joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40aba8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403b68
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406b5c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40abaf
lea eax, [ebp - 0xc]
call fcn.004038f8
ret

Function at 0x4125bc
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x10
call fcn.004028b8
lea eax, [ebp - 0x74]
xor ecx, ecx
mov edx, 0xc
call fcn.004028b8
mov dword [ebp - 0x74], 0xc
mov dword [ebp - 0x6c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x70], eax
push 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_CreatePipe
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.004028b8
mov dword [ebp - 0x58], 0x44
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0x101
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x4000030
push 0xffffffffffffffff
push 0
push 0
mov eax, ebx
call fcn.00403d94
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x412724
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov dl, 1
mov eax, dword [0x40f6f8]
call fcn.00402e14
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4126fe
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
lea eax, [ebp - 0x10]
push eax
push 0xff
lea eax, [ebp - 0x174]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4126d2
lea edx, [ebp - 0x174]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x10]
jmp 0x41269a
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00411408
mov eax, dword [esi]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412705
mov eax, dword [ebp - 0x14]
call fcn.00402e44
ret
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412a28
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403d84
xor eax, eax
push ebp
push 0x412af8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x209]
mov edx, dword [ebp - 4]
call fcn.004070dc
lea eax, [ebp - 0x250]
xor ecx, ecx
mov edx, 0x44
call fcn.004028b8
mov dword [ebp - 0x250], 0x44
mov dword [ebp - 0x224], 1
mov word [ebp - 0x220], si
push ebx
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x209]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x412abb
mov dword [ebp - 8], 0xffffffff
jmp 0x412ae2
push 0xffffffffffffffff
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412aff
lea eax, [ebp - 4]
call fcn.004038f8
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x65592162
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f314
mov ecx, 0x64a90f8a
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1331058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.013311a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x133107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x133106a
add dl, dl
jne 0x1331089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13310dc
xor eax, eax
add dl, dl
jne 0x1331096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x133117d
add dl, dl
jne 0x13310a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13310b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13310bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13310c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13310d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1331075
mov eax, 1
add dl, dl
jne 0x13310ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13310f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13310e1
sub eax, ebx
mov ebx, 1
jne 0x1331128
mov ecx, 1
add dl, dl
jne 0x133110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1331119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1331105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1331075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x133113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x133114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1331136
cmp eax, 0x7d00
jae 0x133116d
cmp eax, 0x500
jb 0x1331168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1331075
cmp eax, 0x7f
ja 0x1331170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1331075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x133119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1331075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10005020
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2215
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x24
mov eax, dword [0x1011b600]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
xorps xmm0, xmm0
mov dword [ebp - 0x34], esi
push 0x40
movups xmmword [ebp - 0x2c], xmm0
call fcn.100af0c0
movups xmm0, xmmword [0x1010b52c]
mov ecx, eax
mov dword [ebp - 0x1c], 0x37
add esp, 4
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0x3f
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x1010b53c]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x1010b54c]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x1010b55c]
mov dword [ecx + 0x30], eax
mov ax, word [0x1010b560]
mov word [ecx + 0x34], ax
mov al, byte [0x1010b562]
mov byte [ecx + 0x36], al
mov byte [ecx + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
call fcn.10004b40
mov ecx, dword [ebp - 0x18]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
cmp ecx, 0xf
jbe 0x10005129
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000511f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000514e
push ecx
push edx
call fcn.100af0f0
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100af09a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100bb68f
int3
Function at 0x10005160
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2215
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x24
mov eax, dword [0x1011b600]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
xorps xmm0, xmm0
mov dword [ebp - 0x34], esi
push 0x40
movups xmmword [ebp - 0x2c], xmm0
call fcn.100af0c0
movups xmm0, xmmword [0x1010b52c]
mov ecx, eax
mov dword [ebp - 0x1c], 0x37
add esp, 4
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0x3f
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x1010b53c]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x1010b54c]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x1010b55c]
mov dword [ecx + 0x30], eax
mov ax, word [0x1010b560]
mov word [ecx + 0x34], ax
mov al, byte [0x1010b562]
mov byte [ecx + 0x36], al
mov byte [ecx + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
call fcn.10004b40
mov ecx, dword [ebp - 0x18]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
cmp ecx, 0xf
jbe 0x10005269
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000525f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000528e
push ecx
push edx
call fcn.100af0f0
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::Filter_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100af09a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100bb68f
int3

Function at 0x10008be0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Delete file
Get common file path
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1000aa60

Function at 0x10008e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, 0x101213f8
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008e80
sub ecx, edx
sar ecx, 1
je 0x10008ecb
push 0x101213f8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10008ecb
push esi
push 0x101213f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10008eca
push 0x1010bc1c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10008ecc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
ret
pop esi
jmp eax
Function at 0x10008ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, 0x101213f8
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008ee0
sub ecx, edx
sar ecx, 1
je 0x10008f2b
push 0x101213f8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10008f2b
push esi
push 0x101213f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10008f2a
push 0x1010bc40
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10008f2c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
ret
pop esi
jmp eax

Function at 0x10008f30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
mov dword [ebp - 0x28], eax
mov esi, ecx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], 0
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x10008fad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Unable_to_exe11cute_2222_s_as_admin:_Error__d_n
call fcn.10006580
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.100bff51
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10008fe0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e26dd
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1011b600]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov edi, dword [0x10121914]
xor esi, esi
test edi, edi
je 0x100090a0
push 0xa
movzx eax, cx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x100090a0
push edi
push dword [0x10121914]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100090a0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100090a0
push edi
push dword [0x10121914]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100090a0
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, 1
cmp eax, dword [ebp - 0x14]
cmove esi, ecx
mov ecx, dword [ebp + 0x24]
cmp ecx, 7
jbe 0x100090d6
mov edx, dword [ebp + 0x10]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100090cc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100090ea
push ecx
push edx
call fcn.100af0f0
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100bb68f
int3
Function at 0x100090f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x1011b600]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov byte [ebp - 0x439], 0
push 0
push 2
mov dword [ebp - 0x444], eax
mov ebx, ecx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, 0xffffffff
jne 0x10009145
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100af09a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10009215
push edi
nop word [eax + eax]
push dword [ebp - 0x430]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000923f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x10009238
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100091b3
sub ecx, edx
mov esi, ebx
sar ecx, 1
cmp dword [ebx + 0x14], 7
jbe 0x100091cc
mov esi, dword [ebx]
mov edx, dword [ebx + 0x10]
cmp edx, ecx
jne 0x10009232
lea eax, [ebp - 0x20c]
test edx, edx
je 0x100091f2
mov ecx, eax
sub esi, ecx
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x10009232
add eax, 2
sub edx, 1
jne 0x100091e1
mov ecx, dword [ebp - 0x444]
mov eax, dword [ebp - 0x430]
push edi
mov byte [ebp - 0x439], 1
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x440]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x439]
xor ecx, ebp
pop esi
pop ebx
call fcn.100af09a
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x440]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10009170
jmp 0x10009214

Function at 0x10009260
Capabilities:
Terminate process

Disassembly:
push edi
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000928d
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
setne al
pop edi
ret
xor al, al
pop edi
ret
Function at 0x100092a0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1011b600]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
mov esi, edx
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10009320
push 0x1010bcc8
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100092f9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10009320
lea eax, [esi + 2]
nop dword [eax]
mov cx, word [esi]
add esi, 2
test cx, cx
jne 0x10009300
sub esi, eax
sar esi, 1
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100af09a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100af09a
mov esp, ebp
pop ebp
ret

Function at 0x100093d0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x100fdbb8
mov esi, edx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x10009424
push 0x1010bcc8
push dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000942b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000942b
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10009430
push dword [ebp - 4]
sub esi, ecx
sar esi, 1
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e28fd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1011b600]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
push 0xa
movzx eax, dx
push eax
push dword [0x10121914]
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1000a994
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
jmp 0x1000aa24
push edi
push dword [0x10121914]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x1000a96a
push edi
push dword [0x10121914]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x2c]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xorps xmm0, xmm0
test eax, eax
je 0x1000a96d
push edi
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.10005a60
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10025d90
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x1000aa24
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000aa1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000aa41
push ecx
push edx
call fcn.100af0f0
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100af09a
mov esp, ebp
pop ebp
ret
call fcn.100bb68f
int3