joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f448
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x20]
mov esi, ecx
and esi, 7
neg esi
and esi, 7
cmp dword [eax - 8], ebx
mov dword [ebp - 0xc], esi
je 0x101f53c
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ebx
je 0x101f4f7
mov esi, 0x400
push esi
call fcn.0105b249
pop ecx
mov dword [ebp + 0x14], eax
lea ecx, [ebp + 0x10]
push ebx
push ecx
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101f4e0
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
add dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], esi
jb 0x101f4e0
lea eax, [ebp + 0x10]
push ebx
push eax
push esi
push dword [ebp + 0x14]
jmp 0x101f4a9
push dword [ebp + 0x14]
call fcn.0105ad60
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc]
jmp 0x101f514
cmp dword [edi + 0x14], 1
jne 0x101f514
lea eax, [ebp + 0xc]
push ebx
push eax
mov byte [ebp + 0x13], bl
push 1
lea eax, [ebp + 0x13]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi + 0x14]
jne 0x101f579
lea eax, [ebp + 0xc]
push ebx
push eax
push esi
push str.PADDINGPADDINGXX
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
add eax, dword [edi + 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [edi + 0x28], ebx
jne 0x101f579
mov eax, dword [edi + 0x24]
push ebx
cmp eax, ebx
je 0x101f550
lea edx, [ebp + 0xc]
push edx
push ecx
jmp 0x101f50a
lea eax, [ebp + 0xc]
push eax
mov eax, esi
add eax, dword [edi + 4]
push eax
mov eax, dword [edi]
sub eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
add eax, dword [edi + 4]
cmp dword [ebp + 0xc], eax
je 0x101f530
xor eax, eax
jmp 0x101f535
Function at 0x10229a3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1081ac9
call fcn.0105c800
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x14], esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov eax, dword [0x1098824]
mov dword [esi + 0x40], eax
push 1
lea edi, [esi + 0x94]
pop eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov al, byte [ebp - 0xd]
push ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov byte [esi + 0x8c], bl
mov dword [esi + 0x90], ebx
push ebx
mov ecx, edi
mov dword [ebp - 4], ebx
mov byte [edi], al
call fcn.0102e113
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov al, byte [ebp - 0xd]
lea edi, [esi + 0xa0]
push ebx
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
mov byte [edi], al
call fcn.0102e113
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0xb8]
mov dword [esi + 0xac], ebx
mov byte [esi + 0xb0], bl
mov dword [esi + 0xb4], ebx
mov byte [ecx], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 4], 2
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.0100fc49
mov byte [ebp - 4], 3
mov byte [esi + 0xcc], bl
mov dword [esi + 0xd0], ebx
mov al, byte [ebp - 0xd]
lea edi, [esi + 0xd8]
push ebx
mov byte [esi + 0xd4], bl
push ebx
mov ecx, edi
mov byte [edi], al
call fcn.0102e113
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov eax, dword [0x1098824]
push ebx
mov dword [esi + 0xe4], eax
mov dword [esi], 0x108845c
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x102559f
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x80]
push esi
lea esi, [ecx + 0x80]
test eax, eax
je 0x10255c4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [esi], 0
pop esi
ret

Function at 0x10257e8
Capabilities:
Create thread

Disassembly:
mov eax, 0x1081d4c
call fcn.0105c800
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0x1025801
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x14], eax
push 0xffffffffffffff9b
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.010087b8
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
mov byte [ebp - 4], 1
call fcn.01026c38
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
je 0x102583c
push edi
mov edi, dword [ebp - 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
jmp 0x102583f
or ecx, 0xffffffff
push ecx
lea eax, [ebp - 0x18]
push dword [ebp - 0x10]
push eax
call fcn.0101bb58
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x18]
push 0x10258a2
push ebx
push ebx
call fcn.0105e167
add esp, 0x24
test eax, eax
je 0x102586e
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x10]
call fcn.01001190
cmp dword [ebp - 0x14], ebx
pop esi
pop ebx
je 0x1025886
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1025ac6
Capabilities:
Create thread

Disassembly:
mov eax, 0x1081d98
call fcn.0105c800
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0x1025adf
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x14], eax
push 0xffffffffffffff9b
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.010087b8
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
mov byte [ebp - 4], 1
call fcn.01026c38
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
je 0x1025b1a
push edi
mov edi, dword [ebp - 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
jmp 0x1025b1d
or ecx, 0xffffffff
push ecx
lea eax, [ebp - 0x18]
push dword [ebp - 0x10]
push eax
call fcn.0101bb58
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x18]
push 0x10259c3
push ebx
push ebx
call fcn.0105e167
add esp, 0x24
test eax, eax
je 0x1025b4c
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x10]
call fcn.01001190
cmp dword [ebp - 0x14], ebx
pop esi
pop ebx
je 0x1025b64
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10267b9
Capabilities:
Copy file

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x102845b
Capabilities:
Create directory

Disassembly:
mov eax, 0x1082084
call fcn.0105c800
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push 0xffffffffffffff9b
call fcn.0100972d
push eax
lea ecx, [ebp - 0x10]
call fcn.010087b8
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.01016902
mov eax, dword [esi + 0x38]
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
cmp dword [eax - 8], edi
setne bl
call fcn.01009915
test al, al
jne 0x10284b6
mov ecx, dword [ebp + 8]
push edi
call fcn.0100972d
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test bl, bl
je 0x1028573
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
test eax, eax
setne bl
test bl, bl
je 0x1028573
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
mov ebx, dword [eax - 8]
call fcn.0100884b
mov eax, dword [ebp - 0x10]
cmp byte [ebx + eax - 1], 0x5c
je 0x102850a
mov ebx, 0x10989d8
mov eax, ebx
test eax, eax
je 0x10284fe
push ebx
call fcn.0105c0e0
pop ecx
jmp 0x1028500
xor eax, eax
push ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.01008a89
mov eax, dword [esi + 0x38]
push eax
mov ecx, dword [eax - 8]
push ecx
lea ecx, [ebp - 0x10]
call fcn.01008a89
push 1
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.01016be3
test eax, eax
setge bl
test bl, bl
je 0x1028573
mov eax, dword [esi + 0x18]
mov ecx, esi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
mov eax, dword [esi]
call dword [eax + 0x38]
push eax
lea ecx, [ebp - 0x1c]
call fcn.01016a76
test eax, eax
setge bl
test bl, bl
je 0x1028573
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.01008a01
cmp byte [ebp + 0x10], 0
je 0x1028573
push dword [ebp - 0x10]
mov ecx, dword [0x10a41bc]
call fcn.0100b289
lea ecx, [ebp - 0x1c]
call fcn.01016ae8
cmp byte [esi + 0x1d], 0
je 0x102858a
push dword [esi + 0x2c]
call fcn.0105ad60
pop ecx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x2c], edi
mov byte [esi + 0x1d], 1
mov dword [esi + 0x18], edi
call fcn.01016958
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.01001190
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x1030f60
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x10a41bc]
sub esp, 0x20
push esi
mov esi, ecx
mov ecx, dword [eax + 4]
push 1
push str.showpopups
call fcn.01011f03
test eax, eax
jne 0x1030f87
mov al, 1
pop esi
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, esi
call fcn.0102c016
test al, al
jne 0x1030f9e
pop esi
add esp, 0x20
ret 4
push ebx
lea edx, [esp + 8]
push edi
xor ebx, ebx
push edx
push 0x1031280
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [str.ToolTray_Window]
mov ecx, dword [esi + 4]
lea edi, [esi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x1031023
mov ecx, dword [edi]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
sub edx, eax
push 5
push ebx
add edx, ecx
push ebx
push edx
call fcn.01044416
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
sub ecx, edx
mov edx, dword [edi]
add eax, ecx
push eax
push ebx
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x1031030
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
mov eax, dword [esi + 0x13c]
cmp eax, ebx
je 0x1031064
lea eax, [eax + eax*2]
mov edx, dword [0x109c68c]
push ebx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov eax, dword [edi]
shl ecx, 5
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x138], eax
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x20
ret 4

Function at 0x10314b0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x10827c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x10891d0
mov dword [esi + 0x80], 0x10891cc
mov eax, dword [esi + 0x88]
mov dword [esp + 0x10], 3
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x10314f9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.01032800
lea ecx, [esi + 0x90]
mov byte [esp + 0x10], 2
call fcn.01052f20
mov eax, dword [esi + 0x8c]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x103152e
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x103152e
push eax
call fcn.0105b157
add esp, 4
mov eax, dword [esi + 0x88]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x103154e
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x103154e
push eax
call fcn.0105b157
add esp, 4
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.01020f8f
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1032ae0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x88]
test eax, eax
je 0x1032b27
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1032b1d
mov ecx, dword [esi + 0x88]
push 0
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x88]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0x88], 0
mov eax, dword [esi + 0x84]
test eax, eax
je 0x1032b41
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x84], 0
mov eax, dword [esi + 0x80]
test eax, eax
je 0x1032b55
mov dword [esi + 0x80], 0
pop esi
ret

Function at 0x1033240
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x98], 1
je 0x10332a4
mov eax, dword [esi + 0x88]
test eax, eax
je 0x10332a4
mov dword [esi + 0x98], 1
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1033292
mov ecx, dword [esi + 0x88]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ecx + 0x20]
push edx
call edi
mov eax, dword [esi + 0x88]
push 0
mov ecx, dword [eax + 4]
push ecx
call edi
pop edi
mov eax, dword [esi + 4]
push 1
lea edx, [esi + 0x38]
push 0
push edx
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop esi
ret
Function at 0x10399c0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x108305a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x1089804
mov dword [esp + 0x10], 7
call fcn.01039b10
mov eax, dword [esi + 0xe0]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x1039a04
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0xec]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1039a24
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x1039a24
push eax
call fcn.0105b157
add esp, 4
mov eax, dword [esi + 0xe0]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1039a44
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x1039a44
push eax
call fcn.0105b157
add esp, 4
mov eax, dword [esi + 0xd8]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1039a64
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x1039a64
push eax
call fcn.0105b157
add esp, 4
mov eax, dword [esi + 0xd4]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1039a84
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x1039a84
push eax
call fcn.0105b157
add esp, 4
mov eax, dword [esi + 0xd0]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1039aa4
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x1039aa4
push eax
call fcn.0105b157
add esp, 4
mov eax, dword [esi + 0xcc]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1039ac4
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x1039ac4
push eax
call fcn.0105b157
add esp, 4
mov eax, dword [esi + 0xc0]
sub eax, 0xc
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1039ae4
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x1039ae4
push eax
call fcn.0105b157
add esp, 4
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.010329c0
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x103d6f0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x80]
test eax, eax
je 0x103d742
mov ecx, dword [esi + 0x120]
mov eax, 2
cmp ecx, eax
je 0x103d742
mov dword [esi + 0x120], eax
mov eax, dword [esi + 0xb4]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov ecx, dword [esi + 0x100]
push 5
push ecx
call edi
mov eax, dword [esi + 4]
push 1
lea edx, [esi + 0x38]
push 0
push edx
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
ret

Function at 0x103e530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1083617
call fcn.0105c800
push ecx
push ebx
push esi
mov esi, ecx
push 0xffffffffffffff9b
push 0x109a4ec
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
call fcn.010087b8
mov eax, dword [0x1098824]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 8], eax
mov eax, dword [0x1098824]
mov dword [esi + 0xc], eax
mov eax, dword [0x1098824]
mov dword [esi + 0x10], eax
mov eax, dword [0x1098824]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0x3e8
mov byte [esi + 0x1c], bl
mov eax, dword [0x1098824]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov eax, dword [0x1098824]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov eax, dword [0x1098824]
mov dword [esi + 0x44], eax
mov eax, dword [0x1098824]
mov dword [esi + 0x48], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 8
mov byte [esi + 0x4c], bl
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
call fcn.01018cca
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x78], bl
mov dword [esi], 0x10899b8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x103eb93
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1083726
call fcn.0105c800
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov dword [esi], 0x10899cc
lea edi, [esi + 0x10]
lea eax, [ebp - 0xd]
xor ebx, ebx
push eax
mov ecx, edi
mov dword [ebp - 4], ebx
mov byte [esi + 4], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0103f7cc
mov al, byte [ebp - 0xd]
mov byte [edi + 0x30], al
mov al, byte [ebp - 0xd]
lea edi, [esi + 0x44]
push ebx
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
mov byte [edi], al
call fcn.0102e113
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov byte [ebp - 4], 2
mov dword [esi + 0x50], ebx
mov byte [esi + 0x54], bl
mov dword [esi], 0x10899c0
call fcn.0104217f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1040c98
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0x29
push ebx
push esi
mov esi, ecx
je 0x1040dc4
cmp dword [ebp + 0x10], 0x46
je 0x1040d93
cmp dword [ebp + 0x10], 0x64
jne 0x1040dd0
mov eax, dword [ebp + 0x14]
cmp dword [eax], 1
jne 0x1040d01
lea eax, [esi + 8]
xor ebx, ebx
cmp dword [eax], ebx
jne 0x1040cf3
push eax
push ebx
push esi
push 0x1040dd6
push ebx
push ebx
call fcn.0105e167
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1040dd0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1040dd0
mov ecx, dword [eax + 4]
cmp ecx, 0x2f0d
je 0x1040d14
cmp ecx, 0x2f06
jne 0x1040d90
lea eax, [esi + 0x8c]
xor ebx, ebx
cmp byte [eax], bl
jne 0x1040d90
mov byte [eax], 1
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push 0x1f
push dword [esi + 0x14]
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], 4
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
test eax, eax
je 0x1040d59
or byte [ebp + 0x11], 0xf1
lea eax, [ebp + 0x10]
push 4
push eax
push 0x1f
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push dword [esi + 0x84]
mov eax, dword [esi + 0x78]
push dword [esi + 0x20]
push dword [eax - 8]
push eax
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1040dd0
push eax
mov ecx, esi
call fcn.0104191d
mov ecx, esi
call fcn.0104193f
jmp 0x1040dd0
push ecx
jmp 0x1040d80
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, dword [esi + 0x10]
jne 0x1040dae
cmp byte [esi + 0x74], bl
je 0x1040dae
cmp esi, ebx
je 0x1040dae
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
call fcn.01041fb9
test al, al
je 0x1040dd0
push ebx
push ebx
push 8
mov ecx, esi
call fcn.01041c98
jmp 0x1040dd0
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x1040dd0
mov byte [esi + 0x75], 1
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x10417fb
Capabilities:
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push edi
xor edi, edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0x20000005
push dword [esi + 0x14]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1041832
mov dword [ebp - 4], edi
and byte [esi + 0x75], 0
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
push 0x40
lea edi, [ebp - 0x134]
pop ecx
mov dword [ebp - 0x34], 0x28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x134]
push esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x34]
push 8
push eax
push dword [esi + 0x14]
mov dword [ebp - 0x1c], 0x100
call dword [sym.imp.WININET.dll_InternetReadFileExA]
dec eax
neg eax
sbb al, al
inc al
movzx edi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x10418a4
cmp eax, 0x3e5
jne 0x10418fd
push 0xea60
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10418fd
push 1
pop edi
jmp 0x10418f3
mov eax, dword [ebp - 0x1c]
test eax, eax
mov dword [ebp - 8], eax
jle 0x10418e8
mov eax, dword [esi + 0x54]
lea edx, [ebp - 8]
lea ecx, [esi + 0x54]
push edx
push dword [ebp - 0x20]
call dword [eax + 0x28]
cmp byte [esi + 0x8d], 0
je 0x10418ec
mov eax, dword [esi + 0x50]
cmp eax, 0xce
je 0x10418d8
cmp eax, 0xc8
jne 0x10418ec
push 0
mov ecx, esi
push dword [ebp - 8]
push 5
call fcn.01041c98
jmp 0x10418ec
mov byte [esi + 0x75], 1
mov dword [ebp - 0x1c], 0x100
cmp byte [esi + 0x75], 0
je 0x1041836
mov eax, edi
pop edi
neg eax
sbb eax, eax
pop esi
and eax, 0x7fffbffb
add eax, 0x80004005
leave
ret