joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10040df9
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10054670]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x10054670]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
cmp dword [ecx + 0x44], esi
je 0x10006874
cmp byte [ecx + 0x49], 0
je 0x10006874
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x1000685c
push esi
push 8
lea ecx, [esp + 0x58]
call fcn.10005c70
mov dword [esp + 0x80], esi
lea esp, [esp]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x54]
call fcn.10006150
mov esi, eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0x84], 1
call fcn.10006150
mov edi, eax
mov ecx, esi
mov byte [esp + 0x80], 2
call fcn.10007280
mov ebx, dword [esp + 0x64]
mov ecx, edi
mov esi, eax
call fcn.10007280
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0x44]
mov edx, dword [ecx]
lea edi, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
add ebx, esi
push ebx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [edx + 0x18]
call eax
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x80], 1
call fcn.100011e0
lea ecx, [esp + 0x44]
mov byte [esp + 0x80], 0
call fcn.100011e0
mov eax, esi
sub eax, 0
je 0x1000678e
dec eax
je 0x10006792
sub eax, 2
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
jne 0x10006857
jmp 0x1000686f
mov byte [edi + 0x49], 0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x54]
call fcn.10006150
mov ecx, eax
mov byte [esp + 0x80], 3
call fcn.10007280
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
sub esi, eax
mov byte [esp + 0x80], 0
call fcn.100011e0
test esi, esi
je 0x10006804
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x54]
call fcn.10006150
mov byte [esp + 0x80], 4
or dword [esp + 0x14], 1
mov ecx, eax
call fcn.10007280
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.10015c70
add esp, 0x10
cmp esi, eax
je 0x10006804
mov bl, 1
jmp 0x10006806
xor bl, bl
mov dword [esp + 0x80], 0
test byte [esp + 0x14], 1
je 0x10006826
and dword [esp + 0x14], 0xfffffffe
lea ecx, [esp + 0x38]
call fcn.100011e0
test bl, bl
jne 0x10006848
cmp byte [edi + 0x49], bl
je 0x10006860
test esi, esi
jne 0x100066e0
push esi
push 8
lea ecx, [esp + 0x58]
call fcn.10005d20
jmp 0x100066e0
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
call fcn.10004140
xor al, al
jmp 0x10006876
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
call fcn.10004140
mov al, 1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.1000fe00
mov esp, ebp
pop ebp
ret
Function at 0x10007140
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040a7b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10054670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000b650
push 0x18
push 0x1004f3f0
mov dword [ebp - 4], 0
call fcn.1000a900
push eax
push 4
call fcn.1000a830
mov edi, eax
add esp, 0x10
test edi, edi
je 0x100071cd
call fcn.1000ae00
mov dword [edi], eax
call fcn.1000ac10
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1000b5e0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x100071c3
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1000b620
jmp 0x100071cf
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100096d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push edi
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x1005562c
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x10055634
call esi
mov eax, dword [edi]
pop esi
cmp eax, dword [0x1005562c]
jne 0x10009723
mov cl, byte [0x10055630]
cmp cl, byte [edi + 4]
jne 0x10009723
mov eax, 0xb
mov esp, ebp
pop ebp
ret
cmp eax, dword [0x10055634]
jne 0x1000973b
mov dl, byte [0x10055638]
mov eax, 5
cmp dl, byte [edi + 4]
je 0x1000973e
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10009750
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [esi + 4]
push edi
push eax
mov edi, ebx
call fcn.100096d0
mov dword [esi + 4], eax
add eax, 5
push eax
call fcn.10016e40
mov edx, dword [esi + 4]
add esp, 8
lea ecx, [ebp - 8]
push ecx
push 0x40
add edx, 5
mov edi, eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 4]
push eax
push ebx
push edi
call fcn.10017c70
mov ecx, dword [esi + 4]
mov byte [edi + ecx], 0xe9
mov eax, dword [esi + 4]
mov edx, ebx
sub edx, edi
sub edx, 5
mov dword [edi + eax + 1], edx
mov eax, dword [ebp + 8]
add esp, 0xc
sub eax, ebx
sub eax, 5
mov dword [ebp - 7], eax
mov dl, byte [ebp - 4]
mov byte [ebp - 8], 0xe9
mov ecx, dword [ebp - 8]
mov dword [ebx], ecx
mov byte [ebx + 4], dl
mov dword [esi], edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000a240
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041324
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10054670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x7c], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x1000a2ad
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x1c]
lea esi, [ebp - 0x7c]
call fcn.10009f90
mov ecx, esi
call fcn.1000a040
mov eax, esi
push eax
mov esi, edi
call fcn.1000a120
mov byte [ebp - 4], bl
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x80], 1
jb 0x1000a2e6
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100159f0
add esp, 4
lea ecx, [ebp + 8]
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
call fcn.100062d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000fe00
mov esp, ebp
pop ebp
ret
Function at 0x1003da90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1003dc40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1003db5d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003dada
mov eax, dword [ebp - 4]
cmp eax, dword [0x10054004]
ja 0x1003dada
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003daaa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10017fe0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003db00
jmp 0x1003db5d
cmp dword [ebp - 0x14], 0x10000
jne 0x1003db43
cmp dword [ebp - 0x18], 0x10000
jb 0x1003db43
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003db36
mov eax, dword [ebp - 8]
jmp 0x1003db5f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003db58
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1003dc40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003daaa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003db70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1003dc70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1003dc35
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003dbb5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10054004]
ja 0x1003dbb5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003db85
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10017fe0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003dbdb
jmp 0x1003dc35
cmp dword [ebp - 0x14], 0x10000
jne 0x1003dc1e
cmp dword [ebp - 0x18], 0x10000
jb 0x1003dc1e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003dc11
mov eax, dword [ebp - 8]
jmp 0x1003dc37
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003dc30
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1003dc70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003db85
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003f040
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10055a10], eax
je 0x1003f05e
mov eax, 0x10dd
jmp 0x1003f13f
mov eax, dword [0x10055a20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003f0dc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1003f0ba
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1003f0ba
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1003e0f0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100159f0
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1003f066
mov dword [0x10055a20], 0
call fcn.1003e9d0
mov ecx, dword [0x10055a1c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1003f129
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100159f0
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1003f0f4
mov dword [0x10055a1c], 0
mov dword [0x10055a10], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003f620
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10055a14], 0
je 0x1003f639
mov eax, dword [0x10055a14]
jmp 0x1003f6d9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1003f64b
xor eax, eax
jmp 0x1003f6d9
push 8
call fcn.10016e40
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003f6a1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1003f68a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100159f0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10055a14], eax
mov dword [0x10055a18], 0
mov eax, dword [ebp - 8]
jmp 0x1003f6d9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1003f6bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1003f66b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10055a1c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10055a1c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f5e0
Capabilities:
Make an http request with a cookie
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100be780]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str._IEQ_HydSel_HydSel_JSP_api_authenticate
push 0x200
push 0x1010e048
mov byte [0x1010e048], 0
call fcn.1000e910
push str._usernamealan.nicoll_inventrics.com_taco
push 0x200
push 0x1010e048
call fcn.1000e910
push str.passwordTaco1234_
push 0x200
push 0x1010e048
call fcn.1000e910
mov eax, dword [0x1010e848]
add esp, 0x24
mov byte [0x1010e248], 0
cmp eax, 0x200
jae 0x1000f7d1
mov ecx, 0x1010e248
mov byte [eax + 0x1010e648], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000f660
sub ecx, edx
push ecx
push str.Content_Length:__d
push 0x200
push 0x1010e648
call fcn.1000e870
add esp, 0x10
push 0
push 0x80800000
push 0x100900f0
push 0
push str.HTTP_1.1
push 0x1010e048
push str.POST
push dword [0x1010e03c]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
mov dword [0x1010e040], esi
test esi, esi
jne 0x1000f6cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013be9
mov esp, ebp
pop ebp
ret
mov ecx, 0x1010e248
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000f6d5
sub ecx, edx
mov edx, 0x1010e648
push edi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000f6e7
push ecx
push 0x1010e248
sub edx, edi
push edx
push 0x1010e648
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
pop edi
test eax, eax
je 0x1000f7b5
call fcn.1000fb10
test al, al
je 0x1000f7b5
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 0x100
push eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x108], 0
push eax
lea eax, [ebp - 0x104]
push eax
push 0x2b
push dword [0x1010e040]
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1000f7b5
mov eax, dword [0x1010e848]
cmp eax, 0x200
jae 0x1000f7d1
mov byte [eax + 0x1010e648], 0
lea eax, [ebp - 0x104]
push eax
push str.Set_Cookie:__s
push 0x200
push 0x1010e648
call fcn.1000e870
mov ecx, 0x1010e648
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000f790
sub ecx, edx
mov dword [0x1010e848], ecx
call fcn.1000fdb0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013be9
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.1000fdb0
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.10013be9
mov esp, ebp
pop ebp
ret
call fcn.10013b0e
int3
Function at 0x1000fb50
Capabilities:
Query remote server for available data
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov byte [0x1010e048], 0
push str._IEQ_HydSel_HydSel_JSP_api_page_searchresults
push 0x200
push 0x1010e048
call fcn.1000e910
mov eax, dword [0x1010e848]
add esp, 0xc
mov byte [0x1010e248], 0
cmp eax, 0x200
jae 0x1000fd47
mov ecx, 0x1010e248
mov byte [eax + 0x1010e648], 0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fba0
push esi
sub ecx, edx
push ecx
push str.Content_Length:__d
push 0x200
push 0x1010e648
call fcn.1000e870
add esp, 0x10
push 0
push 0x80800000
push 0x100900f0
push 0
push str.HTTP_1.1
push 0x1010e048
push 0x1002ec48
push dword [0x1010e03c]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
mov dword [0x1010e040], esi
test esi, esi
jne 0x1000fc04
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x1010e248
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000fc10
sub ecx, edx
mov edx, 0x1010e648
push edi
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1000fc22
push ecx
push 0x1010e248
sub edx, edi
push edx
push 0x1010e648
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x1000fd34
call fcn.1000fb10
test al, al
je 0x1000fd34
mov esi, dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
lea eax, [ebp - 4]
push ebx
xor edi, edi
xor ebx, ebx
push edi
push edi
push eax
push dword [0x1010e040]
call esi
test eax, eax
je 0x1000fd26
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000fd26
inc eax
test edi, edi
je 0x1000fcb9
add eax, edi
push eax
call fcn.10016ebd
push edi
mov esi, eax
push ebx
push esi
call fcn.10014b40
mov ecx, dword [ebp - 4]
lea eax, [esi + edi]
inc ecx
push ecx
push 0
push eax
call fcn.100150c0
push ebx
call fcn.10016ea2
mov ebx, esi
add esp, 0x20
mov esi, dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
jmp 0x1000fcd1
push eax
call fcn.10016ebd
mov ecx, dword [ebp - 4]
mov ebx, eax
inc ecx
push ecx
push 0
push ebx
call fcn.100150c0
add esp, 0x10
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [edi + ebx]
push eax
push dword [0x1010e040]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1000fd15
add edi, dword [ebp - 8]
lea eax, [ebp - 4]
push 0
push 0
push eax
push dword [0x1010e040]
call esi
test eax, eax
jne 0x1000fc74
call fcn.1000fdb0
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call fcn.10016ea2
add esp, 4
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.1000fdb0
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.1000fdb0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10013b0e
int3
Function at 0x100101e0
Capabilities:
Connect to http server
Create http request

Disassembly:
push esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [0x1010e038], eax
test eax, eax
je 0x100102d9
mov ecx, dword [0x101547f8]
mov esi, dword [str.taco.betanext.intelliquip.com]
push 0
push 0
cmp byte [ecx], 0
push 3
cmovne esi, dword [str.taco.intelliquip.com]
push 0
push 0
push 0x1bb
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [0x1010e03c], eax
test eax, eax
je 0x100102d9
push esi
push str.Host:__s
push 0x200
push 0x1010e648
mov byte [0x1010e648], 0
call fcn.1000e870
push str.Content_Type:_application_x_www_form_urlencoded
push 0x200
push 0x1010e648
call fcn.1000e8a0
push str.Connection:_keep_alive
push 0x200
push 0x1010e648
call fcn.1000e8a0
push str.Cache_Control:_no_cache
push 0x200
push 0x1010e648
call fcn.1000e8a0
push str.Accept:__
push 0x200
push 0x1010e648
call fcn.1000e8a0
add esp, 0x40
push str.User_Agent:_HVACS
push 0x200
push 0x1010e648
call fcn.1000e8a0
mov ecx, 0x1010e648
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100102c6
sub ecx, edx
mov al, 1
mov dword [0x1010e848], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop esi
ret
Function at 0x10025276
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10025313
push ebx
push esi
call fcn.1002523f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10025188
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100252c0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10025312
push edi
push eax
call fcn.10020b32
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100252e0
call fcn.10020af8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10025311
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10025188
add esp, 0x20
test eax, eax
jne 0x100252ff
push edi
call fcn.10020af8
jmp 0x10025307
push ebx
call fcn.10020af8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002557e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100354c0
push 0x100354b8
push str.FlsAlloc
push 0x1e
call fcn.1002549c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100255b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002d13c]
call esi
jmp 0x100255b8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100255fc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100354d0
push 0x100354c8
push str.FlsGetValue
push 0x20
call fcn.1002549c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10025633
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002d13c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1002be00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002be2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002be2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret