joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007358e
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x100735a6
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x97
inc ecx
cmp ecx, dword [esp + 8]
jb 0x10073596
xor eax, eax
ret

Function at 0x10073800
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x1c], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push edi
lea eax, [ebp - 0x48]
push eax
push ebx
call fcn.10148cc9
or edi, 0xffffffff
cmp eax, edi
pop ecx
pop ecx
jne 0x10073836
mov eax, edi
jmp 0x1007386e
push esi
mov esi, dword [ebp - 0x34]
push 0x101a04a8
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10147b95
add esp, 0xc
test eax, eax
jne 0x1007386b
cmp dword [ebp - 0x1c], eax
je 0x1007386b
push esi
call fcn.10144fc2
mov ebx, eax
test ebx, ebx
pop ecx
push dword [ebp - 0x1c]
jne 0x1007387c
call fcn.101475da
pop ecx
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10145d71
leave
ret
push esi
push 1
push ebx
call fcn.10147aa1
add esp, 0x10
cmp eax, esi
je 0x1007389d
push ebx
call fcn.10145563
push dword [ebp - 0x1c]
call fcn.101475da
pop ecx
jmp 0x1007386a
push dword [ebp - 0x1c]
call fcn.101475da
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp], str.89F3CC4B_0091_49B0_81A6_188CFF582735
stosw word es:[edi], ax
push 0x101a047c
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.10147724
push 0xa0
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
call fcn.10073784
and dword [ebp - 0x20], 0
push 0x101a87f4
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.10147b95
add esp, 0x30
test eax, eax
jne 0x1007393a
cmp dword [ebp - 0x20], eax
je 0x1007393a
push dword [ebp - 0x20]
push esi
push 1
push ebx
call fcn.10148a8b
add esp, 0x10
cmp eax, esi
je 0x10073923
push ebx
call fcn.10145563
push dword [ebp - 0x20]
call fcn.101475da
pop ecx
jmp 0x10073940
push dword [ebp - 0x20]
call fcn.101475da
push ebx
call fcn.10145563
pop ecx
pop ecx
xor eax, eax
jmp 0x1007386d
push ebx
call fcn.10145563
pop ecx
or eax, 0xffffffff
jmp 0x1007386d
Function at 0x100739c5
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x1c], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push edi
lea eax, [ebp - 0x48]
push eax
push ebx
call fcn.10148cc9
or edi, 0xffffffff
cmp eax, edi
pop ecx
pop ecx
jne 0x100739fb
mov eax, edi
jmp 0x10073a33
push esi
mov esi, dword [ebp - 0x34]
push 0x101a04a8
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10147b95
add esp, 0xc
test eax, eax
jne 0x10073a30
cmp dword [ebp - 0x1c], eax
je 0x10073a30
push esi
call fcn.10144fc2
mov ebx, eax
test ebx, ebx
pop ecx
push dword [ebp - 0x1c]
jne 0x10073a41
call fcn.101475da
pop ecx
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10145d71
leave
ret
push esi
push 1
push ebx
call fcn.10147aa1
add esp, 0x10
cmp eax, esi
je 0x10073a62
push ebx
call fcn.10145563
push dword [ebp - 0x1c]
call fcn.101475da
pop ecx
jmp 0x10073a2f
push dword [ebp - 0x1c]
call fcn.101475da
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp], str.89F3CC4B_0091_49B0_81A6_188CFF582735
stosw word es:[edi], ax
push 0x101a047c
push 0xffffffffffffffff
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.10147724
push 0xa0
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
call fcn.10073949
and dword [ebp - 0x20], 0
push 0x101a87f4
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.10147b95
add esp, 0x30
test eax, eax
jne 0x10073afe
cmp dword [ebp - 0x20], eax
je 0x10073afe
push dword [ebp - 0x20]
push esi
push 1
push ebx
call fcn.10148a8b
add esp, 0x10
cmp eax, esi
push ebx
je 0x10073ae8
call fcn.10145563
push dword [ebp - 0x20]
call fcn.101475da
pop ecx
jmp 0x10073b04
call fcn.10145563
push dword [ebp - 0x20]
call fcn.101475da
pop ecx
pop ecx
xor eax, eax
jmp 0x10073a32
push ebx
call fcn.10145563
pop ecx
or eax, 0xffffffff
jmp 0x10073a32
Function at 0x10074f21
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10074fbe
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x1c], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
pop edi
jne 0x10074f66
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10074fbe
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x10], eax
jne 0x10074faf
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x14], eax
je 0x10074faf
push dword [ebp - 0x14]
push 0
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10074fbd
cmp dword [ebp + 8], 0
push esi
je 0x10074fa2
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10074fa8
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10074f67
pop esi
pop ebx
leave
ret 4

Function at 0x1007504f
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push dword [0x101f8354]
mov edi, ecx
push 0
mov ecx, 0x101f8c68
call fcn.10016a0b
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x10075098
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10075091
lea ecx, [edi + 0x80]
call fcn.10074ffe
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret

Function at 0x10075114
Capabilities:
Read file via mapping

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x10075122
xor eax, eax
jmp 0x10075177
push edi
call fcn.10074ffe
push dword [esp + 0xc]
mov edi, 0xb08
push edi
push 0
push 4
lea ecx, [esi + 0x10]
call fcn.10016a0b
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 4], eax
je 0x1007516c
push edi
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
jne 0x10075170
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10075176
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
pop edi
pop esi
ret 4
Function at 0x100788e6
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push 0
push 4
push 0
push 0x10078415
push 0
push 0
call fcn.10147cdf
mov esi, eax
add esp, 0x18
test esi, esi
je 0x10078923
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret
Function at 0x10079835
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x2720]
mov eax, 0x2720
call fcn.10146c50
push 0xffffffffffffffff
push 0x10184c82
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x271c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [0x101f3028]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push str..PhysicalDrive_d
push eax
mov dword [ebp - 4], ebx
call fcn.10004662
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x100799a7
xor eax, eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 0x18
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push 0x70000
push dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
call esi
cmp eax, 1
jne 0x1007999e
push dword [ebp - 0x34]
push 0x101a91f8
push dword [ebp - 0x18]
call fcn.10004662
xor eax, eax
lea edi, [ebp]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x270f
lea eax, [ebp + 0xd]
push ebx
push eax
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov byte [ebp + 0xc], bl
call fcn.10146c80
add esp, 0x18
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x2710
lea eax, [ebp + 0xc]
push eax
push 0xc
lea eax, [ebp]
push eax
push 0x2d1400
push dword [ebp - 0x14]
call esi
test eax, eax
je 0x1007999e
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
mov edi, dword [ebp - 0x18]
je 0x1007995b
lea eax, [ebp + eax + 0xc]
push eax
lea ecx, [edi + 4]
call fcn.1001e27f
mov eax, dword [ebp + 0x24]
cmp eax, ebx
je 0x1007996f
lea eax, [ebp + eax + 0xc]
push eax
lea ecx, [edi + 8]
call fcn.1001e27f
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x10079983
lea eax, [ebp + eax + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.1001e27f
mov eax, dword [ebp + 0x20]
cmp eax, ebx
je 0x10079997
lea eax, [ebp + eax + 0xc]
push eax
lea ecx, [edi + 0x10]
call fcn.1001e27f
mov dword [ebp - 0x24], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.10003b75
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10079883
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x271c]
xor ecx, ebp
call fcn.10145d71
add ebp, 0x2720
leave
ret
Function at 0x10080357
Capabilities:
Get graphical window text

Disassembly:
push 0x14
mov eax, 0x10185581
call fcn.10145d80
mov esi, ecx
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x100803c5
mov eax, dword [0x101f3028]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov eax, 0x104
push eax
push eax
lea ecx, [ebp - 0x10]
call fcn.1000401e
mov edi, dword [ebp + 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100041f7
push 0x101a968c
push dword [ebp - 0x10]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
je 0x100803bb
call fcn.10003b75
xor eax, eax
jmp 0x100803f3
mov dword [esi + 0x7c], edi
call fcn.10003b75
jmp 0x100803ca
cmp eax, dword [ebp + 8]
jne 0x100803b7
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x7c]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push dword [ebp + 0x10]
add eax, dword [ebp - 0x20]
push dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
call fcn.10145e58
ret 0xc

Function at 0x10081118
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0xfdc]
mov eax, 0x105c
call fcn.10146c50
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0xfd8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xfe4]
mov esi, ecx
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x78], ebx
call fcn.100116a5
call fcn.1011c6e3
push 0x1048
test eax, eax
push ebx
lea eax, [ebp - 0x72]
push eax
je 0x100811ac
call fcn.10146c80
mov eax, dword [esi + 0x58]
add esp, 0xc
lea ecx, [ebp - 0x74]
push ecx
push ebx
push 0xc4
push eax
mov word [ebp - 0x74], 0x824
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
lea eax, [ebp - 0x74]
je 0x10081194
mov ecx, edi
jmp 0x10081215
mov esi, dword [esi + 0x58]
push 0x824
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x10081222
mov ecx, edi
jmp 0x10081212
mov word [ebp - 0x74], bx
call fcn.10146c80
mov eax, dword [esi + 0x58]
add esp, 0xc
push 0xffffffffffffffe8
push eax
call dword [sym.imp.USER32.dll_GetClassLongW]
cmp eax, ebx
mov dword [ebp - 0x7c], eax
je 0x10081222
mov eax, dword [esi + 0x58]
mov edi, dword [sym.imp.USER32.dll_CallWindowProcW]
lea ecx, [ebp - 0x74]
push ecx
push ebx
push 0xc4
push eax
push dword [ebp - 0x7c]
mov word [ebp - 0x74], 0x824
call edi
test eax, eax
lea eax, [ebp - 0x74]
push eax
je 0x100811f7
mov ecx, dword [ebp - 0x80]
jmp 0x10081216
mov esi, dword [esi + 0x58]
push 0x824
push 0xd
push esi
push dword [ebp - 0x7c]
mov word [ebp - 0x74], bx
call edi
test eax, eax
je 0x10081222
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push eax
call fcn.1000425b
mov dword [ebp - 0x78], 1
mov ecx, dword [ebp + 0xfd8]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10145d71
add ebp, 0xfdc
leave
ret 4
Function at 0x10081271
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x10
mov eax, 0x101856f8
call fcn.10145d80
mov ebx, ecx
mov eax, dword [ebp + 0xc]
dec eax
je 0x100813bd
sub eax, 0xc
je 0x100813af
sub eax, 0x55b
jne 0x100813ef
and dword [ebp + 0xc], eax
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], eax
push 0x101f8d14
call edi
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
mov esi, 0x101f8d2c
push eax
mov ecx, esi
call fcn.100805c5
push esi
push dword [0x101f8d30]
lea ecx, [ebp - 0x1c]
call fcn.1007b3bc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ac4c
test al, al
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jne 0x10081353
push 0x101f87ac
call edi
lea ecx, [ebp - 0x14]
call fcn.1007f4e9
add eax, 4
push eax
lea eax, [ebp - 0x14]
mov edi, 0x101f87c4
push eax
mov ecx, edi
call fcn.10080561
push edi
push dword [0x101f87c8]
lea ecx, [ebp - 0x1c]
call fcn.1007b398
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1007ac14
test al, al
jne 0x1008134c
lea ecx, [ebp - 0x14]
call fcn.1007f4c5
add eax, 8
mov eax, dword [eax]
test eax, eax
je 0x1008134c
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.10004f20
push 0x101f87ac
call esi
push 0x101f8d14
call esi
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp esi, edi
je 0x1008139f
push dword [ebx + 0xf4]
lea ecx, [ebp + 0x10]
call fcn.10005f82
mov ebx, dword [esi]
push edi
push edi
push 0x12
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_GetKeyState]
and ax, 0x8000
neg ax
sbb eax, eax
and eax, 3
push eax
push edi
push dword [ebp + 0x10]
push esi
call dword [ebx + 0x28]
push dword [ebp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
je 0x100813ef
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x100813ef
lea eax, [ebx + 0xf0]
push eax
call fcn.10081118
jmp 0x100813ef
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100813ca
mov dword [ebx + 0x124], eax
lea eax, [ebx + 0x124]
mov ecx, dword [eax]
test ecx, ecx
push 0
jle 0x100813df
dec ecx
mov dword [eax], ecx
push 1
jmp 0x100813e1
push 0xd
push 0x564
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
call fcn.10145e58
ret 0x10

Function at 0x10083265
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x28], edi
je 0x100832a8
push edi
push edi
push 0x12
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x1f4
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10083299
push edi
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
pop edi
pop esi
ret
Function at 0x100844dd
Capabilities:
Enumerate browser history

Disassembly:
push 0x40
mov eax, 0x10185bb8
call fcn.10145d80
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
mov eax, dword [0x101f3028]
xor esi, esi
mov dword [ebp - 0x4c], 0x28
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
xor ebx, ebx
inc ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x14]
push eax
push 0x101a9844
push ebx
push esi
push str._J7_
mov byte [ebp - 4], 2
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x100845a9
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jne 0x100845a9
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push 0x10000
push str.http:__
push eax
call dword [ecx + 0x1c]
xor edi, edi
jmp 0x10084593
mov eax, edi
inc edi
cmp eax, 0x32
jge 0x100845a9
push dword [ebp - 0x48]
lea ecx, [ebp - 0x24]
call fcn.1000425b
push dword [ebp - 0x44]
lea ecx, [ebp - 0x20]
call fcn.1000425b
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x1c], esi
call fcn.10084271
pop ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x4c]
push edx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x10084568
mov eax, dword [ebp - 0x10]
cmp eax, esi
mov byte [ebp - 4], bl
je 0x100845b9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
cmp eax, esi
mov byte [ebp - 4], 0
je 0x100845ca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x20]
call fcn.10003b75
lea ecx, [ebp - 0x24]
call fcn.10003b75
call fcn.10145e58
ret
Function at 0x10086d74
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, eax
push ebx
push esi
mov esi, ecx
je 0x10086dd1
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10086dd1
and dword [ebp - 4], 0
push edi
mov edi, dword [sym.imp.WININET.dll_InternetWriteFile]
lea ecx, [ebp + 8]
push ecx
push ebx
mov dword [ebp + 0xc], eax
push eax
jmp 0x10086db7
mov eax, dword [ebp + 8]
add dword [ebp + 0xc], eax
add dword [esi + 0xc], eax
sub ebx, eax
test ebx, ebx
je 0x10086dcb
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 8]
and dword [ebp + 8], 0
call edi
test eax, eax
jne 0x10086da0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 4]
pop edi
jmp 0x10086dd4
or eax, 0xffffffff
pop esi
pop ebx
leave
ret 8

Function at 0x10086dda
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 8], ecx
jne 0x10086df2
or eax, 0xffffffff
jmp 0x10086e8f
cmp dword [ebp + 0xc], edi
je 0x10086dea
cmp dword [ebp + 0x10], edi
jbe 0x10086dea
push 0x101a04a8
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
call fcn.10147b95
add esp, 0xc
test eax, eax
jne 0x10086e8c
cmp dword [ebp - 4], edi
je 0x10086e8c
push ebx
push esi
xor ebx, ebx
push dword [ebp - 4]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.10147aa1
mov esi, eax
add esp, 0x10
cmp esi, dword [ebp + 0x10]
je 0x10086e4a
push dword [ebp - 4]
call fcn.10149ac3
test eax, eax
pop ecx
je 0x10086e64
xor ebx, ebx
inc ebx
cmp esi, edi
jbe 0x10086e5e
mov ecx, dword [ebp - 8]
push esi
push dword [ebp + 0xc]
call fcn.10086d74
test eax, eax
jne 0x10086e7a
cmp ebx, edi
je 0x10086e20
jmp 0x10086e7d
push dword [ebp - 4]
call fcn.10149af2
mov edi, eax
neg edi
sbb edi, edi
neg edi
pop ecx
add edi, 0xfffffffb
jmp 0x10086e7d
push 0xfffffffffffffffd
pop edi
push dword [ebp - 4]
call fcn.101475da
pop ecx
pop esi
mov eax, edi
pop ebx
jmp 0x10086e8f
push 0xfffffffffffffffe
pop eax
pop edi
leave
ret 0xc

Function at 0x1008742a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x10087450
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.10148a8b
add esp, 0x10
cmp eax, dword [ebp + 0xc]
je 0x10087478
xor eax, eax
jmp 0x1008747b
push esi
lea esi, [ecx + 8]
push esi
push dword [esi + 8]
lea ecx, [ebp - 8]
call fcn.10087083
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
push ecx
push eax
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.1008740f
pop esi
xor eax, eax
inc eax
leave
ret 8
Function at 0x1008a435
Capabilities:
Get graphical window text

Disassembly:
push 0x14
mov eax, 0x101861e4
call fcn.10145d80
mov esi, ecx
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x1008a4a9
mov eax, dword [0x101f3028]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov eax, 0x104
push eax
push eax
lea ecx, [ebp - 0x10]
call fcn.1000401e
mov edi, dword [ebp + 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.100041f7
push 0x101a968c
push dword [ebp - 0x10]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
je 0x1008a49c
call fcn.10003b75
xor eax, eax
jmp 0x1008a4da
mov dword [esi + 0x8c], edi
call fcn.10003b75
jmp 0x1008a4ae
cmp eax, dword [ebp + 8]
jne 0x1008a498
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x8c]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push dword [ebp + 0x10]
add eax, dword [ebp - 0x20]
push dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
call fcn.10145e58
ret 0xc

Function at 0x1008d46a
Capabilities:
Accept command line arguments
Create thread
Resume thread

Disassembly:
push ebx
xor ebx, ebx
call fcn.1011c4cf
fcomp qword [0x101a85a0]
fnstsw ax
test ah, 1
jne 0x1008d4fb
mov ecx, 0x101f84e8
call fcn.10051e12
test eax, eax
je 0x1008d4fb
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
cmp edi, ebx
je 0x1008d4fa
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.iexplore.exe
push edi
call esi
test eax, eax
je 0x1008d4f9
push str.SCODEF:
push edi
call esi
test eax, eax
jne 0x1008d4f9
push str.CREDAT:
push edi
call esi
test eax, eax
jne 0x1008d4f9
push ebx
push 4
push ebx
push 0x1008d326
push ebx
push ebx
call fcn.10147cdf
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x1008d4f9
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
pop esi
pop edi
mov eax, ebx
pop ebx
ret