joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cf02
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041fe40
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp word [esi], 0
je 0x40d083
push esi
call fcn.0040d097
push esi
call fcn.00424e13
pop ecx
push esi
mov edi, eax
call fcn.0040d0c2
test al, al
je 0x40cfb7
push esi
call fcn.0040d097
test al, al
je 0x40cf71
lea eax, [edi + 4]
cmp dword [ebp + 0x10], eax
jbe 0x40d083
push dword [ebp + 0x10]
push str.__
push dword [ebp + 0xc]
call fcn.00411919
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call fcn.004118f1
mov al, 1
jmp 0x40d085
push 0x5c
pop eax
cmp word [esi], ax
jne 0x40d083
lea ebx, [esi + 2]
cmp word [ebx], ax
jne 0x40d083
mov esi, dword [ebp + 0x10]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x40d083
push esi
push str.__
push dword [ebp + 0xc]
call fcn.00411919
push esi
push 0x434a04
push dword [ebp + 0xc]
call fcn.004118f1
push esi
push ebx
jmp 0x40cf62
lea eax, [ebp - 0x1000]
mov ebx, 0x7ff
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40d083
cmp eax, ebx
ja 0x40d083
movzx eax, word [esi]
push eax
call fcn.0040d19c
test al, al
je 0x40d022
lea eax, [edi + 6]
mov edi, dword [ebp + 0x10]
cmp edi, eax
jbe 0x40d083
push edi
push str.__
push dword [ebp + 0xc]
call fcn.00411919
xor eax, eax
mov word [ebp - 0xffc], ax
lea eax, [ebp - 0x1000]
push edi
push eax
push dword [ebp + 0xc]
call fcn.004118f1
push edi
jmp 0x40cf61
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.0040ca70
lea eax, [ebp - 0x1000]
push eax
call fcn.00424e13
add edi, 4
add eax, edi
mov edi, dword [ebp + 0x10]
pop ecx
cmp edi, eax
jbe 0x40d083
push edi
push str.__
push dword [ebp + 0xc]
call fcn.00411919
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.004118f1
cmp word [esi], 0x2e
jne 0x40d01c
movzx eax, word [esi + 2]
push eax
call fcn.0040d19c
test al, al
je 0x40d01c
add esi, 4
jmp 0x40d01c
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4015d2
Capabilities:
Create process on windows

Disassembly:
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4015d8
push str.http:__tanatossite.narod.ru_index.html
push 1
push 1
push 0
push 0
push 0xffffffff
call fcn.004041cc
mov dword [esp + 0xc], eax
call fcn.00404b7a
mov dword [esp], eax
call fcn.00404b82
mov dword [esp + 4], eax
call fcn.00404b90
mov dword [esp + 8], eax
mov ebx, dword [esp]
cmp ebx, 0x332c
jne 0x401747
mov ebx, dword [esp + 4]
cmp ebx, dword [esp + 0xc]
jne 0x401747
push 6
push dword [esp + 0x10]
call fcn.004041ec
mov ebx, eax
and ebx, ebx
jne 0x401747
mov eax, dword [0x40a4c0]
push eax
push eax
push 1
push dword [esp + 0x18]
call fcn.00404251
lea ecx, [esp + 0x18]
pop edx
call fcn.00402070
mov eax, dword [0x40a4c0]
push eax
push eax
push dword [esp + 0x1c]
call fcn.00402770
sub esp, 8
fistp qword [esp]
call fcn.00402910
lea ecx, [esp + 0x14]
pop edx
call fcn.00402070
push dword [esp + 0x10]
mov eax, dword [0x40a4c0]
push eax
push eax
push dword [esp + 0x1c]
call fcn.00402660
push eax
push dword [esp + 0x24]
call fcn.00402690
pop edx
pop ecx
mov dword [0x40a4c0], edx
add edx, dword [0x408054]
call fcn.00406870
je 0x401739
mov eax, dword [0x40a4c0]
push eax
push eax
push 1
push dword [esp + 0x18]
call fcn.00404251
lea ecx, [esp + 0x18]
pop edx
call fcn.00402070
mov eax, dword [0x40a4c0]
push eax
push eax
push dword [0x40a4c0]
push 0x40803e
push 1
push dword [esp + 0x28]
call fcn.004029a0
inc dword [0x40a4c0]
mov edx, dword [0x408054]
add dword [esp], edx
call fcn.00402770
pop dword [0x40a4c0]
fistp dword [esp + 0x18]
mov dword [esp + 0x1c], 1
jmp 0x401747
push str.http:__tanatossite.narod.ru_index.html
push dword [esp + 0x10]
call fcn.00404267
mov ebx, dword [esp + 0x1c]
cmp ebx, 1
jne 0x40160c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x20]
jl 0x4017c9
push dword [0x40a4c0]
push 1
push 0x40800d
push 0x40800d
mov eax, dword [0x40a4c0]
push eax
push eax
push 0x40803e
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x34]
call fcn.004029a0
inc dword [0x40a4c0]
push 0x408040
push 0
mov edx, dword [0x408054]
add dword [esp + 8], edx
call sub.SHELL32.dll_ShellExecuteA
pop dword [0x40a4c0]
inc dword [esp + 0x20]
jmp 0x401764
xor eax, eax
push dword [esp + 0x10]
call fcn.004068a0
push dword [esp + 0x14]
call fcn.004068a0
add esp, 0x24
pop ebx
ret
Function at 0x4025bd
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
xor esi, esi
push esi
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esp + 0xc], eax
je 0x402655
push ebx
push ebp
mov ebp, 0x40a6dc
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x40a364]
test esi, esi
mov ebx, 0x40a364
je 0x40262d
push edi
push 0
lea edi, [esi + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x402626
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi]
push edi
push ebx
call fcn.0040673d
pop ecx
pop ecx
jmp 0x402628
mov esi, dword [esi]
test esi, esi
jne 0x402600
pop edi
mov esi, dword [0x4093a8]
inc dword [0x4093a8]
push 0x10
push ebx
call fcn.004066fa
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
push ebp
mov dword [eax], ecx
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 8
Function at 0x405859
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x4058c7
push 0x11
call esi
test al, al
js 0x4058c7
push 0x10
call esi
test al, al
js 0x4058c7
push 0x12
call esi
test al, al
js 0x4058c7
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x4058c7
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x4058eb
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x4058eb
dec eax
push eax
push dword [0x40a734]
call fcn.004065b0
mov eax, dword [eax + 8]
jmp 0x4058ed
xor eax, eax
pop esi
leave
ret 4

Function at 0x4058f2
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x248
push esi
or esi, 0xffffffff
test eax, eax
push edi
mov edi, esi
je 0x405a03
cmp byte [eax], 0
je 0x405a03
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
cmp eax, 2
lea ecx, [ebp + eax - 0x109]
je 0x40594c
cmp eax, 3
jne 0x405989
cmp byte [ebp - 0x107], 0x3a
jne 0x405989
cmp eax, 2
jne 0x40596d
lea eax, [ebp - 0x108]
push 0x407194
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jbe 0x405a03
jmp 0x4059fd
mov byte [ecx], 0
dec ecx
cmp byte [ecx], 0x5c
je 0x405985
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4059d5
test byte [ebp - 0x248], 0x10
je 0x4059b8
push 0xfffffffffffffffe
pop edi
or esi, 0xffffffff
jmp 0x4059cc
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x22c]
xor edi, edi
xor edx, edx
or edi, ecx
or esi, edx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x405a03
cmp byte [ebp - 0x108], 0x5c
jne 0x405a03
cmp byte [ebp - 0x107], 0x5c
jne 0x405a03
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405a03
test al, 0x10
je 0x405a03
push 0xfffffffffffffffe
or esi, 0xffffffff
pop edi
mov eax, edi
pop edi
mov edx, esi
pop esi
leave
ret 4
Function at 0x405b34
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp dword [0x40a4bc], ebx
jne 0x405b62
push fcn.00405b01
push 0x10
push 0x148
call fcn.00406611
mov dword [0x40a4bc], eax
mov esi, dword [ebp + 0xc]
cmp esi, ebx
jne 0x405b6e
mov esi, 0x40700b
push 0x104
lea eax, [ebp - 0x108]
push esi
push eax
call sub.MSVCRT.dll_strncpy
push esi
mov byte [ebp - 4], bl
call sub.MSVCRT.dll_strlen
add esp, 0x10
cmp eax, ebx
je 0x405baa
cmp byte [eax + esi - 1], 0x5c
je 0x405baa
lea eax, [ebp - 0x108]
push 0x407194
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x405bb5
cmp byte [eax], bl
jne 0x405bba
mov eax, 0x407198
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push dword [ebp + 8]
push dword [0x40a4bc]
call fcn.0040654c
mov esi, eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x405bf6
mov dword [esi + 4], ebx
jmp 0x405c08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x405c0c
mov dword [esi + 4], 1
mov edi, esi
jmp 0x405c20
cmp dword [ebp + 8], 0xffffffff
jne 0x405c1e
push esi
push dword [0x40a4bc]
call fcn.004065db
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x405cfa
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x405d6d
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x405d4f
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x405d4d
cmp dl, 0x5c
je 0x405d4d
cmp dl, 0x2f
jne 0x405d59
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x405d39
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x405d6f
xor eax, eax
leave
ret 4

Function at 0x405d90
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x405dc5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x4060f0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x40a744]
push eax
push ecx
mov byte [esp + 0xb], 0
call fcn.004065b0
test eax, eax
je 0x40613a
cmp dword [eax + 4], 0
lea edx, [esp + 3]
je 0x406127
push 1
push edx
push eax
call fcn.004062f0
movsx eax, byte [esp + 3]
pop ecx
ret 4
mov eax, dword [eax]
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4
Function at 0x4061a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40a744]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.004065b0
mov esi, eax
test esi, esi
je 0x406224
cmp dword [esi + 4], 0
je 0x4061f3
push 1
lea edx, [esp + 8]
push edx
push esi
call fcn.004062f0
test eax, eax
je 0x4061e7
add dword [esi + 0xc], 1
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
mov edx, dword [esi]
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40622f
cmp dword [esp + 8], 0
je 0x40622f
mov eax, dword [esi]
push 1
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x4062f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 0
push edi
jne 0x406311
push esi
call fcn.00405d90
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ebx, edi
jl 0x40638a
mov eax, dword [esi + 0x10]
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
sub ecx, 1
je 0x406377
sub ecx, 1
je 0x406362
sub ecx, 2
je 0x40634f
push edi
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ax, word [eax]
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov dl, byte [eax]
mov eax, dword [esp + 0x14]
mov byte [eax], dl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esi + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 4]
push ebx
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
cmp edi, eax
push 0
jl 0x4063d3
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
pop esi
add eax, ebx
pop ebx
ret 0xc
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp edi, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jle 0x4063f6
mov edi, eax
mov ecx, dword [esi + 4]
push edi
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
add esp, 0xc
pop ebp
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x100012c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1004d908]
mov dword [ebp - 4], eax
jmp 0x100012d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100012f6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012d0
mov esp, ebp
pop ebp
ret

Function at 0x10001300
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1004d918], eax
je 0x1000131e
mov eax, 0x10dd
jmp 0x100013ff
mov eax, dword [0x1004d928]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000139c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000137a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000137a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001470
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.10008470
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10001326
mov dword [0x1004d928], 0
call fcn.10001410
mov ecx, dword [0x1004d924]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x100013e9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10008470
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x100013b4
mov dword [0x1004d924], 0
mov dword [0x1004d918], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001970
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001985
xor eax, eax
jmp 0x100019fa
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x100019b2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x100019f5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x100019f3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x100019ef
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019f3
xor eax, eax
jmp 0x100019fa
jmp 0x100019a9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001aa0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1004d91c], 0
je 0x10001ab9
mov eax, dword [0x1004d91c]
jmp 0x10001b59
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10001acb
xor eax, eax
jmp 0x10001b59
push 8
call fcn.1001328f
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001b21
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x10001b0a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10008470
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x1004d91c], eax
mov dword [0x1004d920], 0
mov eax, dword [ebp - 4]
jmp 0x10001b59
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001b3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10001aeb
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x1004d924]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x1004d924], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10002380
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10002450
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000243c
cmp dword [ebp - 4], 0x50000000
jb 0x100023bc
cmp dword [ebp - 4], 0x80000000
ja 0x100023bc
mov dword [ebp - 4], 0x80010000
jmp 0x10002395
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10015640
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100023e2
jmp 0x1000243c
cmp dword [ebp - 0x10], 0x10000
jne 0x10002425
cmp dword [ebp - 0x14], 0x10000
jb 0x10002425
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10002418
mov eax, dword [ebp - 0x24]
jmp 0x1000243e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10002437
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10002450
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10002395
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10002480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10002550
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10002544
cmp dword [ebp - 4], 0x50000000
jb 0x100024c1
cmp dword [ebp - 4], 0x80000000
ja 0x100024c1
mov dword [ebp - 4], 0x4fff0000
jmp 0x1000249a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10015640
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100024e7
jmp 0x10002544
cmp dword [ebp - 0x10], 0x10000
jne 0x1000252a
cmp dword [ebp - 0x14], 0x10000
jb 0x1000252a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000251d
mov eax, dword [ebp - 0x24]
jmp 0x10002546
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000253f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10002550
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000249a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10003260
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not eax
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x1000328d
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + section..d3d9_sh]
sub edx, 1
jne 0x10003273
not eax
pop esi
pop ebp
ret
Function at 0x10008cf0
Capabilities:
Check if file exists
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [ebp - 0xc]
call fcn.10006b10
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x10036248
lea eax, [ebp - 0xc]
push eax
call fcn.10008960
push ebx
push str.Downloading__s
call fcn.10002f50
mov esi, dword [ebp + 0xc]
add esp, 8
push dword [ebp - 4]
push 0x50
push dword [ebp - 4]
push esi
push ebx
push 0
call sub.urlmon.dll_URLDownloadToCacheFileA
mov edi, eax
test edi, edi
js 0x10008dd6
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push eax
push str.Downloaded_OK__d
call fcn.10002f50
add esp, 8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10008de4
push str.But_file_no_existo
call fcn.10002f50
add esp, 4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [ebp - 0xc]
call fcn.10006b10
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x10036248
lea eax, [ebp - 0xc]
push eax
call fcn.10008960
push ebx
push str.Downloading__s
call fcn.10002f50
add esp, 8
push dword [ebp - 4]
push 0x50
push dword [ebp - 4]
push esi
push ebx
push 0
call sub.urlmon.dll_URLDownloadToCacheFileA
mov edi, eax
test edi, edi
jns 0x10008d50
push edi
push str.An_error_occured_:_error_code___d
call fcn.10002f50
add esp, 8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.returning
call fcn.10002f50
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret