joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006d40
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
mov edx, ecx
sub esp, 0x24
mov dword [ebp - 0x14], ecx
test ebx, ebx
je 0x10006d62
cmp ecx, 0x9b
ja 0x10006e08
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Default_DevMode
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x18]
sub esp, 0x18
test eax, eax
je 0x10006dc8
cmp eax, 0xea
je 0x10006dc8
mov dword [ebp - 0x14], 0
xor esi, esi
test byte [0x1001a0b8], 8
jne 0x10006e70
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [ebp - 0x14]
cmp esi, 0x9b
jbe 0x10006daa
add esi, 0x40
test ebx, ebx
je 0x10006df2
cmp word [ebx + 0x24], 0x9b
ja 0x10006deb
mov eax, 0x9c
mov word [ebx + 0x24], ax
mov dword [ebp - 0x14], esi
cmp edx, esi
jae 0x10006e20
mov eax, dword [ebp + 8]
mov dword [eax], esi
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x27
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
jmp 0x10006d62
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_GdiConvertToDevmodeW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.ucrtbase.dll_memcpy
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebp - 0x14]
sub esp, 0xc
jmp 0x10006df2
mov eax, str.Default_DevMode
call fcn.10002fe0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.corrupted_registry_for__s___size__ld__n
mov dword [esp + 8], str.WINSPOOL_GetDevModeFromReg
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
call fcn.100032c0
xor eax, eax
jmp 0x10006db9
Function at 0x100096a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
test edx, edx
jne 0x100096c8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sym.winspool.drv_SetPrinterW
mov eax, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
call fcn.10003cb0
mov ebx, eax
test eax, eax
je 0x10009718
mov ecx, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov edx, dword [ebp - 0x10]
mov dword [esp], edi
mov dword [esp + 4], edx
call sym.winspool.drv_SetPrinterW
sub esp, 0x10
mov edi, eax
cmp esi, ebx
je 0x10009708
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.10006c00
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
xor edi, edi
jmp 0x10009708
Function at 0x1000f910
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 8]
test byte [0x1001a0b8], 8
jne 0x1000fa50
mov dword [esp], 0x1001a0a0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
test ebx, ebx
je 0x1000fa30
cmp dword [0x10021004], ebx
jb 0x1000fa30
mov eax, dword [0x10021008]
mov ebx, dword [eax + ebx*4 - 4]
mov dword [esp], 0x1001a0a0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
test ebx, ebx
je 0x1000fa40
mov eax, dword [ebx]
test eax, eax
je 0x1000fa40
lea edx, [ebp - 0x10]
call fcn.100027d0
mov ebx, eax
test eax, eax
jne 0x1000f9c4
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x1000f9d0
test byte [0x1001a0b8], 2
jne 0x1000fab0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, eax
mov eax, dword [ebp - 0xc]
sub esp, 0x18
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call esi
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x18
mov dword [esp], 0x1001a0a0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lea esp, [ebp - 8]
mov ebx, 6
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x10]
call fcn.10002de0
mov esi, eax
mov eax, dword [ebp + 0xc]
call fcn.10002de0
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], str.__p___s___s__08lx___p___08lx__n
mov dword [esp + 8], str.SetPrinterDataExA
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
call fcn.100032c0
jmp 0x1000f928
mov eax, dword [ebp + 0xc]
call fcn.10002de0
mov dword [esp + 0xc], str.Cant_create_subkey__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SetPrinterDataExA
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 1
call fcn.100032c0
jmp 0x1000f9b5
Function at 0x1000faf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 8]
test byte [0x1001a0b8], 8
jne 0x1000fc30
mov dword [esp], 0x1001a0a0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
test ebx, ebx
je 0x1000fc10
cmp dword [0x10021004], ebx
jb 0x1000fc10
mov eax, dword [0x10021008]
mov ebx, dword [eax + ebx*4 - 4]
mov dword [esp], 0x1001a0a0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
test ebx, ebx
je 0x1000fc20
mov eax, dword [ebx]
test eax, eax
je 0x1000fc20
lea edx, [ebp - 0x10]
call fcn.100027d0
mov ebx, eax
test eax, eax
jne 0x1000fba4
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCreateKeyW]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x1000fbb0
test byte [0x1001a0b8], 2
jne 0x1000fc90
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, eax
mov eax, dword [ebp - 0xc]
sub esp, 0x18
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call esi
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x18
mov dword [esp], 0x1001a0a0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lea esp, [ebp - 8]
mov ebx, 6
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x10]
call fcn.10002fe0
mov esi, eax
mov eax, dword [ebp + 0xc]
call fcn.10002fe0
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], str.__p___s___s__08lx___p___08lx__n
mov dword [esp + 8], str.SetPrinterDataExW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
call fcn.100032c0
jmp 0x1000fb08
mov eax, dword [ebp + 0xc]
call fcn.10002fe0
mov dword [esp + 0xc], str.Cant_create_subkey__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.SetPrinterDataExW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 1
call fcn.100032c0
jmp 0x1000fb95
Function at 0x10012ce0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x48
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
test byte [0x1001a0b8], 8
jne 0x10012e20
mov eax, dword [ebp + 8]
test eax, eax
je 0x10012e08
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x30]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov eax, dword [ebp - 0x2c]
sub esp, 8
mov dword [ebp + 8], eax
test ebx, ebx
je 0x10012d37
mov eax, dword [ebx + 4]
mov dword [ebp - 0x20], 8
lea ebx, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x10012e68
mov eax, dword [esi]
test eax, eax
je 0x10012df0
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov eax, dword [ebp - 0x24]
sub esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x10012d78
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GdiConvertToDevmodeW]
sub esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.winspool.drv_OpenPrinter2W
mov esi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov ebx, eax
mov eax, dword [ebp - 0x34]
sub esp, 0x10
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x14]
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], edi
call esi
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x34], ecx
jmp 0x10012d62
mov dword [ebp - 0x2c], 0
lea edi, [ebp - 0x30]
jmp 0x10012d23
mov eax, dword [ebp + 8]
call fcn.10002de0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], esi
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__p__p__p__n
mov dword [esp + 8], str.OpenPrinter2A
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
call fcn.100032c0
jmp 0x10012cfc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.winspool.drv_OpenPrinter2W
mov esi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
sub esp, 0x10
mov ebx, eax
jmp 0x10012ddb
Function at 0x100141e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
test byte [0x1001a0b8], 8
jne 0x100142c0
test ebx, ebx
je 0x10014203
cmp word [ebx], 0
jne 0x10014280
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10014238
test byte [0x1001a0b8], 1
jne 0x10014320
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 0xc]
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
call fcn.10004d50
mov ebx, eax
test eax, eax
je 0x10014350
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.advapi32.dll_RegDeleteTreeW]
sub esp, 8
test eax, eax
sete al
mov dword [esp], ebx
movzx eax, al
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
test byte [0x1001a0b8], 1
je 0x10014217
mov eax, ebx
call fcn.10002fe0
mov dword [esp + 0xc], str.pName___s___unsupported_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DeletePrinterDriverExW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 0
call fcn.100032c0
jmp 0x10014217
mov eax, dword [ebp + 0x10]
call fcn.10002fe0
mov edi, eax
mov eax, dword [ebp + 0xc]
call fcn.10002fe0
mov esi, eax
mov eax, ebx
call fcn.10002fe0
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x20], edx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], str._s__s__s__lx__lx_n
mov dword [esp + 8], str.DeletePrinterDriverExW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
call fcn.100032c0
jmp 0x100141f9
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], str.dwDeleteFlag___lx___unsupported_n
mov dword [esp + 8], str.DeletePrinterDriverExW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 0
mov dword [esp + 0x10], eax
call fcn.100032c0
jmp 0x10014217
test byte [0x1001a0b8], 2
je 0x10014224
mov dword [esp + 0xc], str.Cant_open_drivers_key_n
mov dword [esp + 8], str.DeletePrinterDriverExW
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 1
call fcn.100032c0
jmp 0x10014224
Function at 0x100181e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ebx, dword [esi + 4]
mov dword [ebp - 0x20], 0x14
test ebx, ebx
je 0x10018237
lea eax, [ebp - 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov ebx, dword [ebp - 0x24]
sub esp, 8
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x100183c8
mov eax, dword [esi + 8]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x10018265
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov eax, dword [ebp - 0x24]
sub esp, 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100183d8
mov edi, dword [esi + 0xc]
test edi, edi
je 0x1001828d
lea eax, [ebp - 0x28]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
mov edi, dword [ebp - 0x24]
sub esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x100183c0
mov eax, dword [esi + 0x10]
xor esi, esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.winspool.drv_StartDocDlgW
sub esp, 8
test eax, eax
je 0x10018392
mov dword [esp + 8], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [ebp - 0x3c], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x34], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x30], eax
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x38], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], edx
mov dword [ebp - 0x30], edx
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x34]
call eax
mov edx, dword [ebp - 0x30]
sub esp, 0x20
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], edi
mov edi, dword [sym.imp.ucrtbase.dll_free]
call edi
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call edi
mov dword [esp], ebx
call edi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8
xor esi, esi
jmp 0x10018392
xor esi, esi
xor edi, edi
mov dword [ebp - 0x2c], 0
jmp 0x10018392
xor esi, esi
xor edi, edi
jmp 0x10018392
Function at 0x1123700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0112378f
jae 0x112370e
xor ecx, ecx
call fcn.0112378f
jae 0x112373d
xor eax, eax
call fcn.0112378f
jae 0x112374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0112378f
adc al, al
jae 0x112372f
jne 0x1123779
stosb byte es:[edi], al
jmp 0x1123711
call fcn.0112379b
sub ecx, ebx
jne 0x1123756
call fcn.01123799
jmp 0x1123775
lodsb al, byte [esi]
shr eax, 1
je 0x1123783
adc ecx, ecx
jmp 0x1123772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01123799
cmp eax, 0x7d00
jae 0x1123772
cmp ah, 5
jae 0x1123773
cmp eax, 0x7f
ja 0x1123774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1123711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10001f64
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x3a980
call fcn.1000a805
xor edx, edx
inc edx
call fcn.10009f52
xor ecx, ecx
and al, 8
cmp al, 8
setne cl
push 0x32
pop edx
dec ecx
and ecx, 0x803000
add ecx, 0x84400200
mov dword [0x10033c5c], ecx
call fcn.10009f52
cmp ax, 1
jne 0x10001fb0
or dword [0x10033c5c], 0x80000
push esi
push edi
push 0x23
pop edx
call fcn.10009f52
movzx eax, ax
xor edi, edi
sub eax, edi
je 0x10001fd5
dec eax
je 0x1000208d
dec eax
je 0x10002084
dec eax
dec eax
jne 0x10001ff0
push edi
push edi
push 0x20
pop edx
call fcn.10009f7b
push eax
push 3
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x100375f4], eax
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea eax, [ebp - 4]
push eax
push 5
push dword [0x100375f4]
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push dword [0x100375f4]
call esi
push 0x10033c58
push edi
push 3
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x100375f4]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
push 0x23
pop edx
mov dword [0x100375f8], edi
call fcn.10009f52
cmp ax, 4
jne 0x1000207b
push 0x21
pop edx
call fcn.10009f8c
push eax
push 0x21
pop edx
call fcn.10009f7b
push eax
push 0x2b
push edi
call esi
push 0x22
pop edx
call fcn.10009f8c
push eax
push 0x22
pop edx
call fcn.10009f7b
push eax
push 0x2c
push dword [0x100375f8]
call esi
call fcn.1000a826
pop edi
pop esi
leave
ret
push edi
push edi
push edi
push edi
jmp 0x10001fe2
push edi
push edi
push edi
push 1
jmp 0x10001fe2
Function at 0x10002185
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x4af]
push ebx
push eax
mov dword [ebp - 0x30], 0x1002d530
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x4b0], bl
call fcn.1001c290
push 0x7f
lea eax, [ebp - 0xaf]
push ebx
push eax
mov byte [ebp - 0xb0], bl
call fcn.1001c290
add esp, 0x18
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x10037600]
cmp eax, ebx
je 0x1000233b
lea esi, [ebp - 0x28]
call fcn.10007e16
push 0x1003b320
mov edi, 0x1002d524
push edi
mov esi, 0x400
push esi
push dword [ebp - 0x20]
call fcn.100149a6
push dword [0x1003af00]
lea eax, [ebp - 0xb0]
push 0x1002d534
push pe_nt_image_headers32
push eax
call fcn.100149a6
lea eax, [ebp - 0xb0]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002230
push dword [0x10037600]
sub eax, ecx
push dword [0x100375fc]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x28]
push eax
push 0xd
pop edx
call fcn.10009f7b
push eax
call fcn.100077c3
mov eax, dword [ebp - 0x24]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002268
sub eax, ecx
lea eax, [ebp - 0x4b0]
jne 0x10002289
push dword [ebp - 0x20]
push edi
push esi
push eax
call fcn.100149a6
add esp, 0x10
jmp 0x1000229e
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push 0x1002d538
push esi
push eax
call fcn.100149a6
add esp, 0x14
call fcn.1000a805
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], ebx
push 0x10033c58
push dword [0x10033c5c]
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
lea eax, [ebp - 0x4b0]
push eax
push 0x1b
pop edx
call fcn.10009f7b
push eax
push dword [0x100375f8]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
push esi
call fcn.100020df
mov eax, dword [ebp - 0x28]
pop ecx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100022e8
push dword [ebp - 0x18]
sub eax, ecx
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push esi
call fcn.1000213e
pop ecx
push esi
test eax, eax
jne 0x10002326
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jb 0x100022ac
jmp 0x10002328
call edi
lea eax, [ebp - 0x28]
call fcn.10007e93
mov dword [0x10037600], ebx
call fcn.1000a826
pop edi
pop esi
pop ebx
leave
ret