joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002f00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x2a
lea ecx, [fcn.10002f00]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10002f33
mov eax, 0x1e0d
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x10002f19
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10002f19
mov eax, dword [ebp - 0x10]
mov dword [0x100d33e8], eax
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret

Function at 0x10003100
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x100d33f0], 0
mov dword [0x100d33f4], 0
mov dword [0x100d3400], 0
mov dword [0x100d33ec], 0x1d00
mov dword [0x100d33e8], 0x24ab
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x10003262
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x100d33f0]
mov esi, eax
add esi, 1
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x100d33f0], edx
mov dword [0x100d33e8], 0x11eb
mov edi, dword [0x100d33f4]
mov ebx, dword [ebp - 0x1c]
movzx edx, byte [ebx + edx]
add edx, edi
mov eax, edx
cdq
idiv ecx
mov dword [0x100d33f4], edx
mov ecx, dword [0x100d33e8]
add ecx, 0x1cfe
mov dword [0x100d33ec], ecx
mov ecx, dword [0x100d33f0]
mov cl, byte [ebx + ecx]
mov byte [0x100d33f8], cl
mov dword [0x100d33e8], 0x7d5
mov edx, dword [0x100d33f4]
mov cl, byte [ebx + edx]
mov edx, dword [0x100d33f0]
mov byte [ebx + edx], cl
mov cl, byte [0x100d33f8]
mov edx, dword [0x100d33f4]
mov byte [ebx + edx], cl
mov dword [0x100d33ec], 0x2207
mov edx, dword [0x100d33f0]
movzx edx, byte [ebx + edx]
mov edi, dword [0x100d33f4]
movzx edi, byte [ebx + edi]
add edi, edx
and edi, 0xff
mov dword [0x100d3400], edi
mov cl, byte [ebx + edi]
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x24]
movzx edx, byte [edx + edi]
mov dword [esp], edx
movzx edx, cl
mov dword [esp + 4], edx
mov dword [ebp - 0x28], esi
call fcn.10001000
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
mov byte [edx + esi], al
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x10]
cmp edi, ebx
mov dword [ebp - 0x20], edi
jne 0x10003163
mov eax, dword [0x100d33e8]
add eax, 0xfffff597
mov dword [0x100d33e8], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100036e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x2c
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x100d33e8], 0x6a9
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x100d33ec], 0x9a7
mov esi, dword [0x100d33e8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
jmp 0x10003798
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [0x100d33e8], ecx
mov dword [0x100d33ec], 0x85f
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
je 0x100037e0
jmp 0x10003840
mov dword [0x100d33e8], 0x144b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000381a
jmp 0x10003840
mov dword [0x100d33ec], 0x18d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x100037fb
jmp 0x10003840
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffbee
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], esi
je 0x1000372a
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jl 0x10003798
jmp 0x1000372a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
cmp ax, 0x6f
je 0x1000377a
jmp 0x10003840
mov dword [0x100d33ec], 0xfffff24c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10003758
jmp 0x10003840
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10003840
mov eax, 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x30], eax
je 0x10003847
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10003847
mov eax, dword [ebp - 0x30]
add esp, 0x2c
pop esi
pop ebp
ret
Function at 0x1002e160
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013d0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x102
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x214], eax
mov dword [eax], 1
je 0x1002e294
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push 0x10
mov dword [ebp - 0x208], ebx
mov esi, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1b7
or ebx, 0x10000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1d4
mov ebx, esi
or ebx, 0x20000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e1ef
mov ebx, esi
or ebx, 0x40000
mov dword [ebp - 0x208], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10143cdc]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10144758]
cmp eax, dword [ecx + 4]
jg 0x1002e2a6
movzx eax, bl
xor eax, 0x811c9dc5
mov edx, dword [0x1014473c]
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp - 0x206]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x205]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul esi, ecx, 0x1000193
mov ecx, dword [0x10144744]
and esi, dword [0x10144750]
mov edi, dword [ecx + esi*8]
mov eax, edi
nop
cmp edi, edx
jne 0x1002e268
mov ecx, edx
jmp 0x1002e26e
mov ecx, dword [ecx + esi*8 + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002e291
cmp dword [eax + 8], ebx
je 0x1002e281
mov eax, dword [eax]
mov ecx, dword [0x10144744]
jmp 0x1002e260
cmp eax, edx
je 0x1002e291
mov eax, dword [ebp - 0x214]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 0x20
push 0x10144758
call fcn.10080750
add esp, 4
cmp dword [0x10144758], 0xffffffff
jne 0x1002e210
mov ecx, 0x80
mov dword [0x10144738], 0
mov esi, 0x100ff040
mov dword [0x1014473c], 0
lea edi, [ebp - 0x204]
mov dword [0x10144740], 0
rep movsd dword es:[edi], dword [esi]
push 0
push 0
mov ecx, 0x1014473c
call fcn.10080750
push 8
mov ecx, 0x10144738
mov dword [0x1014473c], eax
mov dword [0x10144744], 0
mov dword [0x10144748], 0
mov dword [0x1014474c], 0
mov dword [0x10144738], 0x3f800000
call fcn.10080750
lea edi, [ebp - 0x204]
jmp 0x1002e340
mov eax, dword [0x1014473c]
mov ecx, 0x1014473c
push edi
mov esi, dword [eax]
mov eax, dword [esi + 4]
push eax
push esi
mov dword [ebp - 0x20c], eax
call fcn.10080750
mov edx, dword [0x10144740]
mov ecx, 0x15555554
sub ecx, edx
mov dword [ebp - 0x210], eax
cmp ecx, 1
jb 0x1002e3d0
mov ecx, dword [ebp - 0x210]
inc edx
mov dword [0x10144740], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x20c]
mov dword [eax], ecx
mov ecx, 0x10144738
mov eax, dword [0x1014473c]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10080750
add edi, 4
lea eax, [ebp - 4]
cmp edi, eax
jne 0x1002e340
push 0x100f22d0
call fcn.10080750
push 0x10144758
call fcn.10080750
add esp, 8
jmp 0x1002e210
push str.list_T__too_long
call fcn.10080750
int3
Function at 0x1009d6f0
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x30]
mov ecx, esi
call fcn.100491d0
movzx edi, al
mov ecx, esi
neg edi
sbb edi, edi
and edi, 0x800000
call fcn.100491d0
test al, al
je 0x1009d738
mov eax, dword [ebx]
push 0x800
push 0x54
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
lea esi, [ebx + 0x30]
push 0xd
mov ecx, ebx
call fcn.10080750
cmp dword [ebx + 0x40], 0
je 0x1009d7a0
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.10080750
push edi
push 0
push 0
push 0
push dword [eax]
push dword [ebx + 0x10]
push dword [ebx + 0x40]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x44], eax
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009d791
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
cmp dword [ebx + 0x44], 0
je 0x1009d7a7
push 0xe
mov ecx, ebx
call fcn.10080750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.10080750
push 0x10126738
lea eax, [ebp - 0x10]
push eax
call fcn.10080750
int3
Function at 0x1009db10
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb79
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002710
mov edi, eax
test edi, edi
je 0x1009dc5e
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 0x14], 1
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1009dc48
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x1009dc68
shr esi, 1
sub esi, 1
js 0x1009dc83
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x1009dbe0
push esi
mov ecx, edi
call fcn.10080750
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x1009dc83
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x1009dc25
push dword [ecx - 8]
push ecx
call fcn.10080750
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1009dc83
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x1009dc83
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x1009dc48
push esi
push 0x100f6204
mov ecx, edi
call fcn.10080750
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10080750
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.10080750
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.10080750
push 0x80070057
call fcn.10080750
int3
Function at 0x1009dc90
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeba8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov eax, dword [ebp + 8]
add eax, edi
cmp eax, 0xa00000
jg 0x1009dd2a
lea ecx, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push ecx
push esi
push eax
mov ecx, esi
call fcn.10080750
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
add eax, edi
mov dword [ebp - 0x14], 0
push eax
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1009dd45
mov eax, dword [ebp - 0x14]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.10080750
push 0xa
mov ecx, ebx
call fcn.10080750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x24]
call fcn.10080750
push 0x1012ad98
lea eax, [ebp - 0x24]
push eax
call fcn.10080750
push 0x100f6204
lea ecx, [ebp - 0x18]
call fcn.10080750
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x38]
call fcn.10080750
push 0x1012bb4c
lea eax, [ebp - 0x38]
push eax
call fcn.10080750
int3
Function at 0x1009e1b0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec38
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.100493d0
test eax, eax
jne 0x1009e1ed
xor edi, edi
jmp 0x1009e1f7
lea ecx, [ebx + 0x30]
call fcn.100493d0
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.10080750
mov esi, dword [eax]
mov ecx, 0x101448a8
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.10080750
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1009e25f
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x1009e292
push 0x1009ea40
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x1009e2c6
push 2
mov ecx, ebx
call fcn.10080750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.10080750
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.10080750
push 0x1012bb4c
lea eax, [ebp - 0x28]
push eax
call fcn.10080750
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.10080750
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.10080750
push 0x1012bb4c
lea eax, [ebp - 0x3c]
push eax
call fcn.10080750
int3
Function at 0x1009e5e0
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x1009e631
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e661
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax]
cmp ecx, eax
jb 0x1009e6b0
cmp ecx, edx
jb 0x1009e6b0
test eax, eax
je 0x1009e651
cmp ecx, 0xa00000
ja 0x1009e695
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.10080750
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.10080750
push 0x1012bb4c
lea eax, [ebp - 0x34]
push eax
call fcn.10080750
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.10080750
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.10080750
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.10080750
push 0x1012ad98
lea eax, [ebp - 0x2c]
push eax
call fcn.10080750
int3

Function at 0x1009e850
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov ecx, dword [ebp + 8]
lea eax, [edi + ecx]
cmp eax, edi
jl 0x1009e8f1
cmp eax, ecx
jl 0x1009e8f1
cmp eax, 0xa00000
jg 0x1009e8f8
push esi
push eax
mov ecx, esi
call fcn.10080750
mov eax, dword [esi]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1009e8c6
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e913
mov eax, dword [ebx + 0x40]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.10080750
push 0xa
mov ecx, ebx
call fcn.10080750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x1009e8fd
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.10080750
push 0x1012ad98
lea eax, [ebp - 0x1c]
push eax
call fcn.10080750
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.10080750
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.10080750
push 0x1012bb4c
lea eax, [ebp - 0x30]
push eax
call fcn.10080750
int3
Function at 0x2580f5a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x2580f5b8
pop dword [ebp - 0x14]
mov eax, 0x2580f5b8
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x93477e80
sub dword [ebp - 0x24], 0x44f53935
mov dword [ebp - 0x20], 0xb61db540
add dword [ebp - 0x20], 0x7c159705
mov dword [ebp - 0x1c], 0xf220f283
add dword [ebp - 0x1c], 0x5a2b51ab
mov dword [ebp - 0x18], 0xd6e0a764
sub dword [ebp - 0x18], 0xd6e0a764
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa83c0c3a
add dword [ebp - 0x24], 0xcc365d1c
mov dword [ebp - 0x20], 0x12da99ca
sub dword [ebp - 0x20], 0xd16e3855
mov dword [ebp - 0x1c], 0xc8b86a81
add dword [ebp - 0x1c], 0x9ab701eb
mov dword [ebp - 0x18], 0xd956f2c1
sub dword [ebp - 0x18], 0xd956f2c1
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x355fb9fc
sub eax, 0xfdde97c
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae58
push 0
call eax
mov ecx, 0xc07928a3
sub ecx, 0xc078e86c
mov esi, eax
mov edx, 0x6da54e72
add edx, 0xb7dd478e
add edx, dword [ebp - 0x14]
mov edi, 0x8bca6294
mov dword [ebp - 4], 0x210acdc3
mov ebx, dword [edx]
xor dword [ebp - 0xc], esi
sub ebx, edi
xor dword [ebp - 0x10], eax
mov dword [esi], ebx
mov dword [ebp - 8], 0x3e79f7c1
add esi, 0x8ece9756
sub esi, 0x8ece9752
add edx, 0x8ecbab88
add edx, 0x7134547c
loop 0x2580f6ca
add eax, 0xf3af
mov ebx, eax
add eax, 5
mov ecx, 0xc5045899
add ecx, 0x607ba767
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x408498
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x4084ed
push dword [esp + 0x10]
push 0x408417
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x41e568]
test esi, esi
je 0x408546
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4084e5
cmp byte [esi + 0x10], 0
je 0x4084e5
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4084c1
jmp 0x408546
mov esi, dword [0x41e568]
test esi, esi
je 0x408546
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x40853f
cmp byte [esi + 0x11], 0
je 0x40851b
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x408532
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x41e568
call fcn.00416ab7
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x4084fa
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4090d5
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x41ed40]
call fcn.004163ee
mov ebx, eax
test ebx, ebx
je 0x409139
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4090fe
push dword [esp + 0xc]
push ebx
call eax
jmp 0x409139
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00417560
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.00417630
pop edi
pop esi
pop ebx
ret 8
Function at 0x409569
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4096df
mov eax, dword [esp + 0x24]
dec eax
je 0x4096c2
dec eax
jne 0x4096df
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.00409522
pop ecx
test eax, eax
je 0x409620
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x4095e3
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x4096be
dec ebx
je 0x4096ba
dec ebx
je 0x409699
dec ebx
je 0x409653
sub ebx, 4
jne 0x4096df
test edi, edi
jne 0x4096df
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x4096df
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x4095e3
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x4095de
sub edi, 0
je 0x40968b
dec edi
je 0x40967d
dec edi
je 0x40966f
dec edi
jne 0x4096df
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x4096df
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x4096df
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x4096df
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x4096df
sub edi, 0
je 0x4096b6
dec edi
je 0x4096b2
dec edi
jne 0x4096df
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x4096df
push 0x3c
jmp 0x4096de
push 0x32
jmp 0x4096de
push 0x14
jmp 0x4096de
push 5
jmp 0x4096de
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4096dc
cmp eax, 0xa
je 0x4096d8
cmp eax, 0x5a
jne 0x4096df
push 0x28
jmp 0x4096de
push 0x1e
jmp 0x4096de
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret