joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69b53da4
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [eax], edi
push 0x36
lea eax, [ebx + 3]
cdq
pop ecx
idiv ecx
mov dword [ebp - 0xc], edi
imul eax, eax, 0x128
add eax, 0x254
push eax
call fcn.69b1d3c9
mov esi, dword [ebp + 8]
mov ecx, eax
cmp ecx, edi
mov dword [ebp - 8], ecx
mov dword [ebp + 8], edi
jne 0x69b53df1
mov dword [ebp - 0xc], 0x8007000e
jmp 0x69b53f77
cmp ebx, 3
push 2
pop edi
jl 0x69b53eac
mov eax, ebx
xor edx, edx
push 3
pop ebx
div ebx
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
mov edx, eax
mov eax, dword [ebp + 0xc]
sub eax, edx
mov dword [ebp - 0x10], eax
mov al, byte [esi + 1]
mov dl, byte [esi]
mov bl, al
shr bl, 4
and dl, 3
shl dl, 4
or dl, bl
and al, 0xf
mov byte [ebp + 0xf], dl
mov dl, byte [esi + 2]
shl al, 2
mov bl, dl
shr bl, 6
or al, bl
movzx ebx, byte [esi]
add dword [ebp + 8], 4
shr ebx, 2
mov bx, word [ebx*2 + 0x69b46d90]
mov word [ecx], bx
movzx ebx, byte [ebp + 0xf]
mov bx, word [ebx*2 + 0x69b46d90]
add ecx, edi
mov word [ecx], bx
movzx eax, al
mov ax, word [eax*2 + 0x69b46d90]
add ecx, edi
mov word [ecx], ax
and dl, 0x3f
movzx eax, dl
mov ax, word [eax*2 + 0x69b46d90]
add ecx, edi
mov word [ecx], ax
add ecx, edi
add esi, 3
cmp dword [ebp + 8], 0x48
jl 0x69b53ea0
mov word [ecx], 0xd
add ecx, edi
mov word [ecx], 0xa
add ecx, edi
and dword [ebp + 8], 0
dec dword [ebp - 4]
jne 0x69b53e16
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, 4
cmp eax, 0x48
jl 0x69b53ec5
mov word [ecx], 0xd
add ecx, edi
mov word [ecx], 0xa
add ecx, edi
test ebx, ebx
je 0x69b53f5e
cmp ebx, 1
jne 0x69b53f05
mov dl, byte [esi]
mov al, dl
and al, 3
movzx edx, dl
shl al, 4
shr edx, 2
mov dx, word [edx*2 + 0x69b46d90]
mov word [ecx], dx
movzx eax, al
mov ax, word [eax*2 + 0x69b46d90]
add ecx, edi
mov word [ecx], ax
add ecx, edi
mov word [ecx], 0x3d
jmp 0x69b53f55
cmp ebx, edi
jne 0x69b53f5e
mov dl, byte [esi]
mov al, byte [esi + 1]
mov byte [ebp + 0xf], dl
movzx esi, byte [ebp + 0xf]
and dl, 3
mov bl, al
shl dl, 4
shr bl, 4
or dl, bl
and al, 0xf
shr esi, 2
mov si, word [esi*2 + 0x69b46d90]
mov word [ecx], si
shl al, 2
movzx edx, dl
mov dx, word [edx*2 + 0x69b46d90]
add ecx, edi
movzx eax, al
mov word [ecx], dx
mov ax, word [eax*2 + 0x69b46d90]
add ecx, edi
mov word [ecx], ax
add ecx, edi
mov word [ecx], 0x3d
add ecx, edi
push dword [ebp - 8]
and word [ecx], 0
call fcn.69b2d3f9
mov ecx, dword [ebp + 0x10]
push dword [ebp - 8]
mov dword [ecx], eax
call fcn.69b1131d
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x69bb1b45
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x10], edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x20], ebx
je 0x69bb1cab
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x69b4aa60
push eax
call dword [ecx]
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x69bb1cb2
mov eax, dword [esi]
push esi
mov word [ebp - 0x34], 8
mov dword [ebp - 0x2c], ebx
call dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x34]
push edx
push edi
push 0x942
push 0x69b4a870
push eax
call dword [ecx + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp dword [ebp - 4], edi
jge 0x69bb1cb2
cmp dword [esi + 0x28], edi
je 0x69bb1cb2
or dword [ebp - 0x18], 0xffffffff
push edi
mov ebx, 0x2000
push ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x1c], edi
call fcn.69b18229
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x69bb1bf5
mov dword [ebp - 4], 0x8007000e
jmp 0x69bb1c7b
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.ole32.dll_CreateBindCtx]
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x69bb1c7b
mov esi, dword [esi + 0x28]
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push 0x69b1a0b0
push edi
push dword [ebp - 0x1c]
push esi
call dword [eax + 0x24]
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x69bb1c7b
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_52]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
jne 0x69bb1c66
mov dword [ebp - 4], 0x80004005
jmp 0x69bb1c7b
cmp dword [ebp - 0x14], edi
je 0x69bb1c7b
push edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push ebx
push dword [ebp - 0xc]
push eax
call dword [ecx + 0xc]
test eax, eax
jge 0x69bb1c4d
push dword [ebp - 0xc]
call fcn.69b1131d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x69bb1c9c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 8], edi
mov eax, dword [ebp - 0x1c]
cmp eax, edi
je 0x69bb1cb2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x69bb1cb2
mov dword [ebp - 4], 0x8007000e
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x69bb1cc2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x20], edi
pop edi
pop esi
pop ebx
je 0x69bb1cd3
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x69bb495a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push dword [0x69bd320c]
lea ecx, [ebp - 4]
xor esi, esi
xor ebx, ebx
call fcn.69b15707
cmp dword [0x69be3278], esi
jne 0x69bb4993
push 0x69be3278
call fcn.69bb48e8
mov ebx, eax
cmp ebx, esi
jl 0x69bb4a42
cmp word [0x69be3288], si
jne 0x69bb49d8
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [0x69bdcbd0]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 0x69bb462a
mov dword [ebp - 0xc], str.XMLMimeWnd
call dword [sym.imp.USER32.dll_RegisterClassA]
cmp ax, si
mov word [0x69be3288], ax
jne 0x69bb49d8
mov esi, 0x80004005
jmp 0x69bb4a44
cmp dword [0x69be327c], esi
jne 0x69bb49f0
push 0x69be327c
call fcn.69bb4896
mov ebx, eax
cmp ebx, esi
jl 0x69bb4a42
mov edi, 0x69be3280
cmp dword [edi], esi
jne 0x69bb4a0a
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, esi
mov dword [edi], eax
je 0x69bb4a3d
add edi, 4
cmp edi, 0x69be3288
jl 0x69bb49f5
cmp dword [0x69be328c], esi
jne 0x69bb4a42
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x69bb40db
push 0x7d000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x69be328c], eax
jne 0x69bb4a42
mov ebx, 0x80004005
mov esi, ebx
lea ecx, [ebp - 4]
call fcn.69b1574c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x69bb8877
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 4
pop eax
call fcn.69b364c4
mov dword [ebp - 8], esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x69bb8973
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0x4c]
xor esi, esi
cmp dword [0x69bdecd0], 2
jne 0x69bb88f8
push 0x69b36d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
je 0x69bb88f8
push 0x69bb8980
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x69bb88f8
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], esi
call eax
cmp eax, 1
pop ecx
jne 0x69bb88f8
cmp dword [ebp - 4], esi
jbe 0x69bb88f8
mov esi, dword [ebp - 4]
mov edx, dword [0x69bdecd0]
mov ebx, edx
dec ebx
neg ebx
sbb ebx, ebx
and ebx, 0x103
lea ecx, [edi - 1]
lea eax, [esi + edi - 1]
not ecx
inc ebx
and eax, ecx
mov dword [ebp - 4], eax
je 0x69bb8921
add eax, edi
mov dword [ebp - 4], eax
lea ecx, [edi + edi]
cmp eax, ecx
jae 0x69bb892d
mov dword [ebp - 4], ecx
mov eax, ecx
lea esi, [edi - 1]
not esi
and esi, dword [ebp - 8]
sub esi, eax
cmp edx, 1
jne 0x69bb893f
push 0x11
pop edi
mov ecx, dword [ebp - 0xc]
add edi, ecx
cmp esi, edi
jb 0x69bb8973
push 4
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x69bb8973
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x69bb8973
xor eax, eax
inc eax
jmp 0x69bb8975
xor eax, eax
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x69bb8e9a
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x69bb8edc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x69bb8ec3
push 0x69bb8ecc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x69bb8ec3
push dword [ebp + 8]
call eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x69bb907b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp ecx, dword [esi*8 + 0x69be2308]
je 0x69bb909d
inc esi
cmp esi, 0x13
mov dword [ebp - 4], esi
jb 0x69bb908b
cmp esi, 0x13
je 0x69bb91d9
mov eax, dword [0x69be3294]
cmp eax, 1
push ebx
je 0x69bb91a8
test eax, eax
jne 0x69bb90c6
cmp dword [0x69be3298], 1
je 0x69bb91a8
cmp ecx, 0xfc
je 0x69bb91d8
push edi
push 6
pop ecx
mov esi, 0x69bb9224
mov edi, 0x69be3300
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x69be331a
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x69be341e], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x69bb9114
push 5
pop ecx
mov esi, 0x69bb920c
mov edi, 0x69be331a
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x69bb9119
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x69bb914c
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x69bb912d
sub eax, edx
push 3
lea eax, [eax + 0x69be32df]
push 0x69bb9208
push eax
call fcn.69b39de1
add esp, 0xc
mov edx, 0x69be3300
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x69bb9154
mov eax, dword [ebp - 4]
mov eax, dword [eax*8 + 0x69be230c]
mov esi, 0x69bb9204
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x69bb9170
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x69bb917c
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x69bb91dc
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.69bbb0b1
add esp, 0xc
pop edi
jmp 0x69bb91d8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x69bb91d8
mov edx, dword [esi*8 + 0x69be230c]
mov ecx, edx
lea esi, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x69bb91c0
push 0
sub ecx, esi
lea esi, [ebp - 8]
push esi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret
Function at 0x69bbb0b1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x69be3618], ebx
push esi
push edi
jne 0x69bbb133
push 0x69bbb210
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x69bbb16e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x69bbb204
push edi
call esi
test eax, eax
mov dword [0x69be3618], eax
je 0x69bbb16e
push 0x69bbb1f4
push edi
call esi
push 0x69bbb1e0
push edi
mov dword [0x69be361c], eax
call esi
cmp dword [0x69bdecd0], 2
mov dword [0x69be3620], eax
jne 0x69bbb133
push 0x69bbb1c4
push edi
call esi
test eax, eax
mov dword [0x69be3628], eax
je 0x69bbb133
push 0x69bbb1ac
push edi
call esi
mov dword [0x69be3624], eax
mov eax, dword [0x69be3624]
test eax, eax
je 0x69bbb178
call eax
test eax, eax
je 0x69bbb15f
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x69be3628]
test eax, eax
je 0x69bbb15f
test byte [ebp - 8], 1
jne 0x69bbb178
cmp dword [0x69bdecdc], 4
jb 0x69bbb172
or byte [ebp + 0x12], 0x20
jmp 0x69bbb197
xor eax, eax
jmp 0x69bbb1a7
or byte [ebp + 0x12], 4
jmp 0x69bbb197
mov eax, dword [0x69be361c]
test eax, eax
je 0x69bbb197
call eax
mov ebx, eax
test ebx, ebx
je 0x69bbb197
mov eax, dword [0x69be3620]
test eax, eax
je 0x69bbb197
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x69be3618]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x69bc5455
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x69bd7228]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push edi
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov edi, ecx
push 2
push dword [edi + 0x50]
mov dword [ebp - 0x28], 0x20
call esi
test eax, eax
je 0x69bc54a7
push 0x69bc54d0
lea eax, [ebp - 0x24]
push eax
call fcn.69b1ba60
test eax, eax
je 0x69bc54a7
xor eax, eax
jmp 0x69bc54c1
push 0
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
push 0x20000005
push dword [edi + 0x50]
mov dword [ebp - 0x28], 4
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.69b1718c
leave
ret 4
Function at 0x69bc5788
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x50]
xor esi, esi
cmp eax, esi
push edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [ebp - 4], esi
je 0x69bc57ad
push eax
call edi
mov dword [ebx + 0x50], esi
mov eax, dword [ebx + 0x4c]
cmp eax, esi
je 0x69bc57ba
push eax
call edi
mov dword [ebx + 0x4c], esi
cmp dword [ebx + 0x48], esi
jne 0x69bc5815
push esi
push esi
push esi
push esi
push 0x69bc5950
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
cmp eax, esi
mov dword [ebx + 0x48], eax
je 0x69bc5911
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea ecx, [ebp - 8]
push ecx
push 0x44
push eax
mov dword [ebp - 8], 0xfde9
call edi
test eax, eax
je 0x69bc5911
push 4
lea eax, [ebp - 0xc]
push eax
push 0x54
push dword [ebx + 0x48]
mov dword [ebp - 0xc], 0x28
call edi
test eax, eax
je 0x69bc5911
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
push eax
push esi
push esi
push dword [ebp + 8]
xor edi, edi
inc edi
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x69bc5911
cmp dword [ebp - 0x44], edi
je 0x69bc585e
cmp dword [ebp - 0x44], 2
je 0x69bc585e
mov edi, 0x80004005
jmp 0x69bc5946
cmp dword [ebp - 0x20], esi
jne 0x69bc586d
mov dword [ebp - 0x24], 0x69b46910
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x3c]
lea eax, [eax + eax + 2]
push eax
call fcn.69b1d3c9
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x69bc588b
mov edi, 0x8007000e
jmp 0x69bc5939
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
mov edi, eax
rep movsw word es:[edi], word [esi]
mov ecx, dword [ebp - 0x3c]
and word [eax + ecx*2], 0
push 0
push dword [ebp - 0x38]
push eax
push dword [ebx + 0x48]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
test eax, eax
mov dword [ebx + 0x4c], eax
je 0x69bc590f
push 2
pop edi
cmp dword [ebp - 0x44], edi
mov ecx, 0x80
jne 0x69bc58c6
mov ecx, 0x800080
push ecx
xor esi, esi
push esi
push esi
push esi
push dword [ebp - 0x24]
push 0x69b49c44
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
cmp eax, esi
mov dword [ebx + 0x50], eax
je 0x69bc590f
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 0x3f
push eax
mov dword [ebp - 0x10], edi
call esi
test eax, eax
je 0x69bc590f
and dword [ebp - 0x14], 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4d
push dword [ebx + 0x50]
call esi
test eax, eax
jne 0x69bc5935
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x69bc5923
call edi
mov edi, eax
jmp 0x69bc5939
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x69bc5939
xor edi, edi
xor esi, esi
cmp dword [ebp - 4], esi
je 0x69bc5946
push dword [ebp - 4]
call fcn.69b1131d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x69bc59b8
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ecx], eax
push eax
mov esi, 0xffff
jmp 0x69bc5a0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x69bc5a51
cmp dword [ebp - 4], 0
jne 0x69bc5a40
mov eax, dword [ebp - 0xc]
shr eax, 1
shl eax, 1
push eax
call fcn.69b1d3c9
test eax, eax
mov dword [ebp - 4], eax
je 0x69bc5a48
push 0
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp + 8]
push esi
push dword [ebx + 0x50]
call edi
test eax, eax
je 0x69bc59e3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x69bc5a36
push dword [ebp - 4]
call fcn.69b1131d
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8
push dword [ebp - 4]
call fcn.69b1131d
mov dword [ebp - 8], 0x8007000e
jmp 0x69bc5a36
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x69bc5a64
call edi
mov dword [ebp - 8], eax
jmp 0x69bc5a28
call edi
and eax, esi
or eax, 0x80070000
jmp 0x69bc5a5f
Function at 0x69bc5a6f
Capabilities:
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push esi
push 1
push ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [esi], ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, eax
cmp edi, ebx
jl 0x69bc5be7
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 4]
push eax
mov ecx, edi
call fcn.69bc5455
test eax, eax
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
push ebx
je 0x69bc5abe
mov ecx, dword [ebp - 4]
jmp 0x69bc5ac7
or dword [ebp - 4], 0xffffffff
mov ecx, 0x2000
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x18]
push ebx
push 0x2000
call fcn.69b18229
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x69bc5aea
mov edi, 0x8007000e
jmp 0x69bc5be7
cmp dword [ebp - 4], ebx
je 0x69bc5bb4
lea eax, [ebp + 8]
push eax
push dword [edi + 0x50]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x69bc5b0f
jmp 0x69bc5b7d
mov edi, dword [ebp - 0x14]
mov eax, 0x2000
cmp dword [ebp + 8], eax
jb 0x69bc5b1c
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
push dword [edi + 0x50]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x69bc5b7d
cmp dword [ebp - 8], ebx
je 0x69bc5ba1
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call dword [ecx + 0x10]
mov edi, eax
cmp edi, ebx
jl 0x69bc5be7
mov eax, dword [ebp - 8]
add dword [ebp - 0xc], eax
cmp eax, ebx
je 0x69bc5ba1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0x69bc5ba1
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x50]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x69bc5b0c
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x69bc5b8f
call edi
mov edi, eax
jmp 0x69bc5be7
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x69bc5be7
mov eax, dword [esi]
mov edx, dword [eax]
xor ecx, ecx
push ecx
push dword [ebp - 0xc]
push eax
call dword [edx + 0x18]
cmp dword [ebp - 0xc], ebx
jne 0x69bc5bd3
push esi
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, eax
cmp edi, ebx
jl 0x69bc5be7
mov eax, dword [esi]
mov edx, dword [eax]
push ebx
xor ecx, ecx
push ecx
push eax
mov dword [ebp - 0x18], ebx
call dword [edx + 0x18]
mov eax, dword [esi]
mov edx, dword [eax]
push ebx
push ebx
xor ecx, ecx
push ecx
push ecx
push eax
call dword [edx + 0x14]
mov edi, eax
cmp edi, ebx
jge 0x69bc5bf7
mov eax, dword [esi]
cmp eax, ebx
je 0x69bc5bf9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], ebx
jmp 0x69bc5bf9
xor edi, edi
cmp dword [ebp - 0x10], ebx
je 0x69bc5c06
push dword [ebp - 0x10]
call fcn.69b1131d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x69bc60c4
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x70]
mov eax, dword [edi]
test eax, eax
je 0x69bc60f6
cmp byte [esi + 0x74], 0
jne 0x69bc60f6
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x69bc60f6
mov ecx, dword [eax]
push 0x69b46908
push 0x80004005
push eax
call dword [ecx + 0x1c]
push 0
mov ecx, edi
call fcn.69b1538d
pop edi
mov ecx, esi
pop esi
jmp fcn.69b2fd31
Function at 0x69bc6943
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
pop edi
je 0x69bc6982
mov eax, dword [ebp - 0x30]
jmp 0x69bc6985
or eax, 0xffffffff
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3f072091
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..pdata_1
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6c840416
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219