joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486dc7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
lea edx, [ecx + ecx]
jmp 0x486e05
dec edx
jp 0x486def
mov edx, 0x869b48b3
lea eax, [esp + ebx]
xchg dh, al
setbe dl
jmp 0x486e32
lea eax, [edx + ebx]
mov dx, word [esp]
rol cl, 0
xchg dx, ax
mov ax, 0xf762
jmp 0x486dcd

Function at 0x4b44ff
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [ecx + 3]
stc
sub esp, 8
jmp 0x4b42ab
cmp bl, 0x61
jb 0x4b3ce4
jae 0x4734fa
enter 0xffffffffffff826b, 0x3d
cmp bl, 0x7a
jbe 0x4734d5
ja 0x4b3ce4
push esp
invalid
cmp bl, 0x30
jmp 0x4b4282
jmp 0x4b42c1
jne 0x47345b
je 0x4734d5
cmp dword [ecx + reloc.KERNEL32.dll_VirtualAlloc], esi
lea esp, [esp + 0xc]
jbe 0x4734d5
ja 0x4734eb
jb 0x4b3d1e
sub esp, 0x19
lea esp, [esp + 1]
jmp 0x4b430d
cmp bl, 0x5a
pushal
lea esp, [esp + 0x12]
lea esp, [esp + 2]
jmp 0x4b4272
lea esp, [esp + 8]
cmp cl, 0x41
jmp 0x4b42e8
cmp bl, 0x2b
je 0x4734d5
cmp bl, 0x2f
jmp 0x4b3d23
lea esp, [esp + 0x18]
cmp bl, 0x39
jbe 0x4734d5
ja 0x4b3d1e
lea esp, [esp]
lea esp, [esp + 4]
jb 0x4734eb
jae 0x4b429d

Function at 0x552830
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, 0xe1c90791
sub esp, 0xb
not bp
cpuid
jmp 0x55284d
push word [esp + 0x15]
lea esp, [esp + 0xd]
lea ecx, reloc.KERNEL32.dll_VirtualAlloc
setle dl
rdtsc
and bh, 0x8e
jmp 0x5528cf
rdtsc
rcr edi, cl
xor cx, 0x14be
add esp, 2
mov al, dh
cmc
jmp 0x5528b8
pop word [esp]
mov ch, byte [esp + 1]
mov word [esp], dx
lea eax, reloc.KERNEL32.dll_VirtualAlloc
xchg byte [esp], bh
cpuid
jmp 0x552889
lea edx, [ebx + ebx]
bsf bp, ax
xchg byte [esp], ch
cpuid
jmp 0x5528f7
neg ebx
setg ah
pop bp
mov ch, byte [esp + 0x18]
add esp, 0x16
xchg edx, ecx
jmp 0x55289f
xor ah, 0xfa
not bl
add esp, 1
inc bp
call fcn.00552951
inc ebp
into
pop esp
cmp edx, esi
jno 0x5528d6
lea ebx, [eax*4]
mov ah, 0x84
mov ax, word [esp]
xchg cx, bx
sub esp, 9
std
jmp 0x5528e1

Function at 0x552951
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
mov eax, esp
lea esp, [esp + 6]
setnp ch
mov ch, dl
bsf edx, esi
jmp 0x55296c
mov eax, ebx
pop edx
jmp 0x552938
mov word [esp + 3], dx
inc bx
lea ebp, [esp + eax]
lea ecx, [ebx + ebp]
lea esi, [edx + ebx]
jmp 0x55297f
push word [esp]
bswap eax
push word [esp + 3]
inc cl
rdtsc
mov bl, dl
jmp 0x552956
mov al, byte [esp + 4]
pop word [esp + 1]
mov cx, word [esp]
pushfd
add esp, 4
jmp 0x5529de
bsf ecx, eax
bswap esi
sub esp, 0xa
xchg cx, ax
setl ah
jmp 0x552a0d
pop bx
inc cl
add esp, 2
bsf ecx, edi
shr ax, 4
setae bl
jmp 0x5529a6
mov ch, 0xfe
mov bh, byte [esp]
lea ebp, [esi*4]
sbb edx, 0xfaca800d
mov dword [esp], esi
mov eax, edx
jmp 0x5529bc
not cx
push edx
mov ebx, esi
btr ecx, ebp
bsr dx, bx
mov dh, 0x96
jmp 0x552a26
bsr bp, cx
mov dword [esp + 1], edi
pop dword [esp]
lea esp, [esp + 1]
lea edi, reloc.KERNEL32.dll_VirtualAlloc
pop ax
jmp 0x5529f7
pop bx
mov dword [esp], esi
mov edi, ebp
lea esp, [esp + 4]
mov bp, word [esp]
jmp 0x552a67
mov byte [esp], ah
mov byte [esp], bl
mov dl, 0x33
xchg si, cx
mov ch, 0x69
lea ebx, [edi*4]
jmp 0x552a51
Function at 0x552e10
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [ecx - 0x38]
mov dl, byte [esp + 5]
adc al, 0x6f
add esp, 0
jmp 0x552fcb
mov ebx, esp
setne dl
xchg ah, bl
mov si, bx
lea esi, [esp + eax]
add esp, 0
setnp ah
mov bx, word [esp]
lea edx, [ebx + esi]
mov dx, word [esp + 1]
mov word [esp], di
jmp 0x552e5b
clc
cpuid
btr di, bp
xchg word [esp], ax
rdtsc
cpuid
jmp 0x552e86
lea ebp, reloc.KERNEL32.dll_VirtualAlloc
mov eax, 0xe2d42553
pop ecx
neg dx
bswap ebx
btc bx, ax
jmp 0x552f35
Function at 0x5532de
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x55331b
mov dh, cl
dec bh
lea esp, [esp + 0x11]
xchg byte [esp], al
push word [esp + 6]
xor ah, cl
pop bp
push dword [esp + 4]
lea edx, [esi*4]
pushfd
jmp 0x553305

Function at 0x553471
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebp
pop word [esp]
bsf di, si
cpuid
pop di
jmp 0x553444

Function at 0x5553c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [ebx*4]
pushal
mov cx, 0xdcee
sets dh
jmp 0x5553d6
mov edx, 0xa382d6f3
mov word [esp], dx
mov dword [esp], ecx
jmp 0x5553b2
pop cx
mov edx, dword [esp + 0xe]
lea esp, [esp + 2]
mov dword [esp + 0x17], eax
rol cl, 2
shr edx, cl
jmp 0x555437
xchg edx, ecx
mov edx, 0x5f66528
lea ecx, [edi*4]
jmp 0x555493
mov cl, byte [esp]
bts eax, ecx
rdtsc
lea eax, [edx*4]
mov ecx, dword [esp]
mov al, ah
jmp 0x555403
mov ax, word [esp]
neg cx
xchg ecx, eax
bswap edx
btc ecx, ebp
mov ecx, 0x756506d4
jmp 0x555419
mov ecx, dword [esp + 6]
pop dword [esp + 4]
call fcn.0055544c
push dword [esp]
bt edx, ebx
mov eax, 0x9363dee1
pop word [esp + 8]
shl eax, 0x14
lea edx, [ecx + ecx]
jmp 0x5554bd
lea ecx, reloc.KERNEL32.dll_VirtualAlloc
lea eax, [ecx + edx]
mov ax, bp
rdtsc
clc
sub esp, 0xe
jmp 0x555462
sub esp, 0x1c
bsf cx, di
call fcn.005554d6
push ss
mov word [edx], es
xchg esp, eax
sub bl, byte [ecx + 0x6632dbf8]
mov eax, 0x9b0fe5ed
les esp, [esi - 0x46]
call 0x2469db82
mov ax, 0xe5ed
setnp ah
mov dx, 0xb7e8
xchg byte [esp], dl
pop word [esp + 4]
bt dx, bx
jmp 0x5554a7

Function at 0x5557fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x1d]
adc eax, 0x614a5922
rdtsc
rdtsc
call fcn.0055578b
xor al, 0x27
dec esi
invalid
mov ah, byte [esp + 0x12]
add esp, 8
mov dword [esp + 0xc], ebx
neg dx
rdtsc
push word [esp + 0x18]
jmp 0x555748
cld
pop eax
mov ax, sp
rol cx, cl
push word [esp + 0x17]
bswap eax
jmp 0x55575e
mov dh, byte [esp + 0x20]
mov eax, dword [esp + 0xe]
push word [esp + 0x1c]
mov ax, 0x6343
jmp 0x5557bd

Function at 0x555942
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec cx
xchg dword [esp + 3], edx
mov edx, 0x679c9854
jmp 0x556eb3

Function at 0x5565ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x13], ecx
rdtsc
rdtsc
mov cx, 0xfe75
push dword [esp + 3]
stc
jmp 0x5565cb
mov cx, word [esp]
lea ecx, reloc.KERNEL32.dll_VirtualAlloc
bswap eax
bswap ecx
std
sub esp, 0x13
jmp 0x55659e
btr ecx, esp
mov dl, 0xe8
add esp, 0x14
mov word [esp + 3], bx
rol cl, 5
call fcn.0055660c
mov byte [0x38c9ae38], al
xchg byte [ebp + edx - 0x4be0137b], cl
add al, 0xb7
bsf edx, ecx
rdtsc
cld
jmp 0x5565b7

Function at 0x55690f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0xfaee
xchg ecx, eax
bsr dx, cx
rdtsc
mov edx, 0x54f02729
jmp 0x55680b
Function at 0x5569fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1e
push dword [esp + 0x1e]
cld
mov dword [esp + 0xe], ecx
bswap ecx
bswap ecx
jmp 0x556a0b
lea ecx, [eax - 0xd9]
btr ax, bp
cmc
xchg byte [esp], cl
jmp 0x5569e5
btc edx, ebp
not dx
mov ecx, dword [esp + 1]
rdtsc
sub esp, 0x12
xchg dx, ax
jmp 0x556a7d
dec ah
pushal
xchg word [esp + 2], ax
mov cx, si
mov byte [esp + 0x20], cl
jmp 0x556ab7
mov eax, dword [esp]
lea edx, [ecx - 0x4c]
pushfd
mov cx, word [esp + 1]
pop word [esp]
lea edx, [eax*4]
jmp 0x556a41
bswap ecx
not dh
push dword [esp + 0x12]
clc
sub esp, 0x1e
lea esp, [esp + 0x5b]
jmp 0x556a57
lea eax, reloc.KERNEL32.dll_VirtualAlloc
std
inc edx
xchg byte [esp + 2], ch
bt cx, dx
sub esp, 0x1b
jmp 0x556acf
push dword [esp + 0x1b]
add esp, 2
xchg dx, cx
xchg dword [esp + 1], ecx
bt ax, bp
mov ax, 0x4aee
jmp 0x556a8f
pop ax
cmc
mov edx, ebx
mov dh, dl
xchg word [esp + 0x2b], dx
bts dx, sp
jmp 0x556c29
dec al
lea eax, [esp + edi]
mov edx, dword [esp]
rdtsc
cmp ch, cl
inc al
jmp 0x556b73
mov ax, word [esp]
bswap eax
dec eax
not ax
mov dx, 0x1a94
mov ecx, esi
jmp 0x556b05
mov cx, word [esp]
bsf ecx, ebx
call fcn.00556b5d
xor al, 0xac
and al, byte [ebp - 0x4c]
add edi, dword [ecx]
sbb byte [ebx + 0x52], bh
lea ecx, [ecx + 0x88]
rcr al, cl
xor ecx, 0x867f1fa3
cld
not ecx
lea eax, [ecx*4]
jmp 0x556b2d
bswap edx
mov ecx, 0x9c2444a4
rdtsc
bsr eax, ecx
neg dx
lea edx, [esp + esi]
jmp 0x556b43
mov ax, word [esp + 0x21]
mov ah, 0xd9
push esp
lea esp, [esp + 0x41]
rdtsc
mov edx, dword [esp]
jmp 0x556b1b

Function at 0x5570aa
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 4], ecx
mov dword [esp], edx
push ebx
call fcn.00556ff5
push dword [esp + 3]
push eax
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0x55705d
mov eax, dword [eax]
jmp 0x557090
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x557047
mov eax, dword [eax + 8]
push eax
jmp 0x55700d
mov word [esp + 1], ax
jmp 0x55701d

Function at 0x402658
Capabilities:
Terminate process

Disassembly:
xor edi, edi
xor esi, esi
mov edx, eax
mov eax, 5
add eax, 5
inc eax
test eax, 0xb
jne 0x40267a
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401036], eax
ret
Function at 0x401b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00407dd1

Function at 0x402150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dbdd
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x5cfff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x214], edi
push 0
push 0x66
mov dword [ebp - 0x218], edi
call fcn.004075ed
lea esi, [edi + 0xd8]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [edi], vtable.CQSV2FLVDlg.0
mov dword [ebp - 0x214], esi
call fcn.0040bfa9
mov dword [esi], vtable.CListCtrl.0
push 0x5b04b0
lea ecx, [edi + 0x158]
mov byte [ebp - 4], 1
call fcn.00405220
push 0
push 0x10
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0041547f
call fcn.0041547f
push 0x13f
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
lea edx, [ebp - 0x210]
mov dword [edi + 0xd4], eax
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402210
sub edx, ecx
lea eax, [ebp - 0x210]
sar edx, 1
lea ecx, [edi + 0x158]
push edx
push eax
call fcn.004050e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c0c7
mov esp, ebp
pop ebp
ret 4
Function at 0x402940
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.WIN32EXE
push 0x97
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x402964
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40298e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40298e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x402996
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x5b026c
lea ecx, [ebp - 4]
call fcn.00405220
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4029e2
lea ecx, [ebp - 4]
call fcn.00401c60
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00401c60
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402a00
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.WIN32EXE
push 0x98
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x402a24
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x402a4e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402a4e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x402a56
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x5b029c
lea ecx, [ebp - 4]
call fcn.00405220
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402aa2
lea ecx, [ebp - 4]
call fcn.00401c60
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00401c60
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402ac0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dcb2
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x5cfff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.WIN32EXE
push 0x140
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x402cee
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x402cee
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402cee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x402cee
push 0x104
lea eax, [ebp - 0x2ac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00405220
mov dword [ebp - 4], 0
push 0x5c
push dword [ebp - 0x2b0]
call fcn.0054ed77
add esp, 8
test eax, eax
je 0x402bc0
sub eax, dword [ebp - 0x2b0]
sar eax, 1
cmp eax, 0xffffffff
je 0x402bc0
inc eax
lea ecx, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.004044b0
push eax
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 1
call fcn.00404b60
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 0
call fcn.00401c60
mov eax, dword [ebp - 0x2b0]
cmp dword [eax - 0xc], 0
jne 0x402c12
lea eax, [ebp - 0xa0]
push eax
push 0x90
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0xa0]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402be5
mov ax, word [0x5b02cc]
mov word [ecx], ax
mov al, byte [0x5b02ce]
mov byte [ecx + 2], al
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00404ca0
call fcn.00409fff
mov ecx, eax
test ecx, ecx
jne 0x402c27
push 0x80004005
call fcn.00401ee0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2b4], eax
push str.support112.exe
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 2
call fcn.00404d30
mov esi, eax
push str.C:Windows_
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 4], 7
call fcn.00404d30
push esi
push eax
lea eax, [ebp - 0x2b8]
mov byte [ebp - 4], 8
push eax
call fcn.00404400
add esp, 0xc
push eax
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 9
call fcn.00404b60
lea ecx, [ebp - 0x2b8]
call fcn.00401c60
lea ecx, [ebp - 0x2bc]
call fcn.00401c60
lea ecx, [ebp - 0x2c0]
call fcn.00401c60
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
lea eax, [ebp - 0x2c4]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402cf2
lea ecx, [ebp - 0x2b4]
call fcn.00401c60
lea ecx, [ebp - 0x2b0]
call fcn.00401c60
xor eax, eax
jmp 0x402d0f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2b4]
call fcn.00401c60
lea ecx, [ebp - 0x2b0]
call fcn.00401c60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c0c7
mov esp, ebp
pop ebp
ret
Function at 0x403f50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56df1b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x5cfff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
mov dword [ebp - 0x23c], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
mov dword [ebp - 0x244], ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x404055
or edi, 0xffffffff
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov ebx, eax
call fcn.00409fff
test eax, eax
je 0x4040bc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x240], esi
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x404073
movzx edi, ax
push edi
call fcn.00415062
test eax, eax
je 0x404014
push edi
push eax
lea ecx, [ebp - 0x240]
call fcn.00404f00
mov esi, dword [ebp - 0x240]
or edi, 0xffffffff
push str.ZhuDongFang
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0054eaf4
add esp, 8
add esi, 0xfffffff0
test eax, eax
jne 0x4040a3
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x404047
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
mov ebx, dword [ebp - 0x244]
jne 0x403fb3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054c0c7
mov esp, ebp
pop ebp
ret
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404076
sub eax, edx
lea ecx, [ebp - 0x240]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004050e0
mov esi, dword [ebp - 0x240]
jmp 0x404017
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x4040b5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x404057
push 0x80004005
call fcn.00401ee0
int3

Function at 0x404dd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404de5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404e26
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x404e22
nop word [eax + eax]
cmp esi, edx
jae 0x404e26
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404e10
cmp esi, edx
jb 0x404e2b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4053a0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5cfff0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x178
mov dword [ebp - 0x2c], ecx
xor bl, bl
mov dword [ebp - 0x28], 0x178
call fcn.005547b3
mov esi, eax
add esp, 4
test esi, esi
jne 0x4053e3
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c0c7
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push esi
push 0
push 0
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
cmp eax, 0x6f
jne 0x405410
push esi
call fcn.005547be
push dword [ebp - 0x28]
call fcn.005547b3
mov esi, eax
add esp, 8
test esi, esi
je 0x4053d1
lea eax, [ebp - 0x28]
push eax
push esi
push 0
push 0
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jne 0x405498
mov ecx, esi
test esi, esi
je 0x405498
nop dword [eax + eax]
cmp dword [ecx + 0x34], 6
je 0x40543f
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x405430
jmp 0x405498
movzx eax, byte [ecx + 0x31]
push eax
movzx eax, byte [ecx + 0x30]
push eax
movzx eax, byte [ecx + 0x2f]
push eax
movzx eax, byte [ecx + 0x2e]
push eax
movzx eax, byte [ecx + 0x2d]
push eax
movzx eax, byte [ecx + 0x2c]
push eax
lea eax, [ebp - 0x24]
push str._02X__02X__02X__02X__02X__02X
push eax
call fcn.00406df0
add esp, 0x20
cmp byte [ebp - 0x24], 0
jne 0x405478
xor ecx, ecx
jmp 0x405489
lea ecx, [ebp - 0x24]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405480
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push eax
call fcn.00406c90
mov bl, 1
push esi
call fcn.005547be
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop esi
pop ebx
call fcn.0054c0c7
mov esp, ebp
pop ebp
ret
Function at 0x407e36
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041547f
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x407e6d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00407e8e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40df1a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40df5f
call fcn.0041547f
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40df5f
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40df7b
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041564f
mov ebx, eax
test edi, edi
je 0x40df79
test esi, esi
je 0x40df79
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e9a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40ea67
cmp dword [esi + 0x20], 0
je 0x40ea67
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40ea67
cmp dword [ebp + 8], 0
je 0x40ea67
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0041547f
push 0x57e598
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40ea38
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40ea67
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00439aed
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x40ea58
test edi, edi
je 0x40ea58
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x40ea63
mov ecx, esi
call fcn.0040e74c
mov eax, ebx
jmp 0x40ea69
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4