joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10216605
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10216581
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10216774
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10216774
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10216729
jg 0x10216661
test eax, eax
je 0x1021671f
push 1
push 0x1000
call fcn.102066c3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10216684
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10216716
push 0x8000
push ebx
call fcn.102008cf
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x102166ad
jg 0x102166a8
cmp ecx, 0x1000
jb 0x102166ad
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.102084af
add esp, 0x10
cmp eax, 0xffffffff
je 0x102166f2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x102166a8
jl 0x102166d9
test ecx, ecx
jne 0x1021669a
push dword [ebp - 0xc]
push ebx
call fcn.102008cf
push esi
call fcn.10207148
add esp, 0xc
xor ebx, ebx
jmp 0x10216782
cmp byte [edi + 0x24], 0
je 0x10216709
cmp dword [edi + 0x20], 5
jne 0x10216709
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10216714
mov ebx, dword [edi + 0x18]
jmp 0x10216716
xor ebx, ebx
push esi
call fcn.10207148
pop ecx
jmp 0x10216782
test ecx, ecx
jg 0x102166eb
jl 0x10216729
test eax, eax
jae 0x102166eb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10203b81
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10216749
cmp byte [edi + 0x1c], 0
je 0x102166eb
jmp 0x1021677a
push ebx
call fcn.1020b6f9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x102166eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10216782
cmp byte [edi + 0x1c], 0
je 0x1021677f
mov ebx, dword [edi + 0x18]
jmp 0x10216782
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10203b81
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10217580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x102175ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x102175ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x6d6d1015
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x90
mov eax, dword [0x6d6d7040]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push esi
push edi
mov edi, ecx
push eax
mov dword [ebp - 0x14], edi
call dword [sym.imp.msvcr100.dll__strdup]
mov esi, eax
cmp byte [esi], 0x5c
pop ecx
jne 0x6d6d10b8
push 3
pop edi
test edi, edi
jle 0x6d6d107c
inc eax
push 0x5c
push eax
call dword [sym.imp.msvcr100.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x6d6d1062
cmp byte [eax], 0x5c
jne 0x6d6d1062
dec edi
jmp 0x6d6d1046
push esi
call dword [sym.imp.msvcr100.dll_free]
mov dword [esp], str.Malformed_UNC
push dword [ebp - 0x14]
call sub.java.dll__JNU_ThrowIOException_8
xor al, al
jmp 0x6d6d10e8
jne 0x6d6d1062
push 0x7f
mov byte [eax + 1], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
push esi
test eax, eax
jne 0x6d6d10d8
call dword [sym.imp.msvcr100.dll_free]
mov dword [esp], str.GetVolumeInformation_failed
push dword [ebp - 0x14]
call sub.java.dll__JNU_ThrowIOExceptionWithLastError_8
jmp 0x6d6d1078
push 0x5c
push esi
call dword [sym.imp.msvcr100.dll_strchr]
pop ecx
pop ecx
test eax, eax
jne 0x6d6d107e
push esi
call dword [sym.imp.msvcr100.dll_free]
mov dword [esp], str.Absolute_filename_not_specified
push edi
jmp 0x6d6d1073
call dword [sym.imp.msvcr100.dll_free]
mov eax, dword [ebp - 0x18]
shr eax, 3
pop ecx
and eax, 1
mov ecx, dword [ebp + 0x70]
pop edi
xor ecx, ebp
pop esi
call fcn.6d6d2dba
add ebp, 0x74
leave
ret

Function at 0x6d6d2367
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.PdhAddCounterA
push edi
call esi
push str.PdhOpenQueryA
push edi
mov dword [0x6d6d7310], eax
call esi
push str.PdhCloseQuery
push edi
mov dword [0x6d6d7318], eax
call esi
push str.PdhCollectQueryData
push edi
mov dword [0x6d6d708c], eax
call esi
push str.PdhGetFormattedCounterValue
push edi
mov dword [0x6d6d733c], eax
call esi
push str.PdhEnumObjectItemsA
push edi
mov dword [0x6d6d730c], eax
call esi
push str.PdhRemoveCounter
push edi
mov dword [0x6d6d7338], eax
call esi
push str.PdhLookupPerfNameByIndexA
push edi
mov dword [0x6d6d7308], eax
call esi
push str.PdhMakeCounterPathA
push edi
mov dword [0x6d6d70a8], eax
call esi
xor ecx, ecx
mov dword [0x6d6d72b4], eax
pop esi
cmp dword [0x6d6d7310], ecx
je 0x6d6d242d
cmp dword [0x6d6d7318], ecx
je 0x6d6d242d
cmp dword [0x6d6d708c], ecx
je 0x6d6d242d
cmp dword [0x6d6d733c], ecx
je 0x6d6d242d
cmp dword [0x6d6d730c], ecx
je 0x6d6d242d
cmp dword [0x6d6d7338], ecx
je 0x6d6d242d
cmp dword [0x6d6d7308], ecx
je 0x6d6d242d
cmp dword [0x6d6d70a8], ecx
je 0x6d6d242d
cmp eax, ecx
je 0x6d6d242d
xor eax, eax
ret
push str.Required_method_could_not_be_found.
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.msvcr100.dll__snprintf]
add esp, 0xc
or eax, 0xffffffff
ret

Function at 0x6d6d2dba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d6d7040]
jne 0x6d6d2dc4
repz ret
jmp fcn.6d6d31c1
Function at 0x6d6d2e7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x6d6d2e8d
pop dword [ebp - 0x38]
mov eax, 0x66d7ad7c
sub eax, 0xf96a7eef
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x29e653f5
add dword [ebp - 0x48], 0x246bf156
mov dword [ebp - 0x44], 0x220b188a
add dword [ebp - 0x44], 0x102833bb
mov dword [ebp - 0x40], 0x5b085389
add dword [ebp - 0x40], 0xf143f0a5
mov dword [ebp - 0x3c], 0xa9b1f90b
sub dword [ebp - 0x3c], 0xa9b1f90b
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb917eec1
add dword [ebp - 0x48], 0xbb5a7a95
mov dword [ebp - 0x44], 0x4a41c3db
sub dword [ebp - 0x44], 0x8d56266
mov dword [ebp - 0x40], 0x8567a0de
add dword [ebp - 0x40], 0xde07cb8e
mov dword [ebp - 0x3c], 0x827a1c67
add dword [ebp - 0x3c], 0x7d85e399
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x376bb
push 0
call eax
mov ecx, 0x9d091b23
add ecx, 0x62f73047
mov edx, eax
mov ebx, 0xfad594f
sub ebx, 0xa23fc34f
add ebx, dword [ebp - 0x38]
mov esi, 0xb1e7ebd9
sub dword [ebp - 0x2c], 0x3fc0099c
mov edi, dword [ebx]
xor dword [ebp - 4], ecx
sub edi, esi
mov dword [ebp - 0x30], 0xd2adece0
mov dword [edx], edi
add dword [ebp - 0x30], 0xe6a36bf4
add edx, 4
add ebx, 0x66b0b147
add ebx, 0x994f4ebd
loop 0x6d6d2f9f
add eax, 0xdb712e3c
add eax, 0x248ff23f
xor ebx, ebx
add ebx, eax
add eax, 0x52a7240f
add eax, 0xad58dbf6
mov ecx, 0x7f398a9e
sub ecx, 0x11cc8a9e
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x406eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x50c40
call fcn.004096c0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x50c20], 0
push eax
push eax
push eax
mov word [ebp - 0x50c0c], ax
lea eax, [ebp - 0x50c1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50c20]
mov dword [ebp - 0x50c1c], 0x10001
push eax
mov dword [ebp - 0x50c18], 0x2b11
mov dword [ebp - 0x50c14], 0x2b11
mov dword [ebp - 0x50c10], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x50bfe
lea eax, [ebp - 0x50c08]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
shr edx, 7
xor dl, al
add dl, al
xor dl, 5
mov cl, dl
shl dl, 2
add cl, dl
mov byte [ebp + eax - 0x50c08], cl
inc eax
cmp eax, 0x50bfe
jb 0x406f33
lea eax, [ebp - 0x50c08]
mov dword [ebp - 0x50c3c], 0x50bfe
mov dword [ebp - 0x50c40], eax
lea eax, [ebp - 0x50c40]
push 0x20
push eax
push dword [ebp - 0x50c20]
mov dword [ebp - 0x50c38], 0
mov dword [ebp - 0x50c34], 0
mov dword [ebp - 0x50c30], 0
mov dword [ebp - 0x50c2c], 0
mov dword [ebp - 0x50c28], 0
mov dword [ebp - 0x50c24], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x50c40]
push eax
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x50c20]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408a19
mov esp, ebp
pop ebp
ret
Function at 0x407350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa1840
call fcn.004096c0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa1820], 0
push eax
push eax
push eax
mov word [ebp - 0xa180c], ax
lea eax, [ebp - 0xa181c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xa1820]
mov dword [ebp - 0xa181c], 0x10001
push eax
mov dword [ebp - 0xa1818], 0x5622
mov dword [ebp - 0xa1814], 0x5622
mov dword [ebp - 0xa1810], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xa17fc
lea eax, [ebp - 0xa1808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
shr edx, 0xc
and dl, 0xd
shr ecx, 0xa
xor dl, 2
and cl, 9
or dl, cl
movsx ecx, al
movsx edx, dl
imul edx, ecx
mov byte [ebp + eax - 0xa1808], dl
inc eax
cmp eax, 0xa17fc
jb 0x4073d3
lea eax, [ebp - 0xa1808]
mov dword [ebp - 0xa183c], 0xa17fc
mov dword [ebp - 0xa1840], eax
lea eax, [ebp - 0xa1840]
push 0x20
push eax
push dword [ebp - 0xa1820]
mov dword [ebp - 0xa1838], 0
mov dword [ebp - 0xa1834], 0
mov dword [ebp - 0xa1830], 0
mov dword [ebp - 0xa182c], 0
mov dword [ebp - 0xa1828], 0
mov dword [ebp - 0xa1824], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xa1840]
push eax
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xa1820]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408a19
mov esp, ebp
pop ebp
ret
Function at 0x409249
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409288
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409288
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409288
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409288
cmp dword [ecx + 0x74], 0xe
jbe 0x409288
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401050
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x8190ac]
sub esp, 0x11c
test eax, eax
jne 0x40114e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00403c40
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x4010a0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41d100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x4010b0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41d104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x4010e5
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00403a80
pop edi
pop esi
pop ebx
test eax, eax
je 0x401149
mov eax, dword [eax + 0x18]
test eax, eax
je 0x401149
mov dword [0x8190ac], eax
add esp, 0x11c
ret
mov eax, dword [0x8190ac]
add esp, 0x11c
ret
Function at 0x402100
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x402128
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x402136
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40214f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40215d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x402176
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x402184
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x40219d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x4021ab
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x4021f2
add dword [esp], 5
retf
Function at 0x402b60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x818208]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x402d0d
cmp dword [0x81820c], 0
jne 0x402cf9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00403c40
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x402bb0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41d0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x402bc0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41d0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x402bf5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00403c40
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402c54
sub edx, esi
sar edx, 1
je 0x402d0d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x402c70
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x402d0d
xor eax, eax
push ebx
test edx, edx
je 0x402ca8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x402ca8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x402c91
xor eax, eax
test edx, edx
je 0x402cc2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x402cc2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402cb0
xor eax, eax
test edx, edx
je 0x402cdf
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x402cdf
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402cd0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x818208]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x4034e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40352b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40351b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x403501
jmp 0x403520
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x40357b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x403540
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403540
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40355c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00403930
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40359d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x403610
mov esi, dword [ebx]
cmp esi, ebx
je 0x403610
test esi, esi
je 0x403610
cmp word [esi + 0x24], 2
jbe 0x40360a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40360a
cmp dword [esi + 0x18], 0
je 0x40360a
test ebp, ebp
je 0x4035c5
cmp ebp, eax
jne 0x40360a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00403930
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4035ea
cmp eax, dword [esi + 0x18]
jne 0x40360a
cmp dword [esp + 0x10], 0
je 0x40361d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401730
add esp, 8
test eax, eax
je 0x40361d
mov esi, dword [esi]
cmp esi, ebx
jne 0x4035a3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x403660
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x818348
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403789
cmp dword fs:[0xc0], eax
je 0x40368b
mov dword [0x818344], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x81822c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x818230], eax
movzx edx, word [esi + 0xac]
mov dword [0x818234], edx
mov eax, dword [esi + 0xb0]
mov dword [0x818238], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x4036eb
push 0x7f
push eax
push 0x81823c
call fcn.00403930
mov edx, dword [0x818234]
add esp, 0xc
jmp 0x4036f3
xor eax, eax
mov word [0x81823c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x81833c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x81833e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x818340], ax
mov ecx, eax
mov byte [0x818342], 0
cmp byte [0x7ffe0268], 0
je 0x40373a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x818342], bl
cmp ebx, 1
pop ebx
jne 0x403754
and ecx, 0xffef
mov word [0x818340], cx
test edx, edx
jne 0x403789
call fcn.00403660
cmp dword [0x81822c], 6
ja 0x403789
jb 0x403771
cmp dword [0x818230], 4
jae 0x403789
call fcn.00403660
cmp dword [0x81822c], 0xa
jae 0x403789
mov dword [0x818234], 1
ret

Function at 0x403a80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x403adb
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403aa0
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x403abc
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00403930
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x403afd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x403b6f
mov esi, dword [ebx]
cmp esi, ebx
je 0x403b6f
test esi, esi
je 0x403b6f
cmp word [esi + 0x24], 2
jbe 0x403b69
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x403b69
cmp dword [esi + 0x18], 0
je 0x403b69
test ebp, ebp
je 0x403b25
cmp ebp, eax
jne 0x403b69
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00403930
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x403b4a
cmp edx, dword [esi + 0x18]
jne 0x403b69
cmp dword [esp + 0x14], eax
je 0x403b7c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401730
add esp, 8
test eax, eax
je 0x403b7c
mov esi, dword [esi]
cmp esi, ebx
jne 0x403b03
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x41ca02
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x401000
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x45458b
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x46bd84]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
push eax
mov dword [esi], vtable.CApnHttpRequestor.0
call fcn.00401f90
add eax, 0x10
mov dword [esi + 4], eax
mov byte [esp + 0x14], 2
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
push eax
call fcn.00401f90
mov ecx, dword [esp + 0x28]
add esp, 8
push 0
push 0
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [esp + 0x2c]
push 0
push 0
push ecx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x401099
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov byte [esp + 0x10], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4010be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4010e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 0x10