joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10080e66
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
cmp ax, 0x7b29
sub esp, 0xffffffa8
je 0x1006f367
cmp cx, 0x4209
shl ecx, 8
cmc
movzx eax, byte [eax + str.cw]
cmp al, bh
stc
clc
test ch, ch
or ecx, eax
sete al
movzx eax, bl
bt sp, ax
clc
pushfd
mov word [esp], 0xe9a6
shl ecx, 8
test bx, 0x693b
cmp ah, dl
stc
shr ebx, 0x18
push 0xa309938c
cmp dl, al
mov byte [esp], 0x12
movzx eax, byte [eax + str.cw]
stc
cmp di, dx
or ecx, eax
rcl ax, 0xc
rol al, 2
test dh, 0x8a
pushal
mov eax, dword [ebp - 8]
clc
push ebp
xor ecx, dword [edi + 0x18]
push dword [esp]
pushfd
pushfd
lea esp, [esp + 0x38]
jmp 0x100699eb

Function at 0x10081b37
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp byte [eax + 0xd], 0
pushal
pushfd
mov dword [esp + 8], eax
lea esp, [esp + 0x2c]
jne 0x10080758
pushal
mov edx, dword [edx]
push dword [esp]
stc
bt sp, bx
nop
call fcn.1007dac5

Function at 0x10081bae
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
shrd si, sp, 9
bswap esi
sub esi, 0xa631dc8f
shr eax, 8
lea esi, [ebp + 0x3eea9828]
xor si, 0x347f
movzx eax, al
bsf ax, bx
bsr ax, ax
mov eax, dword [ebp - 4]
pushfd
xor ecx, dword [edi + 0x10]
jmp 0x10075601
cmp dl, 0x10
clc
shr eax, 0x18
clc
test bh, ch
clc
clc
mov dword [edx], ecx
bts cx, 0xa
bts cx, ax
test esi, 0xfa023106
movzx ecx, byte [eax + str.cw]
lahf
rcr ah, 1
test dl, 0x30
and ah, bl
mov eax, dword [ebp + 0xc]
test dh, dl
stc
shr eax, 0x10
pushal
mov word [esp + 4], 0xe49
jmp 0x10081a9b
movzx eax, al
cmc
stc
test dx, si
shl ecx, 8
stc
cmp cx, 0x6d50
movzx eax, byte [eax + str.cw]
bt si, ax
or ecx, eax
movsx ax, bl
mov eax, ebx
push 0x6dec8e77
lea esp, [esp + 0x38]
jmp 0x10067530
jmp 0x10068727
Function at 0x10001370
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x100a8810]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100013b6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.10053b60
add esp, 0x1a0
ret
mov esi, dword [sym.imp.WS2_32.dll_gethostbyname]
push str.tqos.gamesafe.qq.com
call esi
test eax, eax
je 0x100013d7
mov ebx, eax
mov edi, 0x100b2bfc
call fcn.10001300
test eax, eax
je 0x100013f4
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.10053b60
add esp, 0x1a0
ret
push str.tqos.gamesafe.qq.com
call esi
test eax, eax
je 0x1000140f
mov ebx, eax
mov edi, 0x100b2bec
call fcn.10001300
test eax, eax
je 0x1000142c
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.10053b60
add esp, 0x1a0
ret
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10053b60
add esp, 0x1a0
ret

Function at 0x10001470
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
cmp dword [0x100b2c00], 0
je 0x10001482
cmp dword [0x100b2bf0], 0
jne 0x1000148f
call fcn.10001370
test eax, eax
je 0x1000148f
or eax, 0xffffffff
ret
mov eax, dword [0x100abcb4]
cmp eax, 0xffffffff
jne 0x100014b5
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x100abcb4], eax
cmp eax, 0xffffffff
jne 0x100014b5
mov eax, 0xfffffffe
ret
cmp byte [esp + 0xc], 0
mov ecx, 0x100b2bfc
jne 0x100014c6
mov ecx, 0x100b2bec
mov edx, dword [esp + 4]
push 0x10
push ecx
mov ecx, dword [esp + 0x10]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x100014fd
mov eax, dword [0x100abcb4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x100abcb4], 0xffffffff
mov eax, 0xfffffffd
ret
xor eax, eax
ret

Function at 0x10003150
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebp
push esi
push edi
xor esi, esi
xor edx, edx
xor eax, eax
mov ecx, ebx
mov edi, 0x100
mov dword [ecx], eax
inc eax
add ecx, 4
sub edi, 1
jne 0x10003161
mov ecx, ebx
mov dword [esp + 0xc], 0x100
jmp 0x10003180
mov eax, dword [esp + 0x14]
movzx ax, byte [edx + eax]
add ax, word [ecx]
mov edi, dword [ecx]
add ax, si
mov esi, 0xff
and ax, si
movzx esi, ax
movzx eax, si
mov ebp, dword [ebx + eax*4]
lea eax, [ebx + eax*4]
mov dword [ecx], ebp
mov dword [eax], edi
lea eax, [edx + 1]
xor edx, edx
div dword [esp + 0x18]
add ecx, 4
sub dword [esp + 0xc], 1
jne 0x10003180
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x100031d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
cmp dword [esp + 0x14], ecx
jbe 0x10003218
push ebx
inc ecx
and ecx, 0xff
mov edx, dword [eax + ecx*4]
add esi, edx
and esi, 0xff
mov ebx, dword [eax + esi*4]
mov dword [eax + ecx*4], ebx
mov dword [eax + esi*4], edx
mov ebx, dword [eax + ecx*4]
add ebx, edx
and ebx, 0xff
mov dl, byte [eax + ebx*4]
xor byte [edi + ebp], dl
inc edi
cmp edi, dword [esp + 0x18]
jb 0x100031e4
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x100042e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push closesocket
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004348
push edi
lea ecx, [esp + 0xc]
push ecx
push 2
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10004341
cmp dword [esp + 8], 2
jne 0x10004341
xor ecx, ecx
mov eax, 0x5a4d
cmp ax, word [esp + 0xc]
sete cl
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x100085c0
Capabilities:
Execute syscall

Disassembly:
lea edx, [esp + 8]
int 0x2e
ret
Function at 0x100108d0
Capabilities:
Check if file exists

Disassembly:
cmp dword [ecx + 0x1c], 0x10
jb 0x100108e6
mov ecx, dword [ecx + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
inc eax
ret
add ecx, 8
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x10010900
Capabilities:
Check if file exists

Disassembly:
cmp dword [ecx + 0x1c], 0x10
jb 0x10010917
mov ecx, dword [ecx + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
neg eax
ret
add ecx, 8
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x10010930
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0x10
jb 0x1001093e
mov eax, dword [esi + 8]
jmp 0x10010941
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10010953
mov eax, 1
pop esi
ret
cmp dword [esi + 0x1c], 0x10
jb 0x1001095e
mov eax, dword [esi + 8]
jmp 0x10010961
lea eax, [esi + 8]
push eax
call fcn.10035e30
add esp, 4
test eax, eax
je 0x10010973
cmp eax, dword [esi + 0x68]
jne 0x1001094c
xor eax, eax
pop esi
ret

Function at 0x10010980
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0x10
jb 0x1001098e
mov eax, dword [esi + 8]
jmp 0x10010991
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100109c3
cmp dword [esi + 0x1c], 0x10
jb 0x100109a7
mov eax, dword [esi + 8]
jmp 0x100109aa
lea eax, [esi + 8]
push eax
call fcn.10035e30
add esp, 4
test eax, eax
je 0x100109c3
cmp eax, dword [esi + 0x68]
jne 0x100109c3
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x100109d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x204
mov eax, dword [0x100a8810]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
push edi
push 0x1fe
lea eax, [esp + 0xd]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x14], 0
call fcn.10054210
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
call edi
mov eax, 0x10
cmp dword [esi + 0x54], eax
jb 0x10010a18
mov ecx, dword [esi + 0x40]
jmp 0x10010a1b
lea ecx, [esi + 0x40]
cmp dword [esi + 0x1c], eax
jb 0x10010a25
mov eax, dword [esi + 8]
jmp 0x10010a28
lea eax, [esi + 8]
push 0x1ff
lea edx, [esp + 0xc]
push edx
push ecx
push eax
call fcn.10004bf0
add esp, 0x10
call edi
cmp byte [esp + 8], 0
je 0x10010a9e
lea eax, [esp + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10010a50
push 4
sub eax, edx
inc eax
push 0x1000
push eax
push 0
mov dword [esi + 0x5c], eax
call fcn.100bb62e
mov dword [esi + 0x58], eax
test eax, eax
je 0x10010a9e
mov edx, dword [esi + 0x5c]
lea ecx, [esp + 8]
push ecx
push edx
push eax
call fcn.10004860
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.10053b60
add esp, 0x204
ret
mov ecx, dword [esp + 0x208]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10053b60
add esp, 0x204
ret
Function at 0x100111e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
mov eax, dword [0x100a8810]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
xor ebx, ebx
push 0x103
lea eax, [esp + 0x11]
push ebx
push eax
mov byte [esp + 0x18], bl
call fcn.10054210
add esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp + 8], ebx
cmp dword [0x100ad190], ebx
je 0x1001122a
cmp dword [0x100ad194], ebx
jne 0x100112d2
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x100112d2
push 0x103
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100112d2
push ebx
lea edx, [esp + 0x10]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [esp + 4], eax
cmp eax, ebx
jbe 0x100112d2
push esi
push eax
call fcn.100535c2
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x100112d1
mov eax, dword [esp + 8]
push esi
push eax
push ebx
lea ecx, [esp + 0x1c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push 0x1008e560
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 8]
mov dword [0x100ad190], ecx
mov eax, dword [eax + 0xc]
mov dword [0x100ad194], eax
cmp ecx, ebx
je 0x100112c2
mov dword [0x100ad198], 1
cmp eax, ebx
jne 0x100112c8
mov dword [0x100ad198], ebx
push esi
call fcn.10054ba8
add esp, 4
pop esi
mov ecx, dword [esp + 0x110]
pop ebx
xor ecx, esp
call fcn.10053b60
add esp, 0x110
ret
Function at 0x10011360
Capabilities:
Get file version info

Disassembly:
sub esp, 0x218
mov eax, dword [0x100a8810]
xor eax, esp
mov dword [esp + 0x214], eax
push edi
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.10054210
push 0x103
lea ecx, [esp + 0x125]
push 0
push ecx
mov byte [esp + 0x12c], 0
call fcn.10054210
add esp, 0x18
push 0x104
lea ecx, [esp + 0x14]
push ecx
xor edx, edx
xor eax, eax
push str.ntdll.dll
mov word [esp + 0x10], dx
mov word [esp + 0x12], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea edx, [esp + 0x14]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x100114c4
push esi
push edi
call fcn.100535c2
mov esi, eax
add esp, 4
test esi, esi
je 0x100114c3
push esi
push edi
push 0
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x100114ba
mov ecx, 0x409
lea eax, [esp + 0x10]
push eax
mov word [esp + 0xc], cx
lea ecx, [esp + 0x10]
push ecx
push str.VarFileInfoTranslation
mov edx, 0x4b0
push esi
mov word [esp + 0x1a], dx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10011454
cmp dword [esp + 0x10], 4
jb 0x10011454
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
mov dword [esp + 8], eax
jmp 0x10011458
mov eax, dword [esp + 8]
shr eax, 0x10
push eax
movzx eax, word [esp + 0xc]
push eax
push str.StringFileInfo_04x_04xFileVersion
lea ecx, [esp + 0x124]
push 0x104
push ecx
call fcn.100049b0
add esp, 0x14
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x120]
push ecx
push esi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0xc]
movsx edx, byte [eax]
sub edx, 0x30
mov dword [0x100ad1a0], edx
movsx eax, byte [eax + 2]
sub eax, 0x30
mov dword [0x100ad1a4], eax
mov dword [0x100ad19c], 1
push esi
call fcn.10054ba8
add esp, 4
pop esi
mov ecx, dword [esp + 0x218]
pop edi
xor ecx, esp
call fcn.10053b60
add esp, 0x218
ret
Function at 0x10026b00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x10089c20
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a8810]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], 0
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
lea esi, [edi + edi + 2]
cmp esi, ebx
mov dword [esp + 0x18], edi
jge 0x10026b9b
lea ecx, [esi*8]
sub ecx, esi
lea eax, [ebp + ecx*4]
lea edx, [eax - 0x1c]
push edx
push eax
call dword [esp + 0x1c]
add esp, 8
test al, al
je 0x10026b6d
dec esi
push 0xffffffffffffffff
lea eax, [esi*8]
sub eax, esi
lea ecx, [ebp + eax*4]
push 0
lea edx, [edi*8]
sub edx, edi
push ecx
lea ecx, [ebp + edx*4]
call fcn.100059f0
mov edi, esi
lea esi, [esi + esi + 2]
cmp esi, ebx
jl 0x10026b4f
jne 0x10026bc4
push 0xffffffffffffffff
lea eax, [ebx*8]
sub eax, ebx
lea ecx, [ebp + eax*4 - 0x1c]
push 0
lea edx, [edi*8]
sub edx, edi
push ecx
lea ecx, [ebp + edx*4]
call fcn.100059f0
lea edi, [ebx - 1]
mov eax, dword [esp + 0x14]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x60]
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], 0
push edx
mov byte [ecx + 4], 0
call fcn.100059f0
mov byte [esp + 0x44], 1
mov eax, dword [esp + 0x38]
push eax
push edi
push ebp
mov byte [esp + 0x50], 0
call fcn.10026950
add esp, 0x2c
mov dword [esp + 0x24], 0xffffffff
cmp dword [esp + 0x50], 0x10
jb 0x10026c28
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.10053c4b
add esp, 4
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10027cb0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x10089df0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a8810]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov ebp, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push ebp
push edi
xor ebx, ebx
push eax
mov byte [edi], bl
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, edi
lea edx, [eax + 1]
jmp 0x10027d00
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10027d00
sub eax, edx
je 0x10027d71
mov eax, edi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10027d20
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.10005b10
mov dword [esp + 0x3c], ebx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 8]
call fcn.10025a50
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x30], 0x10
jb 0x10027d61
mov edx, dword [esp + 0x1c]
push edx
call fcn.10053c4b
add esp, 4
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x44]
push ebp
push edi
push eax
mov byte [edi], bl
call dword [sym.imp.USER32.dll_GetClassNameA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10027d85
sub eax, edx
je 0x10027df7
mov ebp, 0xf
mov eax, edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10027da6
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.10005b10
mov dword [esp + 0x3c], 1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 8]
call fcn.10025a50
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x30], 0x10
jb 0x10027deb
mov edx, dword [esp + 0x1c]
push edx
call fcn.10053c4b
add esp, 4
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x44]
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call ebp
mov esi, eax
cmp esi, ebx
je 0x10027e2b
lea esp, [esp]
mov ecx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x18]
push edi
push esi
call fcn.10027cb0
push 2
push esi
call ebp
mov esi, eax
cmp esi, ebx
jne 0x10027e10
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x10027eb0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push esi
push 0x10027ae0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, esi
call fcn.10027e50
mov ebx, dword [esi + 0x18]
add esi, 8
cmp dword [esi + 0xc], ebx
jbe 0x10027edc
call fcn.10054b41
mov edi, dword [esi + 0xc]
mov ebp, dword [esi]
cmp edi, dword [esi + 0x10]
jbe 0x10027eeb
call fcn.10054b41
mov eax, dword [esi]
test ebp, ebp
je 0x10027ef5
cmp ebp, eax
je 0x10027efa
call fcn.10054b41
mov ecx, ebx
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
push 0x10026920
add eax, edx
push eax
push ebx
push edi
call fcn.10027930
mov edi, dword [esi + 0x10]
add esp, 0x10
cmp dword [esi + 0xc], edi
jbe 0x10027f2e
call fcn.10054b41
mov ebp, dword [esi + 0xc]
mov ebx, dword [esi]
cmp ebp, dword [esi + 0x10]
jbe 0x10027f3d
call fcn.10054b41
push 0x100268f0
push edi
push ebp
mov dword [esp + 0x20], edi
call fcn.10026a90
add esp, 0xc
push eax
push ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.10027280
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x10028901
Capabilities:
Get http content length

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 0
call fcn.100286e0
test eax, eax
jne 0x10028924
call int.10128f27
test eax, eax
jne 0x10028924
mov dword [esi + 0xc], eax
pop esi
pop ecx
ret
mov ecx, dword [esi + 0x14]
push edi
push 0
lea eax, [esp + 0xc]
push eax
lea edi, [esi + 0xc]
push edi
push 0x20000005
push ecx
mov dword [esp + 0x1c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1002894d
mov dword [edi], eax
mov eax, dword [edi]
pop edi
pop esi
pop ecx
ret
Function at 0x10028e20
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x110
mov eax, dword [0x100a8810]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push edi
push 0x103
xor edi, edi
lea eax, [esp + 0x15]
push edi
push eax
mov ebx, ecx
mov byte [esp + 0x1c], 0
call fcn.10054210
add esp, 0xc
push 0x104
lea ecx, [esp + 0x14]
push ecx
push 0x1008e564
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10028e75
sub eax, edx
jne 0x10028e97
pop edi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.10053b60
add esp, 0x110
ret
push ebp
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x1008e560
push 0x104
lea eax, [esp + 0x1c]
push eax
call fcn.10004920
mov ecx, dword [str.singlesign.dat]
push ecx
push 0x104
lea edx, [esp + 0x1c]
push edx
call fcn.10004920
push edi
push 0x80
push 3
push edi
push 1
push closesocket
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10028f5b
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
je 0x10028f53
push esi
call fcn.100535c2
add esp, 4
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
mov edi, eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10028f2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10028f46
cmp esi, dword [esp + 0x14]
jne 0x10028f46
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push esi
push edi
mov ecx, ebx
call eax
mov dword [esp + 0x10], 1
test edi, edi
je 0x10028f53
push edi
call fcn.10053c4b
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 0xc]
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.10053b60
add esp, 0x110
ret

Function at 0x1002c350
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebp
push edi
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 1
push closesocket
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1002c3ec
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x1c]
mov dword [ebx], eax
cmp eax, ebp
je 0x1002c3eb
push esi
push 0x40
push 0x1000
push eax
push ebp
call fcn.100bb62e
mov esi, eax
test esi, esi
je 0x1002c3ea
mov edx, dword [ebx]
push ebp
lea ecx, [esp + 0x14]
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebx]
cmp dword [esp + 0x10], eax
jne 0x1002c3dd
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
push 4
push ebx
push eax
push esi
call fcn.1002c310
xor eax, eax
cmp dword [ebx], eax
setne al
mov ebp, eax
push 0x8000
push 0
push esi
call fcn.100dabb2
pop esi
pop ebx
test edi, edi
je 0x1002c3f7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop ebp
add esp, 8
ret 0xc
Function at 0x1002c430
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
xor edi, edi
lea esi, [ebx + 4]
lea ebx, [ebx]
push 8
push edi
mov ecx, ebx
call fcn.1002c220
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov edx, eax
and edx, 0x80000000
neg edx
sbb edx, edx
and edx, 0x4c11db7
add eax, eax
xor edx, eax
mov ecx, edx
push 0x20
push ecx
mov ecx, ebx
call fcn.1002c220
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0xff
jle 0x1002c440
pop edi
pop esi
pop ebx
ret