joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038f65
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006d240
call fcn.10055640
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], edi
call fcn.1000b767
mov esi, 0x10078600
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.1000b767
mov dword [ebp - 0x20], esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [eax - 0xc]
test ecx, ecx
mov byte [ebp - 4], 2
mov ebx, 0x3636
jle 0x10038fca
movzx eax, word [eax + edi*2]
xor eax, ebx
push eax
lea ecx, [ebp - 0x14]
call fcn.100222cb
mov eax, dword [esi + 4]
inc edi
cmp edi, dword [eax - 0xc]
jl 0x10038fb2
mov eax, dword [esi + 4]
mov eax, dword [eax - 0xc]
push 0x20
pop edi
cmp eax, edi
jge 0x10038fe5
sub edi, eax
push ebx
lea ecx, [ebp - 0x14]
call fcn.100222cb
dec edi
jne 0x10038fd9
mov eax, dword [ebp + 0x10]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [ebp - 0x14]
call fcn.100040ef
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10038e97
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10023513
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10021b48
mov eax, dword [esi + 4]
mov ecx, dword [eax - 0xc]
xor edi, edi
test ecx, ecx
mov ebx, 0x5c5c
jle 0x1003904d
movzx eax, word [eax + edi*2]
xor eax, ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.100222cb
mov eax, dword [esi + 4]
inc edi
cmp edi, dword [eax - 0xc]
jl 0x10039035
mov eax, dword [esi + 4]
mov eax, dword [eax - 0xc]
push 0x20
pop esi
cmp eax, esi
jge 0x10039068
sub esi, eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.100222cb
dec esi
jne 0x1003905c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100040ef
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.10038e97
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 1
call fcn.10021b48
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.10021b48
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10039bb2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x1003aaba
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1006d394
call fcn.10055640
push ecx
and dword [ebp - 0x10], 0
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.1000b767
and dword [ebp - 4], 0
inc esi
push esi
lea ecx, [ebp - 0x10]
call fcn.100015a0
push esi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1000b2bf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.1000287c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001337
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1003b495
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2724
call fcn.100570c0
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, 0x8000
push esi
push ebx
mov edi, ecx
call fcn.10068c4a
pop ecx
push eax
call fcn.10063ae4
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x1003b65f
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.10068c4a
pop ecx
push eax
call fcn.10063ae4
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x1003b65f
test byte [ebx + 0xc], 0x20
jne 0x1003b4fc
test byte [esi + 0xc], 0x20
je 0x1003b5db
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
cmp dword [ebp - 4], 0
jne 0x1003b601
inc dword [ebp - 0xc]
push 0x1388
lea eax, [ebp - 0x2724]
push eax
push ebx
lea eax, [ebp - 4]
push eax
call fcn.100419c2
cmp dword [ebp - 4], 0xfffffffb
je 0x1003b601
cmp dword [ebp - 4], 0
je 0x1003b53e
cmp dword [ebp - 4], 4
jne 0x1003b557
test eax, eax
jle 0x1003b557
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x2724]
push 1
push eax
call fcn.10057c07
add esp, 0x10
mov eax, dword [ebp + 0xc]
test byte [eax + 0xc], 0x20
jne 0x1003b4fc
cmp dword [ebp - 4], 0
je 0x1003b512
cmp dword [ebp - 4], 4
jne 0x1003b601
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 4]
push eax
call fcn.1003f936
xor ecx, ecx
cmp dword [ebp - 4], ecx
jne 0x1003b65f
cmp dword [ebp - 8], ecx
jle 0x1003b5b2
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x139c]
sub esi, eax
lea eax, [ebp + ecx - 0x139c]
mov dl, byte [esi + eax]
inc ecx
cmp ecx, dword [ebp - 8]
mov byte [eax], dl
jl 0x1003b59d
mov esi, dword [ebp + 8]
push ebx
lea eax, [ebp - 4]
push eax
call fcn.1003f8dc
cmp dword [ebp - 4], 0
jne 0x1003b65f
cmp dword [ebp - 8], 0
jne 0x1003b5db
push esi
call fcn.1003f78c
test al, al
pop ecx
jne 0x1003b666
push dword [ebp - 8]
lea eax, [ebp - 0x139c]
push eax
movzx eax, byte [edi + 0x1c]
push eax
push dword [edi + 0x20]
lea eax, [ebp - 4]
push esi
push eax
call fcn.1003f7ad
mov ebx, eax
test ebx, ebx
jne 0x1003b505
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.1003f8dc
mov eax, dword [ebp - 4]
cmp eax, 0xfffffff7
je 0x1003b4fc
cmp eax, 0xfffffff9
je 0x1003b4fc
cmp eax, 0xfffffffa
je 0x1003b4fc
cmp eax, 0xfffffffb
jne 0x1003b4fc
cmp esi, 0x10092eb0
je 0x1003b641
push esi
call fcn.10057e09
pop ecx
cmp dword [ebp + 0xc], 0x10092ed0
je 0x1003b653
push dword [ebp + 0xc]
call fcn.10057e09
pop ecx
cmp dword [ebp - 0xc], 1
setne al
jmp 0x1003b4fe
push 1
call fcn.1005862e
test byte [esi + 0xc], 0x20
jne 0x1003b4fc
push esi
call fcn.10057e09
cmp eax, 0xffffffff
pop ecx
je 0x1003b4fc
mov esi, dword [ebp + 0xc]
test byte [esi + 0xc], 0x20
jne 0x1003b4fc
push esi
call fcn.10057935
test eax, eax
pop ecx
jne 0x1003b4fc
cmp esi, 0x10092ed0
je 0x1003b6b4
push esi
call fcn.10057e09
cmp eax, 0xffffffff
pop ecx
je 0x1003b4fc
mov al, 1
jmp 0x1003b4fe

