joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100875a
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10117a0
call fcn.01008a94
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10134ec
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100856f
cmp eax, esi
jne 0x1008562
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1008572
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1008549
xor esi, esi
inc esi
mov eax, dword [0x10134e8]
cmp eax, esi
jne 0x1008585
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10085c0
mov eax, dword [0x10134e8]
test eax, eax
jne 0x10085ba
mov dword [0x10134e8], esi
push 0x1001334
push 0x1001328
call fcn.010084c6
pop ecx
pop ecx
test eax, eax
je 0x10085c0
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100868a
mov dword [0x1013094], esi
mov eax, dword [0x10134e8]
cmp eax, esi
jne 0x10085e4
push 0x1001324
push 0x100131c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10134e8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10085f1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10134f0], ebx
je 0x1008612
push 0x10134f0
call fcn.01008a09
pop ecx
test eax, eax
je 0x1008612
push ebx
push 2
push ebx
call dword [0x10134f0]
push dword [0x101307c]
push dword [0x1013080]
push dword [0x1013078]
call fcn.010063d8
add esp, 0xc
mov dword [0x1013090], eax
cmp dword [0x1013084], ebx
jne 0x1008670
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1013094], ebx
jne 0x100867e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1013090]
call fcn.01008ad9
ret
call fcn.01008be1
jmp 0x1008527
Function at 0x1008e94
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [0x101303c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x9e4], eax
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0xa04]
mov dword [ebp - 0xa08], esi
mov dword [ebp - 0x9e8], edx
mov dword [ebp - 0x9e0], esi
mov dword [ebp - 0x9dc], esi
rep stosd dword es:[edi], eax
mov word [ebp - 0x46], ax
cmp dword [ebp - 0x9e4], esi
je 0x1009018
cmp ebx, esi
je 0x1009018
mov eax, dword [ebx]
cmp eax, esi
je 0x1008f11
cmp eax, 2
jb 0x1009018
cmp edx, esi
je 0x1009018
cmp dword [0x10133cc], esi
jne 0x1008f45
lea eax, [ebp - 0x9d8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1008f3b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
jmp 0x1009024
mov dword [0x10133cc], 1
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0xa08]
push eax
push esi
push dword [ebp - 0x9e4]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x100902a
mov esi, dword [ebp - 0x9dc]
xor edi, edi
jmp 0x1008fb2
push 4
xor eax, eax
mov word [ebp - 0x848], ax
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x401
lea eax, [ebp - 0x848]
push eax
push dword [esi + 0x10]
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
cmp eax, edi
je 0x1008fb8
cmp eax, 0x2afc
jne 0x1008faf
cmp word [ebp - 0x848], di
jne 0x1008fb8
mov esi, dword [esi + 0x1c]
cmp esi, edi
jne 0x1008f72
jmp 0x1009004
lea esi, [ebp - 0x848]
cmp dword [ebp + 0x14], edi
jne 0x1008fd5
mov eax, esi
push 0x1001940
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
pop ecx
pop ecx
mov esi, eax
push edi
push esi
call fcn.01009a0a
mov ecx, dword [ebx]
inc eax
cmp ecx, eax
jae 0x1008ff1
mov dword [ebx], eax
mov dword [ebp - 0x9e0], 1
jmp 0x1009004
push ecx
push esi
push dword [ebp - 0x9e8]
call fcn.0100a37c
mov dword [ebp - 0x9e0], eax
push dword [ebp - 0x9dc]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, dword [ebp - 0x9e0]
jmp 0x100902c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100902a
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008775
leave
ret 0x10
Function at 0x1009446
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10095a1
push esi
call fcn.0100920d
cmp eax, 1
je 0x10095a1
push esi
mov dword [ebp + 8], esi
call fcn.01008d9b
cmp eax, 1
jne 0x1009480
add esi, 4
mov dword [ebp + 8], esi
push dword [ebp + 8]
call fcn.01009374
test eax, eax
jne 0x100949c
call fcn.010097db
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10095d5
cmp dword [ebp + 0x14], ebx
je 0x10094c5
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10094c5
push dword [ebp + 0x14]
push dword [ebp + 8]
push 0x1001a4c
push 2
call fcn.0100abc7
add esp, 0x10
jmp 0x10094d7
push dword [ebp + 8]
push 0x100188c
push 1
call fcn.0100abc7
add esp, 0xc
test eax, eax
jne 0x10094fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10094ed
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.010097db
push 8
pop eax
jmp 0x10095d5
call fcn.01009748
cmp eax, ebx
jne 0x100950c
push 0x12
call fcn.010096d7
jmp 0x1009516
push ebx
push ebx
push eax
push 0x12
call fcn.0100a8d6
mov edx, eax
cmp edx, ebx
je 0x10094db
push edi
push 8
pop ecx
push ebx
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 0x10]
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
pop edi
cmp esi, ebx
je 0x1009567
cmp esi, 0x4b8
je 0x1009560
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.010097db
jmp 0x10095cf
call fcn.0100ac59
jmp 0x10095cf
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
call fcn.01009042
push eax
call fcn.01009923
test eax, eax
jne 0x10095cf
push dword [ebp + 8]
call fcn.01009429
push 0x1580
call fcn.0100b775
push eax
call fcn.01009774
mov esi, 0x4b8
jmp 0x10095cf
cmp dword [ebp + 0xc], ebx
je 0x10095d3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10095d3
push 0x157e
call fcn.0100b775
push eax
call fcn.01009774
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x10095d5
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x1001225
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1080
call fcn.01001690
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x1080]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x103c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1080], esi
mov esi, 0x800
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x820]
push ebx
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x1020]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x1024]
push eax
push 0xffff
push 0x100118c
push 0x1001108
push 0x80000002
mov dword [ebp - 0x1028], esi
mov dword [ebp - 0x1024], ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100133d
cmp dword [ebp - 0x1024], 1
je 0x10012db
cmp dword [ebp - 0x1024], 2
jne 0x100133d
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x820]
push eax
push 0x400
push 0x10010fc
push 0x10010e8
lea eax, [ebp - 0x1020]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x100133d
push 6
pop ecx
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x1080]
push eax
push ebx
push ebx
push ebx
mov esi, 0x10010cc
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x820]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0100166e
leave
ret 0x10
Function at 0x100165f
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1001b28
call fcn.01001854
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1002378
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1001416
cmp eax, esi
jne 0x1001409
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1001419
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10013f0
xor esi, esi
inc esi
mov eax, dword [0x1002374]
cmp eax, esi
jne 0x100142c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100145b
mov eax, dword [0x1002374]
test eax, eax
jne 0x1001455
mov dword [0x1002374], esi
push 0x10010ac
push 0x10010a0
call fcn.01001355
pop ecx
pop ecx
test eax, eax
je 0x100145b
jmp 0x1001583
mov dword [0x100203c], esi
mov eax, dword [0x1002374]
cmp eax, esi
jne 0x100147f
push 0x100109c
push 0x1001094
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1002374], 2
test ebx, ebx
jne 0x100148b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100237c], 0
je 0x10014af
push 0x100237c
call fcn.010017c9
pop ecx
test eax, eax
je 0x10014af
push 0
push 2
push 0
call dword [0x100237c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100150b
test al, al
je 0x10014c9
cmp dword [ebp - 0x1c], 0
jne 0x100150b
mov al, byte [esi]
test al, al
je 0x10014d9
cmp al, 0x20
ja 0x10014d9
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10014c9
test byte [ebp - 0x3c], 1
je 0x10014e5
movzx eax, word [ebp - 0x38]
jmp 0x10014e8
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1002038], eax
cmp dword [0x100202c], 0
jne 0x100155f
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100151a
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x100152d
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x10014b6
cmp dword [0x100203c], 0
jne 0x100156e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002038]
jmp 0x100158f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001899
ret
call fcn.010019a1
jmp 0x10013b6
Function at 0x407fa0
Capabilities:
Modify service

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp], 1
mov dword [esp + 8], 0
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 3
cmp eax, 0xffffffff
mov dword [esp + 4], ecx
setne dl
mov eax, 0x70f87c
lea ecx, [esp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push ecx
lea eax, [esp + 4]
push 2
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
add esp, 0x1c
ret

Function at 0x408140
Capabilities:
Create http request

Disassembly:
sub esp, 0x50
push esi
push edi
mov ecx, 0xe
mov esi, 0x4313d0
lea edi, [esp + 8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov word [esp + 0x55], ax
push eax
push eax
push eax
Function at 0x100010f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001109
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001144
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001140
lea ebx, [ebx]
cmp esi, eax
jae 0x10001144
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001130
cmp esi, eax
jb 0x1000114a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10001200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp method.CDialog.virtual_312
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x1000dceb
cmp dword [edi + 0x54], 0
jne 0x1000dceb
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.1001c2df
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1000dc92
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x10004d00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100420b8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x100576f0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
call fcn.10003be0
xor ebx, ebx
mov esi, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x48], ebx
call dword [0x10058aac]
cmp esi, ebx
jne 0x10004d69
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or eax, 0xffffffff
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x1c]
push eax
mov word [esp + 0x20], bx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push edi
mov word [esp + 0x20], 8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp eax, ebx
mov dword [esp + 0x24], eax
jne 0x10004dac
cmp edi, ebx
je 0x10004dac
push 0x8007000e
mov word [esp + 0x20], 0xa
mov dword [esp + 0x28], 0x8007000e
call fcn.100010d0
mov byte [esp + 0x48], 1
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x1c]
push str.value
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
call fcn.100031b0
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x18], edi
jne 0x10004dea
push 0x8007000e
call fcn.100010d0
mov byte [esp + 0x48], 2
mov edx, dword [esp + 0x30]
mov ecx, dword [esi]
push 1
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], edx
mov edx, dword [esp + 0x48]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x4c]
push edi
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x1c]
push esi
call eax
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x4c], 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
push 0
call edi
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100420b8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x100576f0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, edx
mov eax, dword [ebp + 8]
push eax
push ecx
call fcn.10003ef0
xor ebx, ebx
mov esi, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x48], ebx
call dword [0x10058aac]
cmp esi, ebx
jne 0x10004ed1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or eax, 0xffffffff
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
lea ecx, [esp + 0x14]
push ecx
push esi
call edx
lea eax, [esp + 0x1c]
push eax
mov word [esp + 0x20], bx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push edi
mov word [esp + 0x20], 8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp eax, ebx
mov dword [esp + 0x24], eax
jne 0x10004f21
cmp edi, ebx
je 0x10004f21
push 0x8007000e
mov word [esp + 0x20], 0xa
mov dword [esp + 0x28], 0x8007000e
call fcn.100010d0
mov byte [esp + 0x48], 1
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x1c]
push str.value
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
call fcn.100031b0
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x18], edi
jne 0x10004f5f
push 0x8007000e
call fcn.100010d0
mov byte [esp + 0x48], 2
mov edx, dword [esp + 0x30]
mov ecx, dword [esi]
push 1
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], edx
mov edx, dword [esp + 0x48]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x4c]
push edi
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x1c]
push esi
call eax
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x4c], 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004fd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100420b8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x100576f0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
call dword [0x10058aac]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
mov dword [esp + 0x4c], ebx
call fcn.10003d40
mov esi, eax
cmp esi, ebx
jne 0x1000503f
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or eax, 0xffffffff
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x1c]
push ecx
mov word [esp + 0x20], bx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push edi
mov word [esp + 0x20], 8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp eax, ebx
mov dword [esp + 0x24], eax
jne 0x10005082
cmp edi, ebx
je 0x10005082
push 0x8007000e
mov word [esp + 0x20], 0xa
mov dword [esp + 0x28], 0x8007000e
call fcn.100010d0
mov byte [esp + 0x48], 1
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
push str.value
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], eax
call fcn.100031b0
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x18], edi
jne 0x100050c0
push 0x8007000e
call fcn.100010d0
mov byte [esp + 0x48], 2
mov edx, dword [esp + 0x30]
mov ecx, dword [esi]
push 1
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], edx
mov edx, dword [esp + 0x48]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x4c]
push edi
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x1c]
push esi
call eax
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x4c], 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
push 0
call edi
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001304d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x10013090
call fcn.1001c2df
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10013090
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100130ab
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.10012c07
test ebx, ebx
mov esi, eax
je 0x100130a9
test edi, edi
je 0x100130a9
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x100136f5
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x100409f2
call fcn.1002d057
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1001371a
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10013766
call fcn.1000d02d
push eax
lea ecx, [ebp - 0x10]
call fcn.10002980
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000d240
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100011b0
mov eax, esi
call fcn.1002d12f
ret 8

Function at 0x10017fff
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x10018028
call fcn.1001c2df
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 8], eax
jne 0x1001804b
push eax
push dword [esi + 4]
call fcn.10017f8a
push esi
push eax
mov ecx, 0x1005beb8
call fcn.10017c5d
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x1002694f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x10026995
call fcn.1001c2df
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10026995
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x100269d8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x100269c1
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x100269c1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x100269d5
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc