joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10033988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x34]
push edi
mov dword [esp + 0xc], 0x10036408
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov eax, dword [esi + 8]
test eax, eax
mov dword [esp + 0x2c], 0
jne 0x1000c297
mov edi, dword [esi + 4]
mov eax, dword [edi + 4]
lea edx, [esp + 0xc]
push edx
push eax
push edi
mov ecx, esi
call fcn.1000bea0
push 1
mov ecx, esi
mov ebx, eax
call fcn.1000c0a0
mov dword [edi + 4], ebx
mov ecx, dword [ebx + 4]
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 4]
mov ebx, dword [eax + 0x18]
mov edi, edx
sub edi, ebx
cmp edi, 0x1770
jbe 0x1000c303
mov edx, dword [eax + 0x10]
mov dword [esi + 0x10], edx
mov eax, dword [eax + 0x14]
mov dword [esi + 0x14], eax
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + 0x18]
mov ecx, esi
mov dword [esi + 0x18], edx
call fcn.1000bee0
mov edi, dword [esi + 4]
mov ecx, dword [edi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
push edi
mov ecx, esi
call fcn.1000bea0
push 1
mov ecx, esi
mov ebx, eax
call fcn.1000c0a0
mov dword [edi + 4], ebx
mov edx, dword [ebx + 4]
pop edi
pop esi
mov dword [edx], ebx
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
mov eax, dword [ecx]
sub edx, dword [eax + 0x18]
cmp edx, 0x1770
ja 0x1000c330
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.1000c140
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.1000c180
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x10010170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10033b58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [0x1003e9ec]
mov ecx, dword [esp + 0x38]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x40]
push ebp
push esi
xor esi, esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], esi
mov byte [esp + 0x18], 0
cmp dword [ebx + 0x18], 0x10
mov edx, dword [ebx + 0x14]
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc], edx
jb 0x100101cf
mov ebp, dword [ebx + 4]
jmp 0x100101d2
lea ebp, [ebx + 4]
cmp edx, esi
jbe 0x10010319
push edi
mov edi, 2
jmp 0x100101f0
mov edx, dword [esp + 0x10]
jmp 0x100101f0
mov al, byte [esi + ebp]
cmp al, 0x25
jne 0x100102fa
cmp edi, edx
jae 0x100102e8
mov al, byte [esi + ebp + 1]
cmp al, 0x30
jl 0x1001020f
cmp al, 0x39
jle 0x10010227
cmp al, 0x61
jl 0x10010217
cmp al, 0x66
jle 0x10010227
cmp al, 0x41
jl 0x100102e8
cmp al, 0x46
jg 0x100102e8
mov cl, byte [esi + ebp + 2]
cmp cl, 0x30
jl 0x10010235
cmp cl, 0x39
jle 0x10010251
cmp cl, 0x61
jl 0x1001023f
cmp cl, 0x66
jle 0x10010251
cmp cl, 0x41
jl 0x100102e8
cmp cl, 0x46
jg 0x100102e8
cmp al, 0x30
jl 0x10010261
cmp al, 0x39
jg 0x10010261
movsx eax, al
sub eax, 0x30
jmp 0x10010284
cmp al, 0x41
jl 0x10010271
cmp al, 0x46
jg 0x10010271
movsx eax, al
sub eax, 0x37
jmp 0x10010284
cmp al, 0x61
jl 0x10010281
cmp al, 0x66
jg 0x10010281
movsx eax, al
sub eax, 0x57
jmp 0x10010284
or eax, 0xffffffff
cmp dword [ebx + 0x18], 0x10
jb 0x1001028f
mov ecx, dword [ebx + 4]
jmp 0x10010292
lea ecx, [ebx + 4]
mov cl, byte [ecx + esi + 2]
cmp cl, 0x30
jl 0x100102a8
cmp cl, 0x39
jg 0x100102a8
movsx ecx, cl
sub ecx, 0x30
jmp 0x100102cf
cmp cl, 0x41
jl 0x100102ba
cmp cl, 0x46
jg 0x100102ba
movsx ecx, cl
sub ecx, 0x37
jmp 0x100102cf
cmp cl, 0x61
jl 0x100102cc
cmp cl, 0x66
jg 0x100102cc
movsx ecx, cl
sub ecx, 0x57
jmp 0x100102cf
or ecx, 0xffffffff
shl al, 4
add al, cl
lea ecx, [esp + 0x18]
push eax
push 1
call fcn.1000a9b0
add esi, 3
add edi, 3
jmp 0x10010308
push 1
push 0x100366a8
lea ecx, [esp + 0x20]
call fcn.1000aba0
jmp 0x10010306
push eax
push 1
lea ecx, [esp + 0x20]
call fcn.1000a9b0
inc esi
inc edi
cmp esi, dword [esp + 0x10]
jb 0x100101e2
mov ecx, dword [esp + 0x14]
xor esi, esi
pop edi
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x1c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], esi
