joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
shr edx, 0x10
mov esi, ecx
push edi
test edx, edx
je 0x4311c1
cmp word [eax], 0x3c
jne 0x4311a7
push eax
call fcn.0048a270
test al, al
jne 0x43125a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push ecx
push eax
call fcn.0048a3e0
test al, al
jne 0x43125a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [0x4e90c0]
test ecx, ecx
mov ebx, dword [ebp + 0xc]
cmove ecx, dword [0x4e90bc]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
je 0x43119c
mov eax, dword [0x4e90c0]
test eax, eax
push edi
cmove eax, dword [0x4e90bc]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x431212
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x140], eax
mov eax, dword [0x4e90c0]
test eax, eax
push ecx
cmove eax, dword [0x4e90bc]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_LockResource]
push eax
mov ecx, esi
call fcn.0048a320
test al, al
je 0x43119c
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov dword [esi + 0x144], ebx
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00431280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x434780
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x10
mov edi, ecx
call fcn.00493133
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test edi, edi
je 0x4347c9
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4347c9
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
cmp dword [esi + 4], 0
jne 0x4347e9
push edi
mov dword [esi + 8], fcn.004199b0
mov dword [esi + 0xc], 0x419a00
call fcn.004199b0
add esp, 4
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43493d
xor al, al
pop ebx
pop ebp
ret 0xc
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x434954
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
xor al, al
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
push esi
push edi
mov eax, dword [eax + 0xe8]
mov dword [ebp + 0xc], eax
call fcn.004933e1
mov ecx, dword [ebp + 0xc]
add esp, 4
xor esi, esi
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edi
nop word [eax + eax]
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
mov eax, dword [ecx + 8]
push edi
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ecx, dword [ebp + 8]
add esi, ecx
cmp esi, edi
jae 0x4349af
test eax, eax
je 0x4349af
test ecx, ecx
mov ecx, dword [ebp + 0xc]
jne 0x434980
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
pop edi
mov al, 1
pop ebx
pop ebp
ret 0xc
Function at 0x43ccf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x43ccfb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x43cdb7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
sub edi, 1
jne 0x43cd10
pop edi
test esi, esi
je 0x43cdda
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c7be0]
sub esi, 1
jne 0x43cdc0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x43d2f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x43d333
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x43d325
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x43d344
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.00496320
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x43d3ab
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x43d3a6
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x43d3d8
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x43d3bc
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.00496320
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x43d3ec
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x43d3e3
cmp byte [esi + 8], 0
je 0x43d3e3
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43e5b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x43e648
cmp dword [esi + 4], 0xffffffff
jne 0x43e648
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x43e5e0
cmp dword [ebp + 0x10], 1
mov eax, dword [0x4c9500]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x43e613
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x43e613
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.0043d1a0
add esp, 8
test eax, eax
jne 0x43e634
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.0043d6c0
mov dword [esi], eax
mov eax, dword [0x4e9104]
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc

Function at 0x440ec0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov edx, ecx
mov byte [edx + 0x235], al
test al, al
jne 0x440eee
mov ecx, dword [edx + 0x40]
test ecx, ecx
je 0x440eee
cmp dword [ecx + 0x420], edx
jne 0x440eee
mov dword [ebp + 8], 0
pop ebp
jmp fcn.00421be0
pop ebp
ret 4
Function at 0x445660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp dword [ebx + 0x14], 0x10
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], eax
jb 0x44567e
mov esi, dword [ebx]
jmp 0x445680
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test eax, eax
je 0x4456a4
mov ebx, eax
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x445690
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 0x18]
and ecx, edx
mov edx, dword [edi + 0xc]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0xc], esi
mov esi, dword [edi + 4]
mov dword [ebp - 8], esi
lea ecx, [edx + ecx*4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0xc], esi
jne 0x4456cd
mov ecx, esi
jmp 0x4456d1
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x44580d
cmp dword [ebx + 0x14], 0x10
lea edx, [eax + 8]
jb 0x4456e6
mov edi, dword [ebx]
jmp 0x4456e8
mov edi, ebx
cmp dword [edx + 0x14], 0x10
lea ecx, [edx + 0x10]
jb 0x4456f3
mov edx, dword [edx]
mov ecx, dword [ecx]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp - 4]
mov esi, ecx
cmp dword [ebp + 0xc], ecx
cmovb esi, dword [ebp + 0xc]
test esi, esi
je 0x445763
sub esi, 4
jb 0x445721
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x445726
add edx, 4
add edi, 4
sub esi, 4
jae 0x445710
cmp esi, 0xfffffffc
je 0x44575a
mov cl, byte [edx]
cmp cl, byte [edi]
jne 0x445753
cmp esi, 0xfffffffd
je 0x44575a
mov cl, byte [edx + 1]
cmp cl, byte [edi + 1]
jne 0x445753
cmp esi, 0xfffffffe
je 0x44575a
mov cl, byte [edx + 2]
cmp cl, byte [edi + 2]
jne 0x445753
cmp esi, 0xffffffff
je 0x44575a
mov cl, byte [edx + 3]
cmp cl, byte [edi + 3]
je 0x44575a
sbb ecx, ecx
or ecx, 1
jmp 0x44575c
xor ecx, ecx
test ecx, ecx
jne 0x44576c
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, ecx
jb 0x44576c
jbe 0x445779
mov eax, dword [eax]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
jmp 0x4456c4
cmp dword [eax + 0x1c], 0x10
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x445787
mov edx, dword [edx]
cmp dword [ebx + 0x14], 0x10
jb 0x44578f
mov ebx, dword [ebx]
mov edi, dword [edi]
cmp ecx, edi
mov esi, edi
cmovb esi, ecx
test esi, esi
je 0x4457f4
sub esi, 4
jb 0x4457b2
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x4457b7
add ebx, 4
add edx, 4
sub esi, 4
jae 0x4457a1
cmp esi, 0xfffffffc
je 0x4457eb
mov cl, byte [ebx]
cmp cl, byte [edx]
jne 0x4457e4
cmp esi, 0xfffffffd
je 0x4457eb
mov cl, byte [ebx + 1]
cmp cl, byte [edx + 1]
jne 0x4457e4
cmp esi, 0xfffffffe
je 0x4457eb
mov cl, byte [ebx + 2]
cmp cl, byte [edx + 2]
jne 0x4457e4
cmp esi, 0xffffffff
je 0x4457eb
mov cl, byte [ebx + 3]
cmp cl, byte [edx + 3]
je 0x4457eb
sbb ecx, ecx
or ecx, 1
jmp 0x4457ed
xor ecx, ecx
test ecx, ecx
jne 0x4457fa
mov ecx, dword [ebp - 4]
cmp ecx, edi
jb 0x4457fa
jbe 0x4457fd
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x445b90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x445bab
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x445bc7
movzx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x445bb6
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x18]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
cmp dword [ecx + 4], eax
jne 0x445bfd
cmp dword [ecx], eax
jne 0x445bf5
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + esi + 4], eax
jmp 0x445c05
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
jmp 0x445c05
cmp dword [ecx], eax
jne 0x445c08
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [edx + 4]
push eax
push esi
call fcn.00445c20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46dac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0
je 0x46db5f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00493c60
mov ebx, esp
test ebx, ebx
je 0x46db5f
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x14]
push 0xffffffffffffffff
add ecx, 0x3fc
push ebx
call fcn.00429c90
mov eax, dword [esi + 0x14]
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x28], 0x20
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [esi + 0x14]
lea edx, [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x184]
mov ecx, dword [esi + 0x14]
push ecx
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004229a0
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493122
mov esp, ebp
pop ebp
ret

Function at 0x46ff40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x46ff71
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x46ff60
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x480e30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8038
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4e5070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.BrowserKernalSwitched
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
cmp byte [ebp + 8], 0
mov byte [esi + 0xd4a], 0
je 0x480ea2
movups xmm0, xmmword [esi + 0x1ec]
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov ecx, esi
movups xmmword [eax], xmm0
call dword [edx + 0x254]
mov ecx, dword [esi + 0x40]
push 0x7d0
push 0x79
push esi
call fcn.00422020
jmp 0x480efd
mov ecx, dword [esi + 0x40]
push 0xc8
push 0x79
push esi
call fcn.00422020
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 2
mov eax, 8
push dword [esi + 0xd60]
mov word [ebp - 0x1c], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0
push 0
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0xd50]
push 0
push 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xd0]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 0x24]
cmp eax, 8
jb 0x480f12
inc eax
lea ecx, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
call fcn.00404770
xor eax, eax
mov dword [ebp + 0x24], 7
mov word [ebp + 0x10], ax
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x20], 0
cmp eax, 8
jb 0x480f3b
inc eax
lea ecx, [ebp + 0x28]
push eax
push dword [ebp + 0x28]
call fcn.00404770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x38
Function at 0x488250
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x20]
mov esi, ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [eax + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
test eax, eax
jne 0x488284
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x488287
pop esi
pop ebp
ret 0x20
mov dword [esi + 4], eax
cmp dword [esi + 8], 0
je 0x4882b3
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
push 0x3f
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x4882b3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x4882b5
xor eax, eax
pop esi
pop ebp
ret 0x20
Function at 0x488940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b81e4
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x4e5070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
lea eax, [edi + 0x10]
mov dword [edi], vtable.CConnection.0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x488996
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x30]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSectionAndSpinCount]
lea eax, [edi + 0x48]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSectionAndSpinCount]
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov byte [ebp - 4], 4
push 0x138
mov dword [edi + 0x28], 0
mov byte [edi + 0xc], 0
call fcn.00493133
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.0042c7f0
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [edi + 0x6c], eax
call dword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
mov dword [edi + 0x2c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x489190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
jne 0x489212
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x489212
call fcn.0042cc50
test eax, eax
je 0x4891b6
push dword [ebp + 8]
mov ecx, eax
call fcn.0042d000
push ebx
push edi
lea ebx, [esi + 0x30]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x60]
sar eax, 2
cmp eax, 5
jge 0x4891fa
cmp dword [esi + 0x28], eax
jne 0x4891fa
push 0
push 0
push esi
push 0x488d40
push 0
push 0
call fcn.00498fd8
add esp, 0x18
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
lea ecx, [esi + 0x60]
push eax
call fcn.00409e50
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push 0
push 1
push 0
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.DLL_PostQueuedCompletionStatus]
pop edi
pop ebx
pop esi
pop ebp
ret 4
Function at 0x4a5551
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a53d0

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x7c117c61
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section._RDATA
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4b9a4b69
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100010f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret

Function at 0x10001110
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret

Function at 0x10001830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov eax, dword [edx + 0x3c]
push edi
xor edi, edi
mov eax, dword [eax + edx + 0x78]
add eax, edx
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0x1c]
mov ebx, dword [eax + 0x18]
add esi, edx
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], edi
jbe 0x100018d0
mov ecx, dword [esi + edi*4]
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x100018ca
xor esi, esi
test ebx, ebx
je 0x100018c7
movzx eax, word [eax + esi*2]
cmp eax, edi
jne 0x100018bf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi*4]
add eax, edx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100018b3
test dl, dl
je 0x100018af
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100018b3
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001893
xor eax, eax
jmp 0x100018b8
sbb eax, eax
or eax, 1
test eax, eax
je 0x100018d9
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
inc esi
cmp esi, ebx
jb 0x10001880
mov esi, dword [ebp - 4]
inc edi
cmp edi, dword [ebp - 8]
jb 0x10001870
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002310
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000232a
or eax, 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret
Function at 0x1000e08a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e0c9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e0c9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e0c9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000e0c9
cmp dword [ecx + 0x74], 0xe
jbe 0x1000e0c9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100129fd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001feb0
push 0x1001fea8
push str.FlsAlloc
push 0x1f
call fcn.100128bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012a31
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c1fc]
call esi
jmp 0x10012a37
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012a7b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001fec0
push 0x1001feb8
push str.FlsGetValue
push 0x21
call fcn.100128bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012ab2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001c1fc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10012aba
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001fec8
push 0x1001fec0
push str.FlsSetValue
push 0x22
call fcn.100128bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012af4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001c1fc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]