joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cdb0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041c056
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.0041c043
pop edi
call fcn.0041c056
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x41cde4
jne 0x41ce37
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.0041bfe7
jb 0x41ce1c
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041f502
call fcn.0041f502
call fcn.0041c81b
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.0041f502
call fcn.0041f502
call fcn.0041f502
call fcn.0041efbc
jmp fcn.004152bc
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x41cde4
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.0041cef3
jb 0x41ce60
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x41ce4d
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x41cde4
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x41ce79
jmp 0x41ce1a
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x41ce77
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.0041bfe7
jb 0x41ce1c
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.0041cef3
jb 0x41ced6
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x41ce96
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x41cdfe

Function at 0x41cf8a
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 7
xor edx, edx
call fcn.0041cff8
pop ecx
jb 0x41cff3
ret

Function at 0x41cf9b
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.0041cff8
pop ecx
jb 0x41cff3
ret
jmp fcn.004152b1

Function at 0x41cfba
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 7
mov edx, 0x80000000
call fcn.0041cff8
pop ecx
jb 0x41cff3
ret

Function at 0x41cfce
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
mov edx, 0x80000000
call fcn.0041cff8
pop ecx
jb 0x41cff3
ret
Function at 0x41d5a5
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041c056
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
jecxz 0x41d5e0
test ebx, ebx
jns 0x41d5d9
push edx
push edi
push ebx
call fcn.0041d1dd
pop ebx
add ebx, eax
add ebx, 2
pop edi
pop edx
call fcn.0041d6dd
jmp 0x41d636
test ebx, ebx
jns 0x41d5f4
push ecx
push edi
push ebx
call fcn.0041d57b
pop eax
add ebx, eax
add ebx, 2
pop edi
pop ecx
call fcn.0041d67d
jmp 0x41d636
call fcn.0041bfe7
jb 0x41d66d
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041f502
call fcn.0041c81b
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041f502
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004152b1

Function at 0x41d5fb
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x6c]
call fcn.0041c056
mov esi, dword [ebp + esi - 0x68]
call fcn.0041c043
test edx, edx
je 0x41d663
test ebx, ebx
jns 0x41d631
push ecx
push esi
push ebx
call fcn.0041d1f4
pop ebx
add ebx, eax
add ebx, 2
pop esi
pop ecx
call fcn.0041d701
call fcn.0041f502
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x41dfc7
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041c056
je 0x41e099
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
je 0x41e099
cmp edx, ecx
jb 0x41e099
push edx
push edi
call fcn.0041d1dd
pop edi
pop edx
mov ebx, eax
test ebx, ebx
je 0x41e099
push edx
mov dword [ebp - 0x60], edx
mov eax, ecx
mul ebx
mov ebx, ecx
pop ecx
sub ecx, eax
push edi
push dword [ebp - 0x60]
call fcn.0041bfe7
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop edx
pop edi
jb 0x41e0a4
mov dword [ebp - 0x64], edi
mov ecx, ebx
push ebx
push esi
push edi
call fcn.0041d206
pop eax
pop esi
pop ebx
jae 0x41e047
mov edx, dword [ebp - 0x64]
add edx, dword [ebp - 0x60]
sub edx, eax
jmp 0x41e06d
push esi
push edi
mov esi, eax
mov ecx, edi
sub ecx, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
add edi, ebx
sub edx, ebx
cmp edx, ebx
jae 0x41e02e
mov eax, edi
mov ecx, edx
mov esi, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x68]
call fcn.0041f502
call fcn.0041c81b
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
jmp 0x41e09e
call fcn.0041f502
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
call fcn.0041f502
call fcn.0041f502
call fcn.0041efbc
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.004152b1
Function at 0x41e3d6
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x41e3f6
and esi, 0xfffffffe
jne 0x41e400
xchg dword [ebx], esi
call fcn.0041c01b
pop edi
pop esi
ret
call fcn.0041c043
mov edi, dword [ebx]
or edi, edi
je 0x41e410
cmp ecx, dword [edi - 4]
je 0x41e430
call fcn.0041bfe7
jb 0x41e440
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.0041c01b
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.0041c01b
pop edi
pop esi
jmp fcn.004152bc

Function at 0x41e450
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x41e46d
mov dword [ebx], eax
ret
push esi
push edi
mov esi, eax
call fcn.0041c043
call fcn.0041bfe7
jb 0x41e48f
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], edx
pop edi
pop esi
ret
mov dword [ebx], edx
pop edi
pop esi
jmp fcn.004152bc

Function at 0x41e498
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x41e4b8
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.0041c043
call fcn.0041bfe7
jb 0x41e4dd
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.004152bc

Function at 0x41e69a
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.0041c043
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.0041c043
jecxz 0x41e710
test ebx, ebx
je 0x41e718
add ebx, ecx
xchg ecx, ebx
call fcn.0041bfe7
jb 0x41e725
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.0041c01b
mov esi, dword [ebp + edi - 0x6c]
call fcn.0041c01b
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004152bc
Function at 0x41ee65
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x41ee92
je 0x41ee8e
shr esi, 1
jae 0x41eeb3
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.0041c01b
jmp 0x41ee71
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x41eec4
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00415da7
pop ebx
jae 0x41ee71
pop esi
pop edx
pop eax
jmp fcn.004152bc
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x41ee71
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x41ee71
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x41ee71

Function at 0x41f60e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], edi
call fcn.0041ff71
jb 0x41f663
call fcn.0041f72b
jb 0x41f663
call fcn.0041f764
mov eax, dword [ebp - 0xc]
cmp eax, 0x80000
ja 0x41f657
call fcn.0041cc01
mov dword [ebp - 0x180], esp
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0x1c]
dec edx
imul edx, dword [ebp - 0xc]
add edx, ecx
call fcn.0041f676

Function at 0x41fba3
Capabilities:
Terminate process

Disassembly:
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
pop edx
add esp, 0x3c
push edx
jmp fcn.004152bc
push ebp
mov ebp, esp
push ebx
sub esp, 0x17c
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], edi
call fcn.0041fc2e
call fcn.0041ff71
jb 0x41fc1c
call fcn.0041ff40
jb 0x41fc1c
call fcn.0041fffa
jb 0x41fc1c
call fcn.0041fc41
mov esi, dword [ebp - 0x20]
call fcn.0041c043
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], esi
call dword [ebp - 0x50]
call dword [ebp - 0x54]
jb 0x41fbfa
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x2c]
jne 0x41fbe0
xor edx, edx
jmp 0x41fc01
mov edx, dword [ebp + 0x1c]
sub edx, dword [ebp - 0x2c]
inc edx
call fcn.0041fc26
mov esi, dword [ebp - 4]
mov word [esi], dx
test dword [ebp + 8], 0x100
je 0x41fc17
mov dword [esi], edx
jmp 0x41f657
call fcn.0041fc26
jmp 0x41f663
Function at 0x4a3200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9d000]
push edi
jmp 0x4a321a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a3221
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3210
mov eax, 1
add ebx, ebx
jne 0x4a3233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a3244
jne 0x4a3263
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3263
dec eax
add ebx, ebx
jne 0x4a3250
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a3228
add ebx, ebx
jne 0x4a325f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a32b5
xor ecx, ecx
sub eax, 3
jb 0x4a327b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a32ea
sar eax, 1
mov ebp, eax
jmp 0x4a3286
add ebx, ebx
jne 0x4a3286
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3254
inc ecx
add ebx, ebx
jne 0x4a3294
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3254
add ebx, ebx
jne 0x4a32a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a3296
jne 0x4a32b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a3296
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a32d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a32c6
jmp 0x4a3216
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a32d4
add edi, ecx
jmp 0x4a3216
pop esi
mov edi, esi
mov ecx, 0x2c5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a32f2
cmp byte [edi], 1
jne 0x4a32f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a32f7
lea edi, [esi + 0xa1000]
mov eax, dword [edi]
or eax, eax
je 0x4a336f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa9f74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xaa028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a3324
mov ecx, edi
jns 0x4a3353
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xaa02c]
or eax, eax
je 0x4a3369
mov dword [ebx], eax
add ebx, 4
jmp 0x4a3341
call dword [esi + 0xaa03c]
mov ebp, dword [esi + 0xaa030]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a33a3
sub esp, 0xffffff80
jmp 0x403985

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x401b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004077ce

Function at 0x402150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d6ed
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x5cfff4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x214], edi
push 0
push 0x66
mov dword [ebp - 0x218], edi
call fcn.0040705d
lea esi, [edi + 0xd8]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [edi], vtable.CQSV2FLVDlg.0
mov dword [ebp - 0x214], esi
call fcn.0040b8c1
mov dword [esi], vtable.CListCtrl.0
push 0x5b0410
lea ecx, [edi + 0x158]
mov byte [ebp - 4], 1
call fcn.00404c90
push 0
push 0x10
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00414d76
call fcn.00414d76
push 0x13f
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
lea edx, [ebp - 0x210]
mov dword [edi + 0xd4], eax
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402210
sub edx, ecx
lea eax, [ebp - 0x210]
sar edx, 1
lea ecx, [edi + 0x158]
push edx
push eax
call fcn.00404b50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054bbdc
mov esp, ebp
pop ebp
ret 4
Function at 0x4028b0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.WIN32EXE
push 0x97
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4028d4
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x4028fe
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4028fe
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x402906
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x5b024c
lea ecx, [ebp - 4]
call fcn.00404c90
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402952
lea ecx, [ebp - 4]
call fcn.00401c60
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00401c60
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402970
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.WIN32EXE
push 0x98
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x402994
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x4029be
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4029be
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4029c6
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x5b027c
lea ecx, [ebp - 4]
call fcn.00404c90
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402a12
lea ecx, [ebp - 4]
call fcn.00401c60
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00401c60
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403c50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d9bb
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x5cfff4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
mov dword [ebp - 0x23c], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
mov dword [ebp - 0x244], ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x403d55
or edi, 0xffffffff
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov ebx, eax
call fcn.00409949
test eax, eax
je 0x403dbc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x240], esi
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x403d73
movzx edi, ax
push edi
call fcn.00414959
test eax, eax
je 0x403d14
push edi
push eax
lea ecx, [ebp - 0x240]
call fcn.00404970
mov esi, dword [ebp - 0x240]
or edi, 0xffffffff
push str.ZhuDongFang
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.0054e614
add esp, 8
add esi, 0xfffffff0
test eax, eax
jne 0x403da3
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x403d47
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
mov ebx, dword [ebp - 0x244]
jne 0x403cb3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054bbdc
mov esp, ebp
pop ebp
ret
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403d76
sub eax, edx
lea ecx, [ebp - 0x240]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00404b50
mov esi, dword [ebp - 0x240]
jmp 0x403d17
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x403db5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x403d57
push 0x80004005
call fcn.00401ee0
int3

Function at 0x404840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404855
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404896
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x404892
nop word [eax + eax]
cmp esi, edx
jae 0x404896
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404880
cmp esi, edx
jb 0x40489b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x404e10
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5cfff4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x178
mov dword [ebp - 0x2c], ecx
xor bl, bl
mov dword [ebp - 0x28], 0x178
call fcn.00554294
mov esi, eax
add esp, 4
test esi, esi
jne 0x404e53
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054bbdc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push esi
push 0
push 0
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
cmp eax, 0x6f
jne 0x404e80
push esi
call fcn.0055429f
push dword [ebp - 0x28]
call fcn.00554294
mov esi, eax
add esp, 8
test esi, esi
je 0x404e41
lea eax, [ebp - 0x28]
push eax
push esi
push 0
push 0
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jne 0x404f08
mov ecx, esi
test esi, esi
je 0x404f08
nop dword [eax + eax]
cmp dword [ecx + 0x34], 6
je 0x404eaf
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x404ea0
jmp 0x404f08
movzx eax, byte [ecx + 0x31]
push eax
movzx eax, byte [ecx + 0x30]
push eax
movzx eax, byte [ecx + 0x2f]
push eax
movzx eax, byte [ecx + 0x2e]
push eax
movzx eax, byte [ecx + 0x2d]
push eax
movzx eax, byte [ecx + 0x2c]
push eax
lea eax, [ebp - 0x24]
push str._02X__02X__02X__02X__02X__02X
push eax
call fcn.00406860
add esp, 0x20
cmp byte [ebp - 0x24], 0
jne 0x404ee8
xor ecx, ecx
jmp 0x404ef9
lea ecx, [ebp - 0x24]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404ef0
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push eax
call fcn.00406700
mov bl, 1
push esi
call fcn.0055429f
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop esi
pop ebx
call fcn.0054bbdc
mov esp, ebp
pop ebp
ret