joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40219c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
xor esi, esi
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x402221
push 0x80000000
push dword [ebp + 8]
call fcn.00402143
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x402221
push edi
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
cmp esi, ebx
je 0x402215
jmp loc.0042d000
push dword [ebp + 8]
call fcn.00401e1d
mov esi, dword [ebp - 0xc]
pop edi
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40222a
mov dword [eax], esi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8

Function at 0x402292
Capabilities:
Delete file
Set file attributes

Disassembly:
xor eax, eax
test edi, edi
je 0x4022b2
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
test eax, eax
jne 0x4022b1
push edi
call esi
pop esi
ret
Function at 0x100055d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1005f00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x2c], 8
push ebx
push esi
lea esi, [ecx + 0x18]
push edi
jb 0x100055ee
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10005617
push 0x10057de4
push esi
call fcn.10034e4e
add esp, 8
test eax, eax
je 0x10005617
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.1000f500
jmp 0x10005638
push 0
push 0x10057dfe
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
call fcn.10004c90
mov edi, dword [ebp - 8]
lea ecx, [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
cmp edi, 0x10
mov edx, dword [ebp - 0xc]
cmovae ecx, esi
push 0x20
push ecx
call fcn.10004be0
add esp, 8
mov bl, al
cmp edi, 0x10
jb 0x10005683
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x10005679
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005696
push ecx
push esi
call fcn.1001752d
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100170ad
mov esp, ebp
pop ebp
ret
call fcn.100316f5
int3
Function at 0x10007f20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov word [ecx + 0x1c90], ax
lea eax, [ebp - 4]
push esi
lea esi, [ecx + 0x1c90]
push eax
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x10007fb3
cmp eax, 0x3fff
ja 0x10007fb3
push esi
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x10007fb3
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x10058094
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10007fb3
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x10057648
push 0x31
push esi
call fcn.100071c0
add esp, 0x1c
xor eax, eax
mov word [esi + 0x60], ax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
jne 0x10009f13
lea edi, [esi + reloc.KERNEL32.dll_MapViewOfFile]
push str.MetalinkFile
push edi
call fcn.1002e6b3
add esp, 8
test eax, eax
je 0x10009e91
xor ecx, ecx
mov word [eax], cx
add eax, 0x1a
push eax
call fcn.10036ec6
add esp, 4
mov dword [esi + 0x2694], eax
mov ecx, dword [esi + 0x62ce0]
mov eax, 0xe1800e19
sub ecx, dword [esi + 0x62cdc]
imul ecx
add edx, ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10009ec4
push eax
lea edx, [esi + 0x10]
mov ecx, edi
call fcn.10009d50
add esp, 4
test eax, eax
je 0x10009f13
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x2464], eax
test eax, eax
je 0x10009f08
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push esi
push 0x10009f20
push 0
push 0
mov dword [esi + 0x5d0f8], 8
call fcn.1003716a
add esp, 0x18
mov dword [esi + 0xc], eax
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b840
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x26d8]
mov edi, dword [eax + ebx*4]
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 1
je 0x1000b9b5
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x1000b8a1
lea ecx, [ebp - 4]
mov dword [ebp + 8], 0
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 8], 4
push ecx
push 0x20000013
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x1000b8a1
mov eax, dword [ebp + 8]
jmp 0x1000b8a3
xor eax, eax
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x1000b8b0
mov dword [ecx + 0x2450], eax
cmp dword [edi], 0
jne 0x1000b974
cmp eax, 0xce
jne 0x1000b974
cmp dword [esi + 0x5d100], 0xffffffff
jne 0x1000b8da
cmp dword [esi + 0x5d104], 0xffffffff
je 0x1000ba3d
push edi
mov ecx, esi
call fcn.1000c8e0
test eax, eax
je 0x1000ba4e
cmp dword [edi + 0x38], 0xffffffff
mov edx, dword [edi + 0x3c]
jne 0x1000b8fc
cmp edx, 0xffffffff
je 0x1000ba4e
mov eax, dword [edi + 0x8040]
mov ecx, dword [eax + 8]
add ecx, dword [edi + 0x38]
mov eax, dword [eax + 0xc]
adc eax, edx
cmp dword [esi + 0x5d108], 0
mov edx, dword [esi + 0x5d10c]
jne 0x1000b920
test edx, edx
je 0x1000b92c
cmp dword [esi + 0x5d108], ecx
jne 0x1000b949
cmp edx, eax
jne 0x1000b949
cmp dword [esi + 0x5d100], ecx
jne 0x1000ba4e
cmp dword [esi + 0x5d104], eax
jne 0x1000ba4e
mov eax, dword [edi + 0x20]
jmp 0x1000b9c4
mov eax, dword [edi + 0x20]
test eax, eax
je 0x1000b95a
mov dword [eax + 0x244c], 1
push ebx
mov ecx, esi
call fcn.1000bf30
push 4
mov ecx, esi
call fcn.1000a460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x1f4
je 0x1000ba28
cmp eax, 0x194
jne 0x1000ba3d
mov eax, dword [edi + 0x20]
test eax, eax
je 0x1000b99b
mov dword [eax + 0x244c], 1
push ebx
mov ecx, esi
call fcn.1000bf30
push 4
mov ecx, esi
call fcn.1000a460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi], 0
jne 0x1000ba28
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1000ba28
mov dword [edi + 0x1c], ecx
cmp dword [eax + 0x2448], 0xffffffff
jne 0x1000b9df
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x20]
sub eax, dword [edi + 8]
mov dword [ecx + 0x2448], eax
cmp dword [esi + 0x26f0], 0
je 0x1000ba00
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x4e20
push eax
push 6
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov eax, dword [edi + 0x8040]
cmp dword [eax + 4], 0
jne 0x1000ba4e
mov dword [eax + 4], 1
mov eax, 1
mov dword [edi + 0x28], 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
push ebx
mov ecx, esi
mov dword [edi + 0x28], 4
call fcn.1000c430
test eax, eax
jne 0x1000ba56
cmp dword [esi + 0x26f0], 0
je 0x1000ba4e
push ecx
mov ecx, esi
call fcn.1000d6f0
push ebx
mov ecx, esi
call fcn.1000bf30
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c060
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1005f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
xor edx, edx
push 0x10000000
push 0
lea eax, [esi + 0x61850]
mov dword [ebp - 0xc], esi
xor ecx, ecx
cmp dx, word [eax]
push 0
push 0
cmove eax, ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x14], eax
test eax, eax
je 0x1000c22e
mov edi, dword [ebx + 0x20]
mov dword [ebp - 0x10], edi
lea ebx, [edi + 0x2348]
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000c0c0
sub ecx, edx
mov eax, 0
sar ecx, 1
cmove ebx, eax
add edi, 0x2048
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000c0e2
sub ecx, edx
mov eax, 0
sar ecx, 1
cmove edi, eax
test ebx, ebx
jne 0x1000c127
lea edx, [esi + 0x60608]
mov ecx, edx
lea ebx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000c110
sub ecx, ebx
mov ebx, 0
sar ecx, 1
cmovne ebx, edx
test edi, edi
jne 0x1000c14d
lea edx, [esi + 0x60708]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000c136
sub ecx, esi
mov edi, 0
sar ecx, 1
cmovne edi, edx
mov esi, dword [ebp - 0x10]
push 0x1000a040
push dword [ebp - 0x14]
mov esi, dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
push edx
mov ecx, dword [edx + 0x20]
push dword [eax + 0x26d4]
xor eax, eax
cmp esi, 1
setne al
lea eax, [eax*2 + 1]
push eax
movzx eax, word [ecx]
push edi
push ebx
push eax
lea eax, [ecx + 0x2148]
push eax
push dword [edx + 0x14]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
test eax, eax
je 0x1000c22e
mov edi, dword [ebp - 0xc]
add edi, 0x60808
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000c1b3
sub ecx, edx
sar ecx, 1
je 0x1000c227
mov dword [ebp - 0x20], 3
test edi, edi
je 0x1000c208
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000c1d4
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jg 0x1000c208
add esi, esi
mov eax, esi
call fcn.10047b80
mov ecx, esp
mov edx, edi
push 3
push esi
call fcn.10004a60
mov dword [ebp - 0x1c], eax
jmp 0x1000c20f
mov dword [ebp - 0x1c], 0
push 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0x10057dfe
push eax
push 0x26
push dword [ebx + 0x14]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov eax, 1
jmp 0x1000c230
xor eax, eax
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100170ad
mov esp, ebp
pop ebp
ret 4
Function at 0x1000cfc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push 2
push 0
push 0
mov eax, dword [esi + 0x26e8]
sub eax, dword [esi + 0x26e4]
push dword [esi + 8]
sar eax, 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 4], 0
je 0x1000d08f
push ebx
push edi
push 0
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26e8]
xor edi, edi
sub eax, dword [esi + 0x26e4]
mov ebx, 4
sar eax, 2
test eax, eax
je 0x1000d061
nop dword [eax]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x26e4]
push 0x20
push dword [eax + edi*4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26e8]
inc edi
sub eax, dword [esi + 0x26e4]
add ebx, 0x20
sar eax, 2
cmp edi, eax
jb 0x1000d030
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push 4
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call ebx
push 0
lea eax, [ebp - 8]
push eax
push 0x6a
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push dword [esi + 8]
call ebx
pop edi
pop ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000f250
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, edx
xor edi, edi
mov ebx, ecx
test esi, esi
je 0x1000f3c4
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
sub eax, ecx
je 0x1000f285
mov edi, ecx
sub edi, esi
add edi, 3
lea ecx, [edi + esi]
mov eax, 0x55555556
imul ecx
mov dword [ebp - 4], ecx
mov eax, edx
inc edx
shr eax, 0x1f
add eax, edx
add eax, edi
add eax, esi
push eax
mov dword [ebp - 0x10], eax
call fcn.10037003
mov ecx, eax
add esp, 4
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x1000f3c4
lea eax, [edi + esi]
test eax, eax
jle 0x1000f3b3
mov edx, dword [ebp - 4]
lea esi, [ecx + 2]
add eax, 0xfffffffd
mov dword [ebp - 8], eax
lea eax, [ebx + 1]
not ebx
movzx ecx, byte [eax - 1]
shr ecx, 2
mov cl, byte [ecx + 0x10055798]
mov byte [esi - 2], cl
lea ecx, [ebx + eax]
cmp ecx, dword [ebp - 8]
jne 0x1000f350
test edi, edi
je 0x1000f350
cmp edi, 1
jne 0x1000f32d
movzx ecx, byte [eax - 1]
and cl, 3
shl cl, 4
movzx edx, cl
movzx ecx, byte [eax]
shr ecx, 4
movzx ecx, byte [edx + ecx + 0x10055798]
mov byte [esi - 1], cl
movzx ecx, byte [eax]
and cl, 0xf
mov byte [esi + 1], 0x3d
shl cl, 2
movzx ecx, cl
movzx ecx, byte [ecx + 0x10055798]
mov byte [esi], cl
jmp 0x1000f39c
cmp edi, 2
jne 0x1000f39f
movzx ecx, byte [eax - 1]
and cl, 3
mov word [esi], 0x3d3d
shl cl, 4
movzx ecx, cl
movzx ecx, byte [ecx + 0x10055798]
mov byte [esi - 1], cl
jmp 0x1000f39f
movzx ecx, byte [eax - 1]
and cl, 3
shl cl, 4
movzx edx, cl
movzx ecx, byte [eax]
shr ecx, 4
movzx ecx, byte [edx + ecx + 0x10055798]
mov byte [esi - 1], cl
movzx ecx, byte [eax]
and cl, 0xf
shl cl, 2
movzx edx, cl
movzx ecx, byte [eax + 1]
shr ecx, 6
movzx ecx, byte [edx + ecx + 0x10055798]
mov byte [esi], cl
movsx ecx, byte [eax + 1]
and ecx, 0x3f
movzx ecx, byte [ecx + 0x10055798]
mov byte [esi + 1], cl
mov edx, dword [ebp - 4]
add eax, 3
add esi, 4
lea ecx, [ebx + eax]
cmp ecx, edx
jl 0x1000f2d3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov byte [ecx + eax - 1], 0
mov eax, ecx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011be0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x1005f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x320]
mov dword [ebp - 0x320], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x310], 2
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069f80], 0
mov dword [0x10069054], 0
jne 0x10011cee
mov eax, dword [ebp - 0x31c]
cmp eax, 5
je 0x10011cee
cmp eax, 6
jne 0x10011cd8
mov eax, dword [ebp - 0x318]
cmp eax, 4
ja 0x10011cee
mov dword [0x10069f80], 1
cmp eax, 1
je 0x10011ce4
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, 2
jne 0x10011ca1
push str.RtlGetVersion
push str.ntdll.dll
mov dword [0x10069054], 1
call esi
push eax
call ebx
test eax, eax
je 0x10011c9b
lea ecx, [ebp - 0x434]
push ecx
call eax
mov eax, dword [ebp - 0x318]
cmp eax, 3
je 0x10011cb0
cmp eax, 4
je 0x10011cb0
cmp eax, 1
jbe 0x10011cee
push str.RtlGetVersion
push str.ntdll.dll
mov dword [0x10069054], 1
call esi
push eax
call ebx
test eax, eax
je 0x10011cee
lea ecx, [ebp - 0x434]
push ecx
call eax
jmp 0x10011cee
jbe 0x10011cee
mov dword [0x10069f80], 1
mov dword [0x10069054], 1
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1002f0c0
add esp, 0xc
cmp dword [0x10069054], 0
je 0x10011d52
xor eax, eax
cmp ax, word [0x10071d88]
jne 0x10011d48
push eax
push 0x26
push 0x10071d88
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, 0x10071d88
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10011d30
mov ecx, 0x10
mov esi, str.internet_exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
push 0x103
jmp 0x10011dde
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0x103
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x438], 4
push eax
lea eax, [ebp - 0x438]
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10011d9d
cmp ax, word [ebp - 0x20c]
jne 0x10011df1
xor eax, eax
cmp ax, word [0x10071d88]
jne 0x10011dd8
push eax
push 0x26
push 0x10071d88
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, 0x10071d88
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10011dc0
mov ecx, 0x10
mov esi, str.internet_exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x43c]
lea edx, [ebp - 0x20c]
mov ecx, 0x10071d88
call fcn.1000f3d0
add esp, 4
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov esi, eax
mov dword [ebp - 0x438], 0
test esi, esi
je 0x10011e24
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100170ad
mov esp, ebp
pop ebp
ret
Function at 0x10013a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x10013c61
cmp eax, 3
jb 0x10013ab6
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x10013af3
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x10013af3
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x10013add
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.10013720
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x10013be3
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.10013090
mov ecx, dword [esi + 0x6af90]
add esp, 4
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x10013ba8
cmp ecx, 3
jb 0x10013ba8
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x10013b40
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [ebp - 4]
jmp 0x10013c0a
mov edx, dword [esi + 0x6af84]
add edx, edi
xor edi, edi
mov dword [esi + 0x6af84], edx
movzx ecx, byte [esi + edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x10013c0a
movzx eax, byte [esi + ecx + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.10013090
dec dword [esi + 0x6af90]
add esp, 4
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
lea ecx, [esi + 0x1af70]
test eax, eax
je 0x10013c3f
mov eax, dword [esi + 0x6af74]
sub edx, eax
push 0
push edx
lea edx, [eax + ecx]
xor ecx, ecx
test eax, eax
cmovs edx, ecx
mov ecx, esi
call fcn.10012d00
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x10013c59
mov ecx, esi
call fcn.100138e0
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x10013a65
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x10013c75
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x10013c77
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.10012d00
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014890
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1001489b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x10014957
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
sub edi, 1
jne 0x100148b0
pop edi
test esi, esi
je 0x1001497a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056fe0]
sub esi, 1
jne 0x10014960
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x10014ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x18]
test edi, edi
je 0x10014dab
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
push ebx
mov ebx, dword [ebp + 0xc]
lea ecx, [eax + ebx]
cmp ecx, edx
jb 0x10014d8d
lea edi, [edx + edx]
push 0
cmp edi, ecx
cmovbe edi, ecx
push edi
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10014d4c
push edi
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x10014d5a
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 0x300
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [esi + 0x20]
push dword [esi + 0x18]
push edi
call fcn.1002f310
add esp, 0xc
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x18], edi
push ebx
push dword [ebp + 8]
lea ecx, [edi + eax]
push ecx
call fcn.1002f310
add esp, 0xc
mov eax, ebx
add dword [esi + 0x1c], ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x10014dd6
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10014fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x64]
test edx, edx
je 0x10015027
mov ecx, dword [edi + 0x6c]
mov ebx, dword [edi + 0x68]
cmp ecx, ebx
jae 0x1001506f
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.1002f310
mov ecx, dword [edi + 0x58]
mov edx, esi
add dword [edi + 0x6c], ebx
add dword [edi + 0x54], ebx
push ebx
call fcn.10014890
add esp, 0x10
mov dword [edi + 0x58], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x10015068
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001506f
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x58]
add dword [edi + 0x54], esi
push esi
call fcn.10014890
add esp, 4
mov dword [edi + 0x58], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0xc], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8