle 0x43eccf
cmpsd dword [esi], dword es:[edi]
mov bl, 0xcb
xor eax, 0xc4dcc68c
xor dword [ecx + 0x387a4d1f], ecx
sub dword [ecx - 0x76f28999], ebx
in eax, 0x61
mov edx, 0x2f26bfad
sal al, 5
invalid
stosb byte es:[edi], al
sar dword [ecx + 0x7e909aeb], 0x35
scasb al, byte es:[edi]
jns 0x43ed24
mov bl, 0x16
push ss
pop ebp
sbb al, cl
push eax
bswap ebx
enter 0xf50, 0xffffffffffffffcb
adc ebx, eax
inc ecx
mov eax, 0x6490eb23
push edi
inc edi
jecxz 0x43ecdb
mov byte [0xb94c6d76], al
jns 0x43ed10
xor bh, al
jns 0x43ed3d
sbb byte [ebx - 0x24], ah
invalid
inc byte [edi]
push edi
jns 0x43ecde
dec ecx
lahf
cmp ebp, edi
dec esp
mov bl, 0x5d
stosd dword es:[edi], eax
ljmp 0xcc60
push edi
and eax, 0xf86fd9de
sub ebx, dword [ebx + 0x7b]
add eax, 0xca9aba7f
mov cl, byte [ecx + edx*8 + 0x7c]
pop es
cli
pop edi
mov cl, dl
or al, 0xe8
popal
ja 0x43ed7c
jmp 0xa253e6ef
sti
ljmp 0xcc0a
Function at 0x44a8d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
je 0x44a97d
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a914
mov edx, dword [0x652fa4]
push 0x652cd8
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, ebx
or eax, 0x8001
push eax
call edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
push ebx
mov esi, eax
call edi
cmp esi, 0xffffffff
je 0x44a93f
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
test eax, eax
je 0x44a95c
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0044a880
add esp, 4
mov dword [0xa53204], eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x22
push ebp
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x44a93f
pop edi
pop esi
pop ebx
mov dword [0xa53204], 0
pop ebp
ret 4
mov dword [0xa53204], 6
or eax, 0xffffffff
pop ebp
ret 4

Function at 0x487e8b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
imul edx, dword [edx], 0x7553ad10
jge 0x487e3d
test al, 0x82
sbb al, 0xaa
scasb al, byte es:[edi]
ljmp 0x8b58
mov eax, dword [edx + 0x1a82ceab]
aam 0x64
and byte [edx - 0x440fd230], 0x48
or dh, 0xa2
sub bh, byte [edx]
lodsd eax, dword [esi]
or bl, bh
sti
neg dword [edi + eax*4 - 0x6b]
mov ch, 0xd
fstp qword [ebx - 0x79]
inc edx
jae 0x487e15
xchg edi, eax
mov edi, dword [ebx - 0x7ac6400d]
ror dword [edx - 0x8bbb2df], cl
pop ebx
ret 0xdd3a
jne 0x487e28
sub dword [ebp - 0x21], eax
cmp eax, 0x1d1ab42a
pop ebx
invalid
Function at 0x4ca611
Capabilities:
Encode data using xor

Disassembly:
pop ss
xor al, 0x6f
adc esp, dword [esi - 0x62]
push eax
and esi, dword [ebx]
jo 0x4ca684
jp 0x4ca695
xor al, 0x8c
or bl, cl
xor byte [ebx + 0x751543d4], 0xc0
inc edx
adc byte [ebx + 0x60a057a0], ch
or cl, bl
or eax, 0x6b149242
neg cl
sahf
cmpsd dword [esi], dword es:[edi]
pop edx
xor byte [ebx - 2], ah
xchg ebx, eax
adc byte [edi + 0x65], bl
mov esi, 0x7325e7d3
xchg edx, ebp
lock add eax, dword [edx]
lodsb al, byte [esi]
and dl, byte [ecx - 0x46]
mov word [eax], cs
retf
inc ebx
adc eax, 0x1042c075
stosd dword es:[edi], eax
mov al, byte [0x860a057]
invalid
and dl, byte [ecx - 0x46]
jns 0x4ca620
sbb al, 0x43
das
mov al, 0x4c
js 0x4ca626
add dh, ah
dec eax
sbb al, 0x5b
scasd eax, dword es:[edi]
or dl, byte [eax]
sub esi, edi
test esp, ebx
cmc
iretd
mov cl, 0xdf
jb 0x4ca650
in al, dx
pop edi
push cs
mov dword [ebx - 0x7b], esi
sub dword [eax - 0x2e4951f5], 0x75646af7
lock adc word [edx + 0x42], ax
push 0x64
jne 0x4ca6ff
lock adc dword [edx + 0x42], eax
pop edi
lahf
xor al, 0x4a
rcl dword [eax - 0x7c2e525f], 0x6d
sar dword [ecx], cl
mov eax, 0x9b404696
scasb al, byte es:[edi]
adc eax, 0x2942353b
cwde
jnp 0x4ca703
movsb byte es:[edi], byte [esi]
jge 0x4ca6c8
stosd dword es:[edi], eax
and eax, ecx
sar dword [ecx + 0x53e0c1cf], cl
jl 0x4ca703
push edi
fsubr dword [eax - 0x7d]
xchg dword [esi], ebp
test eax, ebp
popfd
inc edi
popal
push ebx
push 0x852e8783
call 0x53adee6f
in eax, 0x17
sal dword [esi + ebx*8 + 0x3c], 6
push es
ret 0x16e0
shl byte [ebx + 0x53c68dad], 1
std
pop edx
fst qword [ebx + 0x33ade370]
jnp 0x4ca72d
invalid
retf 0xb72e
add eax, 0x8efbaea1
retf
mov eax, dword [0xcb8efbae]
xor eax, 0xbb284350
add dh, bh
shr esp, cl
js 0x4ca714
imul esi, dword [ecx + 0x5c], 0xfffffffd
xor dword [eax + 0x121c136f], edx
sbb al, 0x12
mov byte [0x4031dfb5], al
fbstp tbyte [ecx]
inc eax
out dx, al
nop
jae 0x4ca6d8
xor eax, dword [eax]
mov byte [0x62f303c5], al
cmp eax, 0x114c325e
ja 0x4ca731
mov dword [0x43dc6f01], eax
dec eax
push edi
mov edi, 0x4c88055e
jg 0x4ca7a8
ficomp word [ebx + esi*8 + 0x86373af]
mov al, byte [0x75426db2]
inc ebx
pop ds
bound eax, qword [0x584c3046]
add al, byte [ebp + 0x1f137ddc]
push cs
push ecx
pop esi
fcmovbe st(0), st(3)
mov ch, 0xfe
jp 0x4ca715
invalid
std
pop ecx
cld
dec ebp
rcl ebp, cl
int3
Function at 0x60d4fd
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esi - 0x6f], ebx
jno 0x60d4f7
ret
xor eax, 0xf13b3fa5
scasd eax, dword es:[edi]
neg dword [ebp + 0x74427a9f]
aad 0x48
aam 0x54
pop ecx
out 0x6d, al
push ebp
add eax, 0xf4d487d4
mov bh, 0x14
jecxz 0x60d52c
mov al, byte [0x8f0b8f6f]
mov ah, 0xa7
nop
mov dword fs:[eax], edi
mov ebp, 0xaf3b1b81
mov cl, 0x55
xchg esp, eax
pop ebp
int1
int3
fcompi st(2)
lodsb al, byte [esi]
enter 0xffffffffffff915c, 0x75
xchg ecx, eax
jne 0x60d496
xchg ecx, eax
jne 0x60d496
and ch, byte [ecx]
inc ecx
popfd
add eax, 0x9af3f865
xchg ebx, eax
push ss
xor dword [eax + 0x3df4b9f2], ebp
jae 0x60d4a9
loopne 0x60d53a
sub eax, 0xc5f198e3
sbb edi, dword [ebp - 0x59d920de]
adc eax, 0xeea187e4
arpl word [edx], di
xor dword [ebp - 0x41b15d97], 0xffffffde
movsb byte es:[edi], byte [esi]
loop 0x60d53f
mov esi, 0xe265a4de
or eax, 0xd530c6a9
cmc
test eax, 0xf5d530c6
mov ch, 0x15
invalid
xlatb
ror ebp, 1
mov dh, 0xf1
test dword [ebx + edi], ecx
lds ebp, [edi + 0x17274978]
das
inc ebp
xchg ecx, eax
xor al, 0xbf
adc dword [ecx + eax*2], edx
jae 0x60d54b
retf 0x7c64
Function at 0x409681
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a344]
jne 0x40968b
repz ret
jmp fcn.0040e06c

Function at 0x41229c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b70f
and dword [ebp - 0x14], 0
cmp dword [0x43e80c], 0
mov dword [ebp - 0x18], eax
jne 0x41234f
push 0x403764
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4123f7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403758
push ebx
call edi
test eax, eax
je 0x4123f7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403748
push ebx
mov dword [0x43e80c], eax
call edi
push eax
call esi
push 0x403734
push ebx
mov dword [0x43e810], eax
call edi
push eax
call esi
push 0x403718
push ebx
mov dword [0x43e814], eax
call edi
push eax
call esi
mov dword [0x43e81c], eax
test eax, eax
je 0x41234f
push 0x403700
push ebx
call edi
push eax
call esi
mov dword [0x43e818], eax
mov eax, dword [0x43e818]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4123a8
cmp dword [0x43e81c], ecx
je 0x4123a8
push eax
call esi
push dword [0x43e81c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4123a8
test ebx, ebx
je 0x4123a8
call edi
test eax, eax
je 0x41239f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41239f
test byte [ebp - 8], 1
jne 0x4123a8
or dword [ebp + 0x10], 0x200000
jmp 0x4123db
mov eax, dword [0x43e810]
cmp eax, dword [ebp - 0x18]
je 0x4123db
push eax
call esi
test eax, eax
je 0x4123db
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4123db
mov eax, dword [0x43e814]
cmp eax, dword [ebp - 0x18]
je 0x4123db
push eax
call esi
test eax, eax
je 0x4123db
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43e80c]
call esi
test eax, eax
je 0x4123f7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4123f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409681
leave
ret
Function at 0x414210
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.00413870
cmp dword [0x4a40f0], 0x37
jne 0x4142a1
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x403f58
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x403fb4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x4a40f4]
mov edx, dword [0x4a37d4]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x10001fe4
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x3a980
call fcn.1000af42
xor edx, edx
inc edx
call fcn.1000a5f2
xor ecx, ecx
and al, 8
cmp al, 8
setne cl
push 0x32
pop edx
dec ecx
and ecx, 0x803000
add ecx, 0x84400200
mov dword [0x10033c5c], ecx
call fcn.1000a5f2
cmp ax, 1
jne 0x10002030
or dword [0x10033c5c], 0x80000
push esi
push edi
push 0x23
pop edx
call fcn.1000a5f2
movzx eax, ax
xor edi, edi
sub eax, edi
je 0x10002055
dec eax
je 0x1000210d
dec eax
je 0x10002104
dec eax
dec eax
jne 0x10002070
push edi
push edi
push 0x20
pop edx
call fcn.1000a61b
push eax
push 3
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x100375f4], eax
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea eax, [ebp - 4]
push eax
push 5
push dword [0x100375f4]
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push dword [0x100375f4]
call esi
push 0x10033c58
push edi
push 3
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x100375f4]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
push 0x23
pop edx
mov dword [0x100375f8], edi
call fcn.1000a5f2
cmp ax, 4
jne 0x100020fb
push 0x21
pop edx
call fcn.1000a62c
push eax
push 0x21
pop edx
call fcn.1000a61b
push eax
push 0x2b
push edi
call esi
push 0x22
pop edx
call fcn.1000a62c
push eax
push 0x22
pop edx
call fcn.1000a61b
push eax
push 0x2c
push dword [0x100375f8]
call esi
call fcn.1000af63
pop edi
pop esi
leave
ret
push edi
push edi
push edi
push edi
jmp 0x10002062
push edi
push edi
push edi
push 1
jmp 0x10002062
Function at 0x10002205
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x4af]
push ebx
push eax
mov dword [ebp - 0x30], 0x1002d530
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x4b0], bl
call fcn.1001cd70
push 0x7f
lea eax, [ebp - 0xaf]
push ebx
push eax
mov byte [ebp - 0xb0], bl
call fcn.1001cd70
add esp, 0x18
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x10037600]
cmp eax, ebx
je 0x100023bb
lea esi, [ebp - 0x28]
call fcn.10008240
push 0x1003b340
mov edi, 0x1002d524
push edi
mov esi, 0x400
push esi
push dword [ebp - 0x20]
call fcn.100152d6
push dword [0x1003af20]
lea eax, [ebp - 0xb0]
push 0x1002d534
push 0x80
push eax
call fcn.100152d6
lea eax, [ebp - 0xb0]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100022b0
push dword [0x10037600]
sub eax, ecx
push dword [0x100375fc]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x28]
push eax
push 0xd
pop edx
call fcn.1000a61b
push eax
call fcn.10007bed
mov eax, dword [ebp - 0x24]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100022e8
sub eax, ecx
lea eax, [ebp - 0x4b0]
jne 0x10002309
push dword [ebp - 0x20]
push edi
push esi
push eax
call fcn.100152d6
add esp, 0x10
jmp 0x1000231e
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push 0x1002d538
push esi
push eax
call fcn.100152d6
add esp, 0x14
call fcn.1000af42
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], ebx
push 0x10033c58
push dword [0x10033c5c]
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
lea eax, [ebp - 0x4b0]
push eax
push 0x1b
pop edx
call fcn.1000a61b
push eax
push dword [0x100375f8]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push esi
call fcn.1000215f
mov eax, dword [ebp - 0x28]
pop ecx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002368
push dword [ebp - 0x18]
sub eax, ecx
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push esi
call fcn.100021be
pop ecx
push esi
test eax, eax
jne 0x100023a6
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x1000232c
jmp 0x100023a8
call edi
lea eax, [ebp - 0x28]
call fcn.100082bd
mov dword [0x10037600], ebx
call fcn.1000af63
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002447
Capabilities:
Query remote server for available data
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
push ebx
push esi
push edi
xor ebx, ebx
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
push 0x3ff
mov dword [ebp - 0x34], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x443]
push ebx
push eax
mov dword [ebp - 0x3c], 0x1002d530
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 0x444], bl
call fcn.1001cd70
mov eax, dword [0x1003af24]
add esp, 0xc
lea esi, [ebp - 0x34]
call fcn.10008240
push dword [ebp + 8]
mov edi, 0x1002d524
push edi
mov esi, 0x400
push esi
push dword [ebp - 0x2c]
call fcn.100152d6
add esp, 0x10
push ebx
push ebx
push dword [0x1003af24]
lea eax, [ebp - 0x34]
push 0x1003af28
push eax
push 0xc
pop edx
call fcn.1000a61b
push eax
call fcn.10007bed
mov eax, dword [ebp - 0x30]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100024df
sub eax, ecx
lea eax, [ebp - 0x444]
jne 0x10002500
push dword [ebp - 0x2c]
push edi
push esi
push eax
call fcn.100152d6
add esp, 0x10
jmp 0x10002515
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push 0x1002d538
push esi
push eax
call fcn.100152d6
add esp, 0x14
push 0x10033c58
push dword [0x10033c5c]
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x444]
push eax
push 0x1a
pop edx
call fcn.1000a61b
push eax
push dword [0x100375f8]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
push edi
call fcn.1000215f
mov eax, dword [ebp - 0x34]
pop ecx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002551
push dword [ebp - 0x24]
sub eax, esi
push dword [ebp - 0x28]
push eax
push dword [ebp - 0x34]
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
lea eax, [ebp - 0x34]
call fcn.100082bd
push edi
call fcn.100021be
pop ecx
test eax, eax
jne 0x1000258c
or ebx, 0xffffffff
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebx
jmp 0x1000260b
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x10002601
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jae 0x10002601
cmp eax, ebx
je 0x10002581
cmp dword [ebp + 0x10], ebx
jbe 0x1000257e
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push 0x1000
add eax, esi
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x100025db
cmp dword [ebp - 8], ebx
je 0x100025db
add esi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp + 0x10]
jb 0x100025ae
cmp esi, dword [ebp + 0x10]
jae 0x1000257e
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp + 0x10]
push 0xb
pop edx
call fcn.1000a61b
mov ecx, dword [ebp + 0xc]
push eax
mov eax, esi
call fcn.100080f5
pop ecx
pop ecx
jmp 0x1000260b
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret