joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
or edx, 0xffffffff
push ebx
push ebp
push esi
push edi
lea edi, [eax + 8]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
xor ebp, ebp
mov dword [esp + 0x1c], ecx
mov esi, edi
mov dword [esp + 0x18], 0
lea ecx, [eax*8 + 8]
test ecx, ecx
je 0x411d9c
movzx eax, byte [esi]
lea esi, [esi + 1]
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x418b80]
sub ecx, 1
jne 0x411d82
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 4]
cmp edx, eax
je 0x411dd5
or dword [0x429040], 0x20000400
push eax
push edx
push str.Mismatched_struct_checksum_for_head_slab___computed__X___read__X
push 1
push 0x429048
mov dword [edi], ebp
mov dword [ecx], ebp
call fcn.00404d90
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
mov ebx, dword [ecx]
mov dword [ecx], ebp
test ebx, ebx
je 0x411f49
mov esi, dword [esp + 0x3c]
xor edi, edi
nop word [eax + eax]
mov eax, ebp
mov dword [esp + 0x20], 0
inc ebp
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
cmp eax, 0x400
jae 0x411f2a
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push 0x10
push eax
push ebx
call fcn.00405c60
test eax, eax
je 0x411f16
mov eax, dword [esp + 0x28]
cmp eax, esi
ja 0x411ef2
lea esi, [eax*8 + 0x10]
push esi
call fcn.00414ef8
mov ecx, dword [esp + 0x20]
add esp, 4
mov edi, eax
push esi
push edi
push ebx
call fcn.00405c60
test eax, eax
je 0x411edf
mov ecx, dword [edi + 8]
lea edx, [edi + 8]
or eax, 0xffffffff
lea esi, [ecx*8 + 8]
test esi, esi
je 0x411e9a
nop dword [eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x418b80]
sub esi, 1
jne 0x411e80
mov ecx, dword [edi + 4]
cmp eax, ecx
jne 0x411ebf
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x14], edi
mov dword [ecx], edi
mov eax, dword [edi]
mov dword [edi], 0
mov edi, eax
mov dword [esp + 0x18], eax
jmp 0x411f16
or dword [0x429040], 0x20000400
push ecx
push eax
push str.Mismatched_struct_checksum_for_intermediate_slab___computed__X___read__X
push 1
push 0x429048
call fcn.00404d90
add esp, 0x14
push edi
call fcn.00414613
mov edi, dword [esp + 0x1c]
add esp, 4
mov esi, dword [esp + 0x3c]
jmp 0x411f16
push esi
push eax
push ebx
push str.Slab_at__p_did_not_pass_sanity_check___read__d___max_expected__d
push 1
lfence
or dword [0x429040], 0x20000800
push 0x429048
call fcn.00404d90
add esp, 0x18
mov ebx, edi
test edi, edi
jne 0x411df0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
or dword [0x429040], 0x20000800
push ebp
push str.Slab_list_did_not_pass_sanity_check___list_too_long___stopping_after__d_elements
push 1
push 0x429048
call fcn.00404d90
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0x70aac15
add eax, 0xf9357051
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xd585fb54
add dword [ebp - 0x50], 0x78cc49f7
mov dword [ebp - 0x4c], 0xfd1cea02
sub dword [ebp - 0x4c], 0xcae99dbd
mov dword [ebp - 0x48], 0xfd031d67
add dword [ebp - 0x48], 0x4f4926c7
mov dword [ebp - 0x44], 0x4e068f69
add dword [ebp - 0x44], 0xb1f97097
lea eax, [ebp - 0x50]
push eax
mov eax, 0x91601a09
sub eax, 0x911fe9b5
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xd85691e6
sub dword [ebp - 0x50], 0x63e42890
mov dword [ebp - 0x4c], 0x2b194bb4
sub dword [ebp - 0x4c], 0xe9acea3f
mov dword [ebp - 0x48], 0xea0ea45
add dword [ebp - 0x48], 0x54ce8227
mov dword [ebp - 0x44], 0xcb3f0026
sub dword [ebp - 0x44], 0xcb3f0026
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3429e
push 0
call eax
mov ecx, 0x30ef496
add ecx, 0xfcf14a25
mov esi, eax
mov edx, str.SVZ4_S
add edx, dword [ebp - 0x40]
mov edi, 0x56fb2eb0
add dword [ebp - 0x10], 0xaf26e6e6
mov ebx, dword [edx]
sub dword [ebp - 0x10], eax
add ebx, edi
mov dword [esi], ebx
xor dword [ebp - 0x3c], 0xe162a2d
add esi, 0x2ce85a70
add esi, 0xd317a594
add edx, 0x1de48e08
add edx, 0xe21b71fc
loop 0x401d77
add eax, 0x868422b4
sub eax, 0x868334f5
mov ebx, eax
add eax, 0x4f513e9e
sub eax, 0x4f513e99
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1001ec1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1001ec29
pop dword [ebp - 0x18]
mov eax, 0x4f5ea2e2
sub eax, 0x3f5cb6b9
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x23b8c9a
add dword [ebp - 0x28], 0x4c16b8b1
mov dword [ebp - 0x24], 0xe9eafb9f
add dword [ebp - 0x24], 0x484850a6
mov dword [ebp - 0x20], 0x548effd5
sub dword [ebp - 0x20], 0x842bba7
mov dword [ebp - 0x1c], 0xb64162c8
add dword [ebp - 0x1c], 0x49be9d38
lea eax, [ebp - 0x28]
push eax
mov eax, 0xd8e2379c
sub eax, 0xc8e03798
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xcc6a4a41
add dword [ebp - 0x28], 0xa8081f15
mov dword [ebp - 0x24], 0xc35b9c8c
add dword [ebp - 0x24], 0x7e10c4e9
mov dword [ebp - 0x20], 0x2b09ffaa
sub dword [ebp - 0x20], 0xc79a933e
mov dword [ebp - 0x1c], 0x66c87643
sub dword [ebp - 0x1c], 0x66c87643
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3a496
push 0
call eax
mov ecx, 0x37c778f0
add ecx, 0xc838c5d9
mov edx, eax
mov ebx, 0x5aaf4894
add ebx, 0xb553736c
add ebx, dword [ebp - 0x18]
mov esi, 0xe5531f28
sub esi, 0xb12dcb7e
mov edi, dword [ebx]
sub dword [ebp - 0xc], 0x1de8abd5
xor edi, esi
mov dword [ebp - 8], 0x5ffa2613
mov dword [edx], edi
add edx, 0xa7c8ae03
sub edx, 0xa7c8adff
add ebx, 4
loop 0x1001ed46
add eax, 0xedf7
xor ebx, ebx
add ebx, eax
add eax, 0xcd63e950
sub eax, 0xcd63e94b
mov ecx, 0xfe03f21e
add ecx, 0x11fc0de2
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401c66
pop dword [ebp - 0x38]
mov eax, 0x401c66
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x55b3fb62
sub dword [ebp - 0x48], 0x761b617
mov dword [ebp - 0x44], 0xb8a244a8
sub dword [ebp - 0x44], 0x866ef863
mov dword [ebp - 0x40], 0xfc0b7201
sub dword [ebp - 0x40], 0xafbf2dd3
mov dword [ebp - 0x3c], 0x2951c43d
sub dword [ebp - 0x3c], 0x2951c43d
lea eax, [ebp - 0x48]
push eax
mov eax, 0xde88b055
add eax, 0x21b77fff
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x6a2fb752
sub dword [ebp - 0x48], 0xf5bd4dfc
mov dword [ebp - 0x44], 0x74fda40
add dword [ebp - 0x44], 0x3a1c8735
mov dword [ebp - 0x40], 0x262df41d
add dword [ebp - 0x40], 0x3d41784f
mov dword [ebp - 0x3c], 0x52889f88
sub dword [ebp - 0x3c], 0x52889f88
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x6f48606c
add eax, 0x90f7cfc0
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3413a
push 0
call eax
mov ecx, 0x3e62
mov esi, eax
mov edx, 0x407000
add edx, dword [ebp - 0x38]
mov edi, 0x52c77c62
sub edi, 0x8e6c40c8
add dword [ebp - 0x2c], ebx
mov ebx, dword [edx]
add dword [ebp - 0xc], esi
xor ebx, edi
mov dword [ebp - 0x30], 0xd65af9d7
mov dword [esi], ebx
add esi, 0x60d0d897
sub esi, 0x60d0d893
add edx, 0x48eed2e6
sub edx, 0x48eed2e2
loop 0x401d77
add eax, 0x519a0bde
sub eax, 0x51991f83
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x40102f
Capabilities:
Query environment variable

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
je 0x401052
push 0x104
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401052
mov bl, 1
mov al, bl
pop ebx
ret
Function at 0x401953
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x403405
call fcn.0040265b
mov eax, dword [ebp + 8]
push 0x104
push eax
xor edi, edi
push edi
push edi
xor ecx, ecx
push 0x404810
mov word [eax], cx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x4019c7
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__NULL__pPath__MAX_PATH_
call fcn.00402497
pop ecx
pop ecx
push edi
push esi
call main
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.00402205
push eax
push esi
push 0x4044ac
call fcn.00402497
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x4019c0
ret
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x401a78
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x401a24
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x40198b
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x401a78
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x401a78
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x40198b
mov eax, esi
call fcn.00402691
ret

Function at 0x4024e1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406040]
jne 0x4024eb
repz ret
jmp fcn.004029fa
Function at 0x4029f0
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x404b88
call fcn.00402b10
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x406448], ebx
jne 0x40278b
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x40643c
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x4027c5
cmp eax, esi
jne 0x4027b8
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x4027c8
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x40279f
xor esi, esi
inc esi
mov eax, dword [0x406438]
cmp eax, esi
jne 0x4027db
push 0x1f
call sub.msvcr100.dll__amsg_exit
pop ecx
jmp 0x402816
mov eax, dword [0x406438]
test eax, eax
jne 0x402810
mov dword [0x406438], esi
push 0x4041b0
push 0x4041a4
call sub.msvcr100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x402816
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402930
mov dword [0x4060f0], esi
mov eax, dword [0x406438]
cmp eax, esi
jne 0x40283a
push 0x4041a0
push 0x404190
call sub.msvcr100.dll__initterm
pop ecx
pop ecx
mov dword [0x406438], 2
cmp dword [ebp - 0x24], ebx
jne 0x402847
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40644c], ebx
je 0x402868
push 0x40644c
call main
pop ecx
test eax, eax
je 0x402868
push ebx
push 2
push ebx
call dword [0x40644c]
mov eax, dword [sym.imp.msvcr100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4028c1
cmp al, bl
je 0x402881
cmp dword [ebp - 0x1c], ebx
jne 0x4028c1
mov al, byte [esi]
cmp al, bl
je 0x402891
cmp al, 0x20
ja 0x402891
inc esi
mov dword [ebp - 0x20], esi
jmp 0x402881
test byte [ebp - 0x40], 1
je 0x40289d
movzx eax, word [ebp - 0x3c]
jmp 0x4028a0
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x4060ec], eax
cmp dword [0x4060e0], ebx
jne 0x402916
push eax
call dword [sym.imp.msvcr100.dll_exit]
cmp al, 0x22
jne 0x4028d0
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcr100.dll__ismbblead]
pop ecx
test eax, eax
je 0x4028e3
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x40286f
cmp dword [0x4060f0], ebx
jne 0x402924
call dword [sym.imp.msvcr100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4060ec]
call fcn.00402b55
ret
call main
jmp 0x40275d
Function at 0x4031a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4031b0
pop dword [ebp - 0x44]
mov eax, 0x4031b0
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xa5448282
sub dword [ebp - 0x54], 0x56f23d37
mov dword [ebp - 0x50], 0x7c1d273c
add dword [ebp - 0x50], 0xb6162509
mov dword [ebp - 0x4c], 0x48238f27
sub dword [ebp - 0x4c], 0xfbd74af9
mov dword [ebp - 0x48], 0x6b46ba8a
sub dword [ebp - 0x48], 0x6b46ba8a
lea eax, [ebp - 0x54]
push eax
mov eax, 0xa14b613a
add eax, 0x5ef4df32
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xdac629e5
add dword [ebp - 0x54], 0x99ac3f71
mov dword [ebp - 0x50], 0xbdb37fd9
add dword [ebp - 0x50], 0x83b8e19c
mov dword [ebp - 0x4c], 0x39dff1a0
sub dword [ebp - 0x4c], 0xd6708534
mov dword [ebp - 0x48], 0xc5027c3d
add dword [ebp - 0x48], 0x3afd83c3
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x363cc
push 0
call eax
mov ecx, 0x4674
xor edi, edi
add edi, eax
mov edx, 0x6814b047
sub edx, 0x67d3a847
add edx, dword [ebp - 0x44]
mov esi, 0x3d81da3d
sub esi, 0xdd121e76
sub dword [ebp - 0x2c], 0x980be2d5
mov ebx, dword [edx]
add dword [ebp - 0x3c], eax
sub ebx, esi
xor dword [ebp - 0x20], 0x30d1ee04
mov dword [edi], ebx
sub dword [ebp - 0x40], ebx
add edi, 0xc3f49f7b
add edi, 0x3c0b6089
add edx, 4
loop 0x4032c4
add eax, 0x65105cfa
sub eax, 0x650f5057
xor ebx, ebx
add ebx, eax
add eax, 0xa77d9ea7
add eax, 0x5882615e
mov ecx, 0x4595657b
sub ecx, 0x4555657b
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100137df
Capabilities:
Generate random numbers via winapi

Disassembly:
call fcn.100b0a27
sub byte [eax], al
add byte [eax - 0x64846fe], al
sub esp, dword [ebx + 0x14]
xchg esp, eax
or esi, dword [ebp + 0xd508a03]
sbb eax, 0x6e64b0a0
dec ebx
jae 0x1001385c
dec edi
lds esi, [edx - 0x7b1f398d]
out dx, al
out dx, eax
ljmp 0xfdb3
mov ebp, esp
push esi
xor esi, esi
cmp dword [0x10120740], 1
je 0x10013871
mov esi, 0x8000ffff
jmp 0x10013899
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [0x10120730]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x100138be
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10023238
mov esi, eax
test esi, esi
jge 0x100138be
mov eax, dword [0x1011faf4]
cmp eax, 0x1011faf4
je 0x100138be
test byte [eax + 0x3c], 2
je 0x100138be
push esi
push 0x100034d8
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.10023238
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x41d6ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], 0x80
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
mov byte [ebp - 0x793], 0x8a
mov byte [ebp - 0x792], 0x9c
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
mov byte [ebp - 0x78d], 0xef
call fcn.0041ba8e
jg 0x41d784
mov ebx, 0x8d0c6a3e
test dword [eax + edi*8 - 1], esp
call dword [eax - 0x18]
push eax
jecxz 0x41d74c
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x550]
lea eax, [ebp + eax - 0x654]
push eax
call fcn.0041b9ff
add esp, 0xc
lea eax, [ebp - 0x654]
mov dword [ebp - 0x3a0], eax
jmp 0x41da06
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.0041ba9e
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.0041b9ff
add esp, 0xc
jmp 0x41da06
Function at 0x1002f691
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor edx, edx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebx], edx
test ecx, ecx
je 0x1002f6ce
mov eax, dword [esi + 4]
cmp eax, 4
je 0x1002f6b4
cmp eax, 5
jne 0x1002f6ce
cmp dword [esi + 0x98], edx
jne 0x1002f6e2
sub eax, 4
je 0x1002f6d7
sub eax, 1
jne 0x1002f6ce
mov eax, dword [esi + 0x78]
mov dword [ebx], eax
mov dword [esi + 0x78], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esi + 0x9c], eax
jmp 0x1002f6ce
mov cl, byte [esi + 0x7c]
test cl, cl
je 0x1002f6ce
cmp eax, 5
jne 0x1002f6ce
lea edi, [esi + 0xa0]
cmp dword [edi], edx
jne 0x1002f756
push dword [esi + 0x64]
push str.call_InternetWriteFile_0x_08x__n
push 7
push 0xc
call fcn.1001ea75
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push edx
call dword [eax + 0x24]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov byte [esi + 0x7c], al
test al, al
je 0x1002f740
push dword [esi + 0x64]
push str.InternetWriteFile_0x_08x__completed_synchronously_n
push 7
push 0xc
call fcn.1001ea75
add esp, 0x10
mov al, byte [esi + 0x7c]
xor edx, edx
mov cl, al
test al, al
je 0x1002f756
cmp dword [edi], edx
jne 0x1002f756
mov ecx, dword [ebp + 0xc]
mov dword [edi], ecx
mov cl, al
test cl, cl
je 0x1002f775
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi]
sub dword [esi + 0x78], eax
mov dword [edi], edx
je 0x1002f775
mov ecx, dword [esi + 0x48]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x1002f6ce
movsx eax, byte [esi + 0x7c]
push ecx
push edx
push eax
lea ecx, [esi + 0x34]
call fcn.1006b86c
jmp 0x1002f6d0
Function at 0x1002f789
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov edx, dword [ebp + 8]
lea edi, [esi + 0x60]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi]
mov dword [eax], ecx
cmp dword [esi + 4], 8
je 0x1002f7b4
cmp dword [esi + 4], 7
jne 0x1002f7d2
xor ebx, ebx
test ecx, ecx
je 0x1002f7d9
mov ecx, dword [esi + 0x48]
mov dword [esi + 0xa4], ebx
mov dword [edi], ebx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov byte [eax + ecx], bl
xor eax, eax
jmp 0x1002f887
cmp dword [esi + 0xa4], ebx
jne 0x1002f7d2
push dword [esi + 0x64]
push str.call_InternetReadFile_0x_08x__n
push 7
push 0xc
call fcn.1001ea75
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x2c]
push edi
push 0x1000
push eax
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetReadFile]
push dword [esi + 0x64]
test eax, eax
je 0x1002f862
push dword [edi]
push str.received__d_bytes_from_0x_08x_n
push 7
push 0xc
call fcn.1001ea75
mov ecx, dword [edi]
add esp, 0x14
test ecx, ecx
jne 0x1002f83d
mov dword [esi + 4], 9
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esi + 0x48]
mov dword [edi], ebx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0xc]
push ebx
mov ecx, dword [ecx]
mov byte [eax + ecx], bl
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x1002f7d2
push str.InternetReadFile_on_0x_08x_returned_FALSE_n
push 7
push 0xc
call fcn.1001ea75
add esp, 0xc
mov dword [esi + 0xa4], 1
lea ecx, [esi + 0x34]
push ebx
push ebx
call fcn.1006b86c
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10032bfe
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x100a3d44
call fcn.1009de72
mov ebx, ecx
mov dword [ebp - 0x228], ebx
lea ecx, [ebx + 4]
mov dword [ebp - 0x230], ebx
call dword [sym.imp.fpsrvutl.dll_Ordinal_4936]
and dword [ebp - 4], 0
lea edi, [ebx + 8]
mov ecx, edi
call dword [sym.imp.fpsrvutl.dll_Ordinal_2954]
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 1
xorps xmm0, xmm0
lea ecx, [ebx + 0x10]
push eax
movlpd qword [ebp - 0x22c], xmm0
call dword [sym.imp.fpsrvutl.dll_Ordinal_1581]
push 0x1c
mov byte [ebx + 0xc], 0
call fcn.1006b86c
mov esi, eax
pop ecx
mov dword [ebp - 0x228], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x10032ca1
movsd xmm0, qword [0x100c7b58]
push 0
push 1
push ecx
push ecx
movsd qword [esp], xmm0
mov ecx, esi
push 0x10035494
push 0x100354a9
push 0x10035502
push 0x10031614
push 0
call dword [sym.imp.fpsrvutl.dll_Ordinal_5937]
jmp 0x10032ca3
xor esi, esi
mov byte [ebp - 4], 1
push 0x20
mov dword [ebx + 0x20], esi
call fcn.1006b86c
pop ecx
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x10032cca
mov ecx, eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5744]
jmp 0x10032ccc
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebx], eax
lea eax, [ebp - 0x21c]
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10032e13
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x224]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5312]
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 4
call dword [sym.imp.fpsrvutl.dll_Ordinal_3213]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x224]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x10032d32
push 0x100b4c6c
lea ecx, [ebp - 0x224]
call dword [sym.imp.fpsrvutl.dll_Ordinal_3702]
lea eax, [ebp - 0x224]
mov ecx, edi
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_985]
push str.MicrosoftWebsiteCache_
lea ecx, [ebp - 0x220]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5241]
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 5
push eax
mov ecx, edi
call dword [sym.imp.fpsrvutl.dll_Ordinal_1682]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x220]
mov edi, dword [sym.imp.fpsrvutl.dll_Ordinal_2017]
call edi
push dword [ebx + 8]
lea ecx, [ebx + 4]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5525]
push str.Websites.xml
lea ecx, [ebp - 0x220]
call dword [sym.imp.fpsrvutl.dll_Ordinal_2836]
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebx + 4]
call dword [sym.imp.fpsrvutl.dll_Ordinal_2202]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x220]
mov esi, dword [sym.imp.fpsrvutl.dll_Ordinal_3409]
call esi
push dword [ebx + 8]
lea ecx, [ebp - 0x220]
call dword [sym.imp.fpsrvutl.dll_Ordinal_150]
push eax
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 7
call dword [sym.imp.fpsrvutl.dll_Ordinal_4804]
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 9
call esi
push 0
push 0
lea ecx, [ebp - 0x240]
call dword [sym.imp.fpsrvutl.dll_Ordinal_3988]
mov ecx, ebx
call fcn.1003324e
lea ecx, [ebp - 0x240]
call dword [sym.imp.fpsrvutl.dll_Ordinal_974]
lea ecx, [ebp - 0x224]
call edi
jmp 0x10032e17
mov byte [ebx + 0xc], 1
mov eax, ebx
call fcn.1009de27
ret