joyce8/EMBER2024-capa huggingface dataset:
Function at 0x138fc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x13ab8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x1395d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x13ad4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x139cf
xor eax, eax
push ebp
push 0x139c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00013754
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x139b1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x13af4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x139cf
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x13ab0
cmp byte [ebp - 0xd], 0
jne 0x13a11
cmp byte [ebp - 0x12], 0
je 0x13ab0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x13a2a
dec ebx
cmp byte [ebx], 0x2e
je 0x13a39
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x13a29
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x13ab0
inc ebx
cmp byte [ebp - 0x12], 0
je 0x13a66
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x13ab0
cmp byte [ebp - 0xd], 0
je 0x13ab0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x13ab0
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x14df4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x14efe
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x14e47
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00013160
jmp 0x14ee5
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00014da8
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00014dc8
mov ebx, eax
test esi, esi
je 0x14e6f
dec esi
test esi, esi
jl 0x14e6f
cmp edi, ebx
jne 0x14e4e
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.000131a0
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.000133f0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.000131e8
cmp eax, 2
jl 0x14ee5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x14ee5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.000131e8
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x14ee5
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.000131e8
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.000133f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14f05
lea eax, [ebp - 0x110]
call fcn.00013078
ret

Function at 0x14fc8
Capabilities:
Get file attributes

Disassembly:
call fcn.00014a18
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x14fdc
dec eax
and al, 0x10
sete al
ret

Function at 0x1519c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x15206
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.000131a0
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.000150a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1520d
lea eax, [ebp - 0x10c]
call fcn.00013078
ret
Function at 0x157ac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x15844
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x157f9
mov eax, dword [ebx + 0x19]
call fcn.000133ac
push eax
push esi
mov eax, edi
call fcn.000133ac
push eax
mov eax, dword [ebx + 0x1d]
call fcn.000133ac
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x1582e
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.000133ac
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00014c18
mov eax, dword [ebp - 8]
call fcn.000133ac
push eax
mov eax, edi
call fcn.000133ac
push eax
mov eax, dword [ebx + 0x1d]
call fcn.000133ac
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1584b
lea eax, [ebp - 8]
call fcn.00013078
ret

Function at 0x15858
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x158bf
mov byte [ebp - 0x800], 0
mov eax, dword [ebx + 0x19]
call fcn.000133ac
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, esi
call fcn.000133ac
push eax
mov eax, edi
call fcn.000133ac
push eax
mov eax, dword [ebx + 0x1d]
call fcn.000133ac
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x800]
mov ecx, 0x800
call fcn.000131d0
jmp 0x158f0
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.000130cc
mov eax, dword [ebx + 0x19]
call fcn.000133ac
push eax
mov eax, esi
call fcn.000133ac
push eax
mov eax, edi
call fcn.000133ac
push eax
mov eax, dword [ebx + 0x1d]
call fcn.000133ac
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x16468
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov bl, 1
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov esi, dword [eax + 0x1c]
dec esi
test esi, esi
jl 0x164c0
inc esi
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov edx, ebp
call fcn.00015acc
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov edi, eax
test bl, bl
je 0x164ac
push 0
push edi
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x164b0
xor eax, eax
jmp 0x164b2
mov al, 1
mov ebx, eax
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
inc ebp
dec esi
jne 0x16483
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1787c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0001339c
xor eax, eax
push ebp
push 0x1796b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.000133ac
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x17955
mov eax, ebx
call fcn.00012504
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x1794e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x17980
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov dword [esi], edx
and eax, 0xffff
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17955
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.0001251c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17972
lea eax, [ebp - 4]
call fcn.00013078
ret
Function at 0x185c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x186bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00013078
test esi, esi
je 0x1869e
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x186d4
push esi
push 0x186e4
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.000132a8
mov eax, dword [ebp - 0x114]
call fcn.000133ac
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x1869e
mov dword [ebp - 8], 0x105
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10d]
push eax
push 0
push 0
push 0x186f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x18695
mov eax, ebx
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.000131d0
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.000134c0
lea edx, [ebp - 0x118]
mov eax, dword [ebx]
call fcn.00017730
mov edx, dword [ebp - 0x118]
mov eax, ebx
call fcn.000130cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x186c3
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.0001309c
ret
Function at 0x18fa8
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x18fb0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x19156
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x1916c
mov eax, ebx
call fcn.00019628
mov eax, dword [ebx + 0x1c]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x1911a
inc edi
xor esi, esi
mov eax, dword [ebx + 0x1c]
mov edx, esi
call fcn.00015acc
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x1c]
mov edx, esi
call fcn.000159b8
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, 0x19184
call fcn.00013234
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00019628
mov eax, dword [ebp - 8]
call fcn.00014fc8
test al, al
je 0x1907b
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, 0x19198
call fcn.00013234
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00019628
cmp dword [ebp - 4], 1
jne 0x19053
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00019514
mov eax, dword [ebp - 8]
call fcn.000133ac
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, 0x191a8
call fcn.00013234
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00019628
lea ecx, [ebp - 0x18]
mov edx, 0x191c0
mov eax, dword [ebp - 8]
call fcn.000150b8
mov eax, dword [ebp - 0x18]
call fcn.00014fc8
test al, al
je 0x19112
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x30]
mov edx, 0x191c0
mov eax, dword [ebp - 8]
call fcn.000150b8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x2c]
mov ecx, 1
mov eax, 0x191d0
call fcn.00014f5c
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00019628
mov eax, dword [ebp - 8]
call fcn.000133ac
push eax
lea ecx, [ebp - 0x34]
mov edx, 0x191c0
mov eax, dword [ebp - 8]
call fcn.000150b8
mov eax, dword [ebp - 0x34]
call fcn.000133ac
push eax
call sub.kernel32.dll_MoveFileA
cmp dword [ebp - 4], 1
jne 0x19112
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00019404
inc esi
dec edi
jne 0x18fe9
mov eax, dword [ebx + 0x1c]
call fcn.00015b50
mov edx, 0x191ec
mov eax, ebx
call fcn.00019628
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1915d
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.0001309c
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.0001309c
ret
Function at 0x191f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0001339c
xor eax, eax
push ebp
push 0x1936a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 4]
mov edx, 0x19384
call fcn.00013234
mov edx, dword [ebp - 0x60]
mov eax, esi
call fcn.00019628
xor ebx, ebx
lea eax, [ebp - 0x4c]
mov edx, 0x44
call fcn.00014758
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.000133ac
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x192c3
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x68]
call fcn.00014a24
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
mov edx, 0x193a8
call fcn.00013234
mov edx, dword [ebp - 0x64]
mov eax, esi
call fcn.00019628
jmp 0x19347
mov dword [ebp - 8], 0x103
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
push 0x3e8
call sub.kernel32.dll_Sleep
cmp dword [ebp - 8], 0x103
je 0x192ca
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 8]
call fcn.00014c18
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
mov edx, 0x193c8
call fcn.00013234
mov edx, dword [ebp - 0x6c]
mov eax, esi
call fcn.00019628
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
lea edx, [ebp - 0x78]
mov eax, ebx
call fcn.00017838
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0x193ec
call fcn.00013234
mov edx, dword [ebp - 0x74]
mov eax, esi
call fcn.00019628
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x19371
lea eax, [ebp - 0x78]
mov edx, 7
call fcn.0001309c
lea eax, [ebp - 4]
call fcn.00013078
ret

Function at 0x1a4ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x1a539
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x20]
mov edi, dword [eax + 0x1c]
dec edi
test edi, edi
jl 0x1a51e
inc edi
xor esi, esi
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x20]
mov edx, esi
call fcn.000159b8
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x1a550
call fcn.00013234
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00019628
push 1
lea ecx, [ebp - 0xc]
mov eax, dword [ebx + 0x20]
mov edx, esi
call fcn.000159b8
mov eax, dword [ebp - 0xc]
call fcn.000133ac
push eax
call sub.kernel32.dll_WinExec
inc esi
dec edi
jne 0x1a4d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1a540
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0001309c
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x4ea4653c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x78b13ec9
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4010e0
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0x30
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.004122f0
add esp, 0xc
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x5c], 0x30
mov dword [ebp - 0x4c], 0
push 0xf0f0f0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebp - 0x3c], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x54], 0x4012b0
mov dword [ebp - 0x34], 0x4232c0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x58], 3
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
movzx eax, ax
test eax, eax
jne 0x401173
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x10000000
push 0
push str.6c1109f1_3589_4c56_92bd_886fd4856fa9
push 8
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80
or eax, 0x10000000
push eax
push 0xffffffffffffffec
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x8001
push 0x111
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x1c
push 0
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004122f0
add esp, 0xc
push 0
push 0x190
push 0x1f4
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x190
cdq
sub eax, edx
sar eax, 1
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x1f4
cdq
sub eax, edx
sar eax, 1
push eax
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x4016a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401260
or eax, 0xffffffff
jmp 0x4012a5
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40128a
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401260
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401cc0
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, 0x50
mov word [ebp - 4], ax
cmp dword [ebp + 0x14], 0
je 0x401cec
mov dword [ebp - 8], 0x800000
mov ecx, 0x1bb
mov word [ebp - 4], cx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
jne 0x401d14
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401d9f
push 0
movzx ecx, word [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edx, dword [ebp + 0x18]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x18]
cmp dword [eax + 4], 0
jne 0x401d4e
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401d9f
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edx, dword [ebp + 0x18]
mov dword [edx + 8], eax
mov eax, dword [ebp + 0x18]
cmp dword [eax + 8], 0
jne 0x401d9d
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401d9f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401db0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x401dec
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0x10], 0
je 0x401e16
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004125b0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.004125b0
add esp, 4
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401e4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401e73
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 4], 0
jne 0x401e71
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401e73
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401e80
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x401ec4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401f6f
cmp dword [ebp - 4], 0
jne 0x401ee7
mov ecx, dword [ebp - 8]
add ecx, 0x64
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
jmp 0x401f0c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 0x64]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x401f1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401f6f
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x401f46
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401f6f
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0
ja 0x401e9d
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov byte [edx + eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret