joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b4c27
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
mov edx, 0x10000000
mov bl, 1
cmp eax, 0xffffffff
je 0x100b4d8f
cmp eax, 0x7c
je 0x100b4d8f
cmp eax, 0x29
jne 0x100b4c62
cmp dword [esi + 0x10], 0
jne 0x100b4d8f
test dword [esi + 0x50], edx
je 0x100b4d7c
cmp eax, 0x2e
jne 0x100b4c7d
push 5
lea ecx, [esi + 0x24]
call fcn.100b643d
mov ecx, esi
call fcn.100b647b
jmp 0x100b4d6e
cmp eax, 0x5c
jne 0x100b4cd4
mov ecx, esi
call fcn.100b647b
test byte [esi + 0x50], 0x80
je 0x100b4cc8
movzx eax, word [esi + 0x48]
mov ecx, eax
cmp eax, 0x62
jne 0x100b4cb0
push 4
lea ecx, [esi + 0x24]
call fcn.100b643d
mov ecx, esi
call fcn.100b647b
jmp 0x100b4d75
cmp ecx, 0x42
jne 0x100b4cc8
push 4
lea ecx, [esi + 0x24]
call fcn.100b643d
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100b4ca4
mov ecx, esi
call fcn.100b4d95
jmp 0x100b4d6e
cmp eax, 0x5b
jne 0x100b4cf4
mov ecx, esi
call fcn.100b647b
mov ecx, esi
call fcn.100b517b
push 4
push 0x5d
mov ecx, esi
call fcn.100b5e43
jmp 0x100b4d6e
cmp eax, 0x28
jne 0x100b4d16
mov ecx, esi
call fcn.100b647b
mov ecx, esi
call fcn.100b6752
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.100b5e43
jmp 0x100b4d6a
cmp eax, 0x5e
jne 0x100b4d22
push 2
jmp 0x100b4c9c
cmp eax, 0x24
jne 0x100b4d2e
push 3
jmp 0x100b4c9c
cmp eax, 0x2a
je 0x100b4d8b
cmp eax, 0x2b
je 0x100b4d8b
cmp eax, 0x3f
je 0x100b4d8b
cmp eax, 0x7b
je 0x100b4d8b
cmp eax, 0x7d
jne 0x100b4d4c
test dword [esi + 0x50], edx
je 0x100b4d83
cmp eax, 0x5d
jne 0x100b4d56
test dword [esi + 0x50], edx
je 0x100b4d87
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.100b458e
mov ecx, esi
call fcn.100b647b
test bl, bl
je 0x100b4d75
mov ecx, esi
call fcn.100b64a4
mov cl, 1
jmp 0x100b4c2e
push 5
call fcn.100b5e37
push 6
jmp 0x100b4d7e
push 4
jmp 0x100b4d7e
push 0xa
jmp 0x100b4d7e
pop esi
mov al, cl
pop ebx
pop ecx
ret

Function at 0x100b95aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x20], 0
jne 0x100b95f5
push str.ORegistryKey.GetValue_failure:_Cannot_get_QWORD_value._The_registry_key_is_closed_or_not_set
push ecx
push 0x30303030
lea ecx, [ebp - 0x398]
call fcn.100b7ff1
push 0x101ebb90
lea eax, [ebp - 0x398]
push eax
call fcn.100357e4
mov ecx, edi
mov dword [ebp - 0x39c], 0xb
mov dword [ebp - 0x3a0], 8
call fcn.100278ea
lea ecx, [ebp - 0x3a0]
push ecx
push ebx
lea ecx, [ebp - 0x39c]
push ecx
push 0
push eax
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
je 0x100b9657
cmp ecx, 2
je 0x100b9653
cmp ecx, 0xea
je 0x100b9653
push edi
lea eax, [esi + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.100626b7
jmp 0x100b95e4
xor al, al
jmp 0x100b9661
cmp dword [ebp - 0x39c], 0xb
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033218
leave
ret 8
Function at 0x100ba3d2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x20], 0
jne 0x100ba41d
push str.ORegistryKey.GetValue_failure:_Cannot_get_DWORD_value._The_registry_key_is_closed_or_not_set
push ecx
push 0x30303030
lea ecx, [ebp - 0x398]
call fcn.100b7ff1
push 0x101ebb90
lea eax, [ebp - 0x398]
push eax
call fcn.100357e4
push 4
pop eax
mov ecx, edi
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x3a0], eax
call fcn.100278ea
lea ecx, [ebp - 0x3a0]
push ecx
push ebx
lea ecx, [ebp - 0x39c]
push ecx
push 0
push eax
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
je 0x100ba47a
cmp ecx, 2
je 0x100ba476
cmp ecx, 0xea
je 0x100ba476
push edi
lea eax, [esi + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x398]
call fcn.100626b7
jmp 0x100ba40c
xor al, al
jmp 0x100ba484
cmp dword [ebp - 0x39c], 4
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033218
leave
ret 8
Function at 0x100c23e9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cf31
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.100c237b
xor eax, eax
mov dword [ebx], 0x101a61e8
mov dword [ebx + 4], 0x101a61bc
lea edi, [ebx + 0xc]
mov dword [ebx + 8], 0x101a61a0
lea esi, [ebx + 0xbc]
mov dword [edi], 0x101a618c
mov ecx, esi
mov dword [ebx + 0x10], 0x101a6178
mov word [ebx + 0x14], ax
mov byte [ebx + 0x16], 1
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov byte [ebx + 0x44], 1
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
mov byte [ebx + 0x70], al
mov dword [ebx + 0x74], esi
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x90], eax
mov byte [ebx + 0x94], al
mov dword [ebx + 0x98], esi
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov dword [ebx + 0xb0], eax
mov dword [ebx + 0xb4], eax
mov byte [ebx + 0xb8], al
call fcn.10025514
lea eax, [ebx + 0xec]
xor ecx, ecx
mov word [eax + 8], cx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [ebx + 0x104], ecx
lea ecx, [ebx + 0x108]
push str.Sequential_Queue
call fcn.100245f6
and dword [ebx + 0x120], 0
test byte [0x10206bc0], 0x10
je 0x100c2549
push ebx
lea eax, [ebx + 0xec]
mov edx, 0x101a5d80
push eax
push ebx
call fcn.100bea67
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100c680f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014ca76
mov eax, dword fs:[0]
push eax
push ebx
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
push ebx
push ebx
lea eax, [edi + 0x14]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
push 0
push 0
lea eax, [edi + 0x34]
inc ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov al, byte [ebp + 8]
mov byte [edi + 0x50], al
xor eax, eax
mov dword [edi + 8], eax
mov byte [edi + 0x51], bl
mov dword [edi + 0x4c], ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
leave
ret 0xc
Function at 0x100d7578
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10153e9d
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x618], ebx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x62c], eax
mov eax, esi
and eax, 0x200
or eax, 0
je 0x100d7712
and dword [ebp - 0x620], 0
lea eax, [ebp - 0x620]
push ecx
xor edx, edx
mov ecx, 0x10188ec8
push eax
inc edx
call fcn.1007251f
test eax, eax
jne 0x100d7712
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x614], eax
push ecx
lea ecx, [ebp - 0x610]
mov dword [ebp - 0x628], 0x200
push ecx
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x624], 0x100
push ecx
push 0
lea ecx, [ebp - 0x624]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push eax
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x100d7706
and dword [ebp - 0x61c], eax
cmp dword [ebp - 0x630], 1
jne 0x100d769d
mov edx, dword [ebp - 0x624]
test edx, edx
je 0x100d769d
cmp dword [edi], edx
jbe 0x100d769d
push edx
push dword [ebx]
lea ecx, [ebp - 0x410]
call fcn.1007502c
test al, al
je 0x100d769d
mov ebx, dword [ebp - 0x628]
lea edx, [ebp - 0x61c]
mov ecx, dword [edi]
push dword [ebp - 0x62c]
shr ebx, 1
dec ebx
add ecx, ebx
add ecx, ecx
call fcn.100742aa
test eax, eax
jns 0x100d76a9
mov ebx, dword [ebp - 0x618]
mov eax, dword [ebp - 0x614]
inc eax
jmp 0x100d75f0
mov edx, dword [edi]
lea esi, [ebx + ebx]
mov ecx, dword [ebp - 0x61c]
lea eax, [ebp - 0x610]
add edx, ebx
push esi
push eax
add edx, edx
call fcn.1006b36b
mov edx, dword [edi]
mov ecx, dword [ebp - 0x618]
add edx, edx
push edx
push dword [ecx]
mov ecx, dword [ebp - 0x61c]
lea ecx, [esi + ecx]
call fcn.1006b36b
mov eax, dword [ebp - 0x618]
add esp, 0x10
mov ecx, dword [ebp - 0x61c]
push dword [ebp - 0x620]
mov dword [eax], ecx
add dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x100d77b4
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and esi, 0x400
or esi, 0
je 0x100d77b2
push 0x100
lea edx, [ebp - 0x210]
mov ecx, 0x10187b60
call fcn.100701c0
lea ecx, [ebp - 0x210]
call fcn.1007015b
and dword [ebp - 0x614], 0
mov ebx, eax
test ebx, ebx
je 0x100d77b2
mov ecx, dword [edi]
lea edx, [ebp - 0x614]
push dword [ebp - 0x62c]
add ecx, ebx
add ecx, ecx
call fcn.100742aa
test eax, eax
js 0x100d77b2
lea esi, [ebx + ebx]
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x614]
call fcn.1003529d
mov eax, dword [edi]
add eax, eax
push eax
mov eax, dword [ebp - 0x618]
push dword [eax]
mov eax, dword [ebp - 0x614]
add eax, esi
push eax
call fcn.1003529d
mov ecx, dword [ebp - 0x618]
add esp, 0x18
mov eax, dword [ebp - 0x614]
mov dword [ecx], eax
add dword [edi], ebx
jmp 0x100d76ff
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10033218
leave
ret 0xc
Function at 0x100d7c8d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10153f2a
mov eax, dword fs:[0]
push eax
mov eax, 0x1088
call fcn.1003430e
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0
push ecx
push 0x7e
mov ecx, edi
call fcn.100d61ef
cmp eax, 0xffffffff
je 0x100d7ead
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0x824
lea ecx, [ebp - 0x105c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
test ebx, ebx
jne 0x100d7db1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100d7ead
mov esi, dword [edi]
mov ecx, edi
call dword [esi + 0xc]
push eax
mov ecx, edi
call dword [esi + 0x4c]
mov edx, dword [edi]
mov esi, eax
mov ecx, edi
mov dword [ebp - 0x1060], esi
call dword [edx + 0xc]
push 0x5c
pop ecx
push ecx
mov edx, eax
mov ecx, esi
call fcn.10080a0a
mov esi, eax
test esi, esi
je 0x100d7daa
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x105c]
push 0x824
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ebx, eax
push 0x5c
pop eax
mov word [esi], ax
lea eax, [ebx - 1]
cmp eax, 0x823
ja 0x100d7daa
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
mov ecx, esi
sub ecx, dword [ebp - 0x1060]
sar ecx, 1
sub eax, ecx
lea ecx, [ebx + eax]
mov dword [ebp - 0x1060], ecx
cmp ecx, 0x824
ja 0x100d7da8
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x105c]
lea eax, [eax + ebx*2]
push esi
push eax
call fcn.1003529d
mov ecx, dword [ebp - 0x1060]
add esp, 0xc
mov ebx, ecx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x50]
lea eax, [ebx - 1]
cmp eax, 0x823
ja 0x100d7ead
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov edx, eax
lea ecx, [ebp - 0x105c]
call fcn.1006b23b
test al, al
jne 0x100d7ead
lea eax, [ebp - 0x105c]
mov dword [ebp - 0x106c], str.After
mov dword [ebp - 0x1068], eax
mov esi, vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
xor eax, eax
mov dword [ebp - 0x1070], esi
mov word [ebp - 0x1064], ax
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 4]
mov dword [ebp - 0x1078], eax
mov ecx, 0x7c7180
xor eax, eax
mov dword [ebp - 0x1080], esi
push eax
push 0xf
pop esi
push esi
mov dword [ebp - 0x107c], str.Before
mov word [ebp - 0x1074], ax
lea edx, [esi + 0x7c]
call fcn.1002c770
test al, al
je 0x100d7e86
xor eax, eax
mov dword [ebp - 0x1094], 0x7c7180
mov word [ebp - 0x1088], ax
lea edx, [ebp - 0x1080]
lea eax, [ebp - 0x1070]
mov dword [ebp - 0x1090], 0x8b
push eax
lea ecx, [ebp - 0x1094]
mov dword [ebp - 0x108c], esi
mov dword [ebp - 0x1084], str.Converted_something_to_long_name_
call fcn.10062d69
cmp ebx, 0x104
ja 0x100d7ead
mov eax, dword [edi]
lea ecx, [ebp - 0x105c]
push ebx
push ecx
mov ecx, edi
call dword [eax + 0x1c]
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
jmp 0x100d7eb0
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10033218
leave
ret 4
Function at 0x100d8b84
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push ebx
mov ebx, ecx
push esi
push edi
mov word [ebx], ax
call fcn.100d96f9
test al, al
je 0x100d8c6e
cmp dword [0x10206b50], 0
je 0x100d8bb2
xor eax, eax
inc eax
jmp 0x100d8c70
mov ecx, ebx
call fcn.1007015b
mov esi, eax
mov dword [ebp - 4], eax
test esi, esi
jg 0x100d8bce
push 0
push 0x14428f
call fcn.1002a3d0
push 0x5c
pop eax
mov edi, 0x104
cmp word [ebx + esi*2 - 2], ax
je 0x100d8bed
cmp esi, edi
je 0x100d8c6e
mov word [ebx + esi*2], ax
inc esi
mov dword [ebp - 4], esi
mov eax, esi
cdq
add eax, 0xc
adc edx, 0
mov dword [ebp - 0xc], edx
js 0x100d8c09
jg 0x100d8c04
cmp eax, 0x7fffffff
jbe 0x100d8c09
push 5
pop ecx
int 0x29
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push ecx
push eax
lea ecx, [ebp - 8]
call fcn.10080909
cmp dword [eax], edi
jg 0x100d8c6e
push 6
lea edi, [ebx + esi*2]
mov esi, str.Content.MSO
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.100d974d
test eax, eax
jne 0x100d8c57
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, ebx
call fcn.100a8251
or eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [ebx + eax*2 + 0x16], cx
xor ecx, ecx
mov word [ebx + eax*2 + 0x18], cx
jmp 0x100d8baa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100d8c75
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push edi
push 0x1015d794
mov esi, ecx
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov ebx, eax
test ebx, ebx
js 0x100d8cab
push dword [ebp - 4]
push 0x104
push esi
call fcn.1003d653
add esp, 0xc
mov eax, dword [ebp - 4]
shr ebx, 0x1f
xor bl, 1
test eax, eax
je 0x100d8cc2
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x100d9762
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101540ee
mov eax, dword fs:[0]
push eax
sub esp, 0x904
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
push 0x100
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x910]
push eax
call fcn.10035153
add esp, 0xc
lea edx, [ebp - 0x810]
mov ecx, esi
xor edi, edi
push 0x400
call fcn.1003094c
push 0x5c
pop esi
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.10034b3f
pop ecx
pop ecx
test eax, eax
je 0x100d97e6
xor ecx, ecx
mov dword [ebp + edi*4 - 0x910], eax
mov word [eax], cx
inc edi
cmp edi, 0x40
jge 0x100d9833
test eax, eax
je 0x100d97fe
lea ecx, [ebp - 0x810]
call fcn.100a8251
test eax, eax
js 0x100d97c6
cmp edi, 1
jle 0x100d982e
mov eax, dword [ebp + edi*4 - 0x914]
dec edi
push 0
mov word [eax], si
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100d97fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100d9833
xor eax, eax
inc eax
jmp 0x100d9835
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10033218
leave
ret

Function at 0x100db664
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cb8f
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0xc
mov ecx, 0x10206e20
call fcn.100dc3c8
mov dword [esi], eax
xor edi, edi
mov dword [esi + 4], edx
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.100dac70
mov dword [esi + 8], eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
call fcn.10084e70
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [ebp - 4], edi
push ecx
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.1002f5ff
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 0x30], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x100e7849
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [ebx + 8]
mov ecx, dword [esi + 4]
add ecx, 0x38
call fcn.100278ea
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x2c]
push 0x100
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], str.RequestId
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1006aea5
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], str.Mso::Http:_calling_WinHttpReadData
push eax
push ecx
push 0x64
mov edx, 0x33f
mov ecx, 0x1e499648
call fcn.1006ad8d
lea ecx, [ebp - 0x1c]
call fcn.100093c1
push 0
push dword [ebx + 4]
push dword [esi + 8]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
mov eax, dword [ebx]
pop edi
setne cl
pop esi
mov byte [eax], cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10033218
leave
ret 4
Function at 0x100f49d5
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x101fe1c0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
mov ecx, dword [esi + 0x28]
add ecx, 0x38
call fcn.100278ea
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x1c]
push 0x100
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], str.RequestId
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1006aea5
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], str.Calling_WinHttpReceiveResponse
push eax
push ecx
push 0x64
mov edx, 0x33f
mov ecx, 0x1e49964a
call fcn.1006ad8d
lea ecx, [esp + 0x2c]
call fcn.100093c1
mov eax, dword [esi + 0x28]
lea ecx, [esp + 0x10]
add eax, 0x6c
push eax
call fcn.1006b06a
mov ecx, dword [esp + 0x10]
call fcn.100df872
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x100f4a72
call fcn.10024d5e
push 0
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
mov eax, dword [edi]
pop edi
setne cl
pop esi
mov byte [eax], cl
mov ecx, dword [esp + 0x3c]
pop ebx
xor ecx, esp
call fcn.10033218
mov esp, ebp
pop ebp
ret 4
Function at 0x100f64db
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101556f9
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
xor eax, eax
push ecx
mov ecx, dword [ecx + 0x3c]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
call fcn.100f639c
push eax
lea ecx, [ebp - 0x50]
call fcn.1006f508
cmp dword [ebp - 0x50], 0
je 0x100f6683
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
jne 0x100f659b
push 1
lea ecx, [ebp - 0x50]
call fcn.100f8074
test al, al
jne 0x100f6590
push ebx
lea ecx, [ebp - 0x50]
call fcn.100f8074
test al, al
jne 0x100f6590
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x100f6587
mov edx, dword [ebp - 0x48]
test edx, edx
je 0x100f6587
mov ecx, eax
add edx, edx
je 0x100f6578
mov byte [ecx], 0
inc ecx
sub edx, 1
jne 0x100f656f
and dword [ebp - 0x4c], 0
and dword [ebp - 4], 0
push eax
call fcn.1003bf94
pop ecx
and dword [ebp - 0x48], 0
jmp 0x100f6683
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x100f6683
mov eax, dword [ebp - 0x48]
cmp eax, 1
jbe 0x100f6683
and dword [ebp - 0x58], 0
lea ecx, [ebp - 0x58]
add eax, 0xb
mov dword [ebp - 0x54], eax
add eax, eax
push eax
call fcn.10073f8e
mov esi, dword [ebp - 0x58]
test al, al
je 0x100f6671
push dword [ebp - 0x54]
mov edx, esi
mov ecx, str.Cookie:
call fcn.1003094c
push dword [ebp - 0x54]
mov edx, esi
mov ecx, ebx
call fcn.10080a7a
push dword [ebp - 0x54]
mov edx, esi
mov ecx, 0x101abd88
call fcn.10080a7a
lea edx, [ebp - 0x41]
mov ecx, 0x3a9b
call fcn.100f88c3
cmp byte [ebp - 0x41], 0
je 0x100f6640
test edi, edi
je 0x100f6640
mov eax, dword [edi]
lea ecx, [ebp - 0x40]
push ebx
mov edi, dword [eax + 0x1c]
call fcn.100111ba
push str.Cookie
lea ecx, [ebp - 0x28]
call fcn.100111ba
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call edi
lea ecx, [ebp - 0x28]
call fcn.100093c1
lea ecx, [ebp - 0x40]
call fcn.100093c1
push 0xa0000000
push 0xffffffffffffffff
push esi
push dword [ebp - 0x60]
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x100f6671
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
je 0x100f6685
push esi
mov dword [ebp - 4], 1
call fcn.1003bf94
pop ecx
jmp 0x100f6685
test esi, esi
je 0x100f6683
push esi
mov dword [ebp - 4], 2
call fcn.1003bf94
pop ecx
xor edi, edi
lea ecx, [ebp - 0x50]
call fcn.100f5efe
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10033218
leave
ret 8
Function at 0x100f68de
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cbdb
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esi], 0x101adab8
call fcn.1002ef21
lea eax, [esi + 0x2c]
xor ebx, ebx
push eax
mov dword [esi + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
mov byte [esi + 0x30], bl
mov eax, esi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x10101d8e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x18], 0
je 0x10101d9a
pop ebp
jmp fcn.10101da1
xor eax, eax
inc eax
pop ebp
ret 4