Function at 0x1003b6bb
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
call fcn.1005565f
pop ecx
mov ecx, 0x400
cmp eax, ecx
jbe 0x1003b6d5
push 1
call fcn.1005862e
push ecx
push dword [esp + 8]
push esi
call fcn.10056f84
and word [esi + 0x800], 0
add esp, 0xc
ret
Function at 0x1003b77b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.100570c0
push edi
mov edi, ecx
and dword [edi + 0x2c], 0
cmp dword [ebp + 8], 0
jne 0x1003b79c
xor al, al
jmp 0x1003b876
cmp dword [edi + 0x18], 8
jb 0x1003b7a7
mov eax, dword [edi + 4]
jmp 0x1003b7aa
lea eax, [edi + 4]
push ebx
push esi
push eax
lea esi, [ebp - 0x814]
call fcn.1003b6bb
push dword [ebp + 8]
lea esi, [ebp - 0x1028]
call fcn.1003b6bb
pop ecx
pop ecx
lea edx, [ebp - 0x814]
call fcn.1003b75e
test al, al
jne 0x1003b872
lea eax, [ebp - 0x814]
push eax
call fcn.1003b6ec
test al, al
pop ecx
je 0x1003b872
cmp byte [edi + 0x28], 0
jne 0x1003b833
lea eax, [ebp - 0x814]
push eax
call fcn.1003b711
test al, al
pop ecx
jne 0x1003b872
cmp byte [edi + 0x28], al
jne 0x1003b833
lea eax, [ebp - 0x1028]
push eax
call fcn.1003b6ec
test al, al
pop ecx
jne 0x1003b872
cmp byte [edi + 0x28], al
jne 0x1003b833
lea eax, [ebp - 0x814]
push eax
call fcn.1003b73b
test eax, eax
pop ecx
jg 0x1003b872
lea eax, [ebp - 0x814]
push 0x1007d078
push eax
call fcn.10058951
mov ebx, eax
lea eax, [ebp - 0x1028]
push 0x1007d080
push eax
call fcn.10058951
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x1003b867
test ebx, ebx
je 0x1003b872
push ebx
jmp 0x1003b86c
test ebx, ebx
jne 0x1003b87b
push esi
call fcn.10057e09
pop ecx
xor al, al
pop esi
pop ebx
pop edi
leave
ret 4
cmp dword [edi + 0x20], 1
jl 0x1003b88c
push 0x10092ef0
call fcn.10057935
pop ecx
push esi
push ebx
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.1003b495
and dword [edi + 0x34], 0
test al, al
jne 0x1003b8b8
lea eax, [ebp - 0x1028]
push eax
call fcn.10057f0b
test eax, eax
pop ecx
je 0x1003b872
push 1
call fcn.1005862e
mov al, 1
jmp 0x1003b874

Function at 0x1003bb33
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [0x1009575c]
call fcn.10041fba
test al, al
jne 0x1003bb6b
push 4
call fcn.10043af0
test eax, eax
pop ecx
je 0x1003bb56
mov dword [eax], 0x1007d08c
jmp 0x1003bb58
xor eax, eax
push eax
push 0
push 0x1001cc83
call fcn.100575f8
add esp, 0xc
mov al, 1
ret
mov eax, dword [0x1009575c]
cmp dword [eax + 0x88], 8
jb 0x1003bb7e
mov ecx, dword [eax + 0x74]
jmp 0x1003bb81
lea ecx, [eax + 0x74]
cmp dword [eax + 0x50], 8
jb 0x1003bb8c
mov eax, dword [eax + 0x3c]
jmp 0x1003bb8f
add eax, 0x3c
push ecx
push eax
push dword [0x1009135c]
call fcn.1003e0ee
add esp, 0xc
jmp 0x1003ba25

Function at 0x1003c758
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1006d4fd
call fcn.10055640
sub esp, 0x20
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.1000205b
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.1003c673
pop ecx
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
cmp dword [ebp - 0x14], 8
push eax
mov eax, dword [ebp - 0x28]
jae 0x1003c79f
lea eax, [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.100014a0
mov ecx, dword [ebp + 8]
call fcn.10012f3f
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000289a
mov ecx, dword [ebp - 0xc]
mov al, 1
mov dword fs:[0], ecx
leave
ret
Function at 0x1003cb28
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1006d4fd
call fcn.10055640
sub esp, 0x20
push str.http:__toolbar.google.com_dc_faq_dc.html
lea ecx, [ebp - 0x2c]
call fcn.10005748
and dword [ebp - 4], 0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
cmp dword [ebp - 0x14], 8
push eax
mov eax, dword [ebp - 0x28]
jae 0x1003cb61
lea eax, [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.100014a0
mov ecx, dword [ebp + 8]
call fcn.10012f3f
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000289a
mov ecx, dword [ebp - 0xc]
mov al, 1
mov dword fs:[0], ecx
leave
ret

Function at 0x1003cb8d
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1006d4fd
call fcn.10055640
sub esp, 0x20
push str.http:__toolbar.google.com_dc_feedback.html
lea ecx, [ebp - 0x2c]
call fcn.10005748
and dword [ebp - 4], 0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, 1
cmp dword [ebp - 0x14], 8
push eax
mov eax, dword [ebp - 0x28]
jae 0x1003cbc6
lea eax, [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.100014a0
mov ecx, dword [ebp + 8]
call fcn.10012f3f
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000289a
mov ecx, dword [ebp - 0xc]
mov al, 1
mov dword fs:[0], ecx
leave
ret

Function at 0x1003cff5
Capabilities:
Delete file

Disassembly:
mov eax, 0x1006d5ee
call fcn.10055640
sub esp, 0x38
call fcn.1003b8f8
test al, al
je 0x1003d016
push str.dc_special
call fcn.1003ccb9
pop ecx
mov eax, dword [0x1009575c]
test eax, eax
je 0x1003d0b5
cmp dword [eax + 0x50], 8
jb 0x1003d02e
mov eax, dword [eax + 0x3c]
jmp 0x1003d031
add eax, 0x3c
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
push 7
pop esi
push 0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], esi
call fcn.1000205b
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], esi
call fcn.1000205b
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.100422f1
test al, al
pop ecx
je 0x1003d09a
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x40]
jae 0x1003d07b
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.10042ab5
test al, al
pop ecx
pop ecx
je 0x1003d09a
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x1003d097
lea eax, [ebp - 0x24]
push eax
call edi
call fcn.1003cbf2
push 1
lea ecx, [ebp - 0x28]
call fcn.1000289a
push 1
lea ecx, [ebp - 0x44]
call fcn.1000289a
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x1003d222
Capabilities:
Delete file

