joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e5010
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cdb1
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push 0
push dword [ebx + 0x1c]
mov dword [ebp - 4], 1
push dword [ebx + 0x24]
call fcn.10120339
add esp, 0xc
test eax, eax
jne 0x100e5185
mov dword [ebp - 0x30], eax
cmp dword [ebx + 0xc], eax
jbe 0x100e5185
push dword [ebx + 0x24]
lea eax, [ebp - 0x2c]
push 1
push 4
push eax
call fcn.101201fe
add esp, 0x10
cmp eax, 1
jne 0x100e5185
mov eax, dword [ebp - 0x2c]
test eax, eax
js 0x100e5185
inc eax
push eax
call fcn.101160b2
mov edi, eax
add esp, 4
test edi, edi
je 0x100e5185
mov eax, dword [ebp - 0x2c]
inc eax
push eax
push 0
push edi
call fcn.1011a400
push dword [ebx + 0x24]
push dword [ebp - 0x2c]
push 1
push edi
call fcn.101201fe
mov ecx, dword [ebp - 0x2c]
add esp, 0x1c
cmp eax, ecx
jne 0x100e517c
xor esi, esi
test ecx, ecx
jle 0x100e5132
jmp 0x100e5110
movsx eax, byte [esi + edi]
movsx ecx, byte [ebx + 0x20]
xor ecx, eax
movsx eax, byte [ebp - 0x2c]
xor ecx, eax
push ecx
call fcn.1011c6e6
mov byte [esi + edi], al
add esp, 4
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x100e5110
cmp byte [edi], 0
jne 0x100e513b
xor eax, eax
jmp 0x100e5149
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100e5140
sub eax, edx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.10002130
push edi
call fcn.1011bfcc
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
add esp, 4
mov ecx, esi
push eax
call fcn.100e59a0
mov edi, dword [ebp - 0x30]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, dword [ebx + 0xc]
jb 0x100e50a5
jmp 0x100e5185
push edi
call fcn.1011bfcc
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x100e5196
push dword [ebp - 0x28]
call fcn.1011a1ea
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 4
Function at 0x100e8070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push closesocket
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0xf
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100e8125
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push str.Build
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100e8125
lea eax, [ebp - 0x14]
push eax
call fcn.1011fe0b
mov ecx, eax
add esp, 4
cmp ecx, 0xf
jl 0x100e8116
lea ecx, [ecx]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0xf
jge 0x100e8100
cmp ecx, 6
jl 0x100e8125
lea eax, [ecx - 6]
mov dword [0x10190088], eax
jmp 0x100e812a
mov eax, dword [0x10190088]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100e813d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10190088]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
Function at 0x100e8c40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov ecx, 0x1e
mov word [ebp - 0x2fc], ax
mov esi, str.CLSIDf414c260_6ac0_11cf_b6d1_00aa00bbbb58InprocServer32
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
push 0x206
push eax
lea eax, [ebp - 0x2fa]
mov ecx, 0x1e
mov esi, str.CLSID16d51579_a30b_4c8b_a276_0ff4dc41e755InprocServer32
lea edi, [ebp - 0xf4]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.1011a400
mov eax, dword [0x10190088]
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x304], 0
cmp eax, 3
je 0x100e8cca
cmp eax, 4
lea eax, [ebp - 0x7c]
jne 0x100e8cd0
lea eax, [ebp - 0xf4]
push 0x20019
push eax
push closesocket
lea ecx, [ebp - 0x30c]
call fcn.1004dd90
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100e8cfd
mov eax, dword [ebp - 0x30c]
xor esi, esi
jmp 0x100e8d89
lea eax, [ebp - 0x300]
mov dword [ebp - 0x300], 0x104
push eax
lea eax, [ebp - 0x2fc]
push eax
push 0
lea ecx, [ebp - 0x30c]
call fcn.1004e350
test eax, eax
jne 0x100e8d7a
cmp dword [ebp - 0x300], esi
je 0x100e8d7a
lea eax, [ebp - 0x2fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100e8d7a
lea eax, [ebp - 0x2fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
test eax, eax
jne 0x100e8d7a
push str..dll
lea eax, [ebp - 0x2fc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100e8d7a
lea eax, [ebp - 0x2fc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
mov esi, 1
mov eax, dword [ebp - 0x30c]
test eax, eax
je 0x100e8d90
push eax
call edi
xor eax, eax
test eax, eax
je 0x100e8d90
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret

Function at 0x100eb490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp eax, 0x30000
jae 0x100eb4c7
xor eax, eax
mov dword [esi + 0x1f40], eax
mov dword [esi + 0x1f44], eax
mov dword [esi + 0x1f48], eax
mov dword [esi + 0x1f4c], eax
mov dword [esi + 0x1f50], eax
xor eax, eax
pop esi
pop ebp
ret 8
inc dword [esi + 0x1f48]
cmp dword [esi + 0x1f48], 1
mov dword [esi + 0x1f40], eax
jne 0x100eb4ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1f4c], eax
jmp 0x100eb4f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x1f48]
mov dword [esi + 0x1f50], eax
cmp ecx, 0xc8
jb 0x100eb4c0
mov eax, dword [esi + 0x1f40]
imul eax, ecx
cmp eax, 0xc800000
jb 0x100eb4c0
mov eax, dword [esi + 0x1f50]
sub eax, dword [esi + 0x1f4c]
cmp eax, 0x1f4
ja 0x100eb4c0
xor eax, eax
mov dword [esi + 0x1f40], eax
mov dword [esi + 0x1f44], eax
mov dword [esi + 0x1f48], eax
mov dword [esi + 0x1f4c], eax
mov dword [esi + 0x1f50], eax
mov eax, 1
pop esi
pop ebp
ret 8
Function at 0x100eca60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [ebx + 8], 0
jne 0x100eca7d
cmp edi, 0x22
jge 0x100eca7d
cmp dword [ebx + edi*4 + 0xc], 0
jne 0x100ecab6
push 0x40
push 0x1000
push 0x38
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x38
mov esi, eax
push 0
push esi
call fcn.1011a400
mov ecx, dword [ebp + 0xc]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
push esi
mov dword [esi + 4], ecx
call fcn.10054180
add esp, 0x10
test al, al
je 0x100ecac2
mov dword [ebx + edi*4 + 0xc], esi
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc
push 0x4000
push 0x38
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x100ecb00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x94]
cmp eax, 7
jne 0x100ecbd3
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.1011a400
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x100ecb89
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x100ecb6f
mov dword [esi + 0x94], eax
jmp 0x100ecbcd
cmp eax, 1
jne 0x100ecb7c
mov dword [esi + 0x94], eax
jmp 0x100ecbcd
cmp eax, 2
jne 0x100ecbcd
mov dword [esi + 0x94], eax
jmp 0x100ecbcd
cmp eax, 6
jne 0x100ecbc3
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x100ecbaa
cmp byte [ebp - 6], 1
setne al
add eax, 3
mov dword [esi + 0x94], eax
jmp 0x100ecbcd
cmp eax, 1
jne 0x100ecbcd
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
mov dword [esi + 0x94], eax
jmp 0x100ecbcd
mov dword [esi + 0x94], 7
mov eax, dword [esi + 0x94]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
Function at 0x100ecc70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
jne 0x100ecc85
cmp dword [esi + 0x70], 0
jne 0x100eccd2
push 0x40
push 0x1000
push 0x38
push 0
call eax
push 0x38
mov edi, eax
push 0
push edi
call fcn.1011a400
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
push edi
mov dword [edi], ecx
mov dword [edi + 4], 0x100ebdb0
call fcn.10054180
add esp, 0x10
test al, al
je 0x100eccbf
mov dword [esi + 0x70], edi
jmp 0x100ecccd
push 0x4000
push 0x38
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [esi + 8], 0
jne 0x100eccde
cmp dword [esi + 0x74], 0
jne 0x100ecd26
push 0x40
push 0x1000
push 0x38
push 0
call eax
push 0x38
mov edi, eax
push 0
push edi
call fcn.1011a400
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push edi
mov dword [edi], ecx
mov dword [edi + 4], 0x100eba50
call fcn.10054180
add esp, 0x10
test al, al
je 0x100ecd18
mov dword [esi + 0x74], edi
jmp 0x100ecd26
push 0x4000
push 0x38
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, esi
mov edi, eax
call fcn.100ecb00
test eax, eax
je 0x100ecd5c
push str.CreateProcessInternalA
push edi
call fcn.100ed1f0
test eax, eax
je 0x100ecd5c
push 0x100ebbf0
push eax
push 0x14
mov ecx, esi
call fcn.100eca60
pop edi
pop esi
ret
Function at 0x100ecd60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
jne 0x100ecd7c
cmp dword [esi + 0x44], 0
jne 0x100ecdc5
push 0x40
push 0x1000
push 0x38
push 0
call eax
push 0x38
mov edi, eax
push 0
push edi
call fcn.1011a400
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov dword [edi], ecx
mov dword [edi + 4], 0x100ec2d0
call fcn.10054180
add esp, 0x10
test al, al
je 0x100ecdb6
mov dword [esi + 0x44], edi
jmp 0x100ecdc0
push 0x4000
push 0x38
push edi
call ebx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [esi + 8], 0
jne 0x100ecdd1
cmp dword [esi + 0x48], 0
jne 0x100ece15
push 0x40
push 0x1000
push 0x38
push 0
call eax
push 0x38
mov edi, eax
push 0
push edi
call fcn.1011a400
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
mov dword [edi], ecx
mov dword [edi + 4], 0x100ec610
call fcn.10054180
add esp, 0x10
test al, al
je 0x100ece0b
mov dword [esi + 0x48], edi
jmp 0x100ece15
push 0x4000
push 0x38
push edi
call ebx
cmp dword [esi + 8], 0
jne 0x100ece21
cmp dword [esi + 0x4c], 0
jne 0x100ece69
push 0x40
push 0x1000
push 0x38
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x38
mov edi, eax
push 0
push edi
call fcn.1011a400
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push edi
mov dword [edi], ecx
mov dword [edi + 4], 0x100ec460
call fcn.10054180
add esp, 0x10
test al, al
je 0x100ece5f
mov dword [esi + 0x4c], edi
jmp 0x100ece69
push 0x4000
push 0x38
push edi
call ebx
cmp dword [esi + 8], 0
jne 0x100ece75
cmp dword [esi + 0x50], 0
jne 0x100ecebf
push 0x40
push 0x1000
push 0x38
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x38
mov edi, eax
push 0
push edi
call fcn.1011a400
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
mov dword [edi], ecx
mov dword [edi + 4], 0x100ec580
call fcn.10054180
add esp, 0x10
test al, al
je 0x100eceb5
mov dword [esi + 0x50], edi
pop edi
pop esi
pop ebx
ret
push 0x4000
push 0x38
push edi
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x100eced0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x38
push 0
push 0x10192034
mov dword [ebp - 4], 0
call fcn.1011a400
call fcn.100e8150
push 0x38
push 0
push 0x1019206c
call fcn.1011a400
add esp, 0x18
call fcn.100e84c0
test eax, eax
je 0x100ecf3c
mov dword [0x10192268], eax
mov dword [0x1019206c], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 0x38
push 0x1019206c
mov dword [0x10192070], 0x100e8db0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1019206c
call fcn.10054180
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x100ecf40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
jne 0x100ecf55
cmp dword [esi + 0x54], 0
jne 0x100ecfa2
push 0x40
push 0x1000
push 0x38
push 0
call eax
push 0x38
mov edi, eax
push 0
push edi
call fcn.1011a400
mov ecx, dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
push edi
mov dword [edi], ecx
mov dword [edi + 4], 0x100ec7a0
call fcn.10054180
add esp, 0x10
test al, al
je 0x100ecf8f
mov dword [esi + 0x54], edi
jmp 0x100ecf9d
push 0x4000
push 0x38
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [esi + 8], 0
jne 0x100ecfae
cmp dword [esi + 0x58], 0
jne 0x100ecff7
push 0x40
push 0x1000
push 0x38
push 0
call eax
push 0x38
mov edi, eax
push 0
push edi
call fcn.1011a400
mov ecx, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push edi
mov dword [edi], ecx
mov dword [edi + 4], 0x100ec820
call fcn.10054180
add esp, 0x10
test al, al
je 0x100ecfe9
mov dword [esi + 0x58], edi
pop edi
pop esi
ret
push 0x4000
push 0x38
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
ret

Function at 0x100ed1f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 8], 0
je 0x100ed2f3
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100ed2f3
cmp dword [0x10192594], 0
jne 0x100ed232
push 0x10192590
mov dword [0x10192594], 1
call fcn.100ed1a0
cmp dword [0x10192590], 0
jne 0x100ed24e
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100ed251
sub esi, ecx
je 0x100ed2f3
inc esi
mov dword [ebp - 4], esi
pushal
pushfd
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x100ed2e5
mov ebx, dword [eax + 0x3c]
cmp word [eax + ebx], 0x4550
jne 0x100ed2e5
mov ebx, dword [eax + ebx + 0x78]
test ebx, ebx
je 0x100ed2e5
add ebx, eax
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x20]
test edx, edx
je 0x100ed2e5
add edx, eax
push ecx
cld
pop ecx
jecxz 0x100ed2e5
dec ecx
mov esi, dword [ebp + 0xc]
mov edi, dword [edx + ecx*4]
test edi, edi
je 0x100ed2e5
add edi, eax
push ecx
mov ecx, dword [ebp - 4]
shr ecx, 2
repe cmpsd dword [esi], dword es:[edi]
jne 0x100ed293
test ecx, ecx
jne 0x100ed293
mov ecx, dword [ebp - 4]
and ecx, 3
je 0x100ed2c2
repe cmpsb byte [esi], byte es:[edi]
jne 0x100ed293
test ecx, ecx
jne 0x100ed293
mov edx, dword [ebx + 0x24]
test edx, edx
je 0x100ed2e5
add edx, eax
pop ecx
movzx ecx, word [edx + ecx*2]
mov edx, dword [ebx + 0x1c]
test edx, edx
je 0x100ed2e5
add edx, eax
mov ebx, dword [edx + ecx*4]
test ebx, ebx
je 0x100ed2e5
add ebx, eax
mov dword [ebp - 8], ebx
popfd
popal
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100ed300
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
xor eax, eax
mov dword [ebp - 0x40], 0
push esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp - 0x3c]
mov edi, eax
mov eax, 0x1000
cmp esi, eax
cmovae esi, eax
lea eax, [ebp - 0x1c]
push esi
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0x18], 0
jne 0x100ed38a
push 1
push 0x2000
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100f3980
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
mov edi, ecx
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1011a400
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1011c136
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x68], eax
test eax, eax
je 0x100f3b06
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinHttpOpen
push eax
call esi
push str.WinHttpConnect
push dword [edi + 0x68]
mov dword [edi + 4], eax
call esi
push str.WinHttpOpenRequest
push dword [edi + 0x68]
mov dword [edi + 8], eax
call esi
push str.WinHttpAddRequestHeaders
push dword [edi + 0x68]
mov dword [edi + 0xc], eax
call esi
push str.WinHttpSendRequest
push dword [edi + 0x68]
mov dword [edi + 0x10], eax
call esi
push str.WinHttpReceiveResponse
push dword [edi + 0x68]
mov dword [edi + 0x14], eax
call esi
push str.WinHttpQueryHeaders
push dword [edi + 0x68]
mov dword [edi + 0x18], eax
call esi
push str.WinHttpReadData
push dword [edi + 0x68]
mov dword [edi + 0x1c], eax
call esi
push str.WinHttpCloseHandle
push dword [edi + 0x68]
mov dword [edi + 0x20], eax
call esi
push str.WinHttpCrackUrl
push dword [edi + 0x68]
mov dword [edi + 0x24], eax
call esi
push str.WinHttpSetOption
push dword [edi + 0x68]
mov dword [edi + 0x28], eax
call esi
push str.WinHttpQueryDataAvailable
push dword [edi + 0x68]
mov dword [edi + 0x2c], eax
call esi
push str.WinHttpSetTimeouts
push dword [edi + 0x68]
mov dword [edi + 0x34], eax
call esi
cmp dword [edi + 4], 0
mov dword [edi + 0x30], eax
pop esi
je 0x100f3b02
cmp dword [edi + 0x10], 0
je 0x100f3b02
cmp dword [edi + 0x24], 0
je 0x100f3b02
cmp dword [edi + 8], 0
je 0x100f3b02
cmp dword [edi + 0xc], 0
je 0x100f3b02
cmp dword [edi + 0x1c], 0
je 0x100f3b02
cmp dword [edi + 0x20], 0
je 0x100f3b02
cmp dword [edi + 0x18], 0
je 0x100f3b02
cmp dword [edi + 0x14], 0
je 0x100f3b02
cmp dword [edi + 0x28], 0
je 0x100f3b02
cmp dword [edi + 0x2c], 0
je 0x100f3b02
test eax, eax
je 0x100f3b02
mov eax, 1
mov dword [edi], eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, dword [edi]
xor ecx, ebp
pop edi
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
Function at 0x100f3b20
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
mov edi, ecx
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1011a400
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.wininet.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1011c136
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x6c], eax
test eax, eax
je 0x100f3c74
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenW
push eax
call esi
push str.InternetConnectW
push dword [edi + 0x6c]
mov dword [edi + 0x3c], eax
call esi
push str.HttpOpenRequestW
push dword [edi + 0x6c]
mov dword [edi + 0x40], eax
call esi
push str.HttpAddRequestHeadersW
push dword [edi + 0x6c]
mov dword [edi + 0x44], eax
call esi
push str.HttpSendRequestW
push dword [edi + 0x6c]
mov dword [edi + 0x48], eax
call esi
push str.HttpQueryInfoW
push dword [edi + 0x6c]
mov dword [edi + 0x4c], eax
call esi
push str.InternetReadFile
push dword [edi + 0x6c]
mov dword [edi + 0x50], eax
call esi
push str.InternetCloseHandle
push dword [edi + 0x6c]
mov dword [edi + 0x54], eax
call esi
push str.InternetCrackUrlW
push dword [edi + 0x6c]
mov dword [edi + 0x58], eax
call esi
push str.InternetSetOptionW
push dword [edi + 0x6c]
mov dword [edi + 0x5c], eax
call esi
push str.InternetQueryDataAvailable
push dword [edi + 0x6c]
mov dword [edi + 0x60], eax
call esi
cmp dword [edi + 0x3c], 0
mov dword [edi + 0x64], eax
pop esi
je 0x100f3c6f
cmp dword [edi + 0x40], 0
je 0x100f3c6f
cmp dword [edi + 0x44], 0
je 0x100f3c6f
cmp dword [edi + 0x48], 0
je 0x100f3c6f
cmp dword [edi + 0x4c], 0
je 0x100f3c6f
cmp dword [edi + 0x50], 0
je 0x100f3c6f
cmp dword [edi + 0x54], 0
je 0x100f3c6f
cmp dword [edi + 0x58], 0
je 0x100f3c6f
cmp dword [edi + 0x5c], 0
je 0x100f3c6f
cmp dword [edi + 0x60], 0
je 0x100f3c6f
mov eax, 1
jmp 0x100f3c71
xor eax, eax
mov dword [edi + 0x38], eax
mov ecx, dword [ebp - 4]
mov eax, dword [edi + 0x38]
xor ecx, ebp
pop edi
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret