joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x5939f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x594d18], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x15c], ebx
jne 0x44a5e6
call fcn.0044cb60
test al, al
je 0x44a5f7
mov byte [0x594d18], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a094
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x5b4]
test eax, eax
je 0x44a618
push 0x400
push eax
call fcn.0049b830
add esp, 8
call fcn.0044cb60
test al, al
jne 0x44a5e6
push esi
push edi
nop word [eax + eax]
mov esi, 2
mov dword [ebp - 0x150], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x14c], eax
nop
lea eax, [ebp - 0x18c]
push eax
call fcn.0043d600
push 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x17c], xmm0
movups xmmword [ebp - 0x16c], xmm0
call fcn.0043fef0
movups xmm1, xmmword [ebp - 0x17c]
add esp, 8
lea ecx, [esi - 1]
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
push eax
movd eax, xmm1
push eax
push 0
push ecx
call fcn.0050ac50
imul esi, dword [ebp - 0x164]
mov edi, eax
lea eax, [ebp - 0x19c]
mov ebx, edx
push eax
mov dword [ebp - 0x154], esi
call fcn.0043d600
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1ac]
push eax
call fcn.0043d600
mov edx, dword [ebp - 0x148]
add esp, 8
inc edx
mov dword [ebp - 0x158], edx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, esi
push 0
push edx
adc eax, 0
push eax
push ecx
call fcn.0050ac50
shld edx, eax, 8
shl eax, 8
xor ebx, edx
xor edi, eax
mov dword [ebp - 0x168], ebx
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x16c], edi
push eax
call fcn.0043d600
lea esi, [eax + 8]
lea eax, [ebp - 0x1cc]
push eax
call fcn.0043d600
add esp, 8
mov ecx, dword [eax]
add ecx, dword [esi]
mov eax, dword [ebp - 0x148]
mov esi, dword [ebp - 0x158]
add eax, 2
imul ecx, eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x148], esi
shl ecx, 0x10
xor eax, ecx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x14c]
movups xmm0, xmmword [ebp - 0x16c]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [ebp - 0x150], 1
mov dword [ebp - 0x14c], eax
jne 0x44a640
movsd xmm0, qword [0x538258]
lea eax, [ebp - 0x44]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.0049b570
add esp, 0x10
call fcn.0044cb60
test al, al
je 0x44a620
lea eax, [ebp - 0x144]
mov byte [ebp - 0x144], 0
push 0x100
push eax
call fcn.0049b760
add esp, 8
cmp byte [ebp - 0x144], 0
pop edi
pop esi
je 0x44a7d5
lea eax, [ebp - 0x144]
push 0x400
push eax
call fcn.0049b830
add esp, 8
call fcn.0044cb60
test al, al
jne 0x44a5e6
push 0x5371f4
push dword [ebp - 0x15c]
call fcn.00440280
add esp, 8
call fcn.0044cb60
xor edx, edx
mov ecx, 0x23
test al, al
pop ebx
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050a094
mov esp, ebp
pop ebp
ret
Function at 0x4558f0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x45591f
push 0x539338
push edx
call fcn.004401b0
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebp
ret
cmp ecx, 0xc8
je 0x455936
push ecx
push 0x539354
push edx
call fcn.00440280
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x45594d
push edi
call fcn.00455650
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x14
jne 0x455961
push edi
call fcn.004546d0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x15
jne 0x455975
push edi
call fcn.00455630
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebp
ret
cmp eax, 0x16
jne 0x455985
push edi
call fcn.004557d0
mov esi, eax
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x466ba0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x466bcd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x466c14
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x466c1a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x466c7b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x466c40
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x466ca7
mov eax, dword [esi + 4]
push 1
push str.lower
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x53c367
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x466c80
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d9630
Capabilities:
Encode data using xor

Disassembly:
int3
push ebx
mov ebx, dword [esp + 8]
push esi
cmpsb byte [esi], byte es:[edi]
jb 0x4d963c
add byte [ebx - 0x75], dl
out 0x15, al
add eax, dword [eax]
ja 0x4d9656
mov eax, dword [esi + 0x10]
add dword [edi + 0x2c], 0x6a
scasb al, byte es:[edi]
sti
dec eax
push ebx
push esi
push 0
lea eax, [ebx - 0x75]
sbb byte [ecx + 0x73], dl
adc al, 0xff
jae 0x4d962a
inc esp
and al, 0x1c
adc byte [eax], 0xf
pop ds
inc esp
add byte [eax], al
nop dword [eax + eax]
sub eax, 0x8b147190
adc al, 0x8d
add dword [eax], eax
or al, 0xff
xor al, 0xb1
or al, 0xfd
inc dword [ebx - 0xa8d3b9]
sal byte [ebp + 0x1c], 1
push 0x10
push edi
je 0x4d965f
in eax, dx
invalid

Function at 0x50715c
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
cmp dword [ebx + 0x28], ebp
lea ecx, [esp + 0x6a0000c4]
and al, 0xc4
add byte [eax], al
push 3
enter 0x100f, 0xc
sbb dword [edi], ecx
adc byte [ecx + ebp], al
and al, 0xc4
add byte [eax], al
push 3
enter 0x100f, 0xc
sbb dword [edi], ecx
adc byte [ecx + ebp], al
movups xmmword [ecx], xmm1
mov ecx, dword [edi]
pop edi
and al, 3
enter 0xf66, 0xffffffffffffffef
ror dword [edi], 0x11
test byte [eax + eax*4], al
add byte [eax], al
push 0xffffffffffffff83
shl byte [eax], 0xf
adc byte [esi + ecx], cl
movups xmm0, xmmword [ecx]
movups xmmword [ecx + edx], xmm1
pxor xmm1, xmm0
movups xmmword [ecx + edi], xmm1
cmp eax, 0x40
jl 0x507156
mov eax, 0x84574c20
invalid

Function at 0x50a36e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x50a3a9
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x50a3a2
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x50a3ae
add edx, 0x28
cmp edx, esi
jne 0x50a393
xor eax, eax
pop esi
int3
mov eax, edx
jmp 0x50a3ab

Function at 0x526705
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00526584
Function at 0x2e01f2ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ds
dec eax
add byte [eax], al
push esi
push ecx
call 0x2e02b6fe
add esp, 8
mov eax, dword [esp + 0x1244]
cmp eax, 0x10
jb 0x2e01f339
mov ecx, dword [esp + 0x1230]
lea esi, [eax + 1]
cmp esi, 0x1000
jae 0x2e023b3e
push esi
push ecx
call 0x2e02b6fe
add esp, 8
mov eax, dword [esp + 0x125c]
cmp eax, 0x10
jb 0x2e01f365
mov ecx, dword [esp + 0x1248]
lea esi, [eax + 1]
cmp esi, 0x1000
jae 0x2e0237e6
push esi
push ecx
call 0x2e02b6fe
add esp, 8
mov eax, dword [esp + 0x1274]
cmp eax, 0x10
jb 0x2e01f391
mov ecx, dword [esp + 0x1260]
lea esi, [eax + 1]
cmp esi, 0x1000
jae 0x2e0236ad
push esi
push ecx
call 0x2e02b6fe
add esp, 8
lea ecx, [esp + 0x70]
call fcn.2e00f0b0
cmp dword [0x42f540], 0
je 0x2e01f6c1
lea ecx, [esp + 0x1370]
mov dword [esp + 4], ecx
call 0x2e0281d0
mov eax, 0xf
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b0], 0
add byte [eax], al
add dh, al
test byte [eax], ah
add dword [eax], eax
add byte [eax], al
mov ebx, dword [0x42f540]
lea eax, [ebx + 1]
mov ecx, 0xf
cmp eax, 0x10
jae 0x2e023366
mov eax, 0x42f530
cmp dword [0x42f544], 0xf
jbe 0x2e01f400
mov eax, dword [0x42f530]
cmp ecx, ebx
jb 0x2e02093f
mov dword [esp + 0x1b0], ebx
cmp ecx, 0xf
jbe 0x2e01f41f
mov ecx, dword [esp + 0x1a0]
mov dword [esp + 0x28], ecx
push ebx
push eax
mov esi, dword [esp + 0x30]
push esi
call 0x2e036f82
add esp, 0xc
mov byte [esi + ebx], 0
mov eax, dword [esp + 0x1b0]
mov ecx, dword [esp + 0x1b4]
cmp ecx, eax
je 0x2e020969
lea edx, [eax + 1]
mov dword [esp + 0x1b0], edx
cmp ecx, 0xf
jbe 0x2e01f460
mov ecx, dword [esp + 0x1a0]
jmp 0x2e01f467
lea ecx, [esp + 0x1a0]
mov word [ecx + eax], 0x5c
mov eax, dword [esp + 0x1380]
cmp dword [esp + 0x1384], 0xf
jbe 0x2e01f489
mov ecx, dword [esp + 0x1370]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1b0]
mov edx, dword [esp + 0x1b4]
mov esi, edx
sub esi, ecx
cmp esi, eax
jb 0x2e02099a
lea edi, [esp + 0x1a0]
lea ebx, [ecx + eax]
mov dword [edi + 0x10], ebx
mov esi, edi
cmp edx, 0xf
jbe 0x2e01f4be
mov esi, dword [esp + 0x1a0]
lea edx, [esp + 0x1b0]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x1b4]
mov dword [esp + 0x10], edx
add ecx, esi
push eax
push dword [esp + 8]
push ecx
call 0x2e036f82
add esp, 0xc
mov byte [esi + ebx], 0
xor ebx, ebx
mov dword [esp + 0x1360], ebx
mov dword [esp + 0x1364], ebx
movsd xmm0, qword [edi + 0x10]
movsd qword [esp + 0x1360], xmm0
movups xmm0, xmmword [edi]
movaps xmmword [esp + 0x1350], xmm0
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
mov eax, dword [esp + 0x10]
mov dword [eax], 0xf
mov byte [edi], 0
mov eax, dword [esp + 0x1b4]
cmp eax, 0x10
jb 0x2e01f550
mov ecx, dword [esp + 0x1a0]
lea esi, [eax + 1]
cmp esi, 0x1000
jae 0x2e0236ca
push esi
push ecx
call 0x2e02b6fe
add esp, 8
mov eax, 0xf
mov dword [esp + 0x1344], eax
mov dword [esp + 0x1340], ebx
mov byte [esp + 0x1330], bl
mov dword [esp + 0x1324], eax
mov dword [esp + 0x1320], ebx
mov byte [esp + 0x1310], bl
mov dword [esp + 0x1304], eax
mov dword [esp + 0x1300], ebx
mov byte [esp + 0x12f0], bl
invalid
mov word [eax + edx*8], fs
adc al, byte [eax]
Function at 0xf11020
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x204]
push str.Local_szLibraryName_X
push eax
call fcn.00f11000
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
push 0
push 4
call dword [sym.imp.kernel32.dll_OpenFileMappingW]
mov edi, eax
test edi, edi
je 0xf11099
push 0x400
push 0
push 0
push 4
push edi
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0xf11092
push esi
push str.C:UsersAdminDesktop_asdasd.bin
call dword [sym.imp.kernel32.dll_lstrcpyW]
push esi
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp word [str.C:UsersAdminDesktop_asdasd.bin], 0
jne 0xf110ba
call sub.ntdll.dll_RtlGetLastNtStatus
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00f1151b
mov esp, ebp
pop ebp
ret 0x10
push str.C:UsersAdminDesktop_asdasd.bin
call dword [sym.imp.kernel32.dll_LoadLibraryW]
test eax, eax
jne 0xf11118
call sub.ntdll.dll_RtlGetLastNtStatus
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea eax, [ebp - 0x204]
push str.Failed_to_load_DLL
push eax
call fcn.00f11000
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x1010
push eax
push str.C:UsersAdminDesktop_asdasd.bin
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00f1151b
mov esp, ebp
pop ebp
ret 0x10
push eax
lea eax, [ebp - 0x204]
push str.DLL_loaded:_0x_p
push eax
call fcn.00f11000
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x1040
push eax
push str.C:UsersAdminDesktop_asdasd.bin
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00f1151b
mov esp, ebp
pop ebp
ret 0x10
Function at 0xf16826
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.kernel32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00f13b16
mov dword [ebp - 0x14], eax
cmp dword [0xf24230], esi
jne 0xf16919
push 0x800
push esi
push 0xf1e4ac
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0xf168a6
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x57
jne 0xf169f9
push esi
push esi
push 0xf1e4ac
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0xf169f9
push 0xf1e4c4
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0xf169f9
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xf24230], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xf24234], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xf24238], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xf24240], eax
test eax, eax
je 0xf16916
push str.GetProcessWindowStation
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xf2423c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
je 0xf1693e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0xf16931
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0xf16953
push 4
pop eax
jmp 0xf169fb
cmp dword [ebp - 0x14], esi
je 0xf16953
push dword [0xf24230]
call dword [sym.imp.kernel32.dll_DecodePointer]
push 3
jmp 0xf16938
mov eax, dword [0xf2423c]
mov ebx, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, edi
je 0xf169b1
cmp dword [0xf24240], edi
je 0xf169b1
push eax
call ebx
push dword [0xf24240]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0xf169b1
test eax, eax
je 0xf169b1
call ecx
test eax, eax
je 0xf169a6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0xf169a6
test byte [ebp - 8], 1
jne 0xf169b1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0xf169e1
mov eax, dword [0xf24234]
cmp eax, edi
je 0xf169de
push eax
call ebx
test eax, eax
je 0xf169de
call eax
mov esi, eax
test esi, esi
je 0xf169de
mov eax, dword [0xf24238]
cmp eax, edi
je 0xf169de
push eax
call ebx
test eax, eax
je 0xf169de
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xf24230]
call ebx
test eax, eax
je 0xf169f9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0xf169fb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00f1151b
mov esp, ebp
pop ebp
ret
Function at 0x401380
Capabilities:
Encode data using xor

Disassembly:
push esi
push str.__xml_version_1.0__encoding_UTF_8___
push 0x12cffb8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._metalink__file_
push 0x12cffb8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x12cffb8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
lea esi, [eax - 0x20]
mov dword [ecx], 0
test esi, esi
jle 0x4013da
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [ecx]
mov dl, byte [eax + 0x12cffd8]
xor dl, byte [eax + 0x12cffb8]
mov byte [eax + edi], dl
inc dword [ecx]
cmp dword [ecx], esi
jl 0x4013c2
pop edi
pop esi
ret

Function at 0x401750
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40181e
push esi
push edi
xor edi, edi
push edi
lea ecx, [esp + 0x10]
push ecx
push 0x5014
push 0x12e1f80
push ebp
mov esi, 1
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4017f4
push ebx
nop
mov ebx, dword [esp + 0x10]
test ebx, ebx
jbe 0x4017f3
xor ecx, ecx
test ebx, ebx
jbe 0x4017d7
mov edi, edi
movzx eax, byte [ecx + 0x12e1f80]
add eax, esi
xor edx, edx
mov esi, 0xfff1
div esi
inc ecx
mov esi, edx
lea eax, [edi + esi]
xor edx, edx
mov edi, 0xfff1
div edi
mov edi, edx
cmp ecx, ebx
jb 0x4017b0
push 0
lea edx, [esp + 0x14]
push edx
push 0x5014
push 0x12e1f80
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4017a0
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
shl edi, 0x10
or edi, esi
push edi
push 0x406334
push 0x12d7f58
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop edi
pop esi
mov eax, 0x12d7f58
pop ebp
pop ecx
ret
mov eax, 0x40632c
pop ebp
pop ecx
ret

Function at 0x401830
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, edi
je 0x40186a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x401a80
Capabilities:
Create process on windows

Disassembly:
push str.__c__start
push 0x1300000
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov eax, 0x1300000
cmp word [eax], 0
je 0x401aa0
add eax, 2
jne 0x401a95
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x401ad7
movzx edx, word [ecx]
test dx, dx
je 0x401ad7
cmp dx, 0x26
je 0x401abc
cmp dx, 0x7c
jne 0x401ac7
mov edx, 0x5e
mov word [eax], dx
add eax, 2
mov dx, word [ecx]
mov word [eax], dx
add ecx, 2
add eax, 2
test ecx, ecx
jne 0x401aa8
xor edx, edx
push edx
push edx
push 0x1300000
push str.cmd.exe
mov ecx, 0x22
push edx
mov word [eax], cx
push edx
mov word [eax + 2], dx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x401b40
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push esi
push 0
push 0
push 0
push 0
push str.formatgoer_67
mov esi, ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], eax
test eax, eax
je 0x401bc4
push 0
push 0x1bb
push str.www.google.com
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [esi + 4], eax
test eax, eax
je 0x401b92
push 0x800000
push 0
push 0
push 0
push 0
push 0x40645c
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x401baf
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [esi + 0xc], eax
cmp dword [esi + 0xc], 0
je 0x401bc4
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [esi + 0xc], eax
pop esi
ret
Function at 0x402480
Capabilities:
Read http header

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x145b890
push 0
mov dword [ebx], 0xffffffff
push 0x35
mov dword [edi], 0xffffffff
push ecx
mov dword [esi], 0xffffffff
mov dword [esp + 0x30], 0x5014
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x402540
mov ax, word [0x145b890]
mov ecx, 0x145b890
mov dword [esp + 0x1c], ecx
test ax, ax
je 0x4024fc
movzx eax, ax
nop
cmp ax, 0x30
jb 0x4024ec
cmp ax, 0x39
jbe 0x4024f8
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4024e0
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00402430
mov dword [esi], eax
lea eax, [esp + 0x20]
push eax
call fcn.00402430
lea ecx, [esp + 0x24]
push ecx
mov dword [edi], eax
call fcn.00402430
add esp, 0xc
mov dword [ebx], eax
cmp dword [esi], 0
jl 0x40253a
cmp dword [edi], 0
jl 0x40253a
test eax, eax
jl 0x40253a
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x402590
Capabilities:
Read http header

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push 0
lea eax, [esp + 4]
push eax
push 0x146fa70
push 0
push 0x21
push ecx
mov dword [esp + 0x18], 0x5014
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x40268f
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.http:__
push 0x146fa70
call esi
cmp eax, 0x146fa70
je 0x402687
push str.https:__
push 0x146fa70
call esi
cmp eax, 0x146fa70
je 0x402687
push str.http
push 0x1465a48
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp byte [esp + 0x14], 0
mov eax, 0x406560
jne 0x402612
mov eax, 0x406562
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
push 0x1465a48
call esi
mov edx, dword [esp + 0x10]
push edx
push 0x1465a48
call esi
push 0x40655c
push 0x1465a48
call esi
movzx eax, word [esp + 0x18]
push eax
push 0x406554
push 0x1465980
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x1465980
push 0x1465a48
call esi
cmp word [0x146fa70], 0x2f
je 0x402673
push 0x406550
push 0x1465a48
call esi
push 0x146fa70
push 0x1465a48
call esi
mov eax, 0x1465a48
pop esi
pop ecx
ret
mov eax, 0x146fa70
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret