joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4483ed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48f190]
jne 0x4483f7
repz ret
jmp fcn.0044fcec

Function at 0x45bf4e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00450c49
and dword [ebp - 4], 0
cmp dword [0x4997ec], 0
mov ebx, eax
jne 0x45bfff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45c0b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46f548
push edi
call esi
test eax, eax
je 0x45c0b0
push eax
call fcn.00450bd7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4997ec], eax
call esi
push eax
call fcn.00450bd7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4997f0], eax
call esi
push eax
call fcn.00450bd7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4997f4], eax
call esi
push eax
call fcn.00450bd7
pop ecx
mov dword [0x4997fc], eax
test eax, eax
je 0x45bfff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00450bd7
pop ecx
mov dword [0x4997f8], eax
mov eax, dword [0x4997f8]
cmp eax, ebx
je 0x45c057
cmp dword [0x4997fc], ebx
je 0x45c057
push eax
call fcn.00450c52
push dword [0x4997fc]
mov esi, eax
call fcn.00450c52
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45c057
test edi, edi
je 0x45c057
call esi
test eax, eax
je 0x45c04e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45c04e
test byte [ebp - 0xc], 1
jne 0x45c057
or dword [ebp + 0x10], 0x200000
jmp 0x45c090
mov eax, dword [0x4997f0]
cmp eax, ebx
je 0x45c090
push eax
call fcn.00450c52
pop ecx
test eax, eax
je 0x45c090
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45c090
mov eax, dword [0x4997f4]
cmp eax, ebx
je 0x45c090
push eax
call fcn.00450c52
pop ecx
test eax, eax
je 0x45c090
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4997ec]
call fcn.00450c52
pop ecx
test eax, eax
je 0x45c0b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45c0b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x70e83dd7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4c9a2149
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x41116e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040bbe7
and dword [ebp - 4], 0
cmp dword [0x41b190], 0
mov ebx, eax
jne 0x41121f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4112d0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41713c
push edi
call esi
test eax, eax
je 0x4112d0
push eax
call fcn.0040bb75
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41b190], eax
call esi
push eax
call fcn.0040bb75
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41b194], eax
call esi
push eax
call fcn.0040bb75
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41b198], eax
call esi
push eax
call fcn.0040bb75
pop ecx
mov dword [0x41b1a0], eax
test eax, eax
je 0x41121f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040bb75
pop ecx
mov dword [0x41b19c], eax
mov eax, dword [0x41b19c]
cmp eax, ebx
je 0x411277
cmp dword [0x41b1a0], ebx
je 0x411277
push eax
call fcn.0040bbf0
push dword [0x41b1a0]
mov esi, eax
call fcn.0040bbf0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x411277
test edi, edi
je 0x411277
call esi
test eax, eax
je 0x41126e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41126e
test byte [ebp - 0xc], 1
jne 0x411277
or dword [ebp + 0x10], 0x200000
jmp 0x4112b0
mov eax, dword [0x41b194]
cmp eax, ebx
je 0x4112b0
push eax
call fcn.0040bbf0
pop ecx
test eax, eax
je 0x4112b0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4112b0
mov eax, dword [0x41b198]
cmp eax, ebx
je 0x4112b0
push eax
call fcn.0040bbf0
pop ecx
test eax, eax
je 0x4112b0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41b190]
call fcn.0040bbf0
pop ecx
test eax, eax
je 0x4112d0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4112d2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4010c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
fldz
xor eax, eax
fstp qword [esp + 4]
xor ecx, ecx
mov dword [esp + 4], eax
mov word [esp], cx
fld qword [0x425f68]
fsub qword [0x41f340]
xor edx, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x44
fstp qword [0x425f68]
mov ecx, dword [0x4247b8]
mov word [esp + 0x4e], dx
mov edx, dword [esp + 4]
sub ecx, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], 1
mov dword [0x4247b8], ecx
mov ecx, 1
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x6c]
mov word [esp + 0x50], cx
lea ecx, [esp + 0x20]
push ecx
push eax
push eax
push 8
push eax
push eax
push eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x84]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x60
ret
Function at 0x4014b0
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x140
mov eax, dword [0x426070]
xor eax, esp
mov dword [esp + 0x13c], eax
fldz
xor eax, eax
fstp dword [esp + 8]
xor ecx, ecx
fldz
fstp qword [esp + 0xc]
mov word [esp], ax
mov word [esp + 4], cx
mov dx, word [esp + 4]
dec dword [esp + 4]
mov dword [esp], eax
movsx eax, dx
cmp eax, 0x74cd767b
jne 0x401501
fld dword [esp + 8]
fsub qword [0x41f388]
fstp dword [esp + 8]
push ebx
push esi
push 0x104
call fcn.0040b711
add esp, 4
push 0
push 2
mov ebx, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x401655
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
fld dword [0x424ba8]
mov dx, word [esp + 0xc]
fsub qword [0x41f380]
movsx ecx, dx
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
fsubp st(1)
fadd dword [esp + 0x10]
fstp dword [esp + 0x10]
test eax, eax
je 0x40161e
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov edi, ebx
lea edx, [esp + 0x48]
sub edi, edx
lea ebx, [ebx]
lea eax, [esp + 0x48]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x401584
push ebx
call fcn.0041e8b3
mov ecx, dword [esp + 0x158]
add esp, 4
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4015c0
test dl, dl
je 0x4015bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4015c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4015a0
xor eax, eax
jmp 0x4015c5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4015fb
cmp dword [esp + 0x158], eax
je 0x401618
mov eax, dword [esp + 0x2c]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4015f7
inc dword [esp + 0x10]
push 0xffffffffffffffff
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
push esi
mov dword [esp + 0x2c], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401580
jmp 0x40161c
inc dword [esp + 0x10]
pop edi
pop ebp
fld qword [0x425760]
push esi
fsub qword [0x41f378]
fsub dword [0x4259ec]
fmul qword [0x424868]
fstp qword [0x424868]
fld dword [0x4259ec]
fadd qword [0x41f350]
fstp dword [0x4259ec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0040b634
mov ecx, dword [esp + 0x148]
mov eax, dword [esp + 0xc]
add esp, 4
pop esi
pop ebx
xor ecx, esp
call fcn.0040bbca
add esp, 0x140
ret
Function at 0x4026c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
fldz
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
fstp dword [esp + 0xc]
push edi
call fcn.0040b711
mov ebx, dword [esp + 0x1c]
push edi
mov esi, eax
push ebx
push esi
call fcn.0040b7e0
mov cx, word [0x424c0c]
movsx edx, cx
mov ecx, 0x17bd5600
sub ecx, edx
mov dword [esp + 0x2c], ecx
add edi, esi
add esp, 0x10
fild dword [esp + 0x1c]
mov eax, esi
fstp dword [esp + 0xc]
inc word [0x424c0c]
fld qword [0x424a98]
mov edx, dword [0x427884]
fadd qword [0x41f350]
lea ecx, [edx + ebx]
sub ecx, 0x423004
fstp qword [0x424a98]
fld qword [0x424a98]
fadd qword [0x41f480]
fstp dword [esp + 0xc]
cmp esi, edi
je 0x40277c
mov edi, edi
mov dx, word [0x423b58]
mov ebx, dword [esp + 0x10]
movsx edx, dx
lea edx, [ebx + edx + 0x45061c06]
mov dword [esp + 0x10], edx
inc word [0x423b58]
mov dl, byte [ecx]
xor byte [eax], dl
inc eax
inc ecx
cmp eax, edi
jne 0x402750
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x404060
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
fldz
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
fst dword [esp + 0xc]
push 3
fstp dword [esp + 0x14]
push 0x4234f0
call fcn.004026c0
fld dword [esp + 0x14]
fadd qword [0x41f5a0]
mov ebx, dword [esp + 0x20]
mov esi, eax
push esi
fadd dword [esp + 0x18]
push ebx
fstp dword [esp + 0x1c]
call fcn.0040c20b
mov edi, eax
add esp, 0x10
mov eax, 0x3e5e
mov word [0x425990], ax
test edi, edi
jne 0x4040f2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
call fcn.0040c20b
fld dword [0x42485c]
fsub qword [0x41f350]
mov edi, eax
add esp, 8
fstp dword [0x42485c]
fld dword [0x42485c]
fadd dword [esp + 0xc]
fstp dword [esp + 0xc]
test edi, edi
je 0x40412c
push edi
push 1
lea ecx, [esp + 0x24]
push 4
push ecx
call fcn.0040c5bd
fld dword [esp + 0x1c]
fsub qword [0x41f350]
push edi
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fsub qword [0x41f598]
fsub qword [0x41f590]
fstp dword [esp + 0x20]
call fcn.0040bdb1
add esp, 0x14
fldz
xor eax, eax
xor edx, edx
mov word [esp + 0xc], dx
fstp dword [esp + 0x10]
mov word [esi], ax
mov byte [esi + 2], al
mov eax, dword [0x424b30]
sub dword [0x423bdc], eax
push esi
call fcn.0040b634
add esp, 4
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x404350
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
fldz
push ebx
fstp qword [esp + 8]
push 0x2e
fldz
push 0x4259a4
fstp dword [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.004026c0
add esp, 8
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push ebx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4043f7
push esi
push edi
push 0x34
push 0x425ed0
call fcn.004026c0
mov edx, dword [esp + 0x28]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4043b0
mov ecx, dword [esp + 0x18]
sub eax, edi
push eax
push edx
push 1
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
fldz
xor edx, edx
push 0x34
push edx
mov word [esp + 0x14], dx
fstp dword [esp + 0x14]
push esi
call fcn.0040bb50
mov eax, dword [0x424b30]
sub dword [0x423bdc], eax
push esi
call fcn.0040b634
add esp, 0x10
pop edi
pop esi
fldz
xor ecx, ecx
push 0x2e
push ecx
mov word [esp + 0xc], cx
fstp dword [esp + 0xc]
push ebx
call fcn.0040bb50
mov edx, dword [0x424b30]
sub dword [0x423bdc], edx
push ebx
call fcn.0040b634
dec dword [0x425e18]
fld dword [esp + 0x18]
fld1
add esp, 0x10
fadd st(1), st(0)
pop ebx
fxch st(1)
fstp dword [esp + 4]
mov eax, dword [0x425e18]
mov dword [esp], eax
fild dword [esp]
fsub dword [esp + 4]
fcomp qword [0x41f5d8]
fnstsw ax
test ah, 1
jne 0x404485
fld qword [0x423b18]
fadd qword [0x41f5d0]
call fcn.0040bbe0
mov word [0x423af8], ax
fadd qword [0x423b18]
mov ecx, dword [esp + 0xc]
push ecx
fstp qword [0x423b18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
fstp st(0)
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
ret
Function at 0x40acc0
Capabilities:
Create thread
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
fldz
push ebx
xor ebx, ebx
mov dword [esp + 0xc], ebx
fst dword [esp + 0x14]
mov dword [esp + 0xc], ebx
xor eax, eax
mov word [esp + 4], ax
mov dword [esp + 0x10], ebx
fstp dword [esp + 8]
fld dword [esp + 8]
push ebp
fsub dword [esp + 0xc]
push esi
push edi
mov dword [0x42788c], ebx
fsub qword [0x41fa60]
fcomp qword [0x41fa58]
fnstsw ax
test ah, 0x44
jnp 0x40ad15
fld dword [esp + 0x14]
fadd qword [0x41fa50]
fstp dword [esp + 0x14]
xor esi, esi
cmp dword [0x423a98], ebx
je 0x40ad51
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push esi
push 0x401a90
push ebx
push ebx
mov dword [esi*4 + 0x4273c8], ebx
call edi
movzx ecx, word [esp + 0x10]
imul ecx, ecx, 0x5c9d84c1
inc esi
mov word [esp + 0x10], cx
cmp esi, dword [0x423a98]
jne 0x40ad25
fld dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
fsub qword [0x41fa48]
push 0xa
fstp dword [esp + 0x24]
mov dx, word [0x4257b8]
mov ecx, dword [esp + 0x1c]
movsx eax, dx
sub eax, ecx
mov word [0x4257b8], ax
inc dword [esp + 0x1c]
fld qword [0x423510]
fsub qword [0x41f350]
fstp qword [0x423510]
fld qword [0x423510]
fsub qword [0x41fa40]
fmul dword [0x424aac]
fstp dword [0x424aac]
call edi
fld qword [0x4259f0]
call fcn.0040bbe0
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esp + 0x18], eax
mov esi, 0x423a9c
jmp 0x40add0
mov edx, dword [esp + 0x1c]
add edx, dword [esp + 0x18]
mov dword [esp + 0x18], edx
dec dword [esp + 0x1c]
movzx eax, word [esi]
mov ecx, dword [eax*4 + 0x4273c8]
push ecx
call ebp
movzx edx, word [esi]
cmp dword [edx*4 + 0x4273c8], ebx
je 0x40ae10
lea esp, [esp]
push 0xa
call edi
movzx eax, word [esi]
cmp dword [eax*4 + 0x4273c8], ebx
jne 0x40ae00
add esi, 2
cmp esi, 0x423aa4
jne 0x40add0
call dword [0x42788c]
rol dword [ebx], 1
movsd dword es:[edi], dword [esi]
push edi
sti
mov ebp, 0x683b9d42
adc dword [esi - 0x3aaf93f1], edx
inc edx
out dx, al
invalid

Function at 0x40bbca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426070]
jne 0x40bbd4
repz ret
jmp fcn.0040fe76
Function at 0x416c94
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00411ba5
and dword [ebp - 4], 0
cmp dword [0x4282f4], 0
mov ebx, eax
jne 0x416d45
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416df6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420b08
push edi
call esi
test eax, eax
je 0x416df6
push eax
call fcn.00411b33
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4282f4], eax
call esi
push eax
call fcn.00411b33
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4282f8], eax
call esi
push eax
call fcn.00411b33
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4282fc], eax
call esi
push eax
call fcn.00411b33
pop ecx
mov dword [0x428304], eax
test eax, eax
je 0x416d45
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411b33
pop ecx
mov dword [0x428300], eax
mov eax, dword [0x428300]
cmp eax, ebx
je 0x416d9d
cmp dword [0x428304], ebx
je 0x416d9d
push eax
call fcn.00411bae
push dword [0x428304]
mov esi, eax
call fcn.00411bae
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416d9d
test edi, edi
je 0x416d9d
call esi
test eax, eax
je 0x416d94
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416d94
test byte [ebp - 0xc], 1
jne 0x416d9d
or dword [ebp + 0x10], 0x200000
jmp 0x416dd6
mov eax, dword [0x4282f8]
cmp eax, ebx
je 0x416dd6
push eax
call fcn.00411bae
pop ecx
test eax, eax
je 0x416dd6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416dd6
mov eax, dword [0x4282fc]
cmp eax, ebx
je 0x416dd6
push eax
call fcn.00411bae
pop ecx
test eax, eax
je 0x416dd6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4282f4]
call fcn.00411bae
pop ecx
test eax, eax
je 0x416df6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416df8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10014210
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x10014279
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10014295
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
pop esi
test eax, eax
je 0x10014279
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x10014295
cmp dword [edi + 4], 0
je 0x10014295
cmp dword [edi + 0xc], 0
je 0x10014295
mov eax, 1
pop edi
pop ebp
ret 4
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x100142a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10143b76
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.101166b0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x420]
push eax
call edi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10014321
lea eax, [ebp - 0x420]
push eax
call edi
sub esi, 1
jne 0x10014313
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.101166b0
add esp, 0xc
lea eax, [ebp - 0x420]
push str.NetBridge.dll
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x424]
call fcn.10012770
push dword [ebp - 0x424]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001437d
xor esi, esi
jmp 0x10014393
push dword [ebp - 0x424]
call fcn.100a2080
add esp, 4
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov edx, dword [ebp - 0x424]
or edi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100143ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x100143da
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.10014210
test eax, eax
je 0x100143da
mov eax, 1
jmp 0x10014474
push str.NetBase.dll
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x428]
call fcn.10012770
push dword [ebp - 0x428]
mov dword [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10014420
xor esi, esi
jmp 0x10014436
push dword [ebp - 0x428]
call fcn.100a2080
add esp, 4
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov edx, dword [ebp - 0x428]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x10014458
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x10014472
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.10014210
test eax, eax
jne 0x100143d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret 4
Function at 0x100148f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10014949
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10014949
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1001493a
cmp esi, edx
jae 0x10014949
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10014928
cmp esi, edx
jae 0x10014949
cmp word [esi], 0
je 0x10014949
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10018cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1019cca0
mov dword [ebp - 0x6c], 0x740068
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x68], 0x700074
push edi
mov dword [ebp - 0x64], 0x2f003a
mov edx, 0x34
mov dword [ebp - 0x60], 0x25002f
sub esi, eax
mov dword [ebp - 0x5c], 0x2f0073
mov dword [ebp - 0x58], 0x6e0065
mov dword [ebp - 0x54], 0x720063
mov dword [ebp - 0x50], 0x700079
mov dword [ebp - 0x4c], 0x2f0074
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x660074
mov dword [ebp - 0x40], 0x67002f
mov dword [ebp - 0x3c], 0x740065
mov dword [ebp - 0x38], 0x700054
mov dword [ebp - 0x34], 0x3f0069
mov dword [ebp - 0x30], 0x720070
mov dword [ebp - 0x2c], 0x64006f
mov dword [ebp - 0x28], 0x630075
mov dword [ebp - 0x24], 0x3d0074
mov dword [ebp - 0x20], 0x730025
mov dword [ebp - 0x1c], 0x630026
mov dword [ebp - 0x18], 0x610068
mov dword [ebp - 0x14], 0x6e006e
mov dword [ebp - 0x10], 0x6c0065
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffca]
test ecx, ecx
je 0x10018dee
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018dee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018dd0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret

Function at 0x10018e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1019646c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x1019cc28
mov dword [ebp - 0x6c], 0x740068
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x68], 0x700074
push edi
mov dword [ebp - 0x64], 0x2f003a
mov edx, 0x34
mov dword [ebp - 0x60], 0x25002f
sub esi, eax
mov dword [ebp - 0x5c], 0x2f0073
mov dword [ebp - 0x58], 0x6e0065
mov dword [ebp - 0x54], 0x720063
mov dword [ebp - 0x50], 0x700079
mov dword [ebp - 0x4c], 0x2f0074
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x660074
mov dword [ebp - 0x40], 0x67002f
mov dword [ebp - 0x3c], 0x740065
mov dword [ebp - 0x38], 0x700054
mov dword [ebp - 0x34], 0x3f0069
mov dword [ebp - 0x30], 0x720070
mov dword [ebp - 0x2c], 0x64006f
mov dword [ebp - 0x28], 0x630075
mov dword [ebp - 0x24], 0x3d0074
mov dword [ebp - 0x20], 0x730025
mov dword [ebp - 0x1c], 0x630026
mov dword [ebp - 0x18], 0x610068
mov dword [ebp - 0x14], 0x6e006e
mov dword [ebp - 0x10], 0x6c0065
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffca]
test ecx, ecx
je 0x10018f0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10018f0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10018ef0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f5f8d
mov esp, ebp
pop ebp
ret