joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a1290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102b9104]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x101a12bb
mov ecx, 0x102b9088
pop ebp
jmp fcn.101a55a0
push 0x102b9104
call fcn.1020d865
add esp, 4
cmp dword [0x102b9104], 0xffffffff
jne 0x101a12b0
mov ecx, 0x102b9088
call fcn.101a54b0
push 0x102b9104
call fcn.1020d865
add esp, 4
jmp 0x101a12b0

Function at 0x101a13c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102b9104]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x101a13eb
mov ecx, 0x102b9088
pop ebp
jmp fcn.101a6db0
push 0x102b9104
call fcn.1020d865
add esp, 4
cmp dword [0x102b9104], 0xffffffff
jne 0x101a13e0
mov ecx, 0x102b9088
call fcn.101a54b0
push 0x102b9104
call fcn.1020d865
add esp, 4
jmp 0x101a13e0

Function at 0x101a1710
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [0x102b910c]
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
test edi, edi
jne 0x101a17f1
xor edi, edi
cmp ebx, 1
je 0x101a17e8
mov eax, dword [esi + 0x11a0]
test eax, eax
jne 0x101a17e8
mov eax, 1
lock xadd dword [esi + 0x11a0], eax
cmp eax, 0x7fffffff
je 0x101a1851
movzx ebx, word [ebp + 8]
push esi
call fcn.101a31b0
add esp, 4
lock sub dword [esi + 0x11a0], 1
mov esi, eax
add dword [eax + 0x310], 1
adc dword [eax + 0x314], 0
cmp bx, 0x31
jae 0x101a17fd
movzx ebx, bx
cmp dword [esi + ebx*8], 0
je 0x101a181b
add dword [esi + 0x318], 1
adc dword [esi + 0x31c], 0
mov eax, dword [esi + ebx*8]
mov ecx, dword [eax]
test ecx, ecx
je 0x101a17c7
mov edx, ecx
not edx
cmp dword [eax + 4], edx
jne 0x101a184c
bswap ecx
prefetcht0 byte [ecx]
jmp 0x101a17c9
bswap ecx
add byte [esi + ebx*8 + 4], 0xff
mov edx, dword [ebp + 0xc]
mov dword [esi + ebx*8], ecx
movzx ecx, word [esi + ebx*8 + 6]
mov dword [edx], ecx
movzx ecx, word [esi + ebx*8 + 6]
sub dword [esi + 0x308], ecx
mov edi, eax
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret 8
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x101a1737
add dword [esi + 0x330], 1
adc dword [esi + 0x334], 0
add dword [esi + 0x320], 1
adc dword [esi + 0x324], 0
jmp 0x101a17e8
add dword [esi + 0x328], 1
adc dword [esi + 0x32c], 0
add dword [esi + 0x320], 1
adc dword [esi + 0x324], 0
mov ecx, esi
push ebx
call fcn.101a3420
mov eax, dword [esi + ebx*8]
test eax, eax
jne 0x101a17ad
jmp 0x101a17e8
call fcn.1002c4d0
int3
Function at 0x101ab780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x101ab7f9
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x101ab79c
xor esi, esi
jmp 0x101ab7de
and ebx, 0xfffffffe
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x1029dd58]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x1029dd58]
add esi, 2
cmp ebx, esi
jne 0x101ab7b0
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x101ab7f9
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x1029dd58]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101b0d10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.10208980
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
je 0x101b0d45
push edi
push dword [esi + 4]
call sub.kernel32.dll_Process32NextW
jmp 0x101b0d52
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.kernel32.dll_Process32FirstW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret

Function at 0x101b3190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102ba3a8]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x101b31bb
mov ecx, 0x102ba3a0
pop ebp
jmp fcn.10162050
push 0x102ba3a8
call fcn.1020d865
add esp, 4
cmp dword [0x102ba3a8], 0xffffffff
jne 0x101b31b0
mov dword [0x102ba3a4], 0
mov dword [0x102ba3a0], 0
mov ecx, 0x102ba3a0
push 0
call fcn.101620c0
push 0x102ba3a8
call fcn.1020d865
add esp, 4
jmp 0x101b31b0
Function at 0x101bc1c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
jne 0x101bc1e7
test eax, eax
jne 0x101bc1e7
cmp dword [esi + 0xc], 0
jne 0x101bc1e7
cmp dword [esi + 4], 0
je 0x101bc2e1
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x101bc206
call fcn.1014e410
push dword [esi]
call fcn.1016f280
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x101bc22c
call fcn.1014e410
push dword [esi + 4]
call fcn.1016f280
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ebx, dword [edi]
cmp eax, ebx
je 0x101bc283
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x101bc267
call fcn.1014e410
push dword [esi]
call fcn.1016f280
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x101bc276
mov dword [esi], ebx
call fcn.1014e410
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
mov ecx, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp ecx, ebx
je 0x101bc2ce
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
add eax, 1
cmp eax, 2
jb 0x101bc2b4
call fcn.1014e410
push dword [esi + 4]
call fcn.1016f280
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x101bc2c4
mov dword [esi + 4], ebx
call fcn.1014e410
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor ecx, ecx
xor eax, eax
jmp 0x101bc23a
Function at 0x101c1d90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x102b0014]
xor ecx, ebp
mov dword [ebp - 8], ecx
cmp eax, 3
jne 0x101c1e05
mov dword [ebp - 0xc], 0x101c1e20
lea eax, [ebp - 0xc]
push 0
push eax
push 0x101c1d70
push 0x102ba424
call dword [sym.imp.kernel32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x101c1e17
cmp dword [0x102ba428], 0
jne 0x101c1e05
push dword [0x102ba42c]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101c1e05
mov esi, eax
push 0x102ba430
call dword [sym.imp.kernel32.dll_AcquireSRWLockExclusive]
push 0x102ba430
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
push esi
call fcn.1017b1f0
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10205d16
add esp, 8
pop esi
pop ebp
ret 0xc
call fcn.102177d0
int3
Function at 0x101e3de0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x101e3df1
test eax, eax
jne 0x101e3e32
test eax, eax
jne 0x101e3e00
mov eax, dword [0x102ba6ec]
test eax, eax
je 0x101e3e00
call eax
cmp dword [0x102ba6e4], 0
je 0x101e3e32
mov esi, dword [0x102ba6e8]
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test edi, edi
jne 0x101e3e38
test esi, esi
je 0x101e3e32
push esi
call dword [0x102ba6e4]
add esp, 4
pop esi
pop edi
pop ebp
ret 0xc
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
test esi, esi
jne 0x101e3e28
jmp 0x101e3e32
Function at 0x101e9270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ecx + 4]
jmp 0x101e9286
mov esi, dword [esi + 0x8c]
test esi, esi
je 0x101e92bb
xor edi, edi
xchg dword [esi], edi
test edi, edi
je 0x101e9280
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
bsf ecx, edi
mov ebx, 1
shl ebx, cl
mov eax, dword [esi + ecx*4 + 8]
push eax
call dword [eax + 4]
add esp, 4
xor edi, ebx
jne 0x101e92a0
jmp 0x101e9280
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101f22f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102c4730]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x101f231b
mov ecx, 0x102c4728
pop ebp
jmp fcn.10162050
push 0x102c4730
call fcn.1020d865
add esp, 4
cmp dword [0x102c4730], 0xffffffff
jne 0x101f2310
mov dword [0x102c472c], 0
mov dword [0x102c4728], 0
mov ecx, 0x102c4728
push 0
call fcn.101620c0
push 0x102c4730
call fcn.1020d865
add esp, 4
jmp 0x101f2310
Function at 0x101fd1c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
mov esi, eax
shr esi, 0xe
and esi, 2
push 0xa5
call ebx
test ax, ax
jns 0x101fd1f5
call fcn.101dd9de
test al, al
je 0x101fd1f5
or esi, 0x20
jmp 0x101fd20f
push 0x11
call ebx
lea edi, [esi + 4]
test ax, ax
cmovns edi, esi
push 0x12
call ebx
lea esi, [edi + 8]
test ax, ax
cmovns esi, edi
call fcn.102038b0
mov edi, esi
or edi, 0x10
test al, al
cmove edi, esi
push 0x90
call ebx
shl eax, 7
mov esi, ebx
movzx ebx, al
or ebx, edi
push 0x14
call esi
mov ecx, esi
mov esi, eax
and esi, 1
shl esi, 8
or esi, ebx
push 0x91
call ecx
and eax, 1
shl eax, 9
or eax, esi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 4]
lea ecx, [edx - 0x100]
cmp ecx, 6
ja 0x101fd272
cmp ecx, 3
je 0x101fd272
mov ecx, dword [edi + 0xc]
shr ecx, 6
and ecx, 0x40000
or eax, ecx
mov ecx, edx
and ecx, 0xfffffffd
cmp ecx, 0x2a1
sete bh
lea esi, [edx - 0x200]
cmp esi, 0xf
setb bl
or bl, bh
cmp bl, 1
jne 0x101fd2b4
mov esi, dword [edi + 8]
mov dword [ebp - 0x10], esi
shr esi, 1
mov edi, esi
and edi, 2
or edi, eax
and esi, 4
or esi, edi
lea eax, [edx - 0xa0]
mov dword [ebp - 0x14], eax
mov eax, esi
jmp 0x101fd2d5
lea esi, [edx - 0xa0]
cmp ecx, 0x2a0
je 0x101fd2cb
cmp esi, 0xd
ja 0x101fd354
mov dword [ebp - 0x14], esi
movzx esi, word [edi + 8]
mov dword [ebp - 0x10], esi
xor esi, esi
inc esi
lea edi, [edx - 0xa1]
cmp edi, 0xc
ja case.default.0x101fd2e3
jmp dword [edi*4 + 0x102a6f5c]
add edx, 0xfffffdff
cmp edx, 0xc
ja case.0x101fd2f5.522
jmp dword [edx*4 + 0x102a6f90]
mov esi, 2
jmp case.0x101fd2f5.513
mov esi, 0x10
jmp case.0x101fd2f5.513
mov esi, 0x20
xor edx, edx
test bl, bl
movzx edi, word [ebp - 0x10]
cmovne edx, edi
or edx, esi
mov esi, edx
and esi, 1
shl esi, 0xa
mov edi, edx
and edi, 0x10
shl edi, 7
and edx, 2
shl edx, 0xb
cmp ecx, 0x2a0
sete cl
cmp dword [ebp - 0x14], 0xe
setb ch
or ch, cl
movzx ecx, ch
shl ecx, 0x11
or ecx, eax
or edi, esi
or edi, edx
or edi, ecx
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp case.0x101fd2f5.513

Function at 0x10201830
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x102c47e0]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x102018a3
mov ecx, 0x102c47d8
call fcn.10162050
test eax, eax
jne 0x10201896
push 4
call fcn.1020d865
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x102c47d8
call fcn.10162050
mov esi, eax
mov ecx, 0x102c47d8
push edi
call fcn.10162080
test esi, esi
je 0x10201896
push esi
call fcn.10205096
add esp, 4
mov ecx, 0x102c47d8
pop esi
pop edi
pop ebp
jmp fcn.10162050
push 0x102c47e0
call fcn.1020d865
add esp, 4
cmp dword [0x102c47e0], 0xffffffff
jne 0x10201852
mov dword [0x102c47dc], 0
mov dword [0x102c47d8], 0
mov ecx, 0x102c47d8
push 0x10037bc0
call fcn.101620c0
push 0x102c47e0
call fcn.1020d865
add esp, 4
jmp 0x10201852
Function at 0x11a6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x11a61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x11a607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11a606a
add dl, dl
jne 0x11a6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11a60dc
xor eax, eax
add dl, dl
jne 0x11a6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11a617d
add dl, dl
jne 0x11a60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11a60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11a60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11a60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11a60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11a6075
mov eax, 1
add dl, dl
jne 0x11a60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11a60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11a60e1
sub eax, ebx
mov ebx, 1
jne 0x11a6128
mov ecx, 1
add dl, dl
jne 0x11a610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11a6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11a6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11a6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x11a613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11a614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11a6136
cmp eax, 0x7d00
jae 0x11a616d
cmp eax, 0x500
jb 0x11a6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11a6075
cmp eax, 0x7f
ja 0x11a6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11a6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x11a619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11a6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000e9bf
pop dword [ebp - 0x3c]
mov eax, 0xd7d2741d
add eax, 0x382e75a2
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xb02d6874
add dword [ebp - 0x4c], 0x9e24dcd7
mov dword [ebp - 0x48], 0xa67129ac
sub dword [ebp - 0x48], 0x743ddd67
mov dword [ebp - 0x44], 0xc4e573cd
sub dword [ebp - 0x44], 0x78992f9f
mov dword [ebp - 0x40], 0x56d03047
add dword [ebp - 0x40], 0xa92fcfb9
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x6540d7f6
add dword [ebp - 0x4c], 0xf319160
mov dword [ebp - 0x48], 0xf23a6c1c
add dword [ebp - 0x48], 0x4f31f559
mov dword [ebp - 0x44], 0x92624b47
add dword [ebp - 0x44], 0xd10d2125
mov dword [ebp - 0x40], 0x55171839
sub dword [ebp - 0x40], 0x55171839
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x7e5320cf
add eax, 0x91ae6f69
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34539
push 0
call eax
mov ecx, 0xc32de0f5
add ecx, 0x3cd25e1c
xor edx, edx
add edx, eax
mov edi, 0x7b89da27
sub edi, 0x6b87b227
add edi, dword [ebp - 0x3c]
mov esi, 0x37136576
sub dword [ebp - 0x24], 0xf4ba35cb
mov ebx, dword [edi]
sub dword [ebp - 0x30], 0x857edad9
xor ebx, esi
xor dword [ebp - 4], eax
mov dword [edx], ebx
sub dword [ebp - 0x1c], edi
add edx, 4
add edi, 0xb043d7f9
add edi, 0x4fbc280b
loop 0x1000ead8
add eax, 0x15dddd49
add eax, 0xea2311ce
xor ebx, ebx
add ebx, eax
add eax, 0x258c8138
add eax, 0xda737ecd
mov ecx, 0x978c97f7
add ecx, 0x78736809
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x401068
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov byte [ebp - 4], 0x43
jmp 0x4010a2
lea eax, [ebp - 3]
mov bl, byte [ebp - 4]
mov byte [eax], bl
mov byte [eax + 1], 0x3a
mov byte [eax + 2], 0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
jne 0x40109f
push 0
mov al, byte [ebp - 4]
movzx ax, al
push ax
call fcn.00401000
inc byte [ebp - 4]
cmp byte [ebp - 4], 0x5a
jbe 0x401074
leave
ret

Function at 0x4010aa
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9f0
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x20c], 0
push 0
push 0
push 0
push 0
push str.MyAgent
call sub.wininet.dll_InternetOpenA
or eax, eax
je 0x401176
mov dword [ebp - 4], eax
push str.2c174823_bd79_4e9a_a631_2635b1f1e83b
push str.https:__sse.hit.edu.cn_test_api
push str._s_ping_machine_id_s
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_wsprintfA
add esp, 0x10
push 0
push 0x80000000
push 0
push 0
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 4]
call sub.wininet.dll_InternetOpenUrlA
or eax, eax
je 0x40116e
mov dword [ebp - 8], eax
lea eax, [ebp - 0x610]
push eax
push 0x3ff
lea eax, [ebp - 0x60c]
push eax
push dword [ebp - 8]
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x610], 0
jbe 0x401166
mov dword [ebp - 0x20c], 1
lea eax, [ebp - 0x60c]
cmp dword [eax], 0x74697865
jne 0x401166
push 0
call sub.kernel32.dll_ExitProcess
push dword [ebp - 8]
call sub.wininet.dll_InternetCloseHandle
push dword [ebp - 4]
call sub.wininet.dll_InternetCloseHandle
leave
ret
Function at 0x401293
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push 0x40303c
push 1
push 0
call sub.kernel32.dll_CreateMutexA
or eax, eax
je 0x4012fc
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x4012fc
push 0
push str.FE3E5BBA_6AA2_E7FC_ECD3_8B5ECDB89F8A
call sub.user32.dll_FindWindowA
or eax, eax
je 0x4012da
mov dword [ebp - 0x48], eax
push 0
push 0
push 0x10
push dword [ebp - 0x48]
call sub.user32.dll_SendMessageA
jmp 0x4012fc
call sub.user32.dll_GetActiveWindow
mov ecx, eax
push 0x10
push 0x403070
push 0x403040
push ecx
call sub.user32.dll_MessageBoxA
mov eax, 1
leave
ret 0x10
call fcn.004010aa
push 0
push str.netsh_advfirewall_reset
call sub.kernel32.dll_WinExec
push 0
push str.netsh_advfirewall_set_allprofiles_state_on
call sub.kernel32.dll_WinExec
push 0
push str.netsh_advfirewall_set_allprofiles_firewallpolicy_blockinbound_blockoutbound
call sub.kernel32.dll_WinExec
push 0
push str.netsh_advfirewall_firewall_add_rule_nameexam_dirout_actionallow_remoteip219.217.226.151_enableyes
call sub.kernel32.dll_WinExec
push 0
push str.netsh_advfirewall_firewall_add_rule_nameexam_dirin_actionallow_remoteip219.217.226.151_enableyes
call sub.kernel32.dll_WinExec
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x401178
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push dword [ebp + 8]
pop dword [ebp - 0x18]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], str.FE3E5BBA_6AA2_E7FC_ECD3_8B5ECDB89F8A
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassA
xor edi, edi
push edi
push dword [ebp + 8]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push str.FE3E5BBA_6AA2_E7FC_ECD3_8B5ECDB89F8A
push 0
call sub.user32.dll_CreateWindowExA
push 0
push 0
push 0
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x4013cd
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x44]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4013a5
mov eax, dword [ebp - 0x3c]
leave
ret 0x10
Function at 0x4045c5
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x4bd44f
call fcn.00435e39
mov ebx, ecx
push 0
call fcn.00405003
push 1
mov ecx, ebx
call fcn.00405558
lea eax, [ebp - 0x1c]
push 0x198
push eax
call fcn.00403977
pop ecx
pop ecx
push dword [eax]
push 2
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x1c]
call fcn.00435f15
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 1
push 1
push 0xf4
push 2
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1be
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
lea ecx, [ebp - 0xa4]
call fcn.00403be3
and dword [ebp - 4], 0
lea esi, [ebx + 0x280]
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebx + 0x1d4]
lea eax, [ebx + 0x1e0]
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 1
call fcn.00403d7c
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x94], 0
je 0x4046d3
cmp dword [ebp - 0xa0], 0
mov byte [ebx + 0x29b], 1
jne 0x4046c3
push 0x4c4b44
lea ecx, [ebp - 0xa4]
call fcn.0040e6e2
push 0x10
push dword [ebp - 0xa4]
push dword [ebp - 0x98]
jmp 0x4046fd
test edi, edi
jne 0x40470a
mov byte [ebx + 0x29b], 1
cmp dword [ebp - 0x70], edi
je 0x404706
cmp dword [ebp - 0x7c], edi
jne 0x4046f5
push 0x4c4b44
lea ecx, [ebp - 0x80]
call fcn.0040e6e2
push 0
push dword [ebp - 0x80]
push dword [ebp - 0x74]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
test edi, edi
je 0x404723
cmp byte [ebx + 0x136], 0
jne 0x404723
mov ecx, ebx
mov byte [ebx + 0x135], 1
call fcn.00405413
jmp 0x40472e
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x80]
call fcn.00402bc6
lea ecx, [ebp - 0xa4]
call fcn.00402bc6
mov al, 1
call fcn.00435e02
ret