joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70781545
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x70781d00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x7078603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x70786034]
sub esp, 4
test ebx, ebx
je 0x70781d4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x70781d44
test esi, esi
je 0x70781d44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x70781d20
mov dword [esp], 0x7078603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x70781f30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x707842a0
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x70781f80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x70782058
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x70781fbe
cmp eax, 4
jne 0x70781fe0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x70781fce
cmp edx, 4
je 0x70781fce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.70781f30
Function at 0x406739
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x469c7c], 0
jne 0x406777
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40674d
mov dword [ecx*4 + 0x469c78], eax
inc ecx
cmp ecx, 0x100
jl 0x406748
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4067a4
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x469c78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406785
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401037
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
call 0x401037
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push esi
push edi
push ebx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403030], eax
mov dword [ebp - 8], 0
push 0xa
push section..data
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x401089
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x401089
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010c1
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
mov dword [ebp - 8], edi
push 0xdeadbeef
push dword [ebp - 0xc]
push dword [ebp - 8]
call section..text
cmp dword [ebp - 8], 0
je 0x4010fb
lea eax, [ebp - 0x40c]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str.dup2patcher.dll
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 0x40c]
push eax
call fcn.00401184
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x401130
mov ebx, eax
push str.load_patcher
push ebx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40111e
call eax
push ebx
call sub.kernel32.dll_FreeLibrary
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_DeleteFileA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401184
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4011af
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x53764133
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x709a72a7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x407a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46a1bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x470560
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], 3
call fcn.0043a280
mov eax, dword [esi + 0x28]
mov ecx, dword [eax]
lea edi, [esi + 0x24]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x28], 2
call fcn.004057a0
mov eax, dword [edi + 4]
push eax
call fcn.00453df1
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x18]
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x28], 1
call fcn.00405860
mov eax, dword [edi + 4]
push eax
call fcn.00453df1
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov edi, dword [esi + 0x14]
add esp, 4
cmp edi, ebx
mov byte [esp + 0x1c], bl
je 0x407b34
lea edx, [edi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x407b34
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
lea eax, [edi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x407b34
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
mov esi, dword [esi + 0xc]
cmp esi, ebx
mov dword [esp + 0x1c], 0xffffffff
je 0x407b69
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x407b69
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
lea eax, [esi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x407b69
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x408850
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub eax, 0
push ebx
je 0x408870
dec eax
je 0x408868
dec eax
jne 0x4088be
mov ebx, dword [0x498a14]
jmp 0x408876
mov ebx, dword [0x498a10]
jmp 0x408876
mov ebx, dword [0x498a0c]
test ebx, ebx
je 0x4088be
cmp ebx, 1
jne 0x40888e
call fcn.004024c0
mov ecx, dword [esp + 0xc]
mov byte [ecx], al
mov al, bl
pop ebx
ret
cmp ebx, 0x41
jb 0x4088be
cmp ebx, 0x5a
ja 0x4088be
lea edx, [esp + 8]
mov dword [esp + 8], 0x5c3a41
push edx
mov byte [esp + 0xc], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4088be
mov eax, dword [esp + 0xc]
mov byte [eax], bl
mov al, 1
pop ebx
ret
xor al, al
pop ebx
ret

Function at 0x409750
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4989f4
call esi
push 0x4989dc
call esi
push 0
push 0
push 0
push 0x4096e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x40aab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46a4a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
mov dword [esp + 0x1c], 0x470450
mov dword [esp + 0x28], 0x7eb9cba7
mov dword [esp + 0x14], 0x470874
xor eax, eax
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x40]
mov word [esp + 8], ax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x470844
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 8]
push eax
mov byte [esp + 0x40], 2
call fcn.0040a8b0
mov edx, dword [esp + 0x24]
add esp, 8
push 0xd1e28639
push 0x6ee41966
push 0xcdafd027
lea ecx, [esp + 0x28]
call dword [edx]
mov edx, dword [esi]
xor eax, 0xcb495fd8
mov ecx, eax
not ecx
xor ecx, eax
and ecx, 0x32884fd2
not eax
xor ecx, eax
xor ecx, 0xbb810d92
mov ecx, dword [edx + ecx*8 + 4]
mov edx, dword [esp + 0x44]
mov eax, dword [ecx]
push edx
lea edx, [esp + 8]
push edx
call dword [eax + 4]
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8

Function at 0x40bd80
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x40bdb6
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [esi + 0x10]
push 1
lea ecx, [esi + 0x10]
push 0x5e
push 0x1f
call dword [eax]
xor al, 0x51
mov byte [edi], al
mov esi, dword [esi]
inc edi
cmp esi, ebx
jne 0x40bd93
mov eax, dword [esp + 0x10]
mov dword [eax], edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
pop esi
mov dword [eax], ecx
pop ebx
ret
Function at 0x469621
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004548d0
mov eax, dword [0x496f74]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0045d1db
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x469754
push 2
push esi
push dword [ebp + 8]
call fcn.0045d1db
add esp, 0xc
cmp eax, ebx
je 0x469754
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x4696f4
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00463d30
push 0x8000
push dword [ebp + 8]
call fcn.00469a1a
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x4696aa
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.0045cba5
add esp, 0xc
cmp eax, 0xffffffff
je 0x4696ca
sub edi, eax
test edi, edi
jg 0x4696a2
jmp 0x4696e2
call fcn.00458159
cmp dword [eax], 5
jne 0x4696df
call fcn.00458150
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.00469a1a
pop ecx
pop ecx
jmp 0x46973c
jge 0x46973c
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045d1db
push dword [ebp + 8]
call fcn.004661f5
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x46973c
call fcn.00458150
mov dword [eax], 0xd
call fcn.00458159
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0045d1db
add esp, 0xc
mov eax, esi
pop edi
jmp 0x469756
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004543e5
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4024ed
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x4024ef
ret
Function at 0x10001392
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x100013a6
xor eax, eax
jmp 0x10001470
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x100013b7
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov edx, dword [ebp + 0x10]
test esi, esi
jle 0x1000146c
push edi
xor edi, edi
inc edi
mov ah, byte [ebx + edi - 1]
xor cl, cl
xor ch, ch
mov byte [ebp - 1], ah
cmp edi, esi
jge 0x100013d8
mov cl, byte [edi + ebx]
lea ebx, [edi + 1]
cmp ebx, esi
mov ebx, dword [ebp + 0xc]
jge 0x100013e6
mov ch, byte [edi + ebx + 1]
mov al, ch
and al, 0x3f
mov byte [ebp - 5], al
mov al, ah
shr al, 2
movzx eax, al
push eax
call fcn.1000135c
mov ah, byte [ebp - 1]
mov byte [edx], al
and ah, 3
mov al, cl
shl ah, 4
shr al, 4
or ah, al
movzx eax, ah
push eax
call fcn.1000135c
add esp, 8
mov byte [edx + 1], al
cmp edi, esi
jge 0x1000143c
and cl, 0xf
shr ch, 6
shl cl, 2
or cl, ch
movzx eax, cl
push eax
call fcn.1000135c
add esp, 4
mov byte [edx + 2], al
jmp 0x10001440
mov byte [edx + 2], 0x3d
lea eax, [edi + 1]
add edx, 3
cmp eax, esi
jge 0x10001459
push dword [ebp - 5]
call fcn.1000135c
add esp, 4
mov byte [edx], al
jmp 0x1000145c
mov byte [edx], 0x3d
add edi, 3
inc edx
lea ecx, [edi - 1]
cmp ecx, esi
jl 0x100013c6
pop edi
mov eax, dword [ebp + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001475
Capabilities:
Download and write a file
Read and send data from client to server
Read data from internet
Read file on windows
Receive and write data from server to client
Receive data
Send data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [0x10005ab4], 2
push 0xa
mov dword [ebp - 4], edi
pop ebx
cmp byte [0x10005ae8], 0
mov ecx, 0x2000
je 0x10001505
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], ecx
push eax
push ecx
push 0x10005c30
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100015af
mov eax, dword [ebp - 8]
test eax, eax
je 0x100015a7
lea ecx, [ebp - 4]
push ecx
push eax
push 0x10005c30
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x100014fa
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100014fa
mov eax, dword [ebp - 8]
add dword [0x10005ab8], ecx
sub eax, ecx
mov dword [ebp - 8], eax
jne 0x100014c7
jmp 0x10001599
mov dword [0x10005ab4], ebx
jmp 0x10001599
lea eax, [ebp - 4]
push eax
push ecx
push 0x10005c30
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x100015d9
mov eax, dword [ebp - 4]
test eax, eax
je 0x100015c7
mov esi, dword [0x10005ab0]
test esi, esi
je 0x10001573
mov ecx, dword [0x10005abc]
mov edx, edi
cmp ecx, dword [0x10008c38]
jae 0x10001593
cmp edx, eax
jae 0x10001593
mov al, byte [edx + 0x10005c30]
inc edx
mov byte [ecx + esi], al
mov ecx, dword [0x10005abc]
mov eax, dword [ebp - 4]
inc ecx
mov dword [0x10005abc], ecx
cmp ecx, dword [0x10008c38]
jae 0x10001593
mov esi, dword [0x10005ab0]
jmp 0x10001545
push edi
lea ecx, [ebp - 8]
push ecx
push eax
push 0x10005c30
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100015bb
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x100015bb
add dword [0x10005ab8], eax
cmp dword [0x10005ab4], 2
jne 0x100015df
jmp 0x1000148f
mov dword [0x10005ab4], edi
jmp 0x100015df
mov dword [0x10005ab4], 0xd
jmp 0x100015df
mov dword [0x10005ab4], 0xc
jmp 0x100015df
mov eax, dword [0x10005ac0]
cmp eax, 0xffffffff
je 0x100015a7
cmp dword [0x10005ab8], eax
jae 0x100015a7
mov dword [0x10005ab4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001e66
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 2
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [0x10005ae0], 0
mov edi, eax
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
je 0x10001f59
push 0x3ed
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ec
push dword [0x10005ae0]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
mov eax, 0x56000000
test ecx, ecx
je 0x10001ec8
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x56000000
push eax
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
cmp byte [0x10005ad9], 0
jne 0x10001f59
push 0
push 0
push 0x31
push dword [0x10005ae0]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 8], eax
test eax, eax
je 0x10001f0f
push 0
push eax
push 0x30
push 0x3e9
push esi
call ebx
push 0
push dword [ebp - 8]
push 0x30
push 2
push esi
call ebx
cmp byte [0x100057e8], 0
jne 0x10001f3b
push 0x40
push 0x100057e8
push 2
push dword [0x10005ae0]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x100057e8
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [0x10005adb], 0
je 0x10001f90
test edi, edi
je 0x10001f6f
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x10005ad9], 0
je 0x10001f90
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor eax, 0x80000
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x1900000
push 0
push 0x401
push 0x3ed
push esi
call ebx
cmp dword [0x100057dc], 0
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
je 0x10001ffe
push 0
push 0x67
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0x170
push 0x3f1
push esi
call ebx
push dword [0x100057dc]
push 0x3f0
push esi
call edi
cmp byte [0x10005828], 0
mov ecx, 0x10004290
mov eax, 0x10005828
cmove eax, ecx
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0x3e8
push 1
push esi
call dword [sym.imp.USER32.dll_SetTimer]
cmp byte [0x10005af0], 0
je 0x10002065
push 0x10005af0
push 0x3f1
push esi
call edi
push 0x100054e0
push 0x3f2
push esi
call edi
push 0x10005520
push 0x3f3
push esi
call edi
push 0x10005600
push 0x3f4
push esi
call edi
push 0x10005560
push 0x3f5
push esi
call edi
push 0x10005680
push 0x3f6
push esi
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003b16
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov byte [0x10005ae9], 1
pop ebp
jmp sym.inetc.dll_get

Function at 0x10003b26
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x100057e4], eax
pop ebp
jmp sym.inetc.dll_get

Function at 0x10003b3f
Capabilities:
Create thread
Get file size
Hide graphical window
Read file on windows
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push str.Uploading__s
push 0x100054e0
mov byte [0x10005ae8], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Uploading
push str.Downloading
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ebp
jmp sym.inetc.dll_get