joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007ca7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, dword [ebp + 8]
push edi
call ebx
mov dword [ebp + 8], eax
xor edi, edi
push edi
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, esi
jb 0x1007d2b
cmp eax, 0x80
jb 0x1007ce1
lea ecx, [esi + 0x80]
cmp eax, ecx
jb 0x1007d2b
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1007d0a
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1007cbe
push 0x4ff
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
call ebx
cmp edi, esi
jae 0x10157b4
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp edi, 0x80
jae 0x101588f
cmp edi, esi
jne 0x1007d29
cmp dword [ebp + 0x10], 0xffffffff
je 0x1007cb9
sub eax, dword [ebp + 8]
cmp dword [ebp + 0x10], eax
jb 0x10261df
sub dword [ebp + 0x10], eax
jmp 0x1007cb9
lea ecx, [esi + 0x80]
cmp edi, ecx
jb 0x1007d29
jmp 0x10157c0
mov eax, 0x102
jmp 0x1007d2b

Function at 0x1007fe2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1007ff0
and dword [esi], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x100b40b
cmp dword [ebp + 0xc], 0
je 0x100b40b
push 0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x103c8c2
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100b3fc
test esi, esi
je 0x1008034
mov dword [esi], eax
xor eax, eax
pop esi
pop ebp
ret 0x10
cmp dword [ebp + 0x10], eax
je 0x100802e
inc eax
jmp 0x1008036
mov eax, 0x80030009
jmp 0x1008036
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 5
neg eax
sbb eax, eax
and eax, 0x7ffcfffc
add eax, 0x80030005
jmp 0x1008036
Function at 0x10083bb
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1068b73
call fcn.010016d0
sub esp, 0x428
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
lea eax, [ebp - 0x228]
jne 0x103c08a
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x103c0a5
lea eax, [ebp - 0x228]
push eax
call fcn.0100838c
lea eax, [ebp + 0xf]
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x1c]
call fcn.01003112
push ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], ebx
call fcn.01008486
mov esi, eax
cmp esi, ebx
setl byte [ebp + 0xf]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
call fcn.01001890
cmp byte [ebp + 0xf], bl
jne 0x1008474
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jne 0x1008445
mov eax, 0x1031a58
lea ecx, [ebp - 0x434]
push ecx
push ebx
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x103c0a5
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x434]
push eax
call fcn.010018c3
xor esi, esi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
push 0x104
push dword [ebp + 0xc]
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov word [ebp - 0x20], bx
jmp 0x10083f2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x103c0ba
call esi
mov esi, eax
jmp 0x1008474
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1008474
Function at 0x1008486
Capabilities:
Create directory

Disassembly:
mov eax, 0x1068b61
call fcn.010016d0
sub esp, 0x20
mov al, byte [ebp + 0xf]
push esi
xor esi, esi
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], esi
jne 0x1010ea6
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.01001aa4
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x103bfe9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push esi
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
cmp esi, 1
je 0x10084f1
cmp eax, 0xb7
jne 0x103bff3
xor esi, esi
pop edi
pop ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.01001890
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
mov ecx, dword [ebp + 8]
push 1
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], 0x5c
call fcn.01001d22
cmp eax, 0xffffffff
je 0x10084f5
mov ecx, dword [ebp + 8]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.01001de9
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.01001aa4
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.01001890
jmp 0x10084c0
mov eax, 0x102b8d8
jmp 0x10084cb
cmp eax, 3
je 0x103c00f
test eax, eax
jg 0x103c003
mov esi, eax
jmp 0x10084f3
and eax, 0xffff
or eax, 0x80070000
jmp 0x103bffc
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.01008486
mov esi, eax
test esi, esi
jl 0x10084f3
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x103c030
mov eax, 0x102b8d8
push 0
push eax
call ebx
test eax, eax
jne 0x10084f1
call edi
test eax, eax
jg 0x103c047
call edi
jmp 0x103bffc
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10084f3

Function at 0x100855b
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x1008572
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x103c9c1
xor eax, eax
pop esi
pop ebp
ret 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x1008584
cmp eax, 3
je 0x1008584
cmp byte [ebp + 0x10], 0
je 0x103ca14
push 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1008584
call esi
test eax, eax
jg 0x103ca03
call esi
jmp 0x1008586
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1008586
test eax, eax
jle 0x1008586
jmp 0x103ca05
Function at 0x100ec1e
Capabilities:
Get common file path
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x1068a44
call fcn.010016d0
sub esp, 0x214
push ebx
xor ebx, ebx
cmp dword [0x1082b04], ebx
mov dword [esp + 8], ebx
je 0x10111fe
mov ecx, dword [esp + 0x218]
mov eax, dword [esp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push edi
mov edi, 0x1082e38
push 1
push edi
call esi
test eax, eax
jne 0x101128b
cmp dword [0x1082b04], ebx
jne 0x1011280
push 0x1082aec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0xc
call fcn.01001860
pop ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x228], ebx
je 0x1011297
lea ecx, [esp + 0xf]
push ecx
mov ecx, eax
call fcn.01001c5e
cmp eax, ebx
mov dword [0x1082ae8], eax
je 0x101129b
push ebp
mov ebp, 0x103
push ebp
lea eax, [esp + 0x20]
push eax
mov ebx, 0x1034c18
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x103bbf1
mov dword [0x1082b04], 1
xor ebx, ebx
pop ebp
push ebx
push edi
call esi
pop edi
pop esi
jmp 0x100ec41
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101120b
xor eax, eax
jmp 0x101124a
mov dword [esp + 0x10], 0x8007000e
jmp 0x1011280
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1011273

Function at 0x100ef5a
Capabilities:
Allocate thread local storage

Disassembly:
push esi
mov esi, ecx
xor ecx, ecx
push ecx
mov eax, fcn.0101328a
push eax
push esi
mov ecx, 0x107c450
call fcn.0100ecae
test eax, eax
jl 0x100f0a1
push esi
push esi
lea ecx, [esi + 0x7c]
call fcn.0100d0c2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi + 0x84], eax
je 0x103f211
push ebx
push edi
push 0
mov ecx, esi
call fcn.010021f9
push 3
push esi
lea ecx, [esi + 0xc4]
call fcn.01010db8
push 4
push esi
lea ecx, [esi + 0x120]
call fcn.01010db8
push 5
push esi
lea ecx, [esi + 0x180]
call fcn.01010db8
push esi
lea ecx, [esi + 0x208]
call fcn.01010dc9
lea edi, [esi + 0x90]
push edi
call fcn.01010f1a
test eax, eax
jl 0x100f09f
mov ecx, dword [edi]
push esi
call fcn.01010302
lea edi, [esi + 0x94]
push edi
call fcn.01010701
test eax, eax
jl 0x100f09f
mov ecx, dword [edi]
push esi
call fcn.010104ae
lea edi, [esi + 0x98]
push edi
call fcn.01010817
test eax, eax
jl 0x100f09f
mov ecx, dword [edi]
push esi
call fcn.010104b8
lea edi, [esi + 0x9c]
push edi
call fcn.01010904
test eax, eax
jl 0x100f09f
mov ecx, dword [edi]
push esi
call fcn.010104b8
lea edi, [esi + 0x8c]
push edi
call fcn.010109da
test eax, eax
jl 0x100f09f
mov ecx, dword [edi]
push esi
call fcn.010104c2
test eax, eax
jl 0x100f09f
lea edi, [esi + 0xa0]
push edi
call fcn.01010ad8
test eax, eax
jl 0x100f09f
mov ecx, dword [edi]
push esi
call fcn.0100f0a3
test eax, eax
jl 0x100f09f
mov ecx, dword [edi]
lea ebx, [esi + 0xa4]
push ebx
call fcn.0100fee1
test eax, eax
jl 0x100f09f
mov ecx, dword [ebx]
add esi, 0xa8
push esi
call fcn.0100d021
test eax, eax
jl 0x100f09f
xor eax, eax
pop edi
pop ebx
pop esi
ret
mov eax, 0x800705aa
pop esi
ret
Function at 0x100fcc3
Capabilities:
Modify service
Query service status
Start service

Disassembly:
mov eax, 0x1069c19
call fcn.010016d0
sub esp, 0x82c
and byte [esp + 3], 0
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, 0x80000000
push ebp
push 0
push 0
mov dword [esp + 0x24], ecx
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x100fd3d
push 4
push 0x1034138
push esi
call ebx
test eax, eax
mov dword [esp + 0x14], eax
je 0x100fd36
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100fd2c
cmp dword [esp + 0x24], 4
jne 0x100fd2c
mov byte [esp + 0x13], 1
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
xor esi, esi
push esi
push esi
call edi
cmp eax, esi
mov dword [esp + 0x14], eax
je 0x100fd94
push 3
push 0x1034138
push eax
call ebx
mov esi, eax
test esi, esi
je 0x100fd88
lea eax, [esp + 0x1c]
push eax
push 0x800
lea eax, [esp + 0x44]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x100fd81
cmp dword [esp + 0x40], 4
je 0x103e428
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
cmp byte [esp + 0x13], 0
je 0x103e44a
mov ecx, dword [esp + 0x83c]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret
push dword [esp + 0x5c]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [esp + 0x60]
push 2
push dword [esp + 0x60]
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x100fd81
push ebp
push esi
push esi
call edi
mov edi, eax
cmp edi, esi
je 0x103e490
push 0x10
push 0x1034138
push edi
call ebx
mov ebx, eax
cmp ebx, esi
je 0x103e47e
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x103e477
mov byte [esp + 0x13], 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [esp + 0x13], 0
jne 0x100fd9f
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xa0]
cmp ecx, esi
mov dword [esp + 0x844], esi
je 0x103e4bd
push esi
lea eax, [esp + 0x18]
push eax
call fcn.0100d0f9
test eax, eax
jl 0x103e4bd
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
or dword [esp + 0x844], 0xffffffff
cmp eax, esi
je 0x100fd9f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100fd9f

Function at 0x101003e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x106d829
call fcn.010016d0
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], edi
call fcn.01002ee9
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
call fcn.01002630
lea ecx, [esi + 0x30]
call fcn.01002ee9
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], 0xfefefefe
mov dword [esi + 0x2c], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1010bae
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x106d3f9
call fcn.010016d0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ebx
call fcn.01002ee9
lea ecx, [esi + 0x24]
mov dword [ebp - 4], ebx
call fcn.01002630
lea ecx, [esi + 0x30]
call fcn.01002ee9
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], 0xfefefefe
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x4c], bl
mov dword [esi + 0x50], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1010dd2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x1c
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
cmp esi, ebx
jl 0x1010e6f
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x103bf7d
lea eax, [ebp - 0x210]
push eax
call fcn.0100838c
cmp dword [ebp + 0xc], ebx
je 0x1010e5e
mov esi, dword [sym.imp.msvcrt.dll_wcsncat]
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x210]
push 0x1034280
push eax
call esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
mov word [ebp - 8], bx
call esi
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
mov word [ebp - 8], bx
call fcn.0100838c
pop edi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.010018c3
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x1010e9e
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x1010e9e
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1010e9e
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x103bf92
call esi
mov esi, eax
jmp 0x1010e6f
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1010e6f
Function at 0x101154f
Capabilities:
Accept command line arguments

Disassembly:
cmp dword [ebp - 0xc], ebx
jne 0x10111dd
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov dword [esi], eax
shl eax, 2
push eax
call fcn.01001860
cmp eax, ebx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
je 0x103be41
xor eax, eax
cmp dword [esi], ebx
jle 0x10111dd
mov edx, dword [ecx]
mov dword [edx + eax*4], ebx
inc eax
cmp eax, dword [esi]
jl 0x10111d3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10115a0
xor esi, esi
pop edi
push dword [ebp - 4]
call sub.msvcrt.dll_free
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
cmp di, 0x27
je 0x10115d3
mov ebx, dword [ebp - 4]
jmp 0x101150b
inc esi
inc esi
jmp 0x10115a6
push edi
call dword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
pop ecx
jne 0x1011510
mov word [ebx], di
inc ebx
inc ebx
inc esi
inc esi
xor edi, edi
mov di, word [esi]
test di, di
jne 0x10114f3
and word [ebx], 0
xor ebx, ebx
mov edi, dword [ebp + 0xc]
cmp dword [edi], ebx
je 0x1011537
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll__wcsdup]
cmp eax, ebx
pop ecx
je 0x103be41
mov ecx, dword [edi]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
pop ecx
je 0x10115bd
inc esi
inc esi
jmp 0x101153a
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], ebx
mov dword [eax], ebx
jne 0x101157c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x103be19
push edi
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [eax + eax + 2]
push eax
call fcn.01001860
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x103be41
mov dword [ebp - 0xc], ebx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
pop ecx
jne 0x10114ec
xor edi, edi
mov di, word [esi]
cmp di, bx
je 0x10111a9
cmp di, 0x22
jne 0x10114dd
mov edx, dword [ebp - 4]
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
je 0x10115fc
cmp ax, di
je 0x10115fa
cmp byte [ebp + 0x14], 0
jne 0x103be21
mov word [edx], ax
inc edx
inc edx
inc esi
inc esi
xor eax, eax
jmp 0x10115d8
inc esi
inc esi
mov word [edx], bx
jmp 0x1011516
xor esi, esi
inc esi
jmp 0x10111ed
cmp ax, 0x5c
jne 0x10115ef
lea ecx, [esi + 2]
cmp word [ecx], bx
je 0x10115ef
mov esi, ecx
mov ax, word [esi]
jmp 0x10115ef
push dword [ebp + 0xc]
mov esi, 0x8007000e
push dword [ebp + 8]
call fcn.01014188
jmp 0x10111ec
Function at 0x1011996
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.010046ac
push 0
push 1
mov ecx, ebx
call fcn.01007750
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01004755
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0x103bc0e
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x1011a3c
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x1011a3c
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x100ec56
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
je 0x1011a3c
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x103bc19
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10119e2
test eax, eax
jg 0x103bc26
call esi
mov esi, eax
jmp 0x1011a2c
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1011a2c

Function at 0x10168fd
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
cmp edi, esi
mov dword [ebp - 4], 0x103
mov ecx, 0x80070057
je 0x1016972
cmp word [edi], si
je 0x1016972
mov edx, dword [ebp + 0xc]
cmp edx, esi
je 0x1016976
cmp word [edx], si
je 0x1016976
cmp eax, esi
jl 0x101696c
push 0x20000000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
push edx
push edi
call dword [sym.imp.WININET.dll_InternetCombineUrlW]
test eax, eax
je 0x103fc05
push esi
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
push esi
call sub.urlmon.dll_URLOpenBlockingStreamW
cmp eax, esi
jl 0x101696c
xor eax, eax
pop edi
pop esi
leave
ret 0xc
mov eax, ecx
jmp 0x1016924
mov eax, ecx
jmp 0x1016930
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x103fc18
call esi
jmp 0x101696c
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x101696c
Function at 0x1016c6c
Capabilities:
Get memory capacity

Disassembly:
mov eax, 0x106cffc
call fcn.010016d0
sub esp, 0x44
push ebx
push esi
mov ebx, ecx
mov esi, ebx
neg esi
lea eax, [ebx + 4]
sbb esi, esi
and esi, eax
push esi
lea ecx, [ebp - 0x10]
call fcn.01001a89
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0xe
jge 0x1042bce
push edi
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1016cd8
cmp dword [ebp - 0x3c], 0
ja 0x1016cd8
jb 0x1042be8
cmp dword [ebp - 0x40], 0x2000000
jb 0x1042be8
mov eax, dword [ebp + 8]
lea edi, [eax + ebx + 0x34]
cmp byte [edi], 0
jne 0x1016d12
push 0
lea ecx, [ebp - 0x10]
call fcn.01001e38
push dword [ebp + 0xc]
push dword [ebx + 0x30]
call fcn.01007c94
test eax, eax
jne 0x1042bf8
push esi
lea ecx, [ebp - 0x10]
call fcn.01001e38
jmp 0x1016cdf
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1016d25
lea ecx, [eax + 4]
call fcn.01001880
mov al, 1
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1042be1
lea ecx, [eax + 4]
call fcn.01001880
xor al, al
jmp 0x1016d28
mov eax, dword [ebp + 0xc]
lea eax, [eax + eax*4]
shl eax, 1
mov dword [ebp + 0xc], eax
jmp 0x1016cd8
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1042c0b
lea ecx, [eax + 4]
call fcn.01001880
xor al, al
jmp 0x1016d27

Function at 0x1017414
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1017422
and dword [esi], 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x1017467
cmp dword [ebp + 0xc], 0
je 0x1017467
test byte [ecx + 0x33], 0x40
je 0x103c8de
push 0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x103c8e8
test esi, esi
je 0x1017460
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, 0x80030009
jmp 0x1017462
mov eax, 0x8003001d
jmp 0x1017462
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x70
jne 0x103c8fd
mov eax, 0x80030070
jmp 0x1017462
xor ecx, ecx
cmp eax, 5
setne cl
dec ecx
and ecx, 0xffffff02
add ecx, 0x80030103
mov eax, ecx
jmp 0x1017462