joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42551a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00422401
and dword [ebp - 4], 0
cmp dword [0x42fb04], 0
mov ebx, eax
jne 0x4255cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42567c
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42567c
push eax
call fcn.0042238f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42fb04], eax
call esi
push eax
call fcn.0042238f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42fb08], eax
call esi
push eax
call fcn.0042238f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42fb0c], eax
call esi
push eax
call fcn.0042238f
pop ecx
mov dword [0x42fb14], eax
test eax, eax
je 0x4255cb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042238f
pop ecx
mov dword [0x42fb10], eax
mov eax, dword [0x42fb10]
cmp eax, ebx
je 0x425623
cmp dword [0x42fb14], ebx
je 0x425623
push eax
call fcn.0042240a
push dword [0x42fb14]
mov esi, eax
call fcn.0042240a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x425623
test edi, edi
je 0x425623
call esi
test eax, eax
je 0x42561a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42561a
test byte [ebp - 0xc], 1
jne 0x425623
or dword [ebp + 0x10], 0x200000
jmp 0x42565c
mov eax, dword [0x42fb08]
cmp eax, ebx
je 0x42565c
push eax
call fcn.0042240a
pop ecx
test eax, eax
je 0x42565c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42565c
mov eax, dword [0x42fb0c]
cmp eax, ebx
je 0x42565c
push eax
call fcn.0042240a
pop ecx
test eax, eax
je 0x42565c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42fb04]
call fcn.0042240a
pop ecx
test eax, eax
je 0x42567c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42567e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x472126
Capabilities:
Encode data using xor

Disassembly:
jl 0x472141
pop ds
xlatb
insb byte es:[edi], dx
pop ss
cmp dh, byte [edx - 0x64]
scasd eax, dword es:[edi]
xor bl, bl
xlatb
dec esp
pop ecx
xchg byte [edi - 0x71fc3672], al
leave
add ecx, dword [esi + 0x59d9db2f]
add al, 0xcd
jg 0x472199
xor ebx, edi
inc ebx
invalid
invalid

Function at 0x4a15b2
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x17bae875
or eax, dword [edx + ecx*4]
and al, 0x4f
xchg ebx, eax
push cs
sub dword [edi - 0x3b7fa752], 0x84937dcc
je 0x4a1643
dec ebx
leave
xchg edi, eax
stosb byte es:[edi], al
shr byte [ecx - 0x41], 0x62
push ss
mov byte [0xf4245158], al
out 0x14, al
insd dword es:[edi], dx
and dword [ebp + 0x122f610d], edi
mov ebp, 0x22aa4c43
jmp 0x5c6cf386

Function at 0x4b96ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2378
cmp edx, dword [eax]
je 0x4b96cf
add eax, 8
inc ecx
cmp eax, 0x4c2408
jl 0x4b96c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2378]
jne 0x4b97fd
mov eax, dword [0x4c6dfc]
cmp eax, 1
je 0x4b97d7
test eax, eax
jne 0x4b9700
cmp dword [0x4c22a0], 1
je 0x4b97d7
cmp edx, 0xfc
je 0x4b97fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b9737
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004ba090
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba520
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b977a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba520
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bea1c
push edi
call fcn.004bc3f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004ba090
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004ba0a0
lea eax, [ebp - 0xa0]
push 0x4be9fc
push eax
call fcn.004ba0a0
push dword [esi + 0x4c237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004ba0a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc364
add esp, 0x2c
pop edi
jmp 0x4b97fd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c237c]
push 0
push eax
push dword [esi]
call fcn.004ba520
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10008cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10008d49
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10008d49
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10008d3a
cmp esi, edx
jae 0x10008d49
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10008d28
cmp esi, edx
jae 0x10008d49
cmp word [esi], 0
je 0x10008d49
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000b830
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ba2fb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x100fc564]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x1000b9f6
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.10093170
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push dword [0x100fec84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call esi
lea eax, [ebp - 0x228]
push eax
call esi
mov eax, dword [0x100fec94]
test al, 1
jne 0x1000b8c9
or eax, 1
mov dword [0x100fec90], 0
mov dword [0x100fec94], eax
mov byte [ebp - 0x229], 0
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 0
push eax
call fcn.10015f10
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 1
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x229]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x240]
push eax
push 0x100093d0
push 0x100fec90
call fcn.1001699f
add esp, 0x10
test eax, eax
je 0x1000ba11
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 2
push eax
call fcn.10015f1f
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x228]
push 0x100fec98
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000b9f6
lea eax, [ebp - 0x228]
push eax
call fcn.1001d8c0
add esp, 4
test eax, eax
je 0x1000b9f6
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000b9f6
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4c746547
push eax
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x1c], 0x78456175
mov dword [ebp - 0x18], 0x69616c70
mov word [ebp - 0x14], 0x6e
call fcn.10009ca0
push dword [ebp - 0x230]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x230]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1000b9e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x1000b9f6
call esi
mov dword [edi], eax
test eax, eax
je 0x1000b9f6
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10076264
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 3
push eax
call fcn.10015f40
add esp, 4
mov byte [ebp - 4], 1
test al, al
jne 0x1000ba31
call fcn.100169dd
sub esp, 8
lea eax, [ebp - 0x238]
mov ecx, esp
push eax
call fcn.1000a760
call fcn.1000e770
int3
Function at 0x1000fac0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x1000fb1e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x1000fae0
mov eax, dword [edi]
jmp 0x1000fc09
cmp eax, 0x4e0
jb 0x1000fc09
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x1000fb40
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x1000fb90
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ba726
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x100fc564]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x428]
mov edi, dword [ebp + 0xc]
push 0x20a
push 0
push eax
mov dword [ebp - 0x45c], esi
call fcn.10093170
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x100105a0
push 0x100c1750
jmp 0x1001065c
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.10093170
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push str.TFR2
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10010596
push str..jpg
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x458]
call fcn.1000f3e0
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x10010608
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x440]
call fcn.1000f3e0
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.100101e0
add esp, 8
lea ecx, [ebp - 0x440]
mov bl, al
call fcn.1000abb0
lea ecx, [ebp - 0x458]
mov dword [ebp - 4], 0xffffffff
call fcn.1000abb0
test bl, bl
je 0x10010596
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.1000f3e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10076264
mov esp, ebp
pop ebp
ret 8
Function at 0x10010a70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ba7b3
mov eax, dword fs:[0]
push eax
mov eax, 0x13a4
call fcn.10076380
mov eax, dword [0x100fc564]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [0x100fecf8], 0
jne 0x10010be2
lea ecx, [ebp - 0x13ad]
call fcn.1000f9e0
push eax
lea ecx, [ebp - 0x24]
call fcn.1000f2a0
lea ecx, [ebp - 0x13ad]
mov dword [ebp - 4], 0
call fcn.1000f900
push eax
lea ecx, [ebp - 0x20]
call fcn.1000f2a0
lea ecx, [ebp - 0x13ad]
mov byte [ebp - 4], 1
call fcn.1000f660
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000f2a0
lea ecx, [ebp - 0x13ad]
mov byte [ebp - 4], 2
call fcn.1000f820
push eax
lea ecx, [ebp - 0x18]
call fcn.1000f2a0
lea ecx, [ebp - 0x13ad]
mov byte [ebp - 4], 3
call fcn.1000f740
push eax
lea ecx, [ebp - 0x14]
call fcn.1000f2a0
mov dword [ebp - 4], 4
call fcn.10016ed5
mov dword [ebp - 0x28], 0xffffffff
mov ecx, 1
mov dword [ebp - 0x13a8], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ebp + ecx*4 - 0x13a8], eax
inc ecx
cmp ecx, 0x270
jl 0x10010b42
mov dword [ebp - 0x13ac], 0x270
nop dword [eax + eax]
lea ecx, [ebp - 0x13ac]
call fcn.1000fac0
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 2
cmp edx, 0x33333333
jae 0x10010b70
mov eax, ecx
xor edx, edx
mov ecx, 5
div ecx
add edx, 0x80000000
cmp edx, 0x80000000
lea eax, [edx - 0x80000000]
lea ecx, [edx - 0x80000000]
cmovae ecx, eax
mov ecx, dword [ebp + ecx*4 - 0x24]
push ecx
mov eax, dword [ecx - 0xc]
inc eax
push eax
push 0x100fecf8
call fcn.10011520
push fcn.10006ab0
push 5
push 4
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.10076275
mov eax, 0x100fecf8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10076264
mov esp, ebp
pop ebp
ret
Function at 0x10011c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x100fc564]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100fee60
mov dword [ebp - 0x64], 0x440041
lea esi, [ebp - 0x64]
mov dword [ebp - 0x60], 0x45005f
push edi
mov dword [ebp - 0x5c], 0x450056
mov edx, 0x30
mov dword [ebp - 0x58], 0x54004e
sub esi, eax
mov dword [ebp - 0x54], 0x7b003a
mov dword [ebp - 0x50], 0x320035
mov dword [ebp - 0x4c], 0x380045
mov dword [ebp - 0x48], 0x350032
mov dword [ebp - 0x44], 0x380032
mov dword [ebp - 0x40], 0x33002d
mov dword [ebp - 0x3c], 0x360042
mov dword [ebp - 0x38], 0x2d0044
mov dword [ebp - 0x34], 0x410034
mov dword [ebp - 0x30], 0x330034
mov dword [ebp - 0x2c], 0x38002d
mov dword [ebp - 0x28], 0x440044
mov dword [ebp - 0x24], 0x2d0046
mov dword [ebp - 0x20], 0x330030
mov dword [ebp - 0x1c], 0x460037
mov dword [ebp - 0x18], 0x420042
mov dword [ebp - 0x14], 0x350033
mov dword [ebp - 0x10], 0x350037
mov dword [ebp - 0xc], 0x370039
mov dword [ebp - 8], 0x7d
nop word [eax + eax]
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x10011cfe
movzx ecx, word [esi + eax]
test cx, cx
je 0x10011cfe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10011ce0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10076264
mov esp, ebp
pop ebp
ret

Function at 0x10011d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x100fc564]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x100fedf0
mov dword [ebp - 0x64], 0x440041
lea esi, [ebp - 0x64]
mov dword [ebp - 0x60], 0x4d005f
push edi
mov dword [ebp - 0x5c], 0x540055
mov edx, 0x30
mov dword [ebp - 0x58], 0x580045
sub esi, eax
mov dword [ebp - 0x54], 0x7b003a
mov dword [ebp - 0x50], 0x320035
mov dword [ebp - 0x4c], 0x380045
mov dword [ebp - 0x48], 0x350032
mov dword [ebp - 0x44], 0x380032
mov dword [ebp - 0x40], 0x33002d
mov dword [ebp - 0x3c], 0x360042
mov dword [ebp - 0x38], 0x2d0044
mov dword [ebp - 0x34], 0x410034
mov dword [ebp - 0x30], 0x330034
mov dword [ebp - 0x2c], 0x38002d
mov dword [ebp - 0x28], 0x440044
mov dword [ebp - 0x24], 0x2d0046
mov dword [ebp - 0x20], 0x330030
mov dword [ebp - 0x1c], 0x460037
mov dword [ebp - 0x18], 0x420042
mov dword [ebp - 0x14], 0x350033
mov dword [ebp - 0x10], 0x350037
mov dword [ebp - 0xc], 0x370039
mov dword [ebp - 8], 0x7d
nop word [eax + eax]
lea ecx, [edx + 0x7fffffce]
test ecx, ecx
je 0x10011e0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10011e0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10011df0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10076264
mov esp, ebp
pop ebp
ret
Function at 0x10011ff0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x10012059
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10012075
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
pop esi
test eax, eax
je 0x10012059
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x10012075
cmp dword [edi + 4], 0
je 0x10012075
cmp dword [edi + 0xc], 0
je 0x10012075
mov eax, 1
pop edi
pop ebp
ret 4
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x10014fb0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bae18
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x100fc564]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100ff2d4]
mov dword [ebp - 4], 2
test al, 1
jne 0x1001501d
or eax, 1
mov dword [0x100ff2d4], eax
call fcn.10007270
mov ecx, eax
test ecx, ecx
je 0x1001513e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x100c00e0
mov dword [0x100ff2d0], eax
call fcn.1007624f
add esp, 4
mov eax, dword [0x100ff2d0]
cmp dword [eax - 0xc], 0
jne 0x100150b6
push 0
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push str.Halowp
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10015073
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.config.ini
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10015090
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, 0x100ff2d0
call fcn.100089d0
mov eax, dword [0x100ff2d0]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100150e7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0xc]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10015105
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10015124
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10076264
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10006e60
int3
Function at 0x10017b80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bb02a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100fc564]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10007270
mov ecx, eax
test ecx, ecx
je 0x10017d44
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10007270
mov ecx, eax
test ecx, ecx
je 0x10017d4e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10007270
mov ecx, eax
test ecx, ecx
je 0x10017d58
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10017c62
xor ecx, ecx
jmp 0x10017c80
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10017c70
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.100089d0
push edi
mov ecx, ebx
call fcn.10017e40
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10017c9c
xor ecx, ecx
jmp 0x10017cb4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10017ca4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.100089d0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10018850
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10017e40
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10017cf5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x10017d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10017d2e
cmp dword [esi + 0x10], 0
je 0x10017d25
push dword [edi]
call fcn.1009e89a
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10006e60
push 0x80004005
call fcn.10006e60
push 0x80004005
call fcn.10006e60
int3