Disassembly:
mov eax, 0x1006d5b0
call fcn.10055640
sub esp, 0x24
push esi
xor esi, esi
cmp dword [0x1009575c], esi
je 0x1003d35d
call fcn.1003d0c1
mov ecx, dword [0x1009575c]
call fcn.10041fba
test al, al
jne 0x1003d28c
call fcn.1003c358
test al, al
jne 0x1003d35d
call fcn.1003c256
cmp eax, 3
jae 0x1003d35d
push 1
call fcn.1003c2b3
call fcn.1003c256
inc eax
push eax
call fcn.1003c291
pop ecx
pop ecx
call fcn.1003cbf2
jmp 0x1003d35d
push ebx
push edi
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 7
call fcn.1000205b
push 4
pop ebx
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], esi
mov esi, str.fupgrade
push esi
push dword [0x100913ac]
mov edi, SysReAllocString
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], ebx
call fcn.100087dc
add esp, 0x18
test al, al
jne 0x1003d351
lea eax, [ebp - 0x30]
push eax
push dword [0x100913bc]
call fcn.1003e16c
test al, al
pop ecx
pop ecx
je 0x1003d351
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1003d2f6
lea eax, [ebp - 0x2c]
push eax
call fcn.100565c8
cmp eax, ebx
pop ecx
jge 0x1003d351
push 3
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push esi
push dword [0x100913ac]
push edi
call fcn.1000982b
add esp, 0x18
xor bl, bl
call fcn.1003b8f8
test al, al
je 0x1003d32e
push esi
call fcn.1003ccb9
pop ecx
inc bl
mov eax, dword [0x1009575c]
cmp dword [eax + 0x50], 8
jb 0x1003d33e
mov eax, dword [eax + 0x3c]
jmp 0x1003d341
add eax, 0x3c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
je 0x1003d351
call fcn.1003cbf2
push 1
lea ecx, [ebp - 0x30]
call fcn.1000289a
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1003d764
Capabilities:
Delete file

Disassembly:
push str.uninstall
call fcn.1003ccb9
mov dword [esp], str.DCClient
push str.SoftwareGoogle
push SysReAllocString
call fcn.100098c9
add esp, 0xc
call fcn.10041fa2
mov eax, dword [0x1009575c]
test eax, eax
je 0x1003d7af
cmp dword [eax + 0x50], 8
jb 0x1003d7a0
mov eax, dword [eax + 0x3c]
jmp 0x1003d7a3
add eax, 0x3c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x1009575c]
cmp dword [eax + 0x18], 8
jb 0x1003d7ba
mov eax, dword [eax + 4]
jmp 0x1003d7bd
add eax, 4
push eax
call fcn.1004285f
pop ecx
ret
Function at 0x1003dec5
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1003def7
lea eax, [ebp - 0x208]
push 0x1007dcd0
push eax
call fcn.100564d6
pop ecx
pop ecx
push ebx
push esi
push edi
xor edi, edi
push edi
call fcn.10056b94
push eax
call fcn.100570fd
cmp word [ebp - 0x208], di
pop ecx
pop ecx
lea esi, [ebp - 0x208]
je 0x1003df20
inc esi
inc esi
cmp word [esi], di
jne 0x1003df19
push 0xa
pop ebx
call fcn.1005710a
push 0xa
cdq
pop ecx
idiv ecx
add edx, 0x30
mov word [esi], dx
inc esi
inc esi
dec ebx
jne 0x1003df23
lea eax, [ebp - 0x208]
push str._gdc.tmp
push eax
mov word [esi], di
call fcn.100564ac
cmp dword [ebp + 0x10], edi
pop ecx
pop ecx
je 0x1003dfa9
push edi
push edi
push edi
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x10]
call fcn.10037024
add esp, 0x14
test al, al
je 0x1003dfa9
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
call fcn.10058d9b
test eax, eax
pop ecx
pop ecx
je 0x1003dfa5
cmp dword [ebp + 0x14], edi
je 0x1003df96
push str.__warning:_rename_failed__
push dword [ebp + 0x14]
call fcn.1002e038
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1003dfd2
mov al, 1
jmp 0x1003dfd4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0x14], edi
je 0x1003dfd2
lea eax, [ebp - 0x208]
push eax
push str.__warning:_download_failed_____s
push dword [ebp + 0x14]
call fcn.1002e038
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003e6d4
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov eax, 0x1006d6ab
call fcn.10055640
sub esp, 0xc74
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.1000205b
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.10042261
mov eax, dword [ebp + 0xc]
pop ecx
push 8
pop esi
cmp dword [eax + 0x18], esi
jb 0x1003e716
mov eax, dword [eax + 4]
jmp 0x1003e719
add eax, 4
cmp dword [ebp - 0x14], esi
mov edx, dword [ebp - 0x28]
jae 0x1003e724
lea edx, [ebp - 0x28]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], esi
jb 0x1003e731
mov ecx, dword [ecx + 4]
jmp 0x1003e734
add ecx, 4
push eax
push edx
push ecx
lea eax, [ebp - 0xc80]
push str.http:__compute.google.com_getcurrver_taskid_sclientid_sclientver_s
push eax
call fcn.10056928
push ebx
call fcn.10036722
add esp, 0x18
test al, al
je 0x1003e885
push str.GoogleCompute
lea ecx, [ebp - 0x80]
call fcn.10005748
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.10036e57
cmp dword [eax + 0x18], esi
pop ecx
pop ecx
jb 0x1003e783
mov eax, dword [eax + 4]
jmp 0x1003e786
add eax, 4
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
push 1
lea ecx, [ebp - 0x64]
mov edi, eax
call fcn.1000289a
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.1000289a
cmp edi, ebx
je 0x1003e885
push ebx
push 0x84000300
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xc80]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
cmp esi, ebx
jne 0x1003e7db
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1003e885
push 0x400
lea eax, [ebp - 0x480]
push ebx
push eax
call fcn.10055e00
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x3ff
lea eax, [ebp - 0x480]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1003e815
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x480], bl
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x64]
call fcn.10005c35
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.100058c1
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.10002e29
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 8], esp
push dword [ebp + 0xc]
call fcn.1000570a
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x1003e870
lea eax, [ebp - 0x44]
push eax
call fcn.1003e1ca
add esp, 0x28
push 1
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.1000289a
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000289a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1003fa8b
Capabilities:
Terminate process

Disassembly:
push str.1.0.1__23_June_2000
push dword [esp + 8]
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_acm.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__21_March_2000._n_n
push 0x10092ef0
call fcn.10059a48
add esp, 0x10
push 3
call fcn.1005862e
int3

Function at 0x10041c28
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xffffffff
jne 0x10041c38
xor eax, eax
leave
ret
push ebx
push esi
push edi
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or dword [ebp - 4], 0xffffffff
xor edi, edi
push edi
push edi
mov dword [ebp - 0xc], eax
push 0x1f0fff
lea eax, [ebp - 4]
push eax
call esi
push eax
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp eax, edi
mov eax, dword [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
jne 0x10041c84
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x10041cdb
cmp dword [ebp - 8], 0x103
jne 0x10041cdb
push 0x1007e48c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp - 0x10], edi
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], edi
jne 0x10041cb8
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0xc]
push edx
push edi
push dword [ebp + 0xc]
push eax
push edi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
cmp ebx, edi
jne 0x10041ce2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x10041ce2
mov dword [ebp - 0x14], 0x42b
cmp ebx, edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], edi
je 0x10041d0d
cmp dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
jne 0x10041cfa
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call esi
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0x10], edi
je 0x10041d17
push dword [ebp - 4]
call esi
cmp dword [ebp - 0xc], edi
jne 0x10041d33
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x10041d6f
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x10041d6c
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x10041d6c
cmp dword [ebp - 8], 0x103
jne 0x10041d6c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret