joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004430
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x140
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push Ordinal_4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100044c6
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x40
lea edx, [esp + 0x1c]
push edx
push esi
call edi
mov eax, 0x5a4d
cmp word [esp + 0x10], ax
jne 0x100044c6
mov ecx, dword [esp + 0x4c]
push ebx
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea edx, [esp + 0x10]
push edx
push 0xf8
lea eax, [esp + 0x5c]
push eax
push esi
call edi
cmp dword [esp + 0x50], 0x4550
jne 0x100044c6
mov ax, word [esp + 0xac]
cmp ax, 2
jne 0x100044bb
mov ebx, 0x10001
jmp 0x100044c6
cmp ax, 3
jne 0x100044c6
mov ebx, 7
test esi, esi
je 0x100044d1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x140
ret
Function at 0x100049a0
Capabilities:
Create process on windows
Impersonate user

Disassembly:
sub esp, 0x10
push ebx
push ebp
push edi
mov ebx, eax
lea eax, [esp + 0x10]
push eax
xor edi, edi
push edi
push 2
push str.UnPacKcN
push edi
push str.UnPacKcN
xor ebp, ebp
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
je 0x10004b51
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [esp + 0x14], eax
test eax, eax
je 0x10004b51
push 0x60000
push ebp
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationA]
mov dword [esp + 0x18], eax
test eax, eax
je 0x10004b1c
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x10004b1c
push 0x60081
push ebp
push ebp
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov ecx, dword [esp + 0x14]
push ecx
mov ebp, eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x10004b1c
test ebp, ebp
je 0x10004b1c
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
call fcn.10004300
add esp, 4
test eax, eax
je 0x10004b1c
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.10004b70
add esp, 8
test eax, eax
je 0x10004b1c
mov edx, dword [esp + 0xc]
push edx
push ebp
call fcn.10004e60
add esp, 8
test eax, eax
je 0x10004b1c
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x10004b1c
push 0x44
push edi
push esi
call fcn.1001cc90
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
add esp, 0xc
push ebx
push esi
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
mov dword [esi], 0x44
mov dword [esi + 8], str.winsta0default
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test edi, edi
je 0x10004b0d
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x10004b0d
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx + 4]
cmp ebx, 0xffffffff
je 0x10004b1c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
cmp dword [esp + 0xc], 0
je 0x10004b37
lea eax, [esp + 0xc]
call fcn.10004410
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10004b46
push eax
call dword [sym.imp.USER32.dll_CloseWindowStation]
test ebp, ebp
je 0x10004b51
push ebp
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x10004b61
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100050b0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x130
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x10005142
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10005128
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
mov eax, str.WINLOGON.EXE
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100050f0
sub eax, edx
push eax
lea ecx, [esp + 0x38]
push ecx
push str.WINLOGON.EXE
call esi
test eax, eax
je 0x1000511b
lea edx, [esp + 0x10]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100050e6
jmp 0x10005128
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov ebx, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
jne 0x10005142
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x130
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x130
ret
Function at 0x100056a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push edi
lea eax, [esp + 0xc]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100056ca
xor eax, eax
pop edi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0xc]
push ecx
call fcn.10005740
mov edi, eax
add esp, 4
test edi, edi
je 0x100056c3
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ebp
push esi
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esi], 0
push ecx
mov dword [esi], 4
push edi
mov dword [ebp], 0
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
push edi
call ebx
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x10005740
Capabilities:
Get token privileges

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x50]
push ecx
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], bl
mov byte [esp + 0x58], bl
mov byte [esp + 0x59], 5
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], ebx
call edi
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 3
push ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ebx
call esi
mov edx, dword [esp + 0x10]
push edx
call fcn.10014821
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x40]
add esp, 4
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ecx
push ebp
push 3
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call fcn.10014821
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x221
push 0x20
push 2
lea edx, [esp + 0x50]
mov esi, eax
push edx
mov dword [esi], ebx
call edi
mov eax, dword [esp + 0x1c]
push eax
call fcn.100058f0
mov dword [esp + 0x18], eax
mov eax, dword [ebp]
add esp, 4
cmp eax, ebx
jbe 0x10005882
mov dword [esp + 0x20], ebx
jle 0x10005882
lea ecx, [ebp + 8]
mov eax, dword [esp + 0x14]
mov edi, dword [eax]
xor edx, edx
cmp edi, ebx
jle 0x10005848
add eax, 4
mov ebx, dword [ecx]
cmp ebx, dword [eax + 4]
jne 0x1000583e
mov ebx, dword [ecx - 4]
cmp ebx, dword [eax]
je 0x10005846
inc edx
add eax, 0xc
cmp edx, edi
jl 0x10005830
xor ebx, ebx
cmp edx, edi
jne 0x10005871
mov eax, dword [esi]
inc eax
lea edx, [eax + eax*2]
mov eax, dword [ecx + 4]
mov dword [esi + edx*4], eax
mov eax, dword [esi]
lea edx, [eax + eax*2]
mov eax, dword [ecx]
mov dword [esi + edx*4 + 8], eax
mov eax, dword [esi]
lea edx, [eax + eax*2]
mov eax, dword [ecx - 4]
mov dword [esi + edx*4 + 4], eax
inc dword [esi]
mov eax, dword [esp + 0x20]
inc eax
add ecx, 0xc
cmp eax, dword [ebp]
mov dword [esp + 0x20], eax
jl 0x10005821
push ebp
call fcn.10014744
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call fcn.10014744
mov ecx, dword [esi]
add esp, 4
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
lea eax, [esi + 4]
push eax
mov eax, dword [esp + 0x4c]
push ecx
lea edx, [esp + 0x44]
push edx
push 1
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_FreeSid]
push ecx
call edi
mov edx, dword [esp + 0x1c]
push edx
call edi
push esi
call fcn.10014744
mov eax, dword [esp + 0x28]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10006ff0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xor ecx, ecx
test edi, edi
jbe 0x100059e5
jmp 0x100059d0
mov eax, ecx
and eax, 0xff
mov dl, byte [eax + 0x1004bee8]
xor byte [eax + esi], dl
inc ecx
cmp ecx, edi
jb 0x100059d0
ret
jmp 0x100059c0

Function at 0x100073ad
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 8
call fcn.1000ce70
push 0x208
push 0x10052b90
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x100073c6
push 0x5c
push 0x10052b90
call fcn.10015620
add esp, 8
test eax, eax
jbe 0x100073c6
mov byte [eax + 1], 0
jmp 0x100073d6
push 0x10052b90
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 0x10052d98
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100073e0
push ebx
push esi
push edi
mov edi, 0x10052b90
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100073f4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x100431c8
push 0x10052b90
rep movsb byte es:[edi], byte [esi]
call fcn.1001594f
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1000743b
push str.Cant_CreateFile
push 0xffffffffffffffff
push eax
call sub.OllyDbg.EXE_Ordinal_2
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push 0x15c9a
mov dword [esp + 0x14], 0x569a2940
mov dword [esp + 0x10], 0xdbd310e1
call fcn.10014821
push 0x15c9a
mov edi, eax
push 0x1002d500
push edi
call fcn.10019650
push edi
lea eax, [esp + 0x20]
lea esi, [esp + 0x24]
call fcn.10009c40
push ebx
push 0x15c9a
push 1
push edi
call fcn.10015ac8
add esp, 0x24
test eax, eax
jne 0x100074af
push str.Write_DrvFile_Failed_
push 0xffffffffffffffff
push eax
call sub.OllyDbg.EXE_Ordinal_2
push edi
call fcn.10014744
push ebx
call fcn.10015bc1
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push edi
call fcn.10014744
push ebx
call fcn.10015bc1
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x100099b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
push edi
push 0x207
lea eax, [esp + 0x25]
push 0
push eax
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
call fcn.1001cc90
mov edi, dword [esp + 0x23c]
add esp, 0xc
call fcn.10009920
mov ebp, eax
test ebp, ebp
jne 0x100099fa
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
push ebp
lea ecx, [esp + 0x24]
push str.StartAddress__0x_X_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x22c]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x100099ed
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push edi
call fcn.10009310
mov eax, dword [esp + 0x10]
mov esi, eax
push eax
shr esi, 2
push 0x40
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
push ebx
push edi
call fcn.10009310
mov ecx, dword [esp + 0x10]
push 0x10009300
push ecx
push esi
push ebx
call fcn.100153d0
xor esi, esi
add esp, 0x10
cmp dword [esp + 0x18], esi
jbe 0x10009af7
lea esp, [esp]
push edi
mov edi, dword [ebx + esi*4]
call fcn.100095d0
mov ecx, dword [ebx + esi*4]
add esp, 4
cmp ebp, ecx
jbe 0x10009aa9
add ecx, eax
cmp ebp, ecx
jb 0x10009ab6
mov edi, dword [esp + 0x14]
inc esi
cmp esi, dword [esp + 0x18]
jb 0x10009a90
jmp 0x10009af7
mov eax, dword [ebx + esi*4]
mov ecx, dword [esp + 0x14]
push 0x208
lea edx, [esp + 0x24]
push edx
push eax
push ecx
call fcn.100092e0
test eax, eax
je 0x10009aeb
mov edx, dword [esp + 0x234]
lea eax, [esp + 0x20]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10009ae1
mov edi, dword [esp + 0x14]
mov dword [esp + 0x1c], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret

Function at 0x10009b10
Capabilities:
Terminate thread

Disassembly:
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
jne 0x10009b24
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x10009c40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, 0x15c99
lea esp, [esp]
mov dl, byte [edi + ebp]
mov ebx, dword [eax]
ror ebx, 7
movzx ecx, dl
add ebx, ecx
mov dword [eax], ebx
mov ebx, dword [esi]
rol ebx, 3
xor ebx, ecx
mov cl, byte [edi + ebp - 1]
mov dword [esi], ebx
movzx ebx, byte [eax]
add bl, dl
xor bl, byte [esi]
movzx edx, cl
sub bl, cl
mov byte [edi + ebp], bl
mov ebx, dword [eax]
ror ebx, 7
add ebx, edx
mov dword [eax], ebx
mov ebx, dword [esi]
rol ebx, 3
xor ebx, edx
mov dl, byte [edi + ebp - 2]
mov dword [esi], ebx
movzx ebx, byte [eax]
add bl, cl
xor bl, byte [esi]
movzx ecx, dl
sub bl, dl
mov byte [edi + ebp - 1], bl
mov ebx, dword [eax]
ror ebx, 7
add ebx, ecx
mov dword [eax], ebx
mov ebx, dword [esi]
rol ebx, 3
xor ebx, ecx
movzx ecx, byte [eax]
add cl, dl
xor cl, bl
sub cl, byte [edi + ebp - 3]
sub edi, 3
mov byte [edi + ebp + 1], cl
mov dword [esi], ebx
test edi, edi
jg 0x10009c50
mov cl, byte [ebp]
mov ebx, dword [eax]
movzx edx, cl
ror ebx, 7
add ebx, edx
mov dword [eax], ebx
mov ebx, dword [esi]
rol ebx, 3
xor ebx, edx
mov dl, byte [eax]
add dl, cl
mov al, bl
mov byte [ebp], dl
xor byte [edi + ebp], al
pop edi
pop ebp
mov dword [esi], ebx
pop ebx
ret

Function at 0x1000b940
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x14
call sub.OllyDbg.EXE_Ordinal_88
add esp, 4
test eax, eax
je 0x1000b984
mov ecx, dword [esp + 4]
push esi
push 0x40
push 0x1000
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x1000b983
call sub.OllyDbg.EXE_Ordinal_186
push 0x10001
push 0
push 0
push esi
push 0
call sub.OllyDbg.EXE_Ordinal_107
add esp, 0x14
pop esi
ret

Function at 0x1000fdb0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000fdec
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1000fdf2
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1000fe3f
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov eax, 1
add esp, 0x24
ret
Function at 0x1000ff40
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ff50
sub eax, edx
mov edi, eax
mov dword [esp + 0x14], edi
fild dword [esp + 0x14]
fmul qword [0x100444a0]
fadd qword [0x10044498]
call fcn.10022000
mov ebx, eax
lea esi, [ebx*4]
push esi
call fcn.10014821
push esi
mov ebp, eax
call fcn.10014821
add esp, 8
mov esi, eax
test ebx, ebx
jle 0x1000ffb3
lea edx, [ebx*4]
mov ecx, edx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
shr ecx, 2
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
mov eax, 1
mov dword [esi], eax
test edi, edi
jle 0x1001009e
mov eax, dword [esp + 0x20]
lea ecx, [edi + eax - 1]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
mov edx, dword [esp + 0x14]
mov al, byte [edx]
mov cl, al
sub cl, 0x30
cmp cl, 9
ja 0x1000ffea
movzx eax, al
sub eax, 0x30
jmp 0x1001000c
mov dl, al
sub dl, 0x61
cmp dl, 5
ja 0x1000fffc
movzx eax, al
sub eax, 0x57
jmp 0x1001000c
mov cl, al
sub cl, 0x41
cmp cl, 5
ja 0x10010010
movzx eax, al
sub eax, 0x37
mov dword [esp + 0x10], eax
test ebx, ebx
jle 0x10010032
mov ecx, esi
mov eax, ebp
sub ecx, ebp
mov edx, ebx
lea esp, [esp]
mov edi, dword [eax + ecx]
imul edi, dword [esp + 0x10]
add dword [eax], edi
add eax, 4
sub edx, 1
jne 0x10010020
xor ecx, ecx
test ebx, ebx
jle 0x10010059
jmp 0x10010040
mov eax, dword [ebp + ecx*4]
cdq
mov edi, 0xa
idiv edi
inc ecx
add dword [ebp + ecx*4], eax
cmp ecx, ebx
mov dword [ebp + ecx*4 - 4], edx
jl 0x10010040
xor eax, eax
test ebx, ebx
jle 0x1001006e
nop
mov edx, dword [esi + eax*4]
shl edx, 4
mov dword [esi + eax*4], edx
inc eax
cmp eax, ebx
jl 0x10010060
xor ecx, ecx
test ebx, ebx
jle 0x1001008b
mov eax, dword [esi + ecx*4]
cdq
mov edi, 0xa
idiv edi
inc ecx
add dword [esi + ecx*4], eax
cmp ecx, ebx
mov dword [esi + ecx*4 - 4], edx
jl 0x10010074
mov eax, 1
sub dword [esp + 0x14], eax
sub dword [esp + 0x18], eax
jne 0x1000ffd2
dec ebx
cmp dword [ebp + ebx*4], 0
jne 0x100100af
sub ebx, eax
cmp dword [ebp + ebx*4], 0
je 0x100100a6
lea eax, [ebx + 3]
push eax
call fcn.10014821
mov edi, eax
lea eax, [ebx + 3]
push eax
push 0
push edi
call fcn.1001cc90
lea edx, [ebx + 1]
add esp, 0x10
xor eax, eax
test edx, edx
jle 0x100100e6
lea ecx, [ebp + ebx*4]
mov bl, byte [ecx]
add bl, 0x30
mov byte [edi + eax], bl
inc eax
sub ecx, 4
cmp eax, edx
jl 0x100100d6
push ebp
call fcn.10014744
push esi
call fcn.10014744
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10010230
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [eax + 0x3c]
movzx ebx, word [esi + eax + 6]
movzx edx, word [esi + eax + 0x14]
add esi, eax
push edi
lea edi, [ebx + ebx*4]
add edi, edi
add edi, edi
lea ecx, [edx + esi + 0x18]
add edi, edi
sub edi, eax
add edi, edx
xor edx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x3c]
lea eax, [edi + esi + 0x18]
div ecx
mov edi, edx
xor edx, edx
test edi, edi
setne dl
mov ebp, eax
add edx, ebp
mov ebp, dword [esp + 0x20]
imul edx, ecx
cmp ebp, edx
jae 0x10010288
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esp + 0x10], 0
test ebx, ebx
jle 0x100102f6
mov edx, dword [esp + 0x18]
add edx, 0x10
mov dword [esp + 0x14], edx
nop
mov edi, dword [edx + 4]
mov eax, dword [edx]
test edi, edi
je 0x100102e2
xor edx, edx
div ecx
mov ebp, eax
xor eax, eax
test edx, edx
setne al
xor edx, edx
add eax, ebp
imul eax, ecx
mov ebp, eax
mov eax, edi
div ecx
test edx, edx
je 0x100102cc
imul eax, ecx
mov edi, eax
cmp dword [esp + 0x20], edi
jb 0x100102da
add ebp, edi
cmp dword [esp + 0x20], ebp
jb 0x10010306
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc eax
add edx, 0x28
cmp eax, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jl 0x100102a0
cmp ebp, dword [esi + 0x54]
jb 0x1001027e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
lea ecx, [eax + eax*4]
mov eax, dword [edx + ecx*8 + 0xc]
sub eax, edi
add eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10010330
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x3c]
mov edx, dword [esp + 4]
add eax, ecx
movzx ecx, word [eax + 0x14]
sub esp, 0x10
push ebx
mov ebx, dword [eax + 0x38]
lea ecx, [ecx + eax + 0x18]
push esi
mov esi, dword [eax + 0x3c]
cmp edx, dword [ecx + 0xc]
jae 0x10010367
cmp edx, dword [eax + 0x54]
jbe 0x1001035f
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret
pop esi
mov eax, edx
pop ebx
add esp, 0x10
ret
push ebp
push edi
movzx edi, word [eax + 6]
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], edi
test edi, edi
jle 0x1001041a
lea edx, [ecx + 8]
mov dword [esp + 0x10], edx
mov ecx, dword [edx + 0xc]
mov eax, dword [edx]
mov ebp, dword [edx + 8]
test ecx, ecx
je 0x10010402
xor edx, edx
div ebx
mov edi, eax
xor eax, eax
test edx, edx
setne al
xor edx, edx
add eax, edi
imul eax, ebx
mov dword [esp + 0x18], eax
mov eax, ebp
div esi
mov edi, eax
xor eax, eax
test edx, edx
setne al
xor edx, edx
add eax, edi
imul eax, esi
mov edi, eax
mov eax, ecx
div esi
test edx, edx
je 0x100103cf
imul eax, esi
mov ecx, eax
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 4]
cmp dword [esp + 0x24], edx
jb 0x100103fa
mov eax, dword [esp + 0x18]
add eax, edx
cmp dword [esp + 0x24], eax
jae 0x100103fa
mov eax, ecx
sub eax, edx
add eax, dword [esp + 0x24]
cmp eax, ecx
jb 0x100103fa
add edi, ecx
cmp eax, edi
jb 0x1001041d
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
inc eax
add edx, 0x28
cmp eax, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
jl 0x10010388
or eax, 0xffffffff
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10010ca0
Capabilities:
Create http request
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10027dd9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [esp + 0x11c]
push edi
lea edi, [esi + 8]
mov dword [esi], vtable.CAutoUpdater.0
xor ebx, ebx
mov eax, 0xf
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov dword [esp + 0x118], ebx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
lea eax, [esi + 0x84]
push eax
mov byte [esp + 0x11c], 3
call fcn.10012960
push ebx
push ebx
push ebx
push ebx
push str.AutoUpdateAgent
mov byte [esp + 0x12c], 4
call dword [sym.imp.WININET.dll_InternetOpenA]
lea ecx, [esp + 0xc]
push ecx
push 0x104
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jbe 0x10010d74
lea eax, [esp + 0xc]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10010d50
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.1000fa50
push 1
push 0x10043454
mov eax, edi
call fcn.10012a70
mov ecx, dword [esp + 0x110]
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0x78], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x110
ret 4