joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5177c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5bfbbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00530b90
xor edi, edi
lea ecx, [esi + 0x64]
mov dword [esp + 0x14], edi
call fcn.00581a0e
mov eax, dword [esp + 0x2c]
push 0x60
mov byte [esp + 0x18], 1
mov dword [esi], 0x5d8eb4
mov dword [esi + 0x30], 2
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], edi
call fcn.00586401
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, edi
mov byte [esp + 0x14], 2
je 0x517830
mov ecx, eax
call fcn.004cea10
jmp 0x517832
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x60], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x80], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], edx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x517870
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5bfbe3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, ecx
push esi
mov dword [esp + 0x14], edi
call fcn.00530bf0
lea ebp, [edi + 0x64]
xor ebx, ebx
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.00581a0e
mov dword [edi], 0x5d8eb4
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov ecx, dword [esi + 0x38]
mov dword [edi + 0x38], ecx
mov edx, dword [esi + 0x34]
mov dword [edi + 0x34], edx
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov ecx, dword [esi + 0x48]
lea edx, [esi + 0x4c]
mov dword [edi + 0x48], ecx
lea eax, [edi + 0x4c]
mov byte [esp + 0x1c], 1
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov ecx, dword [esi + 0x40]
mov dword [edi + 0x40], ecx
mov edx, dword [esi + 0x3c]
mov dword [edi + 0x3c], edx
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov ecx, dword [esi + 0x7c]
mov dword [edi + 0x7c], ecx
mov edx, dword [esi + 0x80]
mov dword [edi + 0x80], edx
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov ecx, dword [esi + 0x88]
mov dword [edi + 0x88], ecx
mov eax, dword [esi + 0x6c]
cmp eax, ebx
jle 0x517952
mov edx, dword [esi + 0x68]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + ebx*4]
push eax
push ecx
mov ecx, ebp
call fcn.00581a6e
mov eax, dword [esi + 0x6c]
inc ebx
cmp ebx, eax
jl 0x517938
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x51ce30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5c0613
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0x24]
lea ecx, [esp + 0x14]
push eax
push 0
push ecx
mov ecx, esi
mov dword [esp + 0x1c], edi
call fcn.00428a90
push eax
mov ecx, edi
call fcn.00428150
lea ecx, [edi + 0x30]
mov dword [esp + 0x28], 0
call fcn.0058185e
mov edx, dword [ebp + 0xc]
mov ecx, esi
push edx
mov byte [esp + 0x2c], 1
mov dword [edi + 0x48], esi
call fcn.004293f0
push 0
mov ecx, edi
mov ebx, eax
call fcn.004293f0
mov esi, eax
push ebx
mov ecx, esi
call fcn.0041e610
mov ecx, ebx
lea eax, [esi + 0x10]
sub ecx, esi
mov dword [esp + 0xc], 4
mov edx, dword [ecx + eax]
mov dword [eax], edx
mov edx, dword [ecx + eax + 4]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xc]
add eax, 8
dec edx
mov dword [esp + 0xc], edx
jne 0x51cebb
mov ax, word [ebx + 0x30]
lea ecx, [ebx + 0x38]
push ecx
lea ecx, [esi + 0x38]
mov word [esi + 0x30], ax
call fcn.00438700
lea edx, [ebx + 0x80]
lea ecx, [esi + 0x80]
push edx
call fcn.00438700
mov ax, word [ebx + 0xc8]
add ebx, 0xcc
push ebx
lea ecx, [esi + 0xcc]
mov word [esi + 0xc8], ax
call fcn.0041e610
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
mov ecx, dword [eax + 0x28]
mov dword [edi + 0x28], ecx
mov dx, word [eax + 0x2c]
mov eax, dword [ebp + 0x10]
lea ecx, [edi + 0x30]
push eax
mov word [edi + 0x2c], dx
call fcn.005818be
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5309b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c1fb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [esp + 8], ebx
mov dword [ebx], 0x5d90d0
mov esi, dword [ebx + 0x34]
mov dword [esp + 0x14], 1
test esi, esi
mov ecx, esi
je 0x530a10
push edi
mov eax, esi
mov esi, dword [esi]
mov edi, dword [eax + 8]
cmp dword [edi + 0x2c], 1
jne 0x530a09
push ecx
lea ecx, [ebx + 0x30]
call fcn.005821dc
test edi, edi
je 0x530a09
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 4]
test esi, esi
mov ecx, esi
jne 0x5309e6
pop edi
lea ecx, [ebx + 0x30]
mov byte [esp + 0x14], 0
call fcn.00582132
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x530f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c205c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
push edi
push eax
mov dword [esp + 0x10], esi
call fcn.00516db0
mov ecx, dword [esp + 0x20]
push 0x60
mov dword [esp + 0x18], 0
mov dword [esi], str.g__yS
mov dword [esi + 0x24], ecx
call fcn.00586401
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x14], 1
je 0x530ff8
push 0x61cf80
push edi
mov ecx, eax
call fcn.0053b990
jmp 0x530ffa
xor eax, eax
push 0x40
mov byte [esp + 0x18], 0
mov dword [esi + 0x34], eax
call fcn.00586401
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x531030
xor edx, edx
push ebp
xor ecx, ecx
xor ebp, ebp
push edx
xor edi, edi
push ecx
push ebp
push edi
mov ecx, eax
call fcn.0051cc80
pop ebp
jmp 0x531032
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 1
mov dword [esi + 0x10], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x53abd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c3290
push eax
mov dword fs:[0], esp
sub esp, 0x54
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x1c]
cmp eax, edi
jne 0x53ac0a
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 8
push ebx
push ebp
lea ecx, [esp + 0x50]
call fcn.0058185e
lea ecx, [esp + 0x3c]
mov dword [esp + 0x6c], edi
call fcn.00581f91
mov eax, dword [esi + 0x60]
mov ebp, dword [esi + 0x40]
mov ebx, dword [esp + 0x74]
cmp eax, edi
mov byte [esp + 0x6c], 1
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
je 0x53ac4e
mov eax, dword [esp + 0x78]
mov ecx, esi
push eax
push ebx
call fcn.00531340
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x54]
test eax, eax
jle 0x53ac6e
mov ecx, dword [esi + 0x50]
lea edx, [esp + 0x1c]
push ebx
push edx
mov ecx, dword [ecx + edi*4]
call fcn.0051ca50
mov eax, dword [esi + 0x54]
inc edi
cmp edi, eax
jl 0x53ac55
xor edi, edi
test ebp, ebp
jle 0x53ac95
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + edi*4]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x53ac90
mov ecx, dword [esp + 0x44]
push eax
push ecx
lea ecx, [esp + 0x44]
call fcn.00581a6e
inc edi
cmp edi, ebp
jl 0x53ac74
mov eax, dword [esp + 0x44]
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x14], eax
je 0x53acae
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
mov eax, dword [eax + 0x1c]
jmp 0x53acb2
mov eax, dword [esp + 0x18]
movsx eax, ax
cmp eax, ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x18], eax
jle 0x53ad55
mov ecx, dword [esp + 0x14]
xor ebp, ebp
xor edi, edi
test ecx, ecx
jle 0x53ad3a
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x74]
push edx
mov ecx, dword [eax + edi*4]
call fcn.00516a50
mov esi, eax
test esi, esi
je 0x53ad2d
mov eax, dword [esi + 0x4c]
mov ecx, dword [esp + 0x78]
cmp eax, ecx
je 0x53ad03
mov edx, dword [ebx]
push eax
mov ecx, ebx
mov dword [esp + 0x7c], eax
call dword [edx + 0x28]
push 0
lea eax, [esp + 0x30]
push ebx
push eax
mov ecx, esi
call fcn.0053c1d0
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov eax, dword [eax + 0xc]
sub eax, ecx
cmp ebp, eax
jg 0x53ad2d
mov ebp, eax
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x53acd5
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x74]
add edi, ebp
inc ecx
cmp ecx, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x74], ecx
jl 0x53acc9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x6c], 0
lea esi, [eax + 0x64]
call fcn.00581fc4
lea ecx, [esp + 0x50]
mov dword [esp + 0x6c], 0xffffffff
call fcn.00581891
mov ecx, dword [esp + 0x64]
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 8
Function at 0x55e290
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
or ecx, 0xffffffff
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 0x7fff
jb 0x55e2b7
pop edi
pop esi
pop ebx
add esp, 0xc
ret
lea eax, [ebx + 1]
push ebp
push eax
call fcn.00586401
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x61a8a4
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx - 0x10]
mov dword [esp + 0x28], ebp
shr esi, 1
call fcn.0056bfed
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x30]
mov edi, 0x17473
push ecx
lea edx, [ebp + 8]
sub ebx, edi
push 0x61a8a4
push edx
mov dword [esp + 0x2c], ebx
call fcn.0056bfed
mov edx, dword [esp + 0x3c]
lea eax, [esi + 1]
sub edx, edi
push eax
mov dword [esp + 0x40], edx
call fcn.00586401
mov ebx, eax
mov byte [ebx + esi], 0
mov ecx, dword [esp + 0x30]
and ecx, 0xffff
push ecx
call fcn.0056df7f
add esp, 0x24
xor edi, edi
test esi, esi
jle 0x55e39d
add ebp, 0x10
lea edx, [esp + 0x14]
push edx
push 0x61a89c
push ebp
call fcn.0056bfed
add esp, 0xc
call fcn.0056df8c
shl eax, 8
mov cl, byte [esp + 0x14]
add ebp, 2
cdq
and edx, 0x7fff
add eax, edx
sar eax, 0xf
xor al, cl
mov byte [edi + ebx], al
mov ecx, dword [esp + 0x20]
and eax, 0xff
sub ecx, eax
inc edi
cmp edi, esi
mov dword [esp + 0x20], ecx
jl 0x55e352
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x55e3b0
push ebx
call fcn.0058642a
add esp, 4
xor ebx, ebx
push ebp
call fcn.0058642a
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x55f34c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5c70ac
call fcn.0056e158
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
xor edi, edi
push 0xa
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
call fcn.0058226f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x10], edi
mov dword [esi], 0x5dbc70
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x58c5ad
Capabilities:
Encode data using xor

Disassembly:
neg edx
lea ebp, [edi - 0x38965dd9]
push 0x79532535
daa
movsb byte es:[edi], byte [esi]
in al, dx
in eax, dx

Function at 0x58de7b
Capabilities:
Encode data using xor

Disassembly:
ja 0x58de31
sub eax, 0xdbbdcc27
pop ecx
sub dword [ecx], ebp
sti
mov cl, 0xb3
dec esi

Function at 0x598a79
Capabilities:
Encode data using xor

Disassembly:
pop edx
push edx
pushfd
push ebp
dec ecx
cmp bl, byte [edx + 0x3649395d]
out dx, al
fstp qword [edx + 0x6a77f88a]
cmp cl, byte [edi + 0x45]
adc eax, 0x259fa326
mov edi, 0xb8b15d96
invalid
Function at 0x5a09e1
Capabilities:
Encode data using xor

Disassembly:
mov bl, 1
xchg edi, eax
or ebx, ecx
dec edi
aaa
invalid
jecxz 0x5a0a1d
leave
scasb al, byte es:[edi]
jg 0x5a0a13
pop edi
or dword [eax - 0x39], edi
rcl ecx, 0x5f
pop edx
clc
xchg edi, eax
loope 0x5a099a
movsd dword es:[edi], dword [esi]
jg 0x5a0a5e
cmp al, 0xb8
lcall 0x41ab, 0xcb1b4be2
and al, 0x4a
jbe 0x5a0a23
mov dh, 0xda
lodsb al, byte [esi]
xchg esi, eax
ror eax, 1
lds edx, [ebp - 0x78]
or bl, byte [eax]
sub al, 0x5b
out 0x5d, al
test eax, 0x47455966
pop ds
imul ecx, dword [edi + 0x4659b5fa], 0x1c
mov al, 0xab
cli
mov ch, 0x59
inc esi
sbb al, 0xb0
stosd dword es:[edi], eax
insb byte es:[edi], dx
xor eax, 0x6f272549
sbb dl, al
mov edx, gs
cmpsd dword ss:[esi], dword es:[edi]
xor al, 0xa5
pop es
sub dword [ebp + 0x36], eax
xchg esp, eax
adc al, 0x64
loop 0x5a0a2f
lds esp, [ebp - 0x47]
lea edi, [ecx + 0x52]
stosd dword es:[edi], eax
add ebp, 0x2ece5ec2
shl byte [ecx - 0x1c5b8ad6], 1
sub dh, byte [ecx + 0x72]
mov word [ecx - 0x2512542e], gs
dec edx
push ecx
mov word [ebp + 0x4b], ss
push esp
push eax
mov ebp, 0x15e314e1
retf 0xdedf
Function at 0x100053c2
Capabilities:
Terminate process

Disassembly:
push 0x10
mov eax, 0x1001ac1b
call fcn.1001a456
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 1
ja 0x100053ea
mov ecx, dword [0x10029d48]
call fcn.100043a3
test al, al
jne 0x100053ea
xor cl, cl
jmp 0x100053ec
mov cl, 1
mov edx, dword [ebp + 0xc]
mov byte [ebp - 0x10], cl
test edx, edx
jne 0x1000542c
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
cmp dword [esi + 8], 0
je 0x1000541d
movzx eax, cl
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.10011024
mov esi, dword [esi]
mov cl, byte [ebp - 0x10]
cmp esi, dword [ebx + 0xc]
jne 0x10005403
jmp 0x10005550
mov edi, dword [ebx + 0xc]
xor cl, cl
mov esi, dword [edi]
jmp 0x1000543f
mov eax, dword [esi + 8]
cmp edx, dword [eax + 0x10]
je 0x10005445
mov esi, dword [esi]
cmp esi, edi
jne 0x10005435
jmp 0x10005492
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
mov eax, ecx
or eax, edx
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
je 0x10005477
call dword [sym.imp.kernel32.dll_GetTickCount64]
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
jne 0x10005473
cmp eax, 0x1388
jbe 0x10005477
mov edi, esi
jmp 0x1000548c
movzx eax, byte [ebp - 0x10]
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.10011024
mov cl, byte [ebp + 0xb]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
cmp edi, eax
jne 0x100054c7
test cl, cl
jne 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
mov ecx, dword [esi + 8]
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.10011024
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054ab
jmp 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x100054ec
mov ecx, dword [esi + 8]
cmp edx, dword [ecx + 0x10]
je 0x100054e5
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.10011024
mov edx, dword [ebp + 0xc]
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054cd
mov ecx, dword [edi + 8]
push 1
push dword [ebp - 0x10]
push 0x80043074
call fcn.10011024
push 0
lea ecx, [ebx + 0x3c]
call fcn.10011024
mov esi, 0x10029eb0
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x10029d58]
test eax, eax
je 0x1000552b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x10029d58], 0
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.kernel32.dll_TerminateProcess]
test eax, eax
je 0x10005550
push 0xffffffffffffffff
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
xor eax, eax
call fcn.1001a427
ret 0xc
Function at 0x1000ddaa
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xc
mov eax, 0x1001b43b
call fcn.1001a456
and dword [ebp - 0x14], 0
xor ecx, ecx
and dword [ebp - 0x18], 0
inc ecx
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0xd], cl
test edi, edi
jne 0x1000ddd5
mov esi, 0x80070057
jmp 0x1000df49
mov ebx, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 8], 0x1b
jne 0x1000de05
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
lea ecx, [ebx - 0x14]
push eax
call fcn.10011024
mov esi, eax
test esi, esi
js 0x1000de02
cmp byte [ebp + 0xf], 0
je 0x1000de02
mov byte [ebp - 0xd], 0
jmp 0x1000de64
xor ecx, ecx
inc ecx
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x1000de33
sub eax, 1
je 0x1000de2c
sub eax, 3
je 0x1000de25
sub eax, 1
jne 0x1000de64
mov eax, dword [0x10029d28]
jmp 0x1000de38
mov eax, dword [0x10029d30]
jmp 0x1000de38
mov eax, dword [0x10029d24]
jmp 0x1000de38
mov eax, dword [0x10029d2c]
test eax, eax
je 0x1000de64
cmp dword [ebx + 0xc4], 0
jne 0x1000de4d
cmp dword [ebx + 0x18], 0
jne 0x1000de4d
xor cl, cl
push ecx
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push dword [edi + 8]
push eax
call fcn.1000d1e8
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1000dee1
cmp dword [ebx + 0xc4], 4
jne 0x1000de7a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x5b4
je 0x1000dee1
cmp dword [edi + 4], 0x100
je 0x1000de8c
cmp dword [edi + 4], 0x101
jne 0x1000dea7
cmp dword [edi + 8], 0x1b
jne 0x1000dea7
cmp dword [ebx + 0xc4], 0
jne 0x1000dea7
cmp dword [ebx + 0x18], 0
jne 0x1000dea7
cmp byte [ebp - 0xd], 0
jne 0x1000dee1
mov ecx, dword [ebx + 0x34]
xor esi, esi
test ecx, ecx
je 0x1000dec0
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push 0x1001d700
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x1000df49
cmp dword [ebp - 0x18], 0
jne 0x1000ded5
mov esi, 0x8000ffff
jmp 0x1000df49
mov eax, dword [ebp - 0x18]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
cmp esi, 1
jne 0x1000df3e
cmp dword [edi + 4], 0x100
jne 0x1000df0c
cmp dword [edi + 8], 9
jne 0x1000df3e
push 0
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push 9
push dword [0x10029d40]
call fcn.1000d1e8
jmp 0x1000df41
cmp dword [edi + 4], 0x104
jne 0x1000df3e
cmp dword [edi + 8], 0x79
jne 0x1000df3e
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ebx, 0x8000
test bx, ax
je 0x1000df3e
push 0x10
call edi
test bx, ax
je 0x1000df3e
xor eax, eax
xor esi, esi
jmp 0x1000df41
mov eax, dword [ebp - 0x14]
test eax, eax
push 1
pop eax
cmovne esi, eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000df5a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.1001a427
ret 8
Function at 0x10011024
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10011033
pop dword [ebp - 0x50]
mov eax, 0x195b629
add eax, 0xe6b5a0a
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x7a1a2ec8
add dword [ebp - 0x60], 0xd4381683
mov dword [ebp - 0x5c], 0x816de08a
sub dword [ebp - 0x5c], 0x4f3a9445
mov dword [ebp - 0x58], 0xce377a9d
add dword [ebp - 0x58], 0x7e14c991
mov dword [ebp - 0x54], 0x200ab7ba
add dword [ebp - 0x54], 0xdff54846
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe1411390
sub dword [ebp - 0x60], 0x6cceaa3a
mov dword [ebp - 0x5c], 0x3ac800e
add dword [ebp - 0x5c], 0x3dbfe167
mov dword [ebp - 0x58], 0x6b05fcce
sub dword [ebp - 0x58], 0x7969062
mov dword [ebp - 0x54], 0x9ac4c92d
add dword [ebp - 0x54], 0x653b36d3
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x5169887
add eax, 0xaeb37a5
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3ce2e
push 0
call eax
mov ecx, 0x33ddde35
add ecx, 0xcc227452
xor ebx, ebx
add ebx, eax
mov edx, 0x9bda205d
sub edx, 0x8bd7405d
add edx, dword [ebp - 0x50]
mov edi, 0xb4bef854
mov dword [ebp - 0x38], 0x566a63ea
mov esi, dword [edx]
xor dword [ebp - 0x34], 0xec3d5206
xor esi, edi
add dword [ebp - 8], 0x7eed493b
mov dword [ebx], esi
sub dword [ebp - 0x34], 0x4a1a85b7
add ebx, 0x51709a8
add ebx, 0xfae8f65c
add edx, 0xaf0f85fb
add edx, 0x50f07a09
loop 0x1001114c
add eax, 0xea77baa4
add eax, 0x1589824b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x10011b7a
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x3c]
mov esi, 0x8004307f
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c], edi
mov eax, 0x824
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push dword [ebp + 0xc]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x10011c2b
mov eax, dword [ebp - 0x30]
cmp eax, 3
je 0x10011bd1
cmp eax, 4
jne 0x10011c2b
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x10011be7
xor ecx, ecx
mov esi, 0x8004307b
cmp eax, 4
cmove esi, ecx
jne 0x10011c2b
cmp dword [ebp + 0x14], 0
je 0x10011c2b
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [edi + 0x74]
jne 0x10011c14
push dword [edi + 0x74]
push dword [edi + 0x6c]
push dword [ebp - 0x2c]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x10011c2b
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
push ecx
push dword [ebp - 0x2c]
lea ecx, [edi - 0x14]
push eax
call fcn.10011c4c
test al, al
mov ecx, 0x8004307c
cmove esi, ecx
pop edi
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x8cc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008cc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8cc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8cc06a
add dl, dl
jne 0x8cc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8cc0dc
xor eax, eax
add dl, dl
jne 0x8cc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8cc17d
add dl, dl
jne 0x8cc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8cc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8cc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8cc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8cc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8cc075
mov eax, 1
add dl, dl
jne 0x8cc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8cc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8cc0e1
sub eax, ebx
mov ebx, 1
jne 0x8cc128
mov ecx, 1
add dl, dl
jne 0x8cc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8cc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8cc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8cc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8cc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8cc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8cc136
cmp eax, 0x7d00
jae 0x8cc16d
cmp eax, 0x500
jb 0x8cc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8cc075
cmp eax, 0x7f
ja 0x8cc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8cc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8cc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8cc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10