joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020edb
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100cc44b
call fcn.100b286c
sub esp, 0x228
mov eax, dword [0x10120240]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x218]
push eax
xor esi, esi
push esi
push esi
push 0x801c
push esi
mov edi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
mov ebx, dword [ebp + 8]
jl 0x10021014
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224]
call fcn.1007e254
lea eax, [ebp - 0x224]
push eax
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.1007e46a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.1007e410
lea esi, [edi + 0x10]
mov ecx, esi
call fcn.1007e67a
test eax, eax
jne 0x10021048
mov ecx, esi
call fcn.1007e558
push eax
mov ecx, ebx
call fcn.1007ee9b
xor esi, esi
inc esi
cmp dword [ebp + 0xc], 0
jne 0x10020fd3
mov ecx, edi
call fcn.10018f69
test eax, eax
jne 0x10020fd3
push str.Communities
mov ecx, ebx
call fcn.1007ee9b
lea eax, [ebp - 0x224]
push eax
mov ecx, edi
call fcn.1001aa9b
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], esi
call fcn.1007e67a
test eax, eax
lea ecx, [ebp - 0x224]
jne 0x1002103f
call fcn.1007e558
push eax
mov ecx, ebx
call fcn.1007ee9b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.1007e410
lea ecx, [ebp + 8]
call fcn.1003442f
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x234], esp
push ebx
mov dword [ebp - 4], 2
call fcn.1007ed4f
lea ecx, [ebp + 8]
call fcn.100348bc
or dword [ebp - 4], 0xffffffff
test eax, eax
lea ecx, [ebp + 8]
je 0x1002100f
call fcn.10034438
mov eax, esi
jmp 0x1002104a
call fcn.10034438
push 0x100df794
lea ecx, [ebp - 0x230]
call fcn.1007e254
lea eax, [ebp - 0x230]
push eax
mov ecx, ebx
mov dword [ebp - 4], 3
call fcn.1007e46a
lea ecx, [ebp - 0x230]
or dword [ebp - 4], 0xffffffff
call fcn.1007e410
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.100b29c1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1002ca7b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100cdbe4
call fcn.100b286c
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.100aab52
xor edi, edi
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], edi
mov dword [esi], 0x100e4c38
call fcn.1007e247
lea ebx, [esi + 0x30]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.1007e247
push 0x100df794
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
call fcn.1007e254
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.1007e46a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 4], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1002d215
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100cdcbf
call fcn.100b286c
sub esp, 0x20
and dword [ebp - 0x14], 0
push edi
mov edi, ecx
lea ecx, [ebp - 0x20]
call fcn.1007e247
mov eax, dword [edi + 4]
test eax, eax
mov dword [ebp - 4], 1
je 0x1002d2c7
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1002d2c7
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
lea ebx, [esi + esi]
push ebx
call fcn.100b29d4
push ebx
push 0
push eax
mov dword [ebp - 0x10], eax
call fcn.100b2930
add esp, 0x10
push esi
push dword [ebp - 0x10]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
pop esi
pop ebx
lea ecx, [ebp - 0x2c]
jne 0x1002d29a
push 0x100df794
call fcn.1007e254
mov byte [ebp - 4], 2
jmp 0x1002d2a6
push dword [ebp - 0x10]
call fcn.1007e254
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push eax
call fcn.1007e46a
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.1007e410
push dword [ebp - 0x10]
call fcn.100b29cf
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.1007ed4f
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 0
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10032fa8
Capabilities:
Encrypt data using dpapi

Disassembly:
mov eax, 0x100ce85c
call fcn.100b286c
sub esp, 0x24
mov ecx, dword [ebp + 8]
call fcn.1007e67a
test eax, eax
jne 0x1003308d
push esi
push edi
push 8
xor edi, edi
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.100b2930
push 8
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.100b2930
push 8
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.100b2930
mov ecx, dword [ebp + 8]
add esp, 0x24
call fcn.1007e558
mov ecx, dword [ebp + 8]
mov esi, eax
call fcn.1007e4d3
mov ecx, dword [ebp + 0xc]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
call fcn.1007e67a
test eax, eax
jne 0x10033034
mov ecx, dword [ebp + 0xc]
call fcn.1007e558
mov ecx, dword [ebp + 0xc]
mov esi, eax
call fcn.1007e4d3
lea eax, [eax + eax + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 0x14]
call fcn.1007e67a
test eax, eax
je 0x10033068
push str.Encription_General_Description
lea ecx, [ebp - 0x30]
call fcn.1007e254
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], edi
call fcn.1007e46a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1007e410
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x24]
push eax
push 4
push edi
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.1007e558
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
pop edi
pop esi
jne 0x10033091
xor eax, eax
jmp 0x1003309c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x100330aa
Capabilities:
Encrypt data using dpapi

Disassembly:
mov eax, 0x100ce87e
call fcn.100b286c
sub esp, 0x34
push ebx
push esi
push edi
push 0x100df794
lea ecx, [ebp - 0x40]
call fcn.1007e254
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1007e46a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1007e410
push 8
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.100b2930
push 8
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.100b2930
push 8
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.100b2930
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add esp, 0x24
mov ecx, esi
mov dword [ebp - 0x28], eax
call fcn.1007e67a
test eax, eax
jne 0x10033141
mov ecx, esi
call fcn.1007e558
mov ecx, esi
mov edi, eax
call fcn.1007e4d3
lea eax, [eax + eax + 2]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp + 0x18]
call fcn.1007e67a
test eax, eax
je 0x10033179
push str.Encription_General_Description
lea ecx, [ebp - 0x40]
call fcn.1007e254
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 4], 1
call fcn.1007e46a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1007e410
mov ecx, dword [ebp + 0x18]
call fcn.1007e558
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call edi
cmp eax, ebx
jne 0x10033251
cmp dword [ebp - 0x14], ebx
je 0x100331b6
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, esi
call fcn.1007e67a
test eax, eax
jne 0x1003324d
mov ecx, dword [ebp + 0xc]
mov esi, 0xfde9
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.1007e2fa
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 2
call fcn.1000335c
lea ecx, [ebp - 0x34]
mov dword [ebp + 0x18], eax
call fcn.100032d4
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call edi
cmp eax, ebx
jne 0x10033225
cmp dword [ebp - 0x14], ebx
je 0x1003323d
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1003323d
mov ecx, dword [ebp + 0x10]
push esi
push dword [ebp - 0x14]
call fcn.1007f358
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10003276
mov eax, ebx
jmp 0x10033268
xor eax, eax
jmp 0x10033268
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
call fcn.1007e4e2
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x1003afdc
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x1003affb
test al, 0x48
jne 0x1003affb
xor eax, eax
leave
ret
shr eax, 5
not eax
and eax, 1
leave
ret

Function at 0x1003b38e
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x100d004b
call fcn.100b286c
push esi
mov esi, ecx
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [esi + 0x30], eax
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x18]
call fcn.1007e46a
push esi
push 0
push 0x1003b060
call fcn.100b2de1
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x1003b3dc
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x100d005d
call fcn.100b286c
push esi
mov esi, ecx
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov dword [esi + 0x30], eax
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x18]
call fcn.1007e46a
push esi
push 0
push 0x1003b17a
call fcn.100b2de1
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x1003b42a
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100d0077
call fcn.100b286c
push esi
mov esi, ecx
lea eax, [ebp + 0x18]
push eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 1
call fcn.1007e46a
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x18]
call fcn.1007e46a
mov eax, dword [ebp + 0x24]
push esi
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x14]
push 0
push 0x1003b2dc
mov dword [esi + 0x30], eax
call fcn.100b2de1
add esp, 0xc
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.1007e410
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x20
Function at 0x1003b9c9
Capabilities:
Parse url

Disassembly:
mov eax, 0x100d0123
call fcn.100b286c
push ecx
mov eax, 0x20e8
call fcn.100b50b0
mov eax, dword [0x10120240]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, 0x1048
push esi
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp - 0x20a4]
push ebx
push eax
call fcn.100b2930
push esi
lea eax, [ebp - 0x105c]
push ebx
push eax
call fcn.100b2930
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x20f8]
push ebx
push eax
call fcn.100b2930
lea eax, [ebp - 0x105c]
lea ecx, [ebp - 0x20a4]
mov dword [ebp - 0x20e8], eax
mov eax, 0x823
mov dword [ebp - 0x20cc], ecx
mov ecx, dword [ebp + 8]
add esp, 0x24
mov dword [ebp - 0x20f8], esi
mov dword [ebp - 0x20e4], eax
mov dword [ebp - 0x20c8], eax
mov dword [ebp - 4], ebx
call fcn.1007e49f
lea ecx, [ebp - 0x20f8]
push ecx
push 0x10000000
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1003baeb
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x20bc]
call fcn.1007e254
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x20bc]
push eax
mov byte [ebp - 4], 1
call fcn.1007e46a
lea ecx, [ebp - 0x20bc]
mov byte [ebp - 4], bl
call fcn.1007e410
lea eax, [ebp - 0x20a4]
push eax
lea ecx, [ebp - 0x20b0]
call fcn.1007e254
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20b0]
push eax
mov byte [ebp - 4], 2
call fcn.1007e46a
lea ecx, [ebp - 0x20b0]
mov byte [ebp - 4], bl
call fcn.1007e410
mov eax, dword [ebp + 0x14]
mov cx, word [ebp - 0x20e0]
mov word [eax], cx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.100b29c1
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1003bb11
Capabilities:
Parse url

Disassembly:
mov eax, 0x100d0143
call fcn.100b286c
push ecx
mov eax, 0x10a0
call fcn.100b50b0
mov eax, dword [0x10120240]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, 0x824
push esi
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp - 0x105c]
push ebx
push eax
call fcn.100b2930
push esi
lea eax, [ebp - 0x838]
push ebx
push eax
call fcn.100b2930
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x10b0]
push ebx
push eax
call fcn.100b2930
lea eax, [ebp - 0x838]
lea ecx, [ebp - 0x105c]
mov dword [ebp - 0x10a0], eax
mov eax, 0x823
mov dword [ebp - 0x1084], ecx
mov ecx, dword [ebp + 8]
add esp, 0x24
mov dword [ebp - 0x10b0], esi
mov dword [ebp - 0x109c], eax
mov dword [ebp - 0x1080], eax
mov dword [ebp - 4], ebx
call fcn.10003294
lea ecx, [ebp - 0x10b0]
push ecx
push 0x10000000
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1003bc33
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x1074]
call fcn.100031e9
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x1074]
push eax
mov byte [ebp - 4], 1
call fcn.10003ff5
lea ecx, [ebp - 0x1074]
mov byte [ebp - 4], bl
call fcn.10003276
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x1068]
call fcn.100031e9
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x1068]
push eax
mov byte [ebp - 4], 2
call fcn.10003ff5
lea ecx, [ebp - 0x1068]
mov byte [ebp - 4], bl
call fcn.10003276
mov eax, dword [ebp + 0x14]
mov cx, word [ebp - 0x1098]
mov word [eax], cx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.100b29c1
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1003bcd6
Capabilities:
Create http request

Disassembly:
mov eax, 0x100d015f
call fcn.100b286c
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
call fcn.1003afdc
test eax, eax
je 0x1003bd3f
xor ebx, ebx
lea ecx, [edi + 0xc]
mov dword [ebp - 4], ebx
call fcn.1000335c
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
lea esi, [edi + 8]
mov dword [esi], eax
je 0x1003bd3f
push ebx
sub esp, 0xc
lea eax, [edi + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.10003fa5
push 0x29
push esi
mov ecx, edi
call fcn.1003bc59
cmp eax, ebx
je 0x1003bd3f
xor eax, eax
inc eax
jmp 0x1003bd41
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1003bd50
Capabilities:
Check http status code

Disassembly:
mov eax, 0x100d0189
call fcn.100b286c
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, 0xfde9
push esi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 1
call fcn.1007e2fa
push esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 2
call fcn.1007e2fa
mov esi, dword [ebp + 8]
xor ebx, ebx
xor edi, edi
cmp dword [esi], ebx
mov byte [ebp - 4], 4
je 0x1003be27
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x28]
call fcn.100032d4
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], eax
call fcn.1000335c
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x18], eax
call fcn.100032d4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.1000335c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
push eax
push dword [esi]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov edi, eax
cmp edi, ebx
jne 0x1003bdeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 8]
push eax
push 0x20000013
push dword [esi]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x1c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp + 8], 0xc8
je 0x1003be27
xor edi, edi
jmp 0x1003be27
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 2
call fcn.10003276
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.10003276
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.1007e410
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.1007e410
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x1c
Function at 0x1003bf18
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov eax, 0x100d01bd
call fcn.100b286c
sub esp, 0x50
mov eax, dword [0x10120240]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
je 0x1003c040
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.1007e67a
cmp eax, ebx
jne 0x1003c040
mov ecx, dword [ebp + 8]
push 0xfde9
lea eax, [ebp - 0x5c]
push eax
call fcn.1007e2fa
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.100032d4
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x50], eax
call fcn.1000335c
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push ebx
push 0x8003
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1003c02a
push ebx
push dword [ebp - 0x50]
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1003c02a
push 0x10
pop edi
xor esi, esi
push esi
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
push 2
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], edi
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1003c02a
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
xor edx, edx
cmp esi, edi
jge 0x1003c012
mov cl, byte [ebp + esi - 0x24]
mov al, cl
shr al, 4
cmp al, 9
movzx eax, al
jbe 0x1003bfef
add eax, 0x57
jmp 0x1003bff2
add eax, 0x30
and cl, 0xf
cmp cl, 9
mov byte [ebp + edx - 0x48], al
movzx eax, cl
jbe 0x1003c006
add eax, 0x57
jmp 0x1003c009
add eax, 0x30
mov byte [ebp + edx - 0x47], al
inc esi
inc edx
inc edx
jmp 0x1003bfd6
mov ecx, dword [ebp + 0xc]
push 0xfde9
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 0x28], 0
call fcn.1007f358
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.10003276
mov eax, ebx
jmp 0x1003c042
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.100b29c1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1003c05b
Capabilities:
Read data from internet
Receive data

Disassembly:
mov eax, 0x100d01d2
call fcn.100b286c
push ecx
mov eax, 0x8424
call fcn.100b50b0
mov eax, dword [0x10120240]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
call fcn.1007e575
lea ecx, [ebp - 0x8434]
call fcn.100031dc
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x841c], ebx
je 0x1003c1b4
mov byte [ebp - 4], 1
mov dword [ebp - 0x8420], ebx
mov edi, 0x7fff
mov esi, 0x400
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
mov dword [ebp - 0x8424], ebx
call fcn.100b2930
add esp, 0xc
push ebx
mov dword [ebp - 0x8428], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x8414]
push ebx
push eax
call fcn.100b2930
add esp, 0xc
lea eax, [ebp - 0x8420]
push eax
push edi
lea eax, [ebp - 0x8414]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, ebx
mov dword [ebp - 0x8418], eax
jne 0x1003c140
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8424], eax
lea eax, [ebp - 0x8428]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x8424]
push eax
call dword [sym.imp.WININET.dll_InternetGetLastResponseInfoA]
mov dword [ebp - 0x8418], eax
mov eax, dword [ebp - 0x8420]
cmp eax, ebx
mov byte [ebp + eax - 0x8414], bl
jbe 0x1003c17f
cmp dword [ebp - 0x8418], ebx
je 0x1003c16b
lea eax, [ebp - 0x8414]
push eax
lea ecx, [ebp - 0x8434]
call fcn.10004049
cmp dword [ebp - 0x8420], ebx
jbe 0x1003c17f
cmp dword [ebp - 0x8418], ebx
jne 0x1003c0b9
lea ecx, [ebp - 0x8434]
call fcn.1000347b
cmp eax, ebx
jne 0x1003c1b4
cmp dword [ebp - 0x8418], ebx
je 0x1003c1b4
mov ecx, dword [ebp + 0xc]
push 0xfde9
lea eax, [ebp - 0x8434]
push eax
call fcn.1007f32e
mov dword [ebp - 0x841c], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8434]
call fcn.10003276
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x841c]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.100b29c1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1003c1ef
Capabilities:
Connect to http server

Disassembly:
mov eax, 0x100d01ec
call fcn.100b286c
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
and dword [ebp - 4], 0
call fcn.1003afdc
test eax, eax
jne 0x1003c218
xor esi, esi
jmp 0x1003c2fa
lea ecx, [ebp + 8]
call fcn.1000347b
test eax, eax
jne 0x1003c211
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.10003fa5
xor ebx, ebx
inc ebx
push 0x3a
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.1000460b
movzx eax, word [ebp + 0x14]
push eax
lea ecx, [ebp - 0x20]
call fcn.1000405b
lea eax, [ebp - 0x20]
lea edi, [esi + 0x18]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.100042e6
test eax, eax
mov dword [ebp - 0x14], eax
je 0x1003c286
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.10003276
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10003276
mov eax, dword [ebp - 0x14]
jmp 0x1003c308
lea ecx, [ebp + 8]
call fcn.1000335c
push ebx
push 0x84000501
push 3
push 0
push 0
push dword [ebp + 0x14]
push eax
push dword [esi + 8]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov esi, eax
test esi, esi
jne 0x1003c2c8
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], al
call fcn.10003276
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10003276
xor eax, eax
jmp 0x1003c308
push esi
sub esp, 0xc
lea eax, [ebp - 0x20]
mov ecx, esp
mov dword [ebp + 0x14], esp
push eax
call fcn.10003fa5
mov ecx, edi
call fcn.100042fe
mov dword [ebp - 4], ebx
jmp 0x1003c2ee
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.10003276
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10003276
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10
Function at 0x1003d47f
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x100d0397
call fcn.100b286c
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 4]
xor edi, edi
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x1003d4e8
cmp dword [esi + 0x4c], edi
je 0x1003d4bc
cmp dword [ebp + 0x14], edi
je 0x1003d4f6
cmp dword [ebp + 0x18], edi
je 0x1003d4bc
lea ecx, [ebp + 8]
call fcn.1007e558
push eax
push dword [esi + 4]
call dword [esi + 0x4c]
jmp 0x1003d4e8
cmp dword [ebp + 0x14], edi
je 0x1003d4f6
cmp dword [ebp + 0x18], edi
push 5
pop eax
jne 0x1003d4cc
push 6
pop eax
push eax
push edi
lea ecx, [ebp + 8]
call fcn.1007e558
push eax
push str.iexplore
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1007e410
jmp 0x1003d55b
xor eax, eax
cmp dword [ebp + 0x14], edi
je 0x1003d4fe
inc eax
inc dword [esi + 0xc]
inc dword [esi + 0x10]
push ebx
push edi
push edi
mov dword [ebp - 0x14], eax
mov word [ebp - 0x1c], 3
mov ebx, dword [ecx]
push edi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 8]
call fcn.1007e558
push eax
push dword [esi + 4]
call dword [ebx + 0x2c]
cmp eax, edi
jge 0x1003d54e
mov eax, dword [esi + 4]
push edi
push edi
mov word [ebp - 0x1c], 3
mov dword [ebp - 0x14], edi
mov ebx, dword [eax]
push edi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 8]
call fcn.1007e558
push eax
push dword [esi + 4]
call dword [ebx + 0x2c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1007e410
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x14