joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100253f0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x1006d4e0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x1008ab54]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
call fcn.10040589
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x10025432
push 0x80004005
call fcn.10001100
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x10], ebp
push esi
mov dword [esp + 0x34], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x10025483
lea ecx, [esp + 0x14]
call fcn.10068e33
push 0
push 0
push esi
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 1
call fcn.10068e49
test eax, eax
lea ecx, [esp + 0x14]
jne 0x100254bd
mov byte [esp + 0x30], al
call fcn.1006922c
lea eax, [ebp - 0x10]
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100254a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
call fcn.1006910e
mov edi, eax
lea ecx, [edi + 1]
push ecx
call fcn.1003efb3
add esp, 4
mov esi, eax
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.10068f5d
mov edx, dword [esp + 0x38]
push edi
push esi
push edx
mov byte [eax + esi], 0
call fcn.10008280
push esi
call fcn.1003efae
add esp, 4
lea ecx, [esp + 0x14]
call fcn.100691f0
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.1006922c
lea eax, [ebp - 0x10]
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10025531
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x10025610
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1006e258
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008ab54]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x34]
xor ecx, ecx
mov eax, 0x200
mov dword [esp + 0x14], eax
mov edx, 2
xor edi, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003efb3
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
push edi
push ebx
call fcn.1004b150
add esp, 0x10
mov ecx, ebp
call fcn.10002060
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push edi
push str.SOFTWAREQuanDuoDuo_
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10025695
mov eax, dword [esp + 0x3c]
cmp eax, 1
jne 0x100256fe
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x44]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100256f7
test ebx, ebx
jne 0x100256d0
push eax
push ebx
mov ecx, ebp
call fcn.10001ec0
lea edi, [ebx + 1]
jmp 0x100257a8
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100256d5
sub eax, edx
sar eax, 1
push eax
push ebx
mov ecx, ebp
call fcn.10001ec0
mov edi, 1
jmp 0x100257a8
xor edi, edi
jmp 0x100257a8
cmp eax, 4
jne 0x100257a8
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
cmp eax, edi
jne 0x100257a8
call fcn.10040589
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x10025744
push 0x80004005
call fcn.10001100
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], edi
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push 0x10079f9c
push edx
call fcn.10012ec0
mov esi, dword [esp + 0x28]
mov eax, dword [esi - 0xc]
add esp, 0xc
push eax
push esi
mov ecx, ebp
call fcn.10001ec0
lea eax, [esi - 0x10]
mov edi, 1
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100257a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebx
call fcn.1003efae
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x1002b470
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x1002b480
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x10091b90], edx
mov dword [esi*8 + 0x10091b94], eax
add esi, 1
cmp esi, 0x100
jl 0x1002b480
mov dword [0x10092398], edi
mov dword [0x1009239c], edi
mov dword [0x10092390], edi
mov dword [0x10092394], edi
pop edi
pop esi
mov byte [0x100923a4], 1
pop ebx
ret

Function at 0x1002b500
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x1007a988]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x10091388], edx
mov dword [eax*8 + 0x1009138c], ebp
add eax, 1
cmp eax, 0x100
mov dword [esp + 0x18], eax
jl 0x1002b510
pop edi
pop esi
pop ebp
mov byte [0x100923a5], 1
pop ebx
add esp, 0x10
ret
Function at 0x1002e640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007047b
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
mov eax, dword [0x1008ab54]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x70]
mov ecx, 4
xor ebx, ebx
mov dword [esi + 0xc], edx
mov dword [esp + 0x74], ecx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esp + 0x68], ecx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
push ebx
push 0x1008d630
push 0x1008c584
mov byte [esp + 0x74], 6
push ebx
push eax
mov dword [esi], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [esi + 4], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [esi + 0x54], eax
call fcn.10069ecd
add esp, 0x14
test eax, eax
je 0x1002e70c
push 0x87
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10002650
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x3c]
push ecx
mov byte [esp + 0x74], 7
call fcn.1000a2a0
push 0x10081700
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], vtable.CryptoPP::InvalidArgument.0
call fcn.1004a8fc
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.BlockPaddingScheme
call fcn.1002ef10
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x6c], 8
call fcn.1002de60
mov byte [esp + 0x68], 6
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x1002e745
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x60
ret 8
Function at 0x1002ef10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006f011
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1008ab54]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], vtable.CryptoPP::AlgorithmParameters.0
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x30]
push eax
push ecx
lea edi, [esp + 0x18]
mov dword [esp + 0x2c], 1
call fcn.1002efb0
push eax
push esi
call fcn.10030360
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
mov dword [esp + 0xc], 1
je 0x1002ef91
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x1002f1e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov edx, edi
xor eax, eax
shr edx, 2
je 0x1002f224
mov edi, ebx
sub esi, ecx
mov eax, ecx
sub edi, ecx
mov dword [esp + 0xc], edx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
sub edx, 1
mov dword [edi + eax - 4], ebp
jne 0x1002f206
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x1002f251
add ebx, eax
add esi, eax
add ecx, eax
test edi, edi
jbe 0x1002f251
mov edx, esi
mov esi, ebx
sub edx, ecx
mov eax, ecx
sub esi, ecx
mov cl, byte [eax + edx]
xor cl, byte [eax]
add eax, 1
sub edi, 1
mov byte [eax + esi - 1], cl
jne 0x1002f240
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1002f260
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
mov edx, ebp
xor ecx, ecx
xor eax, eax
shr edx, 2
je 0x1002f29a
mov eax, edi
sub esi, edi
mov dword [esp + 0xc], edx
push ebx
mov ebx, dword [esi + eax]
xor ebx, dword [eax]
add eax, 4
or ecx, ebx
sub edx, 1
jne 0x1002f282
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
pop ebx
add eax, eax
add eax, eax
sub ebp, eax
jne 0x1002f2ae
pop edi
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebp
pop ecx
ret
add esi, eax
add edi, eax
mov eax, ecx
shr eax, 0x18
mov edx, ecx
shr edx, 0x10
or al, dl
mov edx, ecx
shr edx, 8
or al, dl
or al, cl
test ebp, ebp
jbe 0x1002f2e0
mov ecx, edi
sub esi, edi
mov edi, ebp
mov dl, byte [ecx + esi]
xor dl, byte [ecx]
add ecx, 1
or al, dl
sub edi, 1
jne 0x1002f2d1
xor ecx, ecx
test al, al
pop edi
sete cl
pop esi
mov al, cl
pop ebp
pop ecx
ret
Function at 0x1002f940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100703c0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1008ab54]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x1008ab54]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ecx]
xor edx, edx
push 1
push 0x1008c428
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
push eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x34], eax
push edx
mov edx, dword [esi + 0x80]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.1.0
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10048e2f
mov esp, ebp
pop ebp
ret 8

Function at 0x1002fde0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10070390
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1008ab54]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x1008ab54]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
push 0x1008c428
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x7c]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x20], vtable.CryptoPP::ArraySink.1.0
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10048e2f
mov esp, ebp
pop ebp
ret 8
Function at 0x1003d590
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1006cacb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1008ab54]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100673ae
push 4
mov dword [esp + 0x20], 0
call fcn.1003ef83
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d610
call fcn.1006712b
mov dword [edi], eax
call fcn.10066f5f
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.10067267
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1003d605
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.10067288
jmp 0x1003d612
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x10048e2f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008ab54]
jne 0x10048e39
repz ret
jmp fcn.1004dd53

Function at 0x100519b7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1008b328]
je 0x100519d2
inc edi
cmp edi, 0x17
jb 0x100519c3
cmp edi, 0x17
jae 0x10051b52
push ebp
push 3
call fcn.1006072b
cmp eax, 1
pop ecx
je 0x10051b1e
push 3
call fcn.1006072b
test eax, eax
pop ecx
jne 0x10051a06
cmp dword [0x1008fb78], 1
je 0x10051b1e
cmp ebx, 0xfc
je 0x10051b51
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1008ff50
push ebp
call fcn.1004985b
add esp, 0xc
test eax, eax
je 0x10051a3c
push esi
push esi
push esi
push esi
push esi
call fcn.1004972b
add esp, 0x14
push 0x104
mov esi, 0x1008ff69
push esi
push 0
mov byte [0x1009006d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10051a80
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1004985b
add esp, 0xc
test eax, eax
je 0x10051a80
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004972b
add esp, 0x14
push esi
call fcn.1004de60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10051ac5
push esi
call fcn.1004de60
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10090264
push 0x1007507c
sub ecx, eax
push ecx
push eax
call fcn.1005fb86
add esp, 0x14
test eax, eax
je 0x10051ac5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004972b
add esp, 0x14
jmp 0x10051ac7
xor esi, esi
push 0x10075078
push ebx
push ebp
call fcn.1005fac6
add esp, 0xc
test eax, eax
je 0x10051ae7
push esi
push esi
push esi
push esi
push esi
call fcn.1004972b
add esp, 0x14
push dword [edi*8 + 0x1008b32c]
push ebx
push ebp
call fcn.1005fac6
add esp, 0xc
test eax, eax
je 0x10051b09
push esi
push esi
push esi
push esi
push esi
call fcn.1004972b
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1006056e
add esp, 0xc
jmp 0x10051b51
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10051b51
cmp ebp, 0xffffffff
je 0x10051b51
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008b32c]
push dword [esi]
call fcn.1004de60
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1006056e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100512ca
xor ebx, ebx
cmp dword [0x10090614], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10060644
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10060724
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10060724
push eax
call fcn.1005125c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10090614], eax
call esi
push eax
call fcn.1005125c
mov dword [esp], 0x10076e7c
push edi
mov dword [0x10090618], eax
call esi
push eax
call fcn.1005125c
mov dword [0x1009061c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1004d0b1
test eax, eax
pop ecx
pop ecx
je 0x10060612
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1004972b
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10060644
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1005125c
cmp eax, ebx
pop ecx
mov dword [0x10090624], eax
je 0x10060644
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1005125c
pop ecx
mov dword [0x10090620], eax
mov eax, dword [0x10090620]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x100606c9
cmp dword [0x10090624], ecx
je 0x100606c9
push eax
call fcn.100512d3
push dword [0x10090624]
mov esi, eax
call fcn.100512d3
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x100606c9
cmp edi, ebx
je 0x100606c9
call esi
cmp eax, ebx
je 0x10060696
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10060696
test byte [ebp - 0x18], 1
jne 0x100606c9
lea eax, [ebp - 0x10]
push eax
call fcn.1004d0e8
test eax, eax
pop ecx
je 0x100606b1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1004972b
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x100606c0
or dword [ebp + 0x10], 0x200000
jmp 0x10060704
or dword [ebp + 0x10], 0x40000
jmp 0x10060704
mov eax, dword [0x10090618]
cmp eax, dword [ebp - 8]
je 0x10060704
push eax
call fcn.100512d3
cmp eax, ebx
pop ecx
je 0x10060704
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10060704
mov eax, dword [0x1009061c]
cmp eax, dword [ebp - 8]
je 0x10060704
push eax
call fcn.100512d3
cmp eax, ebx
pop ecx
je 0x10060704
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10090614]
call fcn.100512d3
cmp eax, ebx
pop ecx
je 0x10060724
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10060726
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1006838b
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x100683b4
call fcn.10040385
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 8], eax
jne 0x100683d7
push eax
push dword [esi + 4]
call fcn.10068316
push esi
push eax
mov ecx, 0x10090908
call fcn.10067fc5
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x10068bf1
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x1006c8bb
call fcn.1004ad0d
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.10068bb3
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.10013240
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x10068c57
push eax
push dword [esi + 8]
call fcn.10068316
push dword [esi + 0xc]
mov ecx, 0x10090908
push eax
call fcn.10067fc5
mov eax, esi
call fcn.1004ad76
ret 0x18