joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10089960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec9f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.WebUIController.0
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
call fcn.10002710
mov ebx, eax
test ebx, ebx
je 0x10089a8b
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi + 0x18], eax
mov dword [ebp - 4], 1
call fcn.10002710
mov ebx, eax
test ebx, ebx
je 0x10089a95
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi + 0x1c], eax
mov dword [ebp - 4], 2
call fcn.10002710
mov ebx, eax
test ebx, ebx
je 0x10089a9f
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi + 0x2c], eax
mov dword [ebp - 4], 3
call fcn.10002710
mov ebx, eax
test ebx, ebx
je 0x10089aa9
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x34], 0
mov dword [edi + 0x28], eax
mov eax, edi
mov dword [edi + 0x24], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0xc], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10002de0
push 0x80004005
call fcn.10002de0
push 0x80004005
call fcn.10002de0
push 0x80004005
call fcn.10002de0
int3
Function at 0x10090d50
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ed640
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
test eax, eax
je 0x10090dac
cmp word [eax], 0
je 0x10090dac
add eax, 0xfffffff0
push eax
call fcn.10004440
add esp, 4
lea ecx, [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0
call fcn.10002710
mov edi, eax
test edi, edi
je 0x10090efb
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0x64
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x63
or eax, ecx
mov dword [ebp - 4], 1
jge 0x10090e06
push 0x63
lea ecx, [ebp - 0x10]
call fcn.10003450
mov esi, dword [ebp - 0x10]
cmp dword [esi - 8], 0x63
jl 0x10090ef1
xor eax, eax
mov dword [esi - 0xc], 0x63
mov word [esi + 0xc6], ax
lea eax, [ebp - 0x14]
push eax
push esi
push 8
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10090e80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x20]
call fcn.10004b50
cmp dword [ebp - 0x1c], 0xea
mov byte [ebp - 4], 2
jne 0x10090f05
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
dec eax
push eax
call fcn.10047ce0
push eax
push 8
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x10090f1f
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.10004430
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
jne 0x10090e94
push dword [esi - 8]
push esi
call fcn.1001174c
add esp, 8
test eax, eax
js 0x10090ef1
cmp eax, dword [esi - 8]
jg 0x10090ef1
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
add esi, 0xfffffff0
push esi
call fcn.10004440
mov ebx, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [ebx], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10090edb
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10002de0
push 0x80004005
call fcn.10002de0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10004100
push 0x10126738
lea eax, [ebp - 0x2c]
push eax
call fcn.10006a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x2c]
push eax
call fcn.10006a50
int3
Function at 0x10094e10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x10094e6e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x10094e30
mov eax, dword [edi]
jmp 0x10094f59
cmp eax, 0x4e0
jb 0x10094f59
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10094e90
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10094ee0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100994e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ee499
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x10], 0
call fcn.100446b0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 2
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 1
push dword [ebp + 0xc]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100995d1
mov edi, dword [ebp - 0x10]
sub edi, 1
js 0x100995e7
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x10099577
push edi
mov ecx, esi
call fcn.10003450
mov ecx, dword [esi]
cmp edi, dword [ecx - 8]
jg 0x100995e7
mov dword [ecx - 0xc], edi
xor edx, edx
mov eax, dword [esi]
mov word [eax + edi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
push 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x100995f1
mov eax, dword [esi]
test eax, eax
jne 0x100995ad
xor ecx, ecx
jmp 0x100995bf
push dword [eax - 8]
push eax
call fcn.1001174c
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x100995e7
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x100995e7
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.10002de0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x20]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x20]
push eax
call fcn.10006a50
int3
Function at 0x10099610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ee4c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x20]
call fcn.100446b0
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push edi
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
je 0x10099746
cmp esi, 3
je 0x10099746
test esi, esi
je 0x10099694
push edi
push str.Error_accessing_Windows_Registry_key___s_
push 0
call fcn.10045440
push esi
push 0
call fcn.10044880
add esp, 0x14
jmp 0x10099756
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 2
push ebx
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
cmp esi, 2
je 0x10099733
cmp esi, 3
je 0x10099733
test esi, esi
je 0x100996e8
push ebx
push edi
push str.Error_accessing_Windows_Registry_key_Value___s_s__to_get_size
push 0
call fcn.10045440
push esi
push 0
call fcn.10044880
add esp, 0x18
jmp 0x10099756
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100996f2
shr eax, 1
dec eax
mov ecx, dword [ebp + 0x14]
push eax
call fcn.10047ce0
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
push 2
push ebx
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, dword [ebp + 0x14]
push 0xffffffffffffffff
mov dword [ebp - 0x1c], eax
call fcn.10048470
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x1009972f
push ebx
push edi
push str.Error_accessing_Windows_Registry_key_Value___s_s_
jmp 0x100996d4
mov bl, 1
jmp 0x10099758
push ebx
push edi
push str.Could_not_find_Windows_Registry_key_Value___s_s_
push 0
call fcn.10045440
add esp, 0x10
jmp 0x10099756
push edi
push str.Could_not_find_Windows_Registry_key___s_
push 0
call fcn.10045440
add esp, 0xc
xor bl, bl
mov ecx, dword [ebp - 0x20]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009977f
mov edi, dword [ecx]
push ecx
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100997b0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push str.Entered_HashCAPI::Create
push 0
mov esi, ecx
call fcn.10045430
add esp, 8
push esi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10099805
mov eax, dword [ebp + 0x14]
push 0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
push eax
push ecx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
pop esi
test eax, eax
jne 0x100997ff
push str.CryptHashData_is_failed
jmp 0x1009980a
mov esp, ebp
pop ebp
ret 0x10
push str.CryptCreateHash_is_failed
push dword [ebp + 8]
call fcn.10045430
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0xc]
push eax
call fcn.10006a50
int3
Function at 0x1009d6f0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x30]
mov ecx, esi
call fcn.100491d0
movzx edi, al
mov ecx, esi
neg edi
sbb edi, edi
and edi, 0x800000
call fcn.100491d0
test al, al
je 0x1009d738
mov eax, dword [ebx]
push 0x800
push 0x54
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
lea esi, [ebx + 0x30]
push 0xd
mov ecx, ebx
call fcn.1007ece0
cmp dword [ebx + 0x40], 0
je 0x1009d7a0
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.100493b0
push edi
push 0
push 0
push 0
push dword [eax]
push dword [ebx + 0x10]
push dword [ebx + 0x40]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x44], eax
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009d791
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
cmp dword [ebx + 0x44], 0
je 0x1009d7a7
push 0xe
mov ecx, ebx
call fcn.1007ece0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x10]
push eax
call fcn.10006a50
int3
Function at 0x1009db10
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb79
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002710
mov edi, eax
test edi, edi
je 0x1009dc5e
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 1
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1009dc48
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x1009dc68
shr esi, 1
sub esi, 1
js 0x1009dc83
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x1009dbe0
push esi
mov ecx, edi
call fcn.10003450
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x1009dc83
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x1009dc25
push dword [ecx - 8]
push ecx
call fcn.1001174c
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1009dc83
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x1009dc83
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x1009dc48
push esi
push 0x100f6204
mov ecx, edi
call fcn.10003530
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10002de0
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100043d0
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.10006a50
push 0x80070057
call fcn.10002de0
int3
Function at 0x1009dc90
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeba8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov eax, dword [ebp + 8]
add eax, edi
cmp eax, 0xa00000
jg 0x1009dd2a
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push esi
push eax
mov ecx, esi
call fcn.1009d300
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
add eax, edi
mov dword [ebp - 0x14], 0
push eax
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1009dd45
mov eax, dword [ebp - 0x14]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.100494b0
push 0xa
mov ecx, ebx
call fcn.1007ece0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x24]
call fcn.100043d0
push 0x1012ad98
lea eax, [ebp - 0x24]
push eax
call fcn.10006a50
push 0x100f6204
lea ecx, [ebp - 0x18]
call fcn.10025bc0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x38]
call fcn.10077fa0
push 0x1012bb4c
lea eax, [ebp - 0x38]
push eax
call fcn.10006a50
int3
Function at 0x1009e1b0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec38
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.100493d0
test eax, eax
jne 0x1009e1ed
xor edi, edi
jmp 0x1009e1f7
lea ecx, [ebx + 0x30]
call fcn.100493d0
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.10049180
mov esi, dword [eax]
mov ecx, 0x101448a8
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.10098c50
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009e25f
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x1009e292
push 0x1009ea40
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x1009e2c6
push 2
mov ecx, ebx
call fcn.1007ece0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.10025bc0
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.10077fa0
push 0x1012bb4c
lea eax, [ebp - 0x28]
push eax
call fcn.10006a50
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.10025bc0
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.10077fa0
push 0x1012bb4c
lea eax, [ebp - 0x3c]
push eax
call fcn.10006a50
int3
Function at 0x1009e5e0
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x1009e631
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e661
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax]
cmp ecx, eax
jb 0x1009e6b0
cmp ecx, edx
jb 0x1009e6b0
test eax, eax
je 0x1009e651
cmp ecx, 0xa00000
ja 0x1009e695
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.10025bc0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.10077fa0
push 0x1012bb4c
lea eax, [ebp - 0x34]
push eax
call fcn.10006a50
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100043d0
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.10006a50
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.100043d0
push 0x1012ad98
lea eax, [ebp - 0x2c]
push eax
call fcn.10006a50
int3

Function at 0x1009e850
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov ecx, dword [ebp + 8]
lea eax, [edi + ecx]
cmp eax, edi
jl 0x1009e8f1
cmp eax, ecx
jl 0x1009e8f1
cmp eax, 0xa00000
jg 0x1009e8f8
push esi
push eax
mov ecx, esi
call fcn.100494b0
mov eax, dword [esi]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1009e8c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e913
mov eax, dword [ebx + 0x40]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.100494b0
push 0xa
mov ecx, ebx
call fcn.1007ece0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x1009e8fd
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.100043d0
push 0x1012ad98
lea eax, [ebp - 0x1c]
push eax
call fcn.10006a50
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.10025bc0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.10077fa0
push 0x1012bb4c
lea eax, [ebp - 0x30]
push eax
call fcn.10006a50
int3
Function at 0x100a8d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push 1
push 1
push eax
call fcn.100c828a
add esp, 0x10
cmp eax, 1
sete al
pop ebp
ret

Function at 0x100acf30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1013d0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x38], 0
je 0x100acfef
cmp byte [ebx + 0x3d], 0
je 0x100acfef
mov eax, dword [ebx]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x100acfa5
push edi
mov edi, dword [ebx + 0x38]
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
call dword [0x100f4524]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x100acfb7
sub eax, 1
je 0x100acfbb
sub eax, 2
je 0x100acfef
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x100acfd8
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.100c828a
add esp, 0x10
cmp esi, eax
jne 0x100acfa5
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.100055f3
mov esp, ebp
pop ebp
ret