joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ae90
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret

Function at 0x41b180
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x479600]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push esi
push edi
push 0x40
push 0x36
push eax
mov dword [ebp - 0x48], ebx
call fcn.00421960
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov edi, dword [ebp + 0xc]
xor edx, edx
test esi, esi
jle 0x41b1d7
mov ebx, edi
lea eax, [ebp - 0x44]
sub ebx, eax
nop dword [eax]
cmp edx, 0x40
jge 0x41b1d4
lea ecx, [ebp - 0x44]
add ecx, edx
inc edx
mov al, byte [ebx + ecx]
xor byte [ecx], al
cmp edx, esi
jl 0x41b1c0
mov ebx, dword [ebp - 0x48]
push ebx
call fcn.0041b010
push 0x40
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.0041ad90
push 0x40
lea eax, [ebp - 0x44]
push 0x5c
push eax
call fcn.00421960
add esp, 0x1c
xor edx, edx
test esi, esi
jle 0x41b218
lea eax, [ebp - 0x44]
sub edi, eax
cmp edx, 0x40
jge 0x41b218
lea ecx, [ebp - 0x44]
add ecx, edx
inc edx
mov al, byte [edi + ecx]
xor byte [ecx], al
cmp edx, esi
jl 0x41b204
lea esi, [ebx + 0x60]
push esi
call fcn.0041b010
push 0x40
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.0041ad90
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.0041ca50
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret

Function at 0x41c9b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x47a190]
push esi
push edi
test ecx, ecx
jne 0x41c9f6
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor esi, esi
lea eax, [esi + esi*2]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
push 1
add esi, 0x200
push esi
push ecx
call fcn.00402980
add esp, 0xc
mov dword [0x47a190], eax
push esi
push eax
call edi
mov ecx, dword [0x47a190]
cmp eax, esi
jge 0x41c9c7
push 0
push dword [ebp + 8]
push 0x46b520
push ecx
call fcn.00402170
add esp, 0x10
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov edi, eax
call fcn.004028c0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x41cd20
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x479600]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x200]
push eax
push 4
mov dword [ebp - 0x60], 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0xc9
push dword [0x47b4c8]
mov dword [ebp - 0x200], 0x1fc
mov dword [ebp - 0x1fc], esi
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x1f4], 7
mov dword [ebp - 0x1f0], 0x8006
call dword [sym.imp.USER32.dll_LoadIconA]
movups xmm0, xmmword [str.asdfghj__qwert_authentication_agent_]
mov ecx, dword [0x46bdd0]
mov ebx, eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1c8], ecx
mov cl, byte [0x46bdd4]
movups xmmword [ebp - 0x1e8], xmm0
push eax
movups xmm0, xmmword [0x46bdc0]
push 0
mov dword [ebp - 0x1ec], ebx
movups xmmword [ebp - 0x1d8], xmm0
mov byte [ebp - 0x1c4], cl
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov esi, eax
test ebx, ebx
je 0x41cde7
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
Function at 0x41e4c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004022a0
add esp, 8
mov esi, eax
push 0x1010
push str.asdfghj_Fatal_Error
push esi
push dword [0x47b4d0]
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.004028c0
add esp, 4
push 1
call fcn.00440e24
int3

Function at 0x41e670
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x41e6c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_run___.100s___Error:__d
call fcn.00402230
add esp, 0xc
mov esi, eax
push 0x30
push 0x46bcc4
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.004028c0
add esp, 4
pop esi
pop ebp
ret
Function at 0x41e750
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x479600]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x47a1ac], 0
je 0x41e936
lea eax, [ebp - 0x218]
push eax
push str.SoftwareSimonTathamqwertSessions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41e936
push esi
push edi
push dword [0x47a1a4]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, eax
cmp esi, dword [0x47a1b4]
jle 0x41e7c8
mov edi, dword [sym.imp.USER32.dll_RemoveMenu]
nop dword [eax]
push 0x400
push 0
push dword [0x47a1a4]
call edi
dec esi
cmp esi, dword [0x47a1b4]
jg 0x41e7b0
push 0x104
lea eax, [ebp - 0x10c]
xor edi, edi
push eax
push edi
push dword [ebp - 0x218]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x41e8db
push ebx
mov ebx, 0x1000
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0041e6d0
add esp, 0xc
lea ecx, [ebp - 0x10c]
mov eax, str.Default_20Settings
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41e840
test dl, dl
je 0x41e83c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41e840
add ecx, 2
add eax, 2
test dl, dl
jne 0x41e820
xor eax, eax
jmp 0x41e845
sbb eax, eax
or eax, 1
test eax, eax
je 0x41e8b8
lea eax, [ebp - 0x214]
mov dword [ebp - 0x248], 0x30
mov dword [ebp - 0x224], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x248]
movlpd qword [ebp - 0x234], xmm0
push eax
push 1
push edi
push dword [0x47a1a4]
movlpd qword [ebp - 0x22c], xmm0
movlpd qword [ebp - 0x220], xmm0
mov dword [ebp - 0x244], 0x13
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], ebx
call dword [sym.imp.USER32.dll_InsertMenuItemA]
inc edi
add ebx, 0x10
push 0x104
lea eax, [ebp - 0x10c]
inc esi
push eax
push esi
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x41e7f3
pop ebx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
jne 0x41e936
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0x30
push eax
push 1
push 0
push dword [0x47a1a4]
mov dword [ebp - 0x244], 0x11
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 3
mov dword [ebp - 0x224], str._No_sessions_
call dword [sym.imp.USER32.dll_InsertMenuItemA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
Function at 0x41ef00
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x47a1d8], 0
jne 0x41f087
push esi
push str.advapi32.dll
mov dword [0x47a1d8], 1
call fcn.0041c9b0
add esp, 4
mov dword [0x47a1e0], eax
test eax, eax
je 0x41f07e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetSecurityInfo
push eax
call esi
mov dword [0x47b488], eax
test eax, eax
je 0x41f07e
mov eax, dword [0x47a1e0]
test eax, eax
je 0x41f074
push str.SetSecurityInfo
push eax
call esi
mov dword [0x47b484], eax
test eax, eax
je 0x41f07e
mov eax, dword [0x47a1e0]
test eax, eax
je 0x41f061
push str.OpenProcessToken
push eax
call esi
mov dword [0x47b498], eax
test eax, eax
je 0x41f07e
mov eax, dword [0x47a1e0]
test eax, eax
je 0x41f04e
push str.GetTokenInformation
push eax
call esi
mov dword [0x47b494], eax
test eax, eax
je 0x41f07e
mov eax, dword [0x47a1e0]
test eax, eax
je 0x41f03b
push 0x46e9c4
push eax
call esi
mov dword [0x47b490], eax
test eax, eax
je 0x41f07e
mov eax, dword [0x47a1e0]
test eax, eax
je 0x41f028
push 0x46e9e4
push eax
call esi
mov dword [0x47b48c], eax
test eax, eax
je 0x41f07e
mov eax, dword [0x47a1e0]
test eax, eax
je 0x41f015
push str.SetEntriesInAclA
push eax
call esi
mov dword [0x47b480], eax
test eax, eax
je 0x41f07e
mov eax, 1
mov dword [0x47a1dc], eax
pop esi
ret
xor eax, eax
mov dword [0x47b480], 0
mov dword [0x47a1dc], eax
pop esi
ret
xor eax, eax
mov dword [0x47b48c], 0
mov dword [0x47a1dc], eax
pop esi
ret
xor eax, eax
mov dword [0x47b490], 0
mov dword [0x47a1dc], eax
pop esi
ret
xor eax, eax
mov dword [0x47b494], 0
mov dword [0x47a1dc], eax
pop esi
ret
xor eax, eax
mov dword [0x47b498], 0
mov dword [0x47a1dc], eax
pop esi
ret
mov dword [0x47b484], 0
xor eax, eax
mov dword [0x47a1dc], eax
pop esi
ret
mov eax, dword [0x47a1dc]
ret

Function at 0x420707
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420746
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420746
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420746
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420746
cmp dword [ecx + 0x74], 0xe
jbe 0x420746
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44c1cb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044bdc3

Function at 0x44c1d6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044bf4d

Function at 0x44ed9e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044ec72

Function at 0x451a98
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00451460

Function at 0x4626c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4626ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4626ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x415a3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x415a90
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
sub ebp, eax
stosb byte es:[edi], al
sti
invalid
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.004155ba
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004155f5
insb byte es:[edi], dx
aad 0x82
pop ebp
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl

Function at 0x415a98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004155f5
cmpsb byte [esi], byte es:[edi]
adc esi, dword [ebx + 0x7c858d8a]
invalid
Function at 0x10001020
Capabilities:
Terminate thread

Disassembly:
cmp dword [esi + 4], 0
push edi
je 0x10001049
lea edi, [esi + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [esi + 0x28], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10001090
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001072
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 4]
test eax, eax
je 0x10001083
push eax
call edi
mov dword [esi + 4], 0
mov edx, dword [esi + 8]
push edx
call edi
mov dword [esi + 8], 0
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x100010a0
push eax
call edi
mov dword [esi], 0xffffffff
xor eax, eax
pop edi
ret

Function at 0x10001980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x1001323c
call fcn.1000cf29
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x10001a34
test esi, esi
jne 0x10001a34
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x10001a18
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001a12
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001a12
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x10001a01
cmp esi, eax
jae 0x10001a05
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100019f3
cmp esi, eax
jb 0x10001a09
xor eax, eax
jmp 0x10001a12
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x10001a3d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x1001323c
call fcn.1000cf29
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x100019a5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001b38
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001b6a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10001b66
cmp esi, eax
jae 0x10001b6a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001b58
cmp esi, eax
jb 0x10001b70
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x10002e20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov esi, eax
test edi, edi
je 0x10002fca
test esi, esi
je 0x10002fca
cmp dword [ebp + 0xc], 0
je 0x10002fca
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.10002da0
mov ecx, dword [ebp + 0xc]
cmp dword [ecx], eax
jl 0x10002fca
mov eax, 0x55555556
imul ebx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx*4]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x13
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
js 0x10002f46
cmp dword [ebp - 8], ebx
jne 0x10002ec0
mov edx, ebx
imul edx, edx, 0x4c
lea eax, [ecx*4]
sub eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x10002f2e
mov edx, eax
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl ecx, 8
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esi], al
shl ecx, 6
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
shl ecx, 6
mov byte [esi + 1], al
mov eax, ecx
shr eax, 0x1a
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
shr ecx, 0x14
and ecx, 0x3f
mov byte [esi + 2], al
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esi + 3], cl
add edi, 3
add esi, 4
dec edx
jne 0x10002ec6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
lea edx, [edx + eax*4]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
inc edx
mov dword [ebp - 8], edx
cmp edx, ebx
jle 0x10002ea1
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp + 8]
sub ecx, eax
je 0x10002fb6
lea edx, [ecx + 1]
test edx, edx
je 0x10002fb6
xor eax, eax
test ecx, ecx
jle 0x10002f61
movzx eax, byte [edi]
inc edi
shl eax, 8
cmp ecx, 1
jle 0x10002f6f
movzx ebx, byte [edi]
or eax, ebx
inc edi
shl eax, 8
cmp ecx, 2
jle 0x10002f7c
movzx ecx, byte [edi]
or eax, ecx
shl eax, 8
test edx, edx
jle 0x10002f99
mov ecx, edx
mov edi, eax
shr edi, 0x1a
mov bl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esi], bl
inc esi
shl eax, 6
dec ecx
jne 0x10002f85
add dword [ebp - 4], edx
mov edi, 4
sub edi, edx
test edi, edi
jle 0x10002fb3
push edi
push 0x3d
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
add dword [ebp - 4], edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003320
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 0x10007]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_]
add esp, 4
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x20008
lea esi, [edi + 2]
push 0
push esi
mov dword [ebp - 8], eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
push 0x10003
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x22
push esi
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 8]
lea eax, [esi + eax*2]
lea edx, [ebx + ebx + 2]
push edx
mov dword [eax], 0x200022
push ecx
add eax, 4
push eax
call sub.MSVCR100.dll_memcpy
push 0x44
lea edx, [ebp - 0x64]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push 0
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x10003407
mov edx, dword [ebp - 0x18]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10003417
push eax
call edi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10003421
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000e308
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
mov eax, dword [0x10013034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push 0x100136d8
push eax
mov ebx, str.screensnapshot.exe
call fcn.10006fd0
push 0x3c
lea ecx, [ebp - 0x4c]
push 0
push ecx
mov dword [ebp - 4], 0
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add esp, 0x14
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], str.open
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x48], 0x800040
test esi, esi
je 0x100034c0
push str.__actionhide
call fcn.10003320
add esp, 4
lea ecx, [ebp - 0x4c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp - 0x14]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100034f4
push str.__actionshow
call fcn.10003320
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000351a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100039f0
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [0x100136a0]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x10003a42
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [edi + 0x28]
push eax
push 0
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003a3b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi + 0x2c]
call fcn.10001020
pop edi
xor eax, eax
pop esi
ret
Function at 0x100043b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000eac8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10013034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
js 0x10004400
push 0x1000f44c
push eax
call dword [sym.imp.MSVCR100.dll_wcsstr]
add esp, 8
test eax, eax
je 0x10004400
sub eax, dword [edi]
sar eax, 1
mov esi, eax
cmp esi, 0xffffffff
jne 0x10004418
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x18]
mov edx, edi
call fcn.10006eb0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x1000f44c
mov dword [ebp - 4], 0
call fcn.10006860
mov byte [ebp - 4], 1
mov ecx, dword [eax]
mov ecx, dword [ecx - 0xc]
lea ecx, [ecx + esi]
lea esi, [ebp - 0x10]
mov edx, edi
call fcn.10006de0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10004470
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x100044f0
test al, 0x10
jne 0x100044f0
mov eax, dword [str.Tieba]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x100044a0
push 0x80004005
call fcn.10001b80
mov esi, dword [sym.imp.MSVCR100.dll__wcsicmp]
push eax
push edi
call esi
add esp, 8
test eax, eax
jne 0x100044bf
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
call fcn.10004010
jmp 0x100044f0
mov eax, dword [str.Weibo]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x100044d9
push 0x80004005
call fcn.10001b80
push eax
push edi
call esi
add esp, 8
test eax, eax
jne 0x100044f0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.10003a50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10004513
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10004536
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4