joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d4b750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1d5b300
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1d89190]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [esi + 0x264]
xor ebx, ebx
mov dword [esi + 0x248], ebx
mov dword [esi + 0x24c], ebx
mov byte [esi + 0x10], bl
cmp ecx, ebx
je 0x1d4b7c5
mov eax, dword [ecx]
mov edx, dword [eax + 0x58]
call edx
mov ecx, dword [esi + 0x264]
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x1d4b7b8
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x264], ebx
mov ecx, dword [esi + 0x268]
cmp ecx, ebx
je 0x1d4b7fd
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov ecx, dword [esi + 0x268]
mov dword [ebp - 4], 2
cmp ecx, ebx
je 0x1d4b7f0
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x268], ebx
cmp dword [esi + 0x254], 0xffffffff
je 0x1d4b817
mov eax, dword [esi + 0x250]
mov edx, dword [eax + 0x58]
lea ecx, [esi + 0x250]
call edx
cmp byte [esi + 0x18], bl
lea eax, [esi + 0x18]
je 0x1d4b826
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1d4bbd0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1d5b3d6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x102c
call fcn.01d558b0
mov eax, dword [0x1d89190]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, 1
mov dword [ebp - 0x1018], esi
mov dword [ebp - 4], 0
cmp byte [esi + 0x10], bl
jne 0x1d4bd31
mov ecx, dword [esi + 0x264]
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
push 0x1000
lea edx, [ebp - 0x1014]
push edx
call eax
mov edx, dword [esi + 0x250]
mov edi, eax
lea ecx, [esi + 0x250]
test edi, edi
je 0x1d4bc90
mov edx, dword [edx + 0x44]
push edi
lea eax, [ebp - 0x1014]
push eax
call edx
push ebx
lea eax, [esi + 0x220]
push eax
lea ecx, [ebp - 0x1024]
call fcn.01d565d0
add dword [esi + 0x248], edi
lea ecx, [ebp - 0x1024]
mov dword [esi + 0x240], 2
call fcn.01d56610
mov al, bl
jmp 0x1d4bdbd
mov eax, dword [edx + 0x58]
call eax
mov eax, dword [esi + 0x14]
lea ecx, [eax + 0x81]
push ecx
add eax, 0x185
push eax
push str._s_s
lea edi, [esi + 0x11c]
push 0x104
push edi
call dword [sym.imp.MSVCR100.dll__snprintf]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push 0
push 0
push edi
lea edx, [esi + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
test eax, eax
jne 0x1d4bcf6
push 0x1d7ca34
lea eax, [ebp - 0x1028]
push eax
mov dword [ebp - 0x1028], 2
call sub.MSVCR100.dll__CxxThrowException
push ebx
lea ecx, [esi + 0x220]
push ecx
lea ecx, [ebp - 0x1024]
call fcn.01d565d0
mov ecx, esi
mov byte [ebp - 4], bl
mov dword [esi + 0x240], 3
call fcn.01d4b750
lea ecx, [ebp - 0x1024]
mov byte [ebp - 4], 0
call fcn.01d56610
jmp 0x1d4bdbb
push ebx
lea edx, [esi + 0x220]
push edx
lea ecx, [ebp - 0x1024]
call fcn.01d565d0
mov ecx, esi
mov byte [ebp - 4], 2
mov dword [esi + 0x240], ebx
call fcn.01d4b3d0
lea ecx, [ebp - 0x1024]
mov byte [ebp - 4], 0
call fcn.01d56610
mov al, bl
jmp 0x1d4bdbd
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.01d55e87
mov esp, ebp
pop ebp
ret
Function at 0x1d4c340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov ebx, ecx
lea eax, [esi + 0x289]
push eax
lea ecx, [ebx + 0x928]
call dword [sym.imp.SkinControls.dll_public:_void___thiscall_CSkinHyperLink::SetHyperLinkUrl_char_const__]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0xf0], ecx
mov dword [ebx + 0xf4], edx
lea edi, [ebx + 0xf8]
mov ecx, 0xe3
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x27d]
movsb byte es:[edi], byte [esi]
cmp byte [eax], 0
jne 0x1d4c395
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebx + 0x6a8]
mov edx, dword [eax + 8]
lea ecx, [ebx + 0x6a8]
call edx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SkinResource.dll
call edi
mov esi, eax
call sub.mfc100.dll_Ordinal_1929
mov dword [eax + 0xc], esi
call sub.mfc100.dll_Ordinal_1939
test eax, eax
je 0x1d4c3d1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x7c]
call eax
jmp 0x1d4c3d3
xor eax, eax
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x168]
push 0x2710
mov ecx, ebx
call eax
push 0
call edi
mov esi, eax
call sub.mfc100.dll_Ordinal_1929
mov dword [eax + 0xc], esi
cmp byte [ebx + 0xf8], 1
jne 0x1d4c405
push 5
mov ecx, ebx
call sub.mfc100.dll_Ordinal_12962
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc

Function at 0x1d4d0a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1d5b601
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1d89190]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CCompanionManager.0
xor ebx, ebx
mov eax, vtable.CArrayTemplate_struct_tagCompanionItem___struct_tagCompanionItem__const_const__.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.01d4dbb0
push 0x1d6f3dc
push 0x1d6f3dc
mov byte [ebp - 4], 2
mov byte [esi + 4], bl
call fcn.01d03f50
add esp, 8
neg eax
sbb eax, eax
and eax, esi
push eax
lea ecx, [esi + 0x30]
call fcn.01d4ddc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1d4ffc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1d5b9f9
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1d89190]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, word [ebp + 8]
cmp eax, 1
jne 0x1d50040
mov eax, dword [esi + 0xf0]
shr eax, 8
and eax, 0xf
cmp eax, dword [esi + 0x100]
jb 0x1d50004
xor eax, eax
imul eax, eax, 0xd4
lea eax, [eax + esi + 0x138]
test eax, eax
je 0x1d50018
mov eax, dword [eax + 0x20]
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, esi
push eax
call sub.mfc100.dll_Ordinal_3977
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
cmp eax, 2
jne 0x1d5005b
mov eax, dword [esi + 0x100]
imul eax, eax, 0xd4
lea eax, [eax + esi + 0x64]
test eax, eax
jne 0x1d50015
jmp 0x1d50018
cmp eax, 8
jne 0x1d50023
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push str.https:__pay.dokee.cn
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0xa
push 0
push 0
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esi + 0x100]
imul ecx, ecx, 0xd4
lea eax, [ecx + esi + 0x64]
test eax, eax
je 0x1d500b2
mov eax, dword [eax + 0x20]
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
mov ecx, esi
call sub.mfc100.dll_Ordinal_3977
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
jmp 0x1d50029

Function at 0x1d51a00
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call sub.mfc100.dll_Ordinal_9475
add esi, 0x97
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 1
pop esi
ret
Function at 0x1d53bf0
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
xor esi, esi
cmp cx, ax
jae 0x1d53c2d
movzx ebx, ax
movzx eax, si
push 0
mov edx, ebx
sub edx, eax
add eax, dword [ebp + 8]
push edx
mov edx, dword [edi + 0x7c]
push eax
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1d53c4f
add esi, eax
cmp si, word [ebp + 0xc]
jb 0x1d53c08
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
shr edx, 6
mov dword [edi + 0x14128], edx
pop edi
movzx eax, si
pop esi
pop ebx
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1d53c7d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [edi + 0x14128], edx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x1d53c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1d89190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, 0xfffffffc
push edi
mov edi, ecx
movzx ecx, ax
mov eax, ecx
and eax, 3
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0
je 0x1d53ce8
mov edx, 4
sub edx, eax
movzx eax, dx
mov dword [ebp - 0x18], eax
movzx eax, ax
movzx ecx, cx
push eax
lea edx, [ecx + esi + 4]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, 4
xor bl, bl
cmp cx, ax
jae 0x1d53d2a
add eax, 0xfffffffc
lea edx, [esi + 4]
movzx esi, ax
mov al, byte [edx]
mov cl, byte [edi + 0x1411c]
add bl, al
add al, cl
movzx eax, al
mov al, byte [eax + str.p___D]
add cl, 3
mov byte [edi + 0x1411c], cl
mov byte [edx], al
inc edx
dec esi
jne 0x1d53d00
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
not bl
inc bl
mov byte [esi + 1], bl
mov word [esi + 2], ax
mov byte [esi], 0x66
cmp dword [edi + 0x14130], 0
mov esi, dword [edi + 0x14120]
jne 0x1d53db4
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, eax
call ebx
imul esi, eax
movzx edx, word [ebp - 0xc]
movzx eax, word [ebp - 0x14]
movzx ecx, si
xor eax, edx
movzx edx, word [ebp - 0xe]
xor eax, ecx
movzx ecx, word [ebp - 0x10]
xor eax, edx
xor eax, ecx
imul eax, eax, 0x3adcf
add eax, 0x26a6ed
shr eax, 0x10
mov esi, eax
shr esi, 0x10
imul esi, esi, 0x3adcf
add esi, 0x26a6ed
and esi, 0xffff0000
or esi, eax
xor esi, 0xa55aa55a
mov dword [edi + 0x14120], esi
mov dword [edi + 0x14124], esi
movzx ecx, word [ebp - 0x20]
movzx eax, word [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add eax, ecx
shr eax, 2
movzx eax, ax
add edx, 4
xor ecx, ecx
mov ebx, edx
cmp cx, ax
jae 0x1d53e13
mov dword [ebp - 0x18], eax
xor dword [ebx], esi
movzx ecx, word [edx]
movzx esi, word [edx + 2]
imul ecx, ecx, 0x3adcf
imul esi, esi, 0x3adcf
add esi, 0x26a6ed
add ecx, 0x26a6ed
and esi, 0xffff0000
shr ecx, 0x10
or esi, ecx
add ebx, 4
add edx, 4
xor esi, 0xa55aa55a
dec dword [ebp - 0x18]
jne 0x1d53dd6
cmp dword [edi + 0x14130], 0
jne 0x1d53e4a
movzx ecx, word [ebp + 0xc]
mov ebx, dword [ebp - 0x1c]
push ecx
lea eax, [ebx + 8]
push eax
lea edx, [ebx + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [edi + 0x14120]
mov dword [ebx + 8], eax
mov eax, 4
add word [ebx + 2], ax
add esp, 0xc
add dword [ebp + 0xc], eax
inc dword [edi + 0x14130]
mov ecx, dword [ebp - 4]
mov ax, word [ebp + 0xc]
mov dword [edi + 0x14120], esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01d55e87
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1d540b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1d5bd00
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2020
call fcn.01d558b0
mov eax, dword [0x1d89190]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
movzx eax, word [esi + 0x10a]
push 0
mov ecx, 0x14000
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x10c]
mov eax, dword [esi + 0x7c]
push edx
push eax
mov dword [ebp - 0x2028], esi
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1d54138
push 0x1d764c0
lea ecx, [ebp - 0x202c]
push ecx
mov dword [ebp - 0x202c], 0x1d70784
call sub.MSVCR100.dll__CxxThrowException
add word [esi + 0x10a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
shr edx, 6
mov dword [esi + 0x1412c], edx
jmp 0x1d54160
cmp word [esi + 0x10a], 8
jb 0x1d542c8
cmp byte [esi + 0x10c], 0x66
movzx edi, word [esi + 0x10e]
lea eax, [esi + 0x10c]
je 0x1d5419f
push 0x1d764c0
lea eax, [ebp - 0x2030]
push eax
mov dword [ebp - 0x2030], 0x1d70774
call sub.MSVCR100.dll__CxxThrowException
mov ecx, 0x2008
cmp di, cx
jbe 0x1d541c4
push 0x1d764c0
lea edx, [ebp - 0x2020]
push edx
mov dword [ebp - 0x2020], 0x1d70768
call sub.MSVCR100.dll__CxxThrowException
movzx ecx, word [esi + 0x10a]
cmp cx, di
jb 0x1d542c8
inc dword [esi + 0x14134]
mov ebx, edi
push ebx
push eax
lea eax, [ebp - 0x201c]
push eax
call sub.MSVCR100.dll_memcpy
movzx eax, word [esi + 0x10a]
sub eax, edi
movzx ecx, ax
push ecx
lea edx, [ebx + esi + 0x10c]
mov word [esi + 0x10a], ax
push edx
lea eax, [esi + 0x10c]
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0x18
push edi
lea eax, [ebp - 0x201c]
push eax
mov ecx, esi
call fcn.01d53e70
movzx eax, ax
add eax, 0xfffffff8
movzx edi, ax
mov eax, dword [ebp - 0x2018]
mov ebx, eax
test ax, ax
jne 0x1d54265
shr eax, 0x10
dec eax
jne 0x1d54160
mov ecx, dword [esi + 0x74]
push edi
lea edx, [ebp - 0x2014]
push edx
lea eax, [esi + 0x74]
push 1
push 0
push eax
mov eax, dword [ecx + 0x40]
call eax
add esp, 0x14
jmp 0x1d54160
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx + 8]
lea eax, [esi + 0x74]
push eax
call edx
add esp, 4
push edi
movzx ecx, ax
mov eax, dword [esi + 0x80]
mov edx, dword [eax]
lea edi, [ebp - 0x2014]
push edi
push ebx
push ecx
push eax
mov eax, dword [edx + 0x10]
call eax
add esp, 0x14
test al, al
jne 0x1d54160
push 0x1d764c0
lea ecx, [ebp - 0x2024]
push ecx
mov dword [ebp - 0x2024], 0x1d70754
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [ebp - 0x2028]
push 4
call fcn.01d53ae0
mov eax, 0x1d542c8
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.01d55e87
mov esp, ebp
pop ebp
ret 8
Function at 0x1d54690
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x1d546db
mov edi, dword [ebp + 0x10]
test di, di
je 0x1d546db
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x1d546c7
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1d546c0
or eax, 0xffffffff
jmp 0x1d546c7
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edi
push eax
mov eax, dword [edx + 0x3c]
push ecx
call eax
add esp, 0xc
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1d55e87
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1d89190]
jne 0x1d55e91
repz ret
jmp fcn.01d5620e

Function at 0x1d56690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 4]
call edx
cmp al, 1
jne 0x1d566ab
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1d566ca
push eax
call edi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
xor eax, eax
push eax
push eax
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
push eax
mov dword [ebp - 8], eax
mov byte [ebp - 0xc], al
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 8], eax
test eax, eax
je 0x1d56745
lea eax, [esi + 8]
push eax
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0x1d564e0
push 0
push 0
mov byte [esi + 4], 1
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x1d56722
mov edx, dword [ebp - 8]
push edx
call edi
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
push ecx
call edi
cmp byte [ebp - 0xc], 0
jne 0x1d5674d
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
push 0xffffffffffffffff
mov ecx, esi
call eax
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Copy file
Extract resource via kernel32 functions
Get common file path
Get file size
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x337]
mov byte [ebp - 0x338], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x233]
mov byte [ebp - 0x234], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x12f]
mov byte [ebp - 0x130], bl
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x1c], 0xa
mov byte [ebp - 0x1b], 0xa
mov byte [ebp - 0x1a], 0xa
mov byte [ebp - 0x19], 0xa
mov byte [ebp - 0x18], 0xa
mov byte [ebp - 0x17], 0xa
mov byte [ebp - 0x16], 0xa
mov byte [ebp - 0x15], 0xa
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
call fcn.004021a1
mov eax, 0x401c20
mov edi, 0x401a0b
sub eax, edi
mov dword [ebp - 0x24], eax
mov eax, 0x401f02
sub eax, int.00401ce6
mov dword [ebp - 0x20], eax
mov eax, 0x4019fa
sub eax, 0x401943
mov dword [ebp - 0x28], eax
mov eax, 0x40193a
sub eax, int.004015ee
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push str.RT_RCDATA
push 0x66
call fcn.00401450
add esp, 0x10
cmp dword [ebp - 0x10], ebx
jne 0x4010d7
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
mov esi, 0x40443c
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c]
push 8
push eax
push section..data
call fcn.00402350
add esp, 0xc
test eax, eax
je 0x40119f
push 8
lea eax, [ebp - 0x130]
push section..data
push eax
call fcn.00401f17
push dword [ebp - 0x24]
lea eax, [ebp - 0x130]
push edi
push eax
call fcn.00401f8f
push dword [ebp - 0x20]
lea eax, [ebp - 0x130]
push int.00401ce6
push eax
call fcn.00401f8f
push dword [ebp - 0x28]
lea eax, [ebp - 0x130]
push 0x401943
push eax
call fcn.00401f8f
push dword [ebp - 0x2c]
lea eax, [ebp - 0x130]
push int.004015ee
push eax
call fcn.00401f8f
push dword [ebp - 0x10]
lea eax, [ebp - 0x130]
push dword [ebp - 0x14]
push eax
call fcn.00401f8f
add esp, 0x48
lea eax, [ebp - 0x130]
push 0x100
push ebx
push eax
call fcn.004022f0
call int.004015ee
push str.svchost.exe
push dword [ebp - 0x14]
call int.00401ce6
add esp, 0x14
mov dword [ebp - 4], ebx
call fcn.00401499
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
mov byte [ecx + section..data], al
jl 0x4011a2
lea eax, [ebp - 0x1c]
push 8
push eax
push section..data
call fcn.00402350
add esp, 0xc
test eax, eax
je 0x40119f
push 8
lea eax, [ebp - 0x130]
push section..data
push eax
call fcn.00401f17
push dword [ebp - 0x24]
lea eax, [ebp - 0x130]
push edi
push eax
call fcn.00401f8f
push dword [ebp - 0x20]
lea eax, [ebp - 0x130]
push int.00401ce6
push eax
call fcn.00401f8f
push dword [ebp - 0x28]
lea eax, [ebp - 0x130]
push 0x401943
push eax
jmp loc.00409000
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x54af2e94
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x6aa675bd
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x1b4e7932
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x40dd386f
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
jmp 0x431219