joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18073041
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1822b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x18073064
xor eax, eax
jmp 0x1807312b
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x18073090
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x18073090
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x18073123
cmp dword [esi + 0x4c], 0
je 0x18073127
mov ecx, esi
call fcn.18073d76
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x180730b0
push dword [esi + 0x4c]
push eax
jmp 0x180730ea
mov byte [ebp - 0x28], al
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x18073127
cmp eax, 1
jle 0x180730fa
cmp eax, 3
jne 0x18073127
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.180699ba
pop ecx
pop ecx
test al, al
jne 0x18073123
or ebx, 0xffffffff
jmp 0x18073123
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x18073117
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1819b3d1
add esp, 0x10
cmp edi, eax
jne 0x18073127
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x18073127
mov eax, ebx
jmp 0x1807312a
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.181605f4
leave
ret 4

Function at 0x18073dc4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1822b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x18073e1d
cmp byte [esi + 0x3d], bl
je 0x18073e1d
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x18073e56
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x18073e2e
sub eax, 1
je 0x18073e31
dec eax
sub eax, 1
jne 0x18073e56
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181605f4
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x18073e4e
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1819b3d1
add esp, 0x10
cmp edi, eax
jne 0x18073e56
cmp byte [esi + 0x3d], bl
sete al
jmp 0x18073e1f
xor al, al
jmp 0x18073e1f
Function at 0x1807e50f
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
call fcn.1801c0e3
mov edi, eax
call fcn.18010678
xor ebx, ebx
push ebx
push 0x989680
push edx
push eax
call fcn.18199990
mov ecx, str.HKLMSoftwareMicrosoftEdgeUpdate_
lea esi, [eax + 0x49ef6f00]
cmp byte [ebp - 0xc], bl
jne 0x1807e54b
mov ecx, str.HKCUSoftwareMicrosoftEdgeUpdate_
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 4
mov edx, str.RetryAfter
call fcn.18017b9b
mov ecx, dword [ebp - 8]
add esp, 0xc
test eax, eax
jns 0x1807e56b
mov ecx, ebx
cmp esi, ecx
jae 0x1807e579
lea eax, [esi + 0x15180]
cmp ecx, eax
jbe 0x1807e5c8
push ebx
lea eax, [ebp - 2]
mov byte [ebp - 2], bl
push eax
mov ecx, edi
call fcn.1801d76e
mov esi, eax
test esi, esi
jne 0x1807e5cf
movzx ecx, byte [0x182340f3]
neg ecx
sbb ecx, ecx
and ecx, 0x18233ff0
je 0x1807e5c8
push 7
pop edx
inc eax
mov dword [ebp - 0x1c], ecx
push eax
push edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.18008a16
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push str._ShouldCheckForUpdates_returned_0__checks_disabled_
push eax
call fcn.18006b74
pop ecx
pop ecx
xor al, al
jmp 0x1807e667
push dword [ebp - 0xc]
call fcn.1801d9eb
mov edi, eax
call fcn.1801c0e3
push ebx
lea ecx, [ebp - 1]
mov dword [ebp - 0x18], ebx
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push ecx
mov ecx, eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 1], bl
call fcn.1801ecbc
test eax, eax
js 0x1807e603
cmp byte [ebp - 1], bl
jne 0x1807e665
cmp edi, esi
jl 0x1807e665
lea eax, [esi + 0xe10]
cmp edi, eax
jge 0x1807e663
cmp byte [ebp - 2], bl
jne 0x1807e663
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 4
mov edx, str.DisableUpdateAppsHourlyJitter
mov ecx, str.HKLMSoftwareMicrosoftEdgeUpdateDev_
call fcn.18017b9b
add esp, 0xc
test eax, eax
js 0x1807e63b
cmp dword [ebp - 0xc], ebx
jne 0x1807e663
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
movzx eax, al
neg eax
push 0x64
sbb eax, eax
xor edx, edx
and eax, dword [ebp - 0xc]
pop ecx
div ecx
cmp edx, 0x5a
setb bl
jmp 0x1807e665
mov bl, 1
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1808341c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 4]
push edi
call fcn.18009d8f
push str.F3C4FE00_EFD5_403B_9569_398A20F1BA4A
lea ecx, [ebp - 8]
call fcn.18006e68
mov cl, byte [esi]
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
call fcn.1802230d
pop ecx
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.1800694d
lea ecx, [ebp - 4]
call fcn.1800b236
cmp edx, 0x10003
ja 0x18083476
jb 0x1808346c
test eax, eax
jae 0x18083476
mov ebx, 0x80004001
jmp 0x18083565
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.18010dd8
lea ecx, [ebp + 8]
call fcn.18009d8f
lea edx, [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.1801163f
push 0x1e
lea ecx, [ebp - 0x44]
call fcn.18028f24
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
mov edx, edi
push dword [edi - 0xc]
call fcn.18010e83
pop ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.18009d41
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1800694d
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x44]
call fcn.18029059
mov cl, byte [esi]
lea eax, [ebp + 8]
and dword [ebp + 8], 0
xor edx, edx
push eax
push dword [ebp - 0xc]
inc edx
call fcn.180260d7
mov esi, dword [ebp + 8]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
js 0x18083534
cmp dword [ebp + 0xc], 0
je 0x18083532
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [ebp + 0xc], 0
test eax, eax
jne 0x1808351b
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1808352b
mov ebx, dword [ebp + 0xc]
jmp 0x18083534
cmp eax, 0x102
jne 0x1808352b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x80004005
jmp 0x18083534
xor ebx, ebx
test esi, esi
je 0x1808353f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.1800694d
lea ecx, [ebp - 0x44]
call fcn.18028f8b
lea ecx, [edi - 0x10]
call fcn.1800694d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.1800694d
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.1800694d
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x180897cd
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push ecx
xor edi, edi
mov dword [esp + 0x18], edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov ebx, eax
test ebx, ebx
jne 0x180897f7
call fcn.18018dce
jmp 0x18089878
lea ecx, [esp + 0xc]
call fcn.18009d8f
lea ecx, [esp + 0xc]
call fcn.1801704c
test eax, eax
jns 0x18089818
lea eax, [esp + 0xc]
push eax
call fcn.18016f6c
pop ecx
mov esi, dword [esp + 0xc]
mov eax, edi
mov dword [esp + 0x10], eax
cmp dword [esi - 0xc], edi
je 0x18089837
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov eax, dword [esp + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push 1
push eax
push dword [ebp + 0xc]
push edi
push dword [esp + 0x30]
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x1808985d
call fcn.18018dce
mov edi, eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea ecx, [esi - 0x10]
call fcn.1800694d
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x18089a91
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov bl, cl
call fcn.1801c0e3
test bl, bl
je 0x18089ae9
lea ecx, [ebp - 0xc]
call fcn.18009d8f
lea eax, [ebp - 0xc]
push eax
xor eax, eax
lea ecx, [ebp - 0x10]
inc eax
push eax
push str.MicrosoftCrashReports
mov dword [ebp - 0x14], eax
call fcn.18006e68
push 0x26
mov edx, eax
pop ecx
call fcn.1801b7cf
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov eax, dword [ebp - 0xc]
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x18089b2a
lea ecx, [ebp - 8]
call fcn.18009d8f
lea eax, [ebp - 8]
push eax
push 1
push str.MicrosoftCrashReports
lea ecx, [ebp - 0x14]
call fcn.18006e68
push 0x1c
mov edx, eax
pop ecx
call fcn.1801b7cf
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov eax, dword [ebp - 8]
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 2
lea ecx, [eax - 0x10]
call fcn.18009f92
cmp dword [ebp - 0x10], 0
lea esi, [eax + 0x10]
mov dword [ebp - 4], esi
je 0x18089b49
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.1800694d
cmp dword [ebp - 0x14], 0
je 0x18089b5a
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.1800694d
test bl, bl
je 0x18089b79
cmp dword [esi - 0xc], edi
je 0x18089b7e
lea ecx, [ebp - 4]
call fcn.18089912
mov esi, dword [ebp - 4]
test eax, eax
jns 0x18089b79
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [esi - 0xc], edi
jne 0x18089ba9
lea ecx, [ebp - 0x14]
call fcn.18013325
push eax
lea ecx, [ebp - 4]
call fcn.18009d41
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov esi, dword [ebp - 4]
cmp dword [esi - 0xc], edi
jne 0x18089ba9
mov edi, 0x8004fffc
jmp 0x18089bbb
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x18089bbb
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.18009d41
lea ecx, [esi - 0x10]
call fcn.1800694d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1809e356
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 8
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1809e38b
cmp dword [ebp - 8], 3
jne 0x1809e38b
cmp dword [ebp - 4], esi
jne 0x1809e38b
mov al, 1
jmp 0x1809e39b
push esi
push 0
push dword [ebp + 8]
call fcn.181757a0
add esp, 0xc
xor al, al
pop esi
leave
ret

Function at 0x1809e39e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x20
pop esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1809e3d3
cmp dword [ebp - 8], 3
jne 0x1809e3d3
cmp dword [ebp - 4], esi
jne 0x1809e3d3
mov al, 1
jmp 0x1809e3e3
push esi
push 0
push dword [ebp + 8]
call fcn.181757a0
add esp, 0xc
xor al, al
pop esi
leave
ret
Function at 0x180a0d8c
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x180a0edc
mov edx, 0x10000000
cmp eax, 0x7c
je 0x180a0edc
cmp eax, 0x29
jne 0x180a0dc5
cmp dword [esi + 0x10], 0
jne 0x180a0edc
test dword [esi + 0x50], edx
je 0x180a0ee2
cmp eax, 0x2e
jne 0x180a0de0
push 5
lea ecx, [esi + 0x24]
call fcn.180488c5
mov ecx, esi
call fcn.180a0d64
jmp 0x180a0ec6
cmp eax, 0x5c
jne 0x180a0e32
mov ecx, esi
call fcn.180a0d64
test byte [esi + 0x50], 0x80
je 0x180a0e26
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x180a0e0f
push 4
lea ecx, [esi + 0x24]
call fcn.180488c5
mov ecx, esi
call fcn.180a0d64
jmp 0x180a0ecd
cmp al, 0x42
jne 0x180a0e26
push 4
lea ecx, [esi + 0x24]
call fcn.180488c5
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x180a0e03
mov ecx, esi
call fcn.180a1360
jmp 0x180a0ec6
cmp eax, 0x5b
jne 0x180a0e52
mov ecx, esi
call fcn.180a0d64
mov ecx, esi
call fcn.180a1314
cmp dword [esi + 0x4c], 0x5d
je 0x180a0dd4
push 4
jmp 0x180a0ee4
cmp eax, 0x28
jne 0x180a0e6f
mov ecx, esi
call fcn.180a0d64
mov ecx, esi
call fcn.180a1431
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x180a0ee2
jmp 0x180a0ebb
cmp eax, 0x5e
jne 0x180a0e78
push 2
jmp 0x180a0dfb
cmp eax, 0x24
jne 0x180a0e84
push 3
jmp 0x180a0dfb
cmp eax, 0x2a
je 0x180a0ed8
cmp eax, 0x2b
je 0x180a0ed8
cmp eax, 0x3f
je 0x180a0ed8
cmp eax, 0x7b
je 0x180a0ed8
cmp eax, 0x7d
jne 0x180a0ea2
test dword [esi + 0x50], edx
je 0x180a0ed4
cmp eax, 0x5d
jne 0x180a0eac
test dword [esi + 0x50], edx
je 0x180a0e4b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.180a1578
mov bl, 1
mov ecx, esi
call fcn.180a0d64
test bl, bl
je 0x180a0ecd
mov ecx, esi
call fcn.180a14b2
mov cl, 1
jmp 0x180a0d93
push 6
jmp 0x180a0ee4
push 0xa
jmp 0x180a0ee4
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.18047bc1
int3
Function at 0x180b059e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x1822b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push ebx
push 0x181f4ba4
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
call fcn.1801b1e1
push 0x20a
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.181757a0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x180b06a1
xor eax, eax
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
push eax
call fcn.1800e939
lea edx, [ebp - 0x230]
lea ecx, [ebp - 0x248]
call fcn.180b52d7
push eax
mov ecx, esi
call fcn.180254af
lea ecx, [ebp - 0x248]
call fcn.18012edc
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x180b06a1
mov ecx, dword [ebp - 0x230]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x250], ecx
cmp eax, 0x1000
jb 0x180b0698
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.18007456
mov eax, dword [ebp - 0x24c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x250]
push eax
push ecx
call fcn.18160b12
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.181605f4
leave
ret
Function at 0x180ba137
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1822b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x24], edx
xor eax, eax
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
cmp dword [edi + 0x10], eax
je 0x180ba290
cmp dword [edi + 0x10], 0x20
jne 0x180ba290
mov dword [ebp - 0x18], ebx
mov edx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x180ba18f
mov eax, dword [edi]
mov cl, byte [eax + edx]
call fcn.180ba08b
cmp al, 0xff
je 0x180ba290
mov ecx, dword [ebp - 0x18]
shl ecx, 4
movzx eax, al
add ecx, eax
inc edx
mov dword [ebp - 0x18], ecx
cmp edx, 8
jl 0x180ba185
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x180ba1bd
mov eax, dword [edi]
mov cl, byte [eax + edx]
call fcn.180ba08b
cmp al, 0xff
je 0x180ba290
mov ecx, dword [ebp - 0x14]
shl ecx, 4
movzx eax, al
add cx, ax
inc edx
movzx ecx, cx
movzx eax, cx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
cmp edx, 0xc
jl 0x180ba1b3
cmp edx, 0x10
jae 0x180ba222
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x180ba1fa
mov eax, dword [edi]
mov cl, byte [eax + edx]
call fcn.180ba08b
cmp al, 0xff
je 0x180ba290
mov ecx, dword [ebp - 0x1c]
shl ecx, 4
movzx eax, al
add cx, ax
inc edx
movzx ecx, cx
mov dword [ebp - 0x1c], ecx
cmp edx, 0x10
jl 0x180ba1f0
mov byte [ebp - 0xd], bl
mov al, 1
cmp edx, 0x20
jae 0x180ba272
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], ecx
xor al, 1
cmp dword [edi + 0x14], 0x10
mov byte [ebp - 0xe], al
mov eax, edi
jb 0x180ba241
mov eax, dword [edi]
mov cl, byte [eax + edx]
call fcn.180ba08b
mov cl, byte [ebp - 0xd]
shl cl, 4
add cl, al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], cl
test al, al
je 0x180ba266
mov esi, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov byte [ebp - 0xd], bl
mov byte [esi], cl
inc edx
cmp edx, 0x20
jl 0x180ba232
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov word [esi + 4], ax
mov eax, dword [ebp - 0x1c]
mov word [esi + 6], ax
mov eax, dword [ebp - 8]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
jmp 0x180ba296
mov eax, dword [ebp - 0x24]
mov byte [eax], 1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181605f4
leave
ret
Function at 0x180c5ae2
Capabilities:
Create http request

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
inc eax
push 0x102
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea eax, [esi + 0x14]
push eax
mov dword [esi], 0x18214de0
mov dword [esi + 0xc], 0x18213a98
call fcn.1819a754
xor ebx, ebx
push 0x2c
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.18160e88
add esp, 0xc
mov dword [eax], eax
push 0x10000000
push ebx
push ebx
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push ebx
mov dword [esi + 0x44], eax
push ebx
mov byte [esi + 0x4c], bl
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x10], eax
mov eax, esi
pop esi
pop ebx
ret
Function at 0x180cbc78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x102
mov dword [edi], 0x182151b8
lea eax, [edi + 0xc]
mov dword [edi + 4], ebx
push eax
mov dword [edi + 8], ebx
call fcn.1819a754
lea esi, [edi + 0x3c]
push 2
push esi
call fcn.1819a754
lea eax, [esi + 0x30]
push eax
call fcn.1819ac4c
mov dword [esi + 0x58], ebx
push 0xc
mov dword [edi + 0x98], ebx
mov dword [edi + 0x9c], ebx
call fcn.18160e88
push 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x98], eax
mov dword [edi + 0xa0], ebx
mov dword [edi + 0xa4], ebx
call fcn.18160e88
add esp, 0x1c
lea ecx, [edi + 0xa8]
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0xa0], eax
call fcn.180b9a1b
push 8
mov dword [edi + 0x108], ebx
mov dword [edi + 0x104], ebx
call fcn.18160e88
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push 0x180cc34a
push ebx
push ebx
mov dword [eax], edi
mov dword [eax + 4], 0x180cbfac
call fcn.1819e1b9
add esp, 0x1c
mov dword [ebp - 8], eax
test eax, eax
je 0x180cbd47
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
mov dword [edi + 8], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push 6
mov dword [ebp - 4], ebx
call fcn.1819a35e
int3
Function at 0x180d06bf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1822b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
mov dword [ebp - 8], 0xf
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0xc], ebx
lea esi, [edx + 1]
mov byte [ebp - 0x1c], bl
mov al, byte [edx]
inc edx
test al, al
jne 0x180d06e5
sub edx, esi
push edx
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1801b1e1
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x34]
call fcn.180b5287
mov eax, dword [ebp - 8]
cmp eax, 0x10
jb 0x180d073a
mov ecx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
cmp eax, 0x1000
jb 0x180d0731
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.18007456
mov eax, dword [ebp - 0x38]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x3c]
push eax
push ecx
call fcn.18160b12
pop ecx
pop ecx
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
jb 0x180d0746
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180d0758
test al, 0x10
jne 0x180d0758
mov bl, 1
lea ecx, [ebp - 0x34]
call fcn.1800e90b
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.181605f4
leave
ret
Function at 0x180dceb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
fild dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
fstp qword [esi + 8]
fild dword [ebp + 0xc]
mov dword [esi], 0x182164fc
fstp qword [esi + 0x10]
fld qword [ebp + 0x10]
fstp qword [esi + 0x18]
fld qword [ebp + 0x18]
fstp qword [esi + 0x20]
fldz
fst qword [esi + 0x28]
fst qword [esi + 0x30]
fstp qword [esi + 0x38]
call fcn.1819ad17
or dword [esi + 0x13c4], 0xffffffff
lea edi, [esi + 0x48]
mov ecx, eax
xor edx, edx
mov dword [esi + 0x44], ecx
inc edx
mov ebx, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [edi], ecx
lea edi, [edi + 4]
cmp edx, ebx
jl 0x180dcefe
fldz
mov ecx, esi
mov dword [esi + 0x40], ebx
fstp qword [esi + 0x13c8]
fld1
fstp qword [esi + 0x13d0]
call fcn.180dcf96
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x180df657
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x180df69f
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x180df667
jmp 0x180df6ac
cmp dword [esi], 0x4e0
jb 0x180df6ac
call fcn.180df6e6
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret

Function at 0x180df6e6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x180df6f8
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x180df73d
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret