joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000593b
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1000bde0]
je 0x10005956
inc edi
cmp edi, 0x17
jb 0x10005947
cmp edi, 0x17
jae 0x10005ad6
push ebp
push 3
call fcn.10008e6c
cmp eax, 1
pop ecx
je 0x10005aa2
push 3
call fcn.10008e6c
test eax, eax
pop ecx
jne 0x1000598a
cmp dword [0x1000dbd4], 1
je 0x10005aa2
cmp ebx, 0xfc
je 0x10005ad5
push 0x1000c900
mov ebx, 0x314
push ebx
mov ebp, 0x1000e208
push ebp
call fcn.10006f92
add esp, 0xc
test eax, eax
je 0x100059c0
push esi
push esi
push esi
push esi
push esi
call fcn.10002a14
add esp, 0x14
push 0x104
mov esi, 0x1000e221
push esi
push 0
mov byte [0x1000e325], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10005a04
push 0x1000c8e8
push 0x2fb
push esi
call fcn.10006f92
add esp, 0xc
test eax, eax
je 0x10005a04
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10002a14
add esp, 0x14
push esi
call fcn.10005340
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10005a49
push esi
call fcn.10005340
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1000e51c
push 0x1000c8e4
sub ecx, eax
push ecx
push eax
call fcn.10008546
add esp, 0x14
test eax, eax
je 0x10005a49
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10002a14
add esp, 0x14
jmp 0x10005a4b
xor esi, esi
push 0x1000c8e0
push ebx
push ebp
call fcn.10008487
add esp, 0xc
test eax, eax
je 0x10005a6b
push esi
push esi
push esi
push esi
push esi
call fcn.10002a14
add esp, 0x14
push dword [edi*8 + 0x1000bde4]
push ebx
push ebp
call fcn.10008487
add esp, 0xc
test eax, eax
je 0x10005a8d
push esi
push esi
push esi
push esi
push esi
call fcn.10002a14
add esp, 0x14
push 0x12010
push 0x1000c8b8
push ebp
call fcn.10008caf
add esp, 0xc
jmp 0x10005ad5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10005ad5
cmp ebp, 0xffffffff
je 0x10005ad5
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1000bde4]
push dword [esi]
call fcn.10005340
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10008caf
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10003280
xor ebx, ebx
cmp dword [0x1000e55c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10008d85
push 0x1000d2f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10008e65
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000d2e4
push edi
call esi
cmp eax, ebx
je 0x10008e65
push eax
call fcn.10003212
mov dword [esp], 0x1000d2d4
push edi
mov dword [0x1000e55c], eax
call esi
push eax
call fcn.10003212
mov dword [esp], 0x1000d2c0
push edi
mov dword [0x1000e560], eax
call esi
push eax
call fcn.10003212
mov dword [0x1000e564], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10002f53
test eax, eax
pop ecx
pop ecx
je 0x10008d53
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10002a14
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10008d85
push 0x1000d2a4
push edi
call esi
push eax
call fcn.10003212
cmp eax, ebx
pop ecx
mov dword [0x1000e56c], eax
je 0x10008d85
push 0x1000d28c
push edi
call esi
push eax
call fcn.10003212
pop ecx
mov dword [0x1000e568], eax
mov eax, dword [0x1000e568]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10008e0a
cmp dword [0x1000e56c], ecx
je 0x10008e0a
push eax
call fcn.10003289
push dword [0x1000e56c]
mov esi, eax
call fcn.10003289
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10008e0a
cmp edi, ebx
je 0x10008e0a
call esi
cmp eax, ebx
je 0x10008dd7
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10008dd7
test byte [ebp - 0x18], 1
jne 0x10008e0a
lea eax, [ebp - 0x10]
push eax
call fcn.10002f8a
test eax, eax
pop ecx
je 0x10008df2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10002a14
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10008e01
or dword [ebp + 0x10], 0x200000
jmp 0x10008e45
or dword [ebp + 0x10], 0x40000
jmp 0x10008e45
mov eax, dword [0x1000e560]
cmp eax, dword [ebp - 8]
je 0x10008e45
push eax
call fcn.10003289
cmp eax, ebx
pop ecx
je 0x10008e45
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10008e45
mov eax, dword [0x1000e564]
cmp eax, dword [ebp - 8]
je 0x10008e45
push eax
call fcn.10003289
cmp eax, ebx
pop ecx
je 0x10008e45
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1000e55c]
call fcn.10003289
cmp eax, ebx
pop ecx
je 0x10008e65
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10008e67
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x6f8907a4
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xfc155de
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100defd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100df19
test al, 0x10
jne 0x100df19
xor eax, eax
inc eax
jmp 0x100df1b
xor eax, eax
pop ebp
ret 4

Function at 0x10114d6
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov dword [esi], ebx
push esi
call edi
test eax, eax
je 0x101152d
mov eax, dword [esi]
cmp eax, ebx
je 0x101150e
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], ebx
push 0x10
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push esi
call edi
test eax, eax
jne 0x101152d
call fcn.010231b9
mov esi, eax
push esi
push 0x190f0579
jmp 0x101156c
push 8
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push esi
call edi
test eax, eax
jne 0x101154c
call fcn.010231b9
mov esi, eax
push esi
push 0x191d0579
jmp 0x101156c
lea eax, [ebp - 4]
push eax
push ebx
push 2
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x1011573
call fcn.010231b9
mov esi, eax
push esi
push 0x19250579
call fcn.0101dd77
jmp 0x1011575
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x1011583
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x101e5cf
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x103a5e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x94], edi
cmp dword [esi], edi
jne 0x101e60f
mov esi, 0x80070057
push esi
push 0x75f019a
jmp 0x101e752
push 0xf0000000
push 1
push 0x10048f0
push edi
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x101e63f
call fcn.010231b9
mov esi, eax
push esi
push 0x76e019a
jmp 0x101e752
lea eax, [ebp - 0x94]
push eax
push edi
push edi
push 0x8004
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x101e66f
call fcn.010231b9
mov esi, eax
push esi
push 0x776019a
jmp 0x101e752
push edi
push dword [esi]
push dword [esi + 4]
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x101e697
call fcn.010231b9
mov esi, eax
push esi
push 0x77e019a
jmp 0x101e752
push edi
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push dword [ebp - 0x94]
mov dword [ebp - 0x9c], 0x14
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x101e6d1
call fcn.010231b9
mov esi, eax
push esi
push 0x785019a
jmp 0x101e752
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x9c]
mov dword [ebp - 0xa0], 0x78
push 1
call fcn.01022e1e
mov esi, eax
cmp esi, edi
je 0x101e708
push esi
push 0x78f019a
jmp 0x101e752
xor edx, edx
lea eax, [ebp - 0x90]
mov ecx, eax
cmp dx, word [ebp - 0x90]
je 0x101e734
movzx edx, word [ecx]
push 0x20
pop esi
cmp si, dx
je 0x101e72b
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
xor edx, edx
cmp dx, word [ecx]
jne 0x101e71b
xor ecx, ecx
mov word [eax], cx
push ebx
lea eax, [ebp - 0x90]
push eax
call fcn.01022d77
mov esi, eax
cmp esi, edi
je 0x101e757
push esi
push 0x7a7019a
call fcn.0101dd77
cmp dword [ebp - 0x94], edi
je 0x101e76b
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x98], edi
je 0x101e780
push edi
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d1e3
leave
ret 8
Function at 0x101eb87
Capabilities:
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x103a5e4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.msvcrt.dll_iswalpha]
je 0x101ebd6
movzx eax, word [esi]
push eax
call edi
pop ecx
test eax, eax
je 0x101ebd6
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x101ebd6
xor eax, eax
cmp ax, word [esi + 4]
jne 0x101ebd6
mov eax, 0x800700a1
push eax
push 0xa05019a
jmp 0x101ec21
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x101ec03
call fcn.010231b9
mov edi, eax
push edi
push 0xa0e019a
jmp 0x101ec23
cmp dword [ebp + 0xc], 0
je 0x101ec97
cmp dword [ebp - 0x418], 0
jne 0x101ec29
mov eax, 0x800700a1
push eax
push 0xa15019a
mov edi, eax
push esi
jmp 0x101ecfb
push dword [ebp - 0x20c]
lea esi, [ebp - 0x20c]
call edi
pop ecx
push 0x5c
pop edx
test eax, eax
je 0x101ec5e
push 0x3a
pop eax
cmp ax, word [ebp - 0x20a]
jne 0x101ec5e
mov eax, edx
cmp ax, word [ebp - 0x208]
jne 0x101ec5e
lea esi, [ebp - 0x206]
jmp 0x101ec78
mov eax, edx
cmp ax, word [ebp - 0x20c]
jne 0x101ec78
cmp ax, word [ebp - 0x20a]
jne 0x101ec78
lea esi, [ebp - 0x208]
mov ecx, dword [ebp - 0x418]
cmp ecx, esi
jbe 0x101ec92
lea eax, [ecx - 2]
cmp dx, word [eax]
jne 0x101ec92
mov ecx, eax
mov dword [ebp - 0x418], ecx
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x10047d0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x101ecd6
call fcn.010231b9
push 0x80070005
mov edi, eax
push edi
push 0xa2d019a
lea eax, [ebp - 0x20c]
push eax
call fcn.0101dccb
jmp 0x101ed04
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x101ed02
call fcn.010231b9
mov edi, eax
push edi
push 0xa33019a
lea eax, [ebp - 0x414]
push eax
call fcn.0101ddb2
jmp 0x101ed04
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0101d1e3
leave
ret 8
Function at 0x101ed1b
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push esi
push dword [ebp + 8]
mov dword [edi], esi
mov dword [ebp + 0xc], esi
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
jne 0x101ed5a
call fcn.010231b9
mov ebx, eax
cmp ebx, 0x8007007a
je 0x101ed5a
push ebx
push 0xa4d019a
call fcn.0101dd77
jmp 0x101edb2
mov eax, dword [ebp + 0xc]
add eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x101ed7c
mov eax, 0x8007000e
push eax
mov ebx, eax
push 0xa55019a
jmp 0x101ed9a
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
jne 0x101eda1
call fcn.010231b9
mov ebx, eax
push ebx
push 0xa5b019a
call fcn.0101dd77
jmp 0x101eda7
mov dword [edi], esi
xor esi, esi
xor ebx, ebx
test esi, esi
je 0x101edb2
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x101fb2d
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x103a5e4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x103be18], 0
jne 0x101fbb2
push esi
xor esi, esi
lea eax, [ebp - 0x118]
inc esi
push eax
mov dword [0x103be18], esi
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x101fb7d
call fcn.010231b9
push eax
push 0x1612019a
jmp 0x101fb90
cmp dword [ebp - 0x108], 2
je 0x101fb97
push 0x4c7
push 0x1617019a
call fcn.0101dd77
jmp 0x101fbb1
cmp dword [ebp - 0x114], 5
ja 0x101fbab
jb 0x101fbb1
cmp dword [ebp - 0x110], 0
jbe 0x101fbb1
mov dword [0x103be14], esi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x103be14]
xor ecx, ebp
call fcn.0101d1e3
leave
ret

Function at 0x101fbc8
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x103a5e4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x103be1d], 0
jne 0x101fc3f
lea eax, [ebp - 0x118]
push eax
mov byte [0x103be1d], 1
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x101fc15
call fcn.010231b9
push eax
push 0x165e019a
jmp 0x101fc28
cmp dword [ebp - 0x108], 2
je 0x101fc2f
push 0x4c7
push 0x1663019a
call fcn.0101dd77
jmp 0x101fc3f
cmp dword [ebp - 0x114], 6
jb 0x101fc3f
mov byte [0x103be1c], 1
mov ecx, dword [ebp - 4]
mov al, byte [0x103be1c]
xor ecx, ebp
call fcn.0101d1e3
leave
ret
Function at 0x101fcae
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x103a5e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x101fd1a
call fcn.010231b9
mov edi, eax
push edi
push 0x17d6019a
jmp 0x101fde4
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x101fd3d
call fcn.010231b9
mov edi, eax
cmp edi, ebx
je 0x101fd3d
push edi
push 0x17de019a
jmp 0x101fde4
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xa
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x101fda1
call fcn.010231b9
mov edi, eax
cmp edi, 0x800703f0
jne 0x101fd99
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
jne 0x101fd79
call fcn.010231b9
mov edi, eax
push edi
push 0x17f0019a
jmp 0x101fde4
lea ecx, [ebp - 0x10]
push ecx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x101fda1
call fcn.010231b9
mov edi, eax
push edi
push 0x17f8019a
jmp 0x101fde4
push edi
push 0x17fd019a
jmp 0x101fde4
lea eax, [ebp - 0x18]
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x101fdc3
call fcn.010231b9
mov edi, eax
push edi
push 0x1806019a
jmp 0x101fde4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x101fdeb
call fcn.010231b9
mov edi, eax
push edi
push 0x180f019a
call fcn.0101dd77
jmp 0x101fdf5
cmp dword [ebp - 0x1c], ebx
setne al
mov byte [esi], al
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x101fe05
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x18], ebx
je 0x101fe0f
push dword [ebp - 0x18]
call esi
cmp dword [ebp - 0x14], ebx
je 0x101fe1d
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101d1e3
leave
ret 4
Function at 0x101fe7b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
cmp ebx, esi
jne 0x101feae
call fcn.010231b9
mov edi, eax
push edi
push 0x1d9f019a
call fcn.0101dd77
jmp 0x101ff85
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x101feb4
sub eax, edx
sar eax, 1
lea edi, [eax + ebx + 2]
lea eax, [edi + edi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x101fee9
mov eax, 0x8007000e
push eax
mov edi, eax
push 0x1da8019a
jmp 0x101ff6f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
ja 0x101ff59
test eax, eax
je 0x101ff59
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101fefe
sub eax, edx
push 0x5c
sar eax, 1
pop ecx
cmp cx, word [esi + eax*2 - 2]
je 0x101ff22
push 0x1003d20
push edi
push esi
call fcn.0101528e
push dword [ebp + 8]
push edi
push esi
call fcn.0101528e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x101ff55
call fcn.010231b9
mov edi, eax
push edi
push 0x1dbf019a
push esi
call fcn.0101ddb2
jmp 0x101ff74
xor edi, edi
jmp 0x101ff74
call fcn.010231b9
mov edi, eax
test edi, edi
jne 0x101ff69
mov edi, 0x8007006f
push edi
push 0x1db2019a
call fcn.0101dd77
test esi, esi
je 0x101ff7f
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], 0
jne 0x101ff8c
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10200d8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x103a5e4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, 0x1004a4c
jne 0x1020103
mov edx, 0x1004a40
push ecx
push edx
push eax
push 0x1004a28
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.010152e8
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0101d1e3
leave
ret 0xc
Function at 0x102013f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push esi
sete bl
and dword [eax], 0
push edi
mov edi, ebx
shl edi, 7
add edi, 0x103be28
cmp byte [ebx + 0x103be20], 0
jne 0x1020236
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x102018d
call fcn.010231b9
mov esi, eax
push esi
push 0x201d019a
jmp 0x10201cd
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10201aa
call fcn.010231b9
mov esi, eax
push esi
push 0x2025019a
jmp 0x10201cd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x10201d4
call fcn.010231b9
mov esi, eax
test esi, esi
jne 0x10201c7
mov esi, 0x8007000d
push esi
push 0x2031019a
call fcn.0101dd77
jmp 0x102023d
push 0x1004a6c
lea eax, [esi + 6]
push eax
call fcn.0101fe35
test eax, eax
je 0x10201ed
mov esi, 0x8007000d
jmp 0x102023d
cmp byte [ebp + 0xc], 0
je 0x1020208
movzx eax, word [esi + 0x34]
push eax
movzx eax, word [esi + 0x36]
push eax
movzx eax, word [esi + 0x30]
push eax
movzx eax, word [esi + 0x32]
jmp 0x102021b
movzx eax, word [esi + 0x3c]
push eax
movzx eax, word [esi + 0x3e]
push eax
movzx eax, word [esi + 0x38]
push eax
movzx eax, word [esi + 0x3a]
push eax
push 0x1004a54
push 0x40
push edi
call fcn.01015347
add esp, 0x1c
xchg dword [ebp + 0xc], eax
mov byte [ebx + 0x103be20], 1
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1023835
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor ebx, ebx
push 0x38
lea eax, [ebp - 0x44]
push ebx
push eax
mov dword [ebp - 8], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
xor eax, eax
add esp, 0xc
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x48], 0x3c
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x1023878
mov esi, dword [sym.imp.WININET.dll_InternetCrackUrlW]
sub eax, ecx
lea ecx, [ebp - 0x48]
push ecx
push ebx
sar eax, 1
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x10238ad
call fcn.010231b9
mov edi, eax
push edi
push 0x49b01ca
jmp 0x10239d1
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 8]
push eax
call fcn.01023794
mov edi, eax
cmp edi, ebx
je 0x10238cf
push edi
push 0x4a401ca
jmp 0x10239d1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 8]
push eax
call fcn.01023794
mov edi, eax
cmp edi, ebx
je 0x10238f1
push edi
push 0x4a701ca
jmp 0x10239d1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.01023794
mov edi, eax
cmp edi, ebx
je 0x1023913
push edi
push 0x4aa01ca
jmp 0x10239d1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call fcn.01023794
mov edi, eax
cmp edi, ebx
je 0x1023935
push edi
push 0x4ad01ca
jmp 0x10239d1
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x102393b
lea ecx, [ebp - 0x48]
push ecx
sub eax, edx
push 0x80000000
sar eax, 1
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x102396b
call fcn.010231b9
mov edi, eax
push edi
push 0x4b401ca
jmp 0x10239d1
mov dword [ebp - 0xc], ebx
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.WININET.dll_InternetCreateUrlW]
test eax, eax
jne 0x1023998
call fcn.010231b9
mov edi, eax
cmp edi, 0x8007007a
jne 0x10239b2
cmp esi, ebx
jne 0x10239b2
cmp esi, ebx
jne 0x10239ba
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x10239c6
shr dword [ebp - 0xc], 1
jmp 0x102396e
push edi
push 0x4cf01ca
jmp 0x10239d1
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [ebp - 4], ebx
xor edi, edi
jmp 0x10239d6
mov edi, 0x8007000e
push edi
push 0x4dc01ca
call fcn.0101dd77
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x40], ebx
je 0x10239e6
push dword [ebp - 0x44]
call esi
cmp dword [ebp - 0x34], ebx
je 0x10239f0
push dword [ebp - 0x38]
call esi
cmp dword [ebp - 0x18], ebx
je 0x10239fa
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x10], ebx
je 0x1023a04
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 4], ebx
je 0x1023a0e
push dword [ebp - 4]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8