push eax
mov byte [ecx + 4], 0
call fcn.10001de0
cmp dword [esp + 0x2c], 0x10
pop esi
pop ebp
pop ebx
jb 0x1001034b
mov ecx, dword [esp + 0xc]
push ecx
call fcn.1002678d
add esp, 4
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 4]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10026ded
add esp, 0x34
ret

Function at 0x10010910
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10010939
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10010939
push esi
call fcn.1002657d
add esp, 4
push eax
push esi
mov ecx, 0x1003e224
call fcn.10002160
pop esi
ret
Function at 0x10011ca0
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x198
mov eax, dword [0x1003e9ec]
xor eax, esp
push ebx
mov dword [esp + 0x198], eax
mov eax, dword [esp + 0x1a8]
push ebp
mov ebp, dword [esp + 0x1a4]
push esi
mov esi, dword [esp + 0x1ac]
mov dword [esp + 0xc], eax
call fcn.100053a0
mov ebx, dword [eax + 0x34]
lea ecx, [esp + 0x10]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10011d55
push edi
push 1
push eax
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10011d4e
push 0x274
call fcn.10025077
add esp, 4
mov esi, eax
push esi
push ebx
push edi
call dword [sym.imp.WS2_32.dll_WSADuplicateSocketW]
test eax, eax
jne 0x10011d3d
mov edx, dword [esp + 0x1b8]
mov eax, dword [esp + 0x10]
push edx
push eax
push esi
push ebp
call fcn.10011550
mov ecx, eax
call fcn.10003fb0
jmp 0x10011d54
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
call fcn.1002678d
add esp, 4
jmp 0x10011d54
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
mov ecx, dword [esp + 0x1a0]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10026ded
add esp, 0x198
ret
Function at 0x1001b790
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10034508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
push edi
xor edi, edi
mov ebx, ecx
push ebp
mov dword [ebx + 0x20], edi
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], edi
mov word [esp + 0x3c], di
call fcn.1002657d
add esp, 4
push eax
push ebp
lea ecx, [esp + 0x3c]
call fcn.10002160
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x54]
push ecx
mov dword [esp + 0x7c], edi
call fcn.1001f7d0
mov ecx, dword [eax + 0x18]
mov esi, 8
add esp, 8
cmp ecx, esi
jb 0x1001b803
mov eax, dword [eax + 4]
jmp 0x1001b806
add eax, 4
push edi
push 0x80
push 3
push edi
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x7c], eax
cmp dword [esp + 0x68], esi
jb 0x1001b831
mov edx, dword [esp + 0x54]
push edx
call fcn.1002678d
add esp, 4
cmp dword [esp + 0x4c], esi
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], edi
mov word [esp + 0x54], di
mov dword [esp + 0x74], 0xffffffff
jb 0x1001b85d
mov eax, dword [esp + 0x38]
push eax
call fcn.1002678d
add esp, 4
cmp dword [esp + 0x7c], 0xffffffff
jne 0x1001b882
pop edi
pop esi
pop ebp
mov dword [ebx + 0x20], 1
xor al, al
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 4
push ebp
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.1002657d
add esp, 4
push eax
push ebp
lea ecx, [esp + 0x20]
call fcn.10002160
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x78], 1
call fcn.100218f0
mov ebp, eax
mov eax, dword [esp + 0x34]
add esp, 4
cmp eax, esi
mov dword [esp + 0x74], 0xffffffff
jb 0x1001b8db
mov edx, dword [esp + 0x1c]
push edx
call fcn.1002678d
add esp, 4
push ebp
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
mov dword [esp + 0x14], edi
call fcn.1002511b
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x7c]
push edi
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push ecx
mov dword [esp + 0x88], 2
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001b92a
mov dword [ebx + 0x20], 1
jmp 0x1001b95b
mov eax, dword [ebx + 4]
push ebp
lea ecx, [ebx + 4]
push edi
push esi
call dword [eax + 0xc]
test eax, eax
jg 0x1001b948
mov ecx, dword [esp + 0x7c]
mov dword [ebx + 0x20], 2
push ecx
jmp 0x1001b960
push esi
mov ecx, ebx
call fcn.1001b4e0
test al, al
jne 0x1001b986
mov dword [ebx + 0x20], 2
mov edx, dword [esp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1002678d
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 4
mov eax, dword [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.1001b610
push esi
call fcn.1002678d
mov ecx, dword [esp + 0x70]
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 4

Function at 0x1001bf76
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x1001bf84
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret
Function at 0x1001bf85
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x1001bf93
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x1001bfd2
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
jne 0x1001c016
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x1001bfa9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esp + 0xc], bl
mov dword [esi + 8], eax
jne 0x1001c016
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ebx
ret 4

Function at 0x1001c089
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x1001c12b
cmp word [esi], bx
je 0x1001c12b
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1001c127
inc eax
push edi
push eax
call fcn.1002511b
mov edi, eax
cmp edi, ebx
pop ecx
je 0x1001c126
push edi
push dword [ebp + 8]
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1001c11f
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x1003683c
push edi
mov dword [ebp - 4], ebx
mov dword [ebp + 8], 0x34
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1001c11f
mov eax, dword [ebp - 4]
mov cx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov word [edx], cx
mov cx, word [eax + 8]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov cx, word [eax + 0xe]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [ebp + 0x18]
mov word [ecx], ax
mov bl, 1
push edi
call fcn.10026eed
pop ecx
pop edi
mov al, bl
jmp 0x1001c138
push 0x132b3a1
call fcn.1001e5dd
pop ecx
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x1001c90d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1001c940
cmp word [esi], 0
je 0x1001c940
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001c94b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001c93c
test al, 0x10
je 0x1001c93c
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
push 0x132b3a1
call fcn.1001e5dd
pop ecx
xor al, al
pop esi
ret
Function at 0x1001c94f
Capabilities:
Create directory

Disassembly:
mov eax, 0x10034611
call fcn.10028000
sub esp, 0x20
mov eax, dword [0x1003e9ec]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, ebp
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], eax
je 0x1001c9e0
cmp word [ebx], di
je 0x1001c9e0
push ebx
call fcn.1001c90d
test al, al
pop ecx
je 0x1001c986
mov al, 1
jmp 0x1001c9e2
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push edi
push ebx
push edi
call esi
cmp eax, edi
je 0x1001c982
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.1001bd3e
pop ecx
pop ecx
cmp dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
je 0x1001c9dc
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1001c9b5
lea eax, [ebp - 0x28]
push eax
call fcn.1001c94f
test al, al
pop ecx
je 0x1001c9dc
push edi
push ebx
push edi
call esi
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.100015b0
mov al, bl
jmp 0x1001c9e2
xor bl, bl
jmp 0x1001c9cd
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.10026ded
leave
ret

Function at 0x1001c9fb
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x1001e5fa
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
push ebx
push esi
push edi
je 0x1001e710
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1001e710
xor esi, esi
xor ebx, ebx
xor edx, edx
test edi, edi
jbe 0x1001e70c
mov eax, edi
sub eax, edx
cmp eax, 2
jb 0x1001e63b
cmp byte [edx + ecx], 0xd
jne 0x1001e63b
cmp byte [edx + ecx + 1], 0xa
je 0x1001e676
mov al, byte [edx + ecx]
cmp al, 0xa
je 0x1001e676
cmp al, 0x3d
jne 0x1001e650
inc ebx
cmp ebx, 2
ja 0x1001e710
cmp al, 0x7f
ja 0x1001e710
movzx eax, al
mov al, byte [eax + 0x10036920]
cmp al, 0x7f
je 0x1001e710
cmp al, 0x40
jae 0x1001e675
test ebx, ebx
jne 0x1001e710
inc esi
inc edx
cmp edx, edi
jb 0x1001e625
test esi, esi
je 0x1001e70c
mov ecx, dword [ebp + 0xc]
lea eax, [esi + esi*2]
lea eax, [eax + eax + 7]
shr eax, 3
cmp dword [ecx], eax
jae 0x1001e69a
mov dword [ecx], eax
push 0xfffffffffffffff0
jmp 0x1001e712
mov ecx, dword [ebp + 8]
push 3
xor ebx, ebx
xor esi, esi
test edx, edx
pop edi
jbe 0x1001e704
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0xd
je 0x1001e6fc
cmp al, 0xa
je 0x1001e6fc
movzx eax, al
movzx eax, byte [eax + 0x10036920]
xor edx, edx
cmp al, 0x40
sete dl
shl ebx, 6
and eax, 0x3f
or eax, ebx
mov ebx, eax
sub edi, edx
inc esi
cmp esi, 4
jne 0x1001e6fc
xor esi, esi
test edi, edi
jbe 0x1001e6e7
shr eax, 0x10
mov byte [ecx], al
inc ecx
cmp edi, 1
jbe 0x1001e6f4
mov eax, ebx
shr eax, 8
mov byte [ecx], al
inc ecx
cmp edi, 2
jbe 0x1001e6fc
mov byte [ecx], bl
inc ecx
inc dword [ebp + 0x10]
dec dword [ebp - 4]
jne 0x1001e6ab
sub ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
jmp 0x1001e713
push 0xffffffffffffffee
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001ebb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10034646
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18c
push ebx
push esi
push edi
lea edi, [ebp - 0x198]
mov ecx, 0x63
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.10028020
add esp, 0xc
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 0x80
push 0x10
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.10028020
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x100369fc
lea ecx, [ebp - 0x18c]
push ecx
call fcn.1001fa30
add esp, 0xc
mov dword [ebp - 0x194], eax
mov edx, dword [ebp - 0x194]
mov dword [ebp - 0x198], edx
mov dword [ebp - 4], 0
push 0x100369fc
mov eax, dword [ebp - 0x198]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.1001ba50
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18c]
call fcn.10001710
cmp dword [ebp + 0xc], 0
je 0x1001ec91
push 0x100369f8
lea ecx, [ebp - 0x90]
call fcn.10010490
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x90]
call fcn.10010490
mov esi, esp
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x90]
call fcn.1000f7b0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.10028400
test eax, eax
jne 0x1001ece9
mov byte [ebp - 0x165], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.10001710
mov al, byte [ebp - 0x165]
jmp 0x1001ed53
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x64]
mov dword [eax], ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001ed0e
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.10028400
mov esi, esp
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10028400
mov esi, esp
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10028400
mov byte [ebp - 0x159], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.10001710
mov al, byte [ebp - 0x159]
push edx
mov ecx, ebp
push eax
lea edx, [0x1001ed84]
call fcn.10028423
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x198
cmp ebp, esp
call fcn.10028400
mov esp, ebp
pop ebp
ret
Function at 0x10020060
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10034780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
push edi
lea edi, [ebp - 0x164]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
call fcn.10001040
add eax, 8
mov dword [ebp - 0x14], eax
mov word [ebp - 0x15e], 0
lea eax, [ebp - 0x15e]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10020870
mov dword [ebp - 4], 0
mov word [ebp - 0x152], 0
lea eax, [ebp - 0x152]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x44]
call fcn.10020870
mov byte [ebp - 4], 1
push 0x3c
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.10028020
add esp, 0xc
mov dword [ebp - 0x88], 0x3c
push 0
lea ecx, [ebp - 0x2c]
call fcn.10020910
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x74], eax
push 0
lea ecx, [ebp - 0x44]
call fcn.10020910
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov esi, esp
lea eax, [ebp - 0x88]
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.10001040
push eax
mov ecx, dword [ebp + 8]
call fcn.10001450
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp esi, esp
call fcn.10028400
push 0
lea ecx, [ebp - 0x2c]
call fcn.10020910
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10010470
push 0
lea ecx, [ebp - 0x44]
call fcn.10020910
push eax
mov ecx, dword [ebp + 0x10]
call fcn.10010470
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.100208d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100208d0
push edx
mov ecx, ebp
push eax
lea edx, [0x100201cc]
call fcn.10028423
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x164
cmp ebp, esp
call fcn.10028400
mov esp, ebp
pop ebp
ret
Function at 0x10026187
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1003e9ec]
xor eax, ebp
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.10026157
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.10028020
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x100261eb
cmp dword [ebp - 0x1c], 5
jb 0x10026203
jmp 0x100261ff
cmp dword [ebp - 0x10], 1
jne 0x10026203
cmp dword [ebp - 0x1c], 4
ja 0x100261ff
jne 0x10026203
cmp dword [ebp - 0x18], 0
jbe 0x10026203
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x100372cc
call fcn.10001050
test eax, eax
jge 0x10026224
mov byte [0x1003f900], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10026ded
add ebp, 0x78
leave
ret

Function at 0x10027a1e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10027b0e
mov eax, 0x94
call fcn.10027230
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10027b83
mov ecx, dword [esi + 0x10]
mov dword [0x1003fde0], ecx
mov eax, dword [esi + 4]
mov dword [0x1003fdec], eax
mov edx, dword [esi + 8]
mov dword [0x1003fdf0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1003fde4], esi
je 0x10027a89
or esi, 0x8000
mov dword [0x1003fde4], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x1003fde8], eax
call fcn.1002ab36
test eax, eax
pop ecx
je 0x10027b83
call fcn.1002b9b7
test eax, eax
jne 0x10027ab6
call fcn.1002ab87
jmp 0x10027b83
call fcn.1002db06
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100414e8], eax
call fcn.1002d9e4
mov dword [0x1003fbf0], eax
call fcn.1002d4c5
test eax, eax
jl 0x10027b07
call fcn.1002d942
test eax, eax
jl 0x10027b02
call fcn.1002d70f
test eax, eax
jl 0x10027b02
push 0
call fcn.1002bef3
test eax, eax
pop ecx
jne 0x10027b02
inc dword [0x1003fbec]
jmp 0x10027b94
call fcn.1002d6c3
call fcn.1002b7a0
jmp 0x10027aac
test eax, eax
jne 0x10027b3e
cmp dword [0x1003fbec], eax
jle 0x10027b83
dec dword [0x1003fbec]
cmp dword [0x1003fe1c], eax
jne 0x10027b2d
call fcn.1002c031
call fcn.1002d6c3
call fcn.1002b7a0
call fcn.1002ab87
jmp 0x10027b94
cmp eax, 2
jne 0x10027b87
push 0x8c
push 1
call fcn.1002d3ee
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10027b83
push esi
push dword [0x1003eed0]
call dword [0x1003fdd0]
test eax, eax
push esi
je 0x10027b7d
call fcn.1002b7bd
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10027b94
call fcn.10026792
pop ecx
xor eax, eax
jmp 0x10027b97
cmp eax, 3
jne 0x10027b94
push 0
call fcn.1002b988
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc