joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9b50
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x4a9b6e
mov eax, 0x1000000
pop esi
add esp, 0x50
ret
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileInformationByHandle]
test eax, eax
jne 0x4a9b88
mov eax, 0x200
pop esi
add esp, 0x50
ret
mov eax, dword [esp + 0x20]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
push edi
je 0x4a9b9c
mov ebp, 1
test al, 2
je 0x4a9ba3
or ebp, 2
test al, 4
je 0x4a9baa
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x4a9bb4
or ebp, 0x10
test al, 0x20
je 0x4a9bbb
or ebp, 0x20
test ecx, ecx
je 0x4a9bc7
or ebp, 0x40000000
jmp 0x4a9bcd
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x4a9bdd
or ebp, 0x800000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0x28
mov dword [esp + 0x14], eax
jbe 0x4a9c8b
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x6c]
push 2
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call ebx
cmp word [esp + 0x64], 0x54ad
jne 0x4a9c8b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
lea edx, [eax + 0x34]
cmp ecx, edx
jbe 0x4a9c8b
push 0
push 0
push eax
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x2c]
push 4
push ecx
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x4a9c85
cmp eax, 0x454e
je 0x4a9c85
cmp eax, 0x454c
je 0x4a9c85
cmp eax, 0x4550
jne 0x4a9c8b
or ebp, 0x400000
mov eax, dword [esp + 0x68]
pop ebx
test eax, eax
je 0x4a9c96
mov dword [eax], ebp
mov eax, dword [esp + 0x68]
test eax, eax
je 0x4a9ca4
mov edx, dword [esp + 0x10]
mov dword [eax], edx
mov esi, dword [esp + 0x6c]
mov edi, dword [sym.imp.KERNEL32.DLL_FileTimeToLocalFileTime]
test esi, esi
je 0x4a9d0e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x34]
push eax
push ecx
call edi
lea edx, [esp + 0x18]
lea eax, [esp + 0x3c]
push edx
push eax
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
push edx
call edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.004a9a90
mov edx, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x20]
push edx
push eax
call fcn.004a9a90
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov dword [esi + 4], eax
call fcn.004a9a90
add esp, 0x18
mov dword [esi + 8], eax
mov esi, dword [esp + 0x70]
test esi, esi
je 0x4a9d51
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push ecx
call edi
lea edx, [esp + 0x64]
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FileTimeToDosDateTime]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
and edx, 0xffff
and eax, 0xffff
shl edx, 0x10
or edx, eax
mov dword [esi], edx
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x4a9f30
Capabilities:
Write file on windows

Disassembly:
mov edx, ecx
push ebx
push esi
push edi
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x4a9f80
mov edi, dword [edx + 0x1c]
mov eax, dword [esp + 0x14]
mov esi, dword [edx + 0x20]
lea ecx, [edi + eax]
cmp ecx, esi
jb 0x4a9f5c
pop edi
pop esi
mov dword [edx + 0xc], 0x30000
xor eax, eax
pop ebx
ret 8
mov esi, dword [esp + 0x10]
mov ecx, eax
add edi, ebx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x1c]
pop edi
add ecx, eax
pop esi
mov dword [edx + 0x1c], ecx
pop ebx
ret 8
mov eax, dword [edx]
test eax, eax
je 0x4a9fa8
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
pop esi
mov dword [edx + 0xc], 0x1000000
xor eax, eax
pop ebx
ret 8

Function at 0x4aa3d0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov edx, dword [ebx + 0x58]
test edx, edx
je 0x4aa43a
mov eax, dword [ebx + 0x60]
mov ebp, dword [ebx + 0x5c]
cmp eax, ebp
jae 0x4aa48b
mov ecx, dword [esp + 0x14]
sub ebp, eax
cmp ebp, ecx
jbe 0x4aa3f6
mov ebp, ecx
mov ecx, ebp
lea esi, [eax + edx]
mov eax, dword [esp + 0x10]
mov edx, ecx
push edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
add edx, ebp
add ecx, ebp
push eax
mov dword [ebx + 0x60], edx
mov dword [ebx + 0x48], ecx
call fcn.004a9860
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x4aa484
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4aa48b
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x48]
add ecx, eax
push eax
mov eax, dword [ebx + 0x4c]
push esi
push eax
mov dword [ebx + 0x48], ecx
call fcn.004a9860
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
ret 8
mov dword [ebx + 0xc], 0x1000000
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x4acfa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4acfab
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4ad0ae
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4e972c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4e972c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4e972c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4e972c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4e972c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4e972c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4e972c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4e972c]
xor eax, edx
inc ecx
dec edi
jne 0x4acfc6
pop edi
test esi, esi
je 0x4ad0d0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4e972c]
xor eax, edx
inc ecx
dec esi
jne 0x4ad0b2
pop esi
pop ebx
not eax
ret

Function at 0x4ad890
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4ad8d1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4ad8c6
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4ad8e4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x4ae820
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x4ae8d5
cmp dword [ebp + 4], 0xffffffff
jne 0x4ae8d5
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov edi, 0x506994
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x4ae89d
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x4ae89d
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.004ad620
add esp, 0x10
test eax, eax
jne 0x4ae8c0
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.004adb60
add esp, 4
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x4aed30
Capabilities:
Create directory

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x208
test ecx, ecx
je 0x4aedf8
mov al, byte [ecx]
test al, al
je 0x4aedf8
push ebx
push esi
push edi
mov ebx, ecx
mov esi, ecx
cmp al, 0x2f
je 0x4aed5b
cmp al, 0x5c
jne 0x4aed5d
mov ebx, esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4aed53
mov edi, dword [esp + 0x218]
cmp ebx, ecx
je 0x4aed94
mov esi, ebx
lea eax, [esp + 0xc]
sub esi, ecx
push esi
push ecx
push eax
call fcn.004b97e5
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.004aed30
add esp, 0x14
inc ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4b12c0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x506afc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4b12d3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4b1314
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x506ba4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4b1346
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4b134a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4b133b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4b1368
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4b136c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4b135d
xor ecx, ecx
mov eax, 0x506b0c
xor ebx, ebx
mov bl, byte [ecx + 0x506bb4]
cmp byte [esp + ebx + 0x14], 0
je 0x4b1397
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x506bcc]
cmp byte [esp + ebx + 0x14], 0
je 0x4b13ae
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4b137e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4b1307
lea edx, [esp + 0x84]
push edx
call fcn.004b13f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4b95ad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4b95cd
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.004b86ba
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4b95f0
test byte [esp + 8], 2
je 0x4b95f0
call fcn.004b872d
mov dword [eax], 0xd
call fcn.004b8736
mov dword [eax], 5
jmp 0x4b95c9
xor eax, eax
ret

Function at 0x4ca322
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ca35a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c83af
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c8387
jmp 0x4ca366
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4cba14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cba56
call fcn.004d178d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x4cba56
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x4cba4d
xor eax, eax
jmp 0x4cba5e
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cba64
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d1cbd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d1ceb
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x4d1d09
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d1c23
jmp 0x4d1d09
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d1d09
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d1c23
test edi, edi
mov eax, edi
jne 0x4d1cf3
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0xf7c246a
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x1c636c85
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10002570
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0
mov eax, 1
imul ecx, eax, 0
mov dl, byte [ebp + 0xc]
mov byte [ebp + ecx - 0xc], dl
mov dword [ebp - 8], 1
jmp 0x1000259e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100025d9
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0xd]
shl edx, 1
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0xc], dl
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0xd]
and edx, 0x80
je 0x100025d7
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0xc]
xor ecx, 0x1b
mov edx, dword [ebp - 8]
mov byte [ebp + edx - 0xc], cl
jmp 0x10002595
mov dword [ebp - 8], 0
jmp 0x100025eb
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x10002612
movzx edx, byte [ebp + 8]
mov ecx, dword [ebp - 8]
sar edx, cl
and edx, 1
je 0x10002610
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0xc]
movzx edx, byte [ebp - 1]
xor edx, ecx
mov byte [ebp - 1], dl
jmp 0x100025e2
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8

Function at 0x10005260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10005284
xor eax, eax
jmp 0x10005304
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000529b
xor eax, eax
jmp 0x10005304
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x100052e7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x100052e7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x100052be
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x100052f3
xor eax, eax
jmp 0x10005304
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10005301
xor eax, eax
jmp 0x10005304
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100060d0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017c1b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x101e9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.1001ae30
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1001ae30
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
add edx, 0x30
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.1001ae30
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x48]
mov dword [eax + 0x48], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4c]
mov dword [eax + 0x4c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x50]
mov byte [eax + 0x50], dl
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x54]
mov dword [eax + 0x54], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006d20
Capabilities:
Reference 114dns dns server
Reference alidns dns server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017c2a5
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x101e9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], 0
mov eax, dword [0x101f30a8]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x101f6194]
cmp eax, dword [edx + 4]
jle 0x10006da5
push 0x101f6194
call fcn.10053898
add esp, 4
cmp dword [0x101f6194], 0xffffffff
jne 0x10006da5
mov ecx, 0x101f614c
call fcn.10003fe0
push 0x10181e90
call fcn.10053742
add esp, 4
push 0x101f6194
call fcn.1005384e
add esp, 4
mov ecx, 0x101f614c
call fcn.1001a7e0
movzx ecx, al
test ecx, ecx
jne 0x10006dd4
push 0x101f614c
mov ecx, dword [ebp + 8]
call fcn.1001ae30
mov edx, dword [ebp - 0x44]
or edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp + 8]
jmp 0x10006eff
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x48], esp
push 0x101d79e4
call fcn.10003f60
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x50], esp
push 0x101d79f8
call fcn.10003f60
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.100038f0
add esp, 0x38
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 1
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0x101d7a28
call fcn.10003f60
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.ofm8iARmfbMuOcWSYgdgpA
call fcn.10003f60
lea ecx, [ebp - 0x40]
push ecx
mov byte [ebp - 4], 1
call fcn.100038f0
add esp, 0x38
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 3
push 0x101d7a58
lea ecx, [ebp - 0x28]
call fcn.10003db0
push eax
push 0x101f614c
call fcn.1002f6a0
add esp, 0xc
mov ecx, 0x101f614c
call fcn.1001a7e0
movzx edx, al
test edx, edx
je 0x10006ecb
push str.114.114.114.114
lea ecx, [ebp - 0x28]
call fcn.10003db0
push eax
push 0x101f614c
call fcn.1002f6a0
add esp, 0xc
mov ecx, 0x101f614c
call fcn.1001a7e0
movzx eax, al
test eax, eax
je 0x10006ecb
lea ecx, [ebp - 0x40]
push ecx
mov ecx, 0x101f614c
call fcn.1001ad40
push 0x101f614c
mov ecx, dword [ebp + 8]
call fcn.1001ae30
mov edx, dword [ebp - 0x44]
or edx, 1
mov dword [ebp - 0x44], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10003ed0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003ed0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100531cc
mov esp, ebp
pop ebp
ret

Function at 0x1000a750
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017c66d
mov eax, dword fs:[0]
push eax
sub esp, 0x4e8
mov eax, dword [0x101e9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1f8], ecx
push 0x101d8654
jmp loc.101fb344
Function at 0x1000d0d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0x18
call fcn.1005340d
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000d0f9
mov ecx, dword [ebp - 4]
call fcn.10003fe0
mov dword [ebp - 8], eax
jmp 0x1000d100
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.1001ad40
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x1000cc80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000df50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017cbf3
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x101e9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xec], ecx
push 0x101d8cec
jmp loc.101f70b5