joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e5db
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
lea esi, [ecx + 4]
mov eax, dword [esi]
test eax, eax
je 0x1000e5f5
push eax
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
and dword [esi], 0
push 0x20
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.10095d80
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
pop esi
leave
ret 0x18

Function at 0x1000e6f9
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, ecx
cmp byte [esi + 0x44], 0
je 0x1000e70c
mov al, 1
jmp 0x1000e782
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
push ebx
mov bl, 1
jne 0x1000e71b
xor al, al
jmp 0x1000e781
push edi
xor edi, edi
push edi
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x1000e77b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1000e776
push 0x2710
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000e779
push 0x2c
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.10095d80
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x1000e77b
mov dword [esi + 0x48], eax
xor bl, bl
mov byte [esi + 0x44], bl
mov al, bl
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x1000e787
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, ecx
push dword [esi + 0x4c]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x1000e7b1
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x1000e858
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x1000e7cf
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x1000e857
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x1000e817
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1000e849
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x1000e84c
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x1000e843
mov bl, 1
jmp 0x1000e84c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x1000e881
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, ecx
push dword [esi + 0x4c]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x1000e8ab
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x1000e972
push ebx
xor ebx, ebx
push ebx
push dword [esi + 4]
call edi
cmp eax, 0x80
jne 0x1000e8c9
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x1000e971
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0x14
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [edi], ebx
mov dword [ebp - 4], ebx
call fcn.10095d80
lea eax, [esi + 0x10]
add esp, 0xc
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 1
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1000e92f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1000e963
push dword [esi + 0x4c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000e966
lea eax, [ebp - 4]
push eax
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x40]
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x1000e95d
mov bl, 1
jmp 0x1000e966
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x1000f969
Capabilities:
Initialize winsock library

Disassembly:
push esi
lea esi, [ecx + 0x190]
cmp dword [esi], 0
je 0x1000f980
push ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esi], eax
xor eax, eax
cmp dword [esi], eax
pop esi
sete al
ret
Function at 0x10011caf
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x100b043f
call fcn.10096468
sub esp, 0xac
mov eax, dword [0x100f2810]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [ebx + 0x14], esi
mov dword [ebp - 0x10], eax
je 0x10011dec
push edi
push 0x100befe8
lea ecx, [ebp - 0x64]
call fcn.10001f91
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [ebp - 4], esi
call fcn.100314f6
add esp, 0x10
xor edi, edi
push esi
inc edi
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.10001aed
cmp dword [ebp - 0x34], esi
je 0x10011d23
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10011d1c
lea eax, [ebp - 0x44]
push eax
call fcn.10079a25
pop ecx
push 0x100befe0
lea ecx, [ebp - 0x9c]
call fcn.10001f91
push esi
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2c]
push ebx
push eax
mov byte [ebp - 4], 3
call fcn.100314f6
add esp, 0x10
push esi
push edi
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 5
call fcn.10001aed
cmp dword [ebp - 0x18], esi
je 0x10011d75
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10011d6e
lea eax, [ebp - 0x28]
push eax
call fcn.10079bab
pop ecx
push str.RESULT
lea ecx, [ebp - 0x80]
call fcn.10001f91
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0xb8]
push ebx
push eax
mov byte [ebp - 4], 6
call fcn.100314f6
add esp, 0x10
push str.FINAL
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.1001034b
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push edi
lea ecx, [ebp - 0xb8]
inc bl
call fcn.10001aed
push esi
push edi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.10001aed
test bl, bl
je 0x10011dd7
call fcn.10079a0a
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.10001aed
push esi
push edi
lea ecx, [ebp - 0x48]
call fcn.10001aed
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.10095c5f
leave
ret
Function at 0x10015719
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x100b0814
call fcn.10096468
sub esp, 0x10
push ebx
push esi
push edi
push 0x100bd608
push dword [ebp + 8]
push dword [0x100f414c]
call dword [0x100f3924]
mov esi, eax
test esi, esi
je 0x10015831
push esi
push dword [0x100f414c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [0x100f414c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push str.__xml_version_1.0__encoding_utf_16____
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.1000136b
and dword [ebp - 4], 0
push edi
push esi
lea ecx, [ebp - 0x14]
call fcn.10007516
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.100014a1
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0
call ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
call fcn.10028cb7
pop ecx
pop ecx
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
je 0x1001581b
sub esp, 0x10
mov edi, esp
mov esi, 0x100c0070
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call fcn.1002192a
mov ecx, eax
call fcn.100212cd
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.10007cfd
mov eax, dword [ebp - 0x1c]
test eax, eax
mov byte [ebp - 4], 5
je 0x100157f9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x14]
call fcn.10001134
push dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x14]
test eax, eax
mov byte [ebp - 4], 2
je 0x1001581b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
test eax, eax
mov byte [ebp - 4], 0
je 0x1001582c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x1001706d
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x100b0a05
call fcn.10096468
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 0x10], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 6
call fcn.1000191c
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 7
mov dword [esi + 0x60], edi
call fcn.10079097
lea ecx, [esi + 0x110]
mov byte [ebp - 4], 8
call fcn.1003f768
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1001f078
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x1001f090
mov eax, dword [esi]
jmp 0x1001f092
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x1001f0e8
cmp eax, 0xb7
je 0x1001f0e8
cmp byte [0x100f3bc8], 0
je 0x1001f0e4
cmp dword [edi + 0x18], 8
jb 0x1001f0b9
mov esi, dword [esi]
push eax
push esi
push str.CreateDirectoryAlways_ERROR_sFile_s__error_d
push str.GeneralFuncs
push 4
push 0x56
push str.CreateDirectoryAlways
push str..FclGeneralFuncs.cpp
lea ecx, [ebp - 0x10]
call fcn.100014f6
push eax
call fcn.1001b9ac
add esp, 0x18
xor eax, eax
jmp 0x1001f0eb
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x1001fb8a
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100b0e10
call fcn.10096468
sub esp, 0x23c
mov eax, dword [0x100f2810]
push ebx
xor ebx, ebx
mov dword [ebp - 0x238], ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 7
call fcn.100018ff
mov dword [ebp - 4], ebx
call fcn.1001eac0
test al, al
je 0x1001fc77
push edi
push str.shell32.dll
call dword [0x100f3968]
mov edi, eax
cmp edi, ebx
je 0x1001fc76
push str.SHGetKnownFolderPath
push edi
call dword [0x100f3948]
cmp eax, ebx
je 0x1001fc6f
push esi
lea ecx, [ebp - 0x238]
push ecx
push ebx
push ebx
push 0x100c1998
mov dword [ebp - 0x238], ebx
call eax
cmp byte [0x100f3bc8], bl
mov esi, eax
je 0x1001fc48
push esi
push dword [ebp - 0x238]
lea ecx, [ebp - 0x248]
push str.VistaUtils::GetWriteableFolderPath__s__hr_d
push str.Guru
push 1
push 0x587
push str.VistaUtils::GetWriteableFolderPath
push str..FclGeneralFuncs.cpp
call fcn.100014f6
push eax
call fcn.1001b9ac
add esp, 0x18
cmp esi, ebx
pop esi
jl 0x1001fc6f
cmp dword [ebp - 0x238], ebx
je 0x1001fc6f
push dword [ebp - 0x238]
lea ecx, [ebp - 0x2c]
call fcn.10003859
push dword [ebp - 0x238]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
cmp dword [ebp - 0x18], ebx
ja 0x1001fca1
push 1
push 0x1a
lea eax, [ebp - 0x234]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1001fca1
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10003859
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.10003748
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001aed
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.10095c5f
leave
ret
Function at 0x10022745
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [0x100f473c]
push edi
push 0xf0
push eax
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 1
call dword [0x100f3924]
test eax, eax
je 0x10022897
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10022897
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10022897
call dword [0x100ef0d0]
mov dword [ebp + 8], eax
xor eax, eax
mov ax, word [edi]
test ax, ax
mov dword [ebp - 8], eax
je 0x10022897
inc edi
inc edi
mov ax, word [edi]
inc edi
inc edi
mov ecx, dword [edi]
add edi, 4
cmp ax, 0x403
mov dword [ebp - 0x10], ecx
jne 0x10022811
test edi, edi
jne 0x100227cf
xor eax, eax
jmp 0x10022807
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.10096da0
mov ebx, esp
xor eax, eax
cmp ebx, eax
je 0x10022807
push esi
push ebx
push 0xffffffffffffffff
push edi
push eax
push dword [ebp + 8]
mov word [ebx], ax
call dword [0x100f3970]
neg eax
sbb eax, eax
and eax, ebx
push eax
push 0
push 0x143
jmp 0x10022870
cmp ax, 0x1234
jne 0x1002288a
or dword [ebp - 0x30], 0xffffffff
test edi, edi
mov dword [ebp - 0x34], 1
jne 0x1002282a
xor eax, eax
jmp 0x10022862
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.10096da0
mov ebx, esp
xor eax, eax
cmp ebx, eax
je 0x10022862
push esi
push ebx
push 0xffffffffffffffff
push edi
push eax
push dword [ebp + 8]
mov word [ebx], ax
call dword [0x100f3970]
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x40b
movzx eax, word [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push dword [eax + 4]
call dword [0x100f3a14]
cmp eax, 0xffffffff
jne 0x1002288a
and dword [ebp - 4], 0
add edi, dword [ebp - 0x10]
cmp dword [ebp - 4], 0
jne 0x100227a1
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x40]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10029eed
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
push 0x1c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10029f6b
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp - 0x1c]
push dword [ebp + 0xc]
push edi
call dword [0x100f3940]
test eax, eax
jne 0x10029f21
xor eax, eax
jmp 0x10029f6a
test edi, edi
je 0x10029f1d
mov eax, dword [edi + 0x3c]
and dword [ebp - 4], 0
add eax, edi
movzx edx, word [eax + 6]
movzx ecx, word [eax + 0x14]
sub esi, edi
test edx, edx
push ebx
lea ecx, [ecx + eax + 0x18]
jbe 0x10029f67
lea eax, [ecx + 0x10]
mov edi, dword [eax]
mov ebx, dword [eax - 8]
cmp edi, ebx
mov ecx, dword [eax - 4]
ja 0x10029f52
mov edi, ebx
cmp esi, ecx
jb 0x10029f5c
add edi, ecx
cmp esi, edi
jbe 0x10029f6e
inc dword [ebp - 4]
add eax, 0x28
cmp dword [ebp - 4], edx
jb 0x10029f44
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
inc eax
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
sub esi, ecx
mov dword [eax], esi
xor eax, eax
inc eax
jmp 0x10029f69

Function at 0x1002bc86
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 4]
test al, al
je 0x1002bca5
cmp byte [esi + 0x29], 0
je 0x1002bca5
push dword [esi + 4]
mov byte [esi + 0x29], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret

Function at 0x1002bf9b
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov byte [esi + 0x2a], 1
call dword [eax + 4]
test al, al
je 0x1002c015
cmp byte [esi + 0x29], 0
je 0x1002bfb8
mov ecx, esi
call fcn.1002bc86
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push dword [esp + 8]
mov ecx, esi
call fcn.1002bca7
test al, al
jne 0x1002c015
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test al, al
je 0x1002c015
push edi
push dword [esi + 0x60]
lea edi, [esi + 0x30]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x28], 0
je 0x1002c009
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [edi]
and dword [esi + 4], 0
mov ecx, edi
call dword [eax + 0xc]
pop edi
pop esi
ret 4

Function at 0x1002cd5b
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
mov al, byte [esp + 0xc]
neg al
mov byte [esi + 0x2a], 0
sbb eax, eax
and eax, 4
push eax
push esi
push 0x1002c5fa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test al, al
je 0x1002cd9c
cmp byte [esp + 8], 0
je 0x1002cd9c
xor eax, eax
inc eax
jmp 0x1002cd9e
xor eax, eax
mov byte [esi + 0x29], al
pop esi
ret 4
Function at 0x1002cfd0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
mov esi, ecx
je 0x1002d07b
cmp dword [ebp + 0xc], ebx
je 0x1002d07b
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1002d07b
cmp eax, 0xffffffff
je 0x1002d07b
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call edi
cmp dword [ebp - 8], ebx
mov dword [esi + 8], eax
jne 0x1002d07b
cmp dword [ebp - 4], ebx
jbe 0x1002d07b
cmp eax, ebx
jne 0x1002d07b
push dword [ebp - 4]
call fcn.100957c0
and dword [ebp - 0xc], 0
pop ecx
push 0
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
call edi
cmp dword [ebp - 0x10], 0
mov dword [esi + 8], eax
je 0x1002d074
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 4], ecx
jne 0x1002d074
test eax, eax
jne 0x1002d074
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x1002d07d
push ebx
call fcn.100968cf
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10030ab9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
call fcn.100243ea
mov esi, dword [esp + 0x1c]
mov edi, dword [0x100f3924]
push 5
push dword [esp + 0x24]
xor ebp, ebp
push esi
mov dword [esp + 0x1c], ebp
call edi
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x10030b89
push ebx
push 0xf0
push dword [esp + 0x28]
push esi
call edi
cmp eax, ebp
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [sym.imp.KERNEL32.dll_LockResource]
je 0x10030b0f
push eax
push esi
call edi
push eax
call ebx
mov ebp, eax
push dword [esp + 0x18]
and dword [esp + 0x14], 0
push esi
call edi
test eax, eax
je 0x10030b6d
push eax
call ebx
mov edi, eax
test edi, edi
je 0x10030b6d
push ebp
push edi
call fcn.1002fd97
pop ecx
pop ecx
push dword [esp + 0x30]
mov ebx, eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push esi
call dword [0x100f39bc]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x10030b59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x10030b77
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10030b77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
pop ebx
je 0x10030b89
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x1003f257
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x100b2bac
call fcn.10096468
sub esp, 0x94
mov eax, dword [0x100f2810]
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 0x7c], esi
inc edi
test byte [0x100f41bc], 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x80], ecx
jne 0x1003f29d
or dword [0x100f41bc], edi
push 0x100bb575
mov dword [0x100f41b8], esi
call fcn.100968bd
pop ecx
mov eax, dword [0x100f41b8]
cmp eax, esi
je 0x1003f2c3
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, esi
je 0x1003f2c3
mov ecx, dword [ebp + 8]
push 0x100f41b8
call fcn.10001801
jmp 0x1003f3a9
push 0xf003f
push SysReAllocString
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x84], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.10001f91
lea ecx, [ebp - 0x78]
call fcn.1002bbfd
cmp dword [ebp - 0x30], esi
mov dword [ebp - 4], edi
jne 0x1003f38f
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.100018ff
push str.AppData
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.10001f91
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.1002b2c7
mov ebx, eax
neg ebx
push esi
sbb bl, bl
push edi
lea ecx, [ebp - 0xa0]
inc bl
mov byte [ebp - 4], 2
call fcn.10001aed
test bl, bl
je 0x1003f381
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1003f35b
lea eax, [ebp - 0x28]
mov esi, 0x100f41b8
push eax
mov ecx, esi
call fcn.10024ed1
mov ecx, dword [ebp + 8]
push esi
call fcn.10001801
push 0
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x7c], edi
call fcn.10001aed
jmp 0x1003f39d
push esi
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.10001aed
push dword [ebp + 8]
mov ecx, dword [ebp - 0x80]
call fcn.1003ef1e
mov dword [ebp - 0x7c], edi
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0
call fcn.1002af26
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.10095c5f
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10040f5a
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x100b2e42
call fcn.10096468
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push str.00000000_0000_0000_0000_000000000000
lea ecx, [esi + 8]
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
call fcn.1000136b
mov edi, 0x100bc8a8
push edi
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.1000136b
push edi
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.1000136b
push edi
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 2
call fcn.1000136b
push edi
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.1000136b
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], bl
pop edi
mov byte [esi + 0x39], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret