joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45af50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00458644
xor eax, eax
push ebp
push 0x45b175
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x45af90
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
jmp 0x45afaa
push 0x105
mov eax, dword [ebp - 4]
call fcn.0045927c
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.KERNEL32.DLL_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x45b15f
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x45b184
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x45b079
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x45b184
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x45b079
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x45b1c0
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x45b079
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x45b1c0
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x45b079
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x45b1f4
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
je 0x45b079
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x45b228
push SysFreeString
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
jne 0x45b15f
xor eax, eax
push ebp
push 0x45b158
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0045ad5c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x45b0e8
mov eax, dword [ebp - 0x10]
call fcn.004566d8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004592d4
jmp 0x45b133
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x45b268
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x45b133
mov eax, dword [ebp - 0x10]
call fcn.004566d8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x45b268
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004592d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b15f
cmp dword [ebp - 8], 0
je 0x45b14e
mov eax, dword [ebp - 8]
call fcn.004566f4
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b17c
lea eax, [ebp - 4]
call fcn.00458560
ret
Function at 0x45b458
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00458644
xor eax, eax
push ebp
push 0x45b518
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00459310
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004594c0
mov eax, dword [ebx]
call fcn.0045b320
test al, al
jne 0x45b4f5
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00459310
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004594c0
mov eax, dword [ebx]
call fcn.0045b320
test al, al
jne 0x45b4f5
mov eax, ebx
call fcn.00458560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b51f
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004585c0
lea eax, [ebp - 4]
call fcn.00458560
ret

Function at 0x4719a4
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
call fcn.00471970
push str.LocalFastMM_PID________
push 0
push 4
call sub.KERNEL32.DLL_OpenFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x4719c4
xor eax, eax
pop esi
pop ebx
ret
push 0
push 0
push 0
push 4
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, dword [eax]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop esi
pop ebx
ret

Function at 0x471a50
Capabilities:
Read file via mapping

Disassembly:
push ebx
call fcn.00471040
test eax, eax
jne 0x471aad
cmp dword [0x49843c], 0
jne 0x471aad
call fcn.004719a4
test eax, eax
jne 0x471aa9
push str.LocalFastMM_PID________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
push 0
push 0
push 0
mov ebx, eax
push 2
push ebx
mov dword [0x49843c], ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [eax], fcn.00472066
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
mov eax, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x472ab0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 8], 0
je 0x472b18
mov ax, word [ebx + 8]
mov word [ebp - 4], ax
mov word [ebp - 2], 1
mov word [ebp - 8], 0
mov word [ebp - 6], 0
mov dx, word [ebx]
mov ecx, edx
sub cx, ax
dec edx
mov word [ebp - 0x10], cx
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], dx
mov cx, word [ebx + 4]
mov word [ebp - 0xa], cx
mov word [ebp - 0xe], cx
push eax
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x10]
push edx
mov edx, dword [0x498440]
mov ecx, dword [ebp - 4]
push ecx
push eax
push edx
call sub.KERNEL32.DLL_WriteConsoleOutputA
xor ecx, ecx
mov dword [ebx + 8], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474928
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x474944
call fcn.00475aa4
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x474963
test bl, 1
je 0x474963
call fcn.0047d974
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x479a0c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004736cc
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.004737c8
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004737c8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x48e1ad
lea ecx, [ebp - 0x200]
push ecx
call fcn.004736cc
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.004737c8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.0047b148
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x479b1d
push esi
call fcn.004737c8
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004737c8
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00470f10
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x479af4
xor eax, eax
jmp 0x479ba4
push esi
call fcn.004737c8
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004737c8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004735d3
add esp, 0xc
jmp 0x479b5d
mov edi, dword [ebx + 0x24]
push edi
call fcn.004737c8
pop ecx
push eax
push esi
call fcn.004737c8
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004737c8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00470f30
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x479b5d
xor eax, eax
jmp 0x479ba4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004736cc
add esp, 8
push 0x48e1af
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004736cc
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.004736cc
add esp, 8
push 0x48e1b1
mov edx, dword [ebx + 0x24]
push edx
call fcn.004736cc
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47d908
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x47d935
jmp 0x47d96c
call fcn.0047d8b8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004737c8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004737c8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x47d9f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x48e8b8], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x47daca
cmp dword [0x48e8b4], 0
jne 0x47daca
cmp dword [0x48eadc], 0
je 0x47da84
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0047d1d0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x47da6a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0047d1d0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x47da6a
lea ebx, [ebp - 0x84]
jmp 0x47da6b
inc ebx
call fcn.0047d9a8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x47db05
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x48e8bc
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004737c8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x48e8bf
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x47db05
cmp dword [0x48e8b4], 0
je 0x47dae4
cmp dword [0x48e8b4], 0xffffffff
je 0x47db05
push esi
call dword [0x48e8b4]
pop ecx
mov eax, dword [0x48e8b8]
test eax, eax
je 0x47db05
cmp dword [0x48e8b8], 0xffffffff
je 0x47db05
cmp byte [eax], 0
je 0x47db05
push esi
push eax
call fcn.0047d908
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x480f3c
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0045927c
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x440251
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44024b
test ah, 4
je 0x44024b
test al, 0x10
je 0x44024b
mov eax, esi
call fcn.0045927c
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x440251
push edi
call sub.KERNEL32.DLL_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
jmp 0x4401fc
Function at 0x1f2a0a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1974000]
push edi
or ebp, 0xffffffff
jmp 0x1f2a0c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1f2a0c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f2a0b8
mov eax, 1
add ebx, ebx
jne 0x1f2a0db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1f2a0ec
jne 0x1f2a10b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f2a10b
dec eax
add ebx, ebx
jne 0x1f2a0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1f2a0d0
add ebx, ebx
jne 0x1f2a107
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1f2a15d
xor ecx, ecx
sub eax, 3
jb 0x1f2a123
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1f2a192
sar eax, 1
mov ebp, eax
jmp 0x1f2a12e
add ebx, ebx
jne 0x1f2a12e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f2a0fc
inc ecx
add ebx, ebx
jne 0x1f2a13c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f2a0fc
add ebx, ebx
jne 0x1f2a149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1f2a13e
jne 0x1f2a15a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1f2a13e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1f2a17c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1f2a16e
jmp 0x1f2a0be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1f2a17c
add edi, ecx
jmp 0x1f2a0be
pop esi
mov edi, esi
mov ecx, 0x4ca7fd
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1f2a1b7
cmp byte [edi], 0x65
jne 0x1f2a19c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x1f2a19a
lea edi, [esi + 0x1aee000]
mov eax, dword [edi]
or eax, eax
je 0x1f2a1ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2fb7cd0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2fb7e00]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1f2a1bd
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2fb7e08]
or eax, eax
je 0x1f2a1f9
mov dword [ebx], eax
add ebx, 4
jmp 0x1f2a1da
call dword [esi + 0x2fb7e04]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1f2a230
cmp al, 0xef
ja 0x1f2a223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1f2a205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1f2a212
mov ebp, dword [esi + 0x2fb7e0c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1f2a264
sub esp, 0xffffff80
jmp 0x92006c
Function at 0x100010d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x38
mov eax, dword [0x1000d05c]
xor eax, esp
mov dword [esp + 0x34], eax
cmp dword [esp + 0x40], 1
push ebx
push ebp
push esi
push edi
jne 0x100012dc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, dword [eax]
cmp word [edi], 0x22
jne 0x1000112d
add edi, 2
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001117
sub eax, edx
sar eax, 1
xor edx, edx
mov word [edi + eax*2 - 2], dx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
push 0
push edi
call ebx
mov ebp, eax
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10002742
mov esi, eax
add esp, 4
test esi, esi
jne 0x10001175
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.100027a7
add esp, 0x38
ret 0xc
push 0
push esi
push ebp
push edi
call ebx
xor eax, eax
mov word [esi + ebp*2], ax
mov ecx, 0x4b
mov word [esp + 0x28], cx
mov edx, 0x45
mov word [esp + 0x2a], dx
mov eax, 0x52
mov word [esp + 0x2c], ax
mov word [esp + 0x30], dx
mov ecx, 0x4e
mov word [esp + 0x2e], cx
mov eax, 0x4c
mov word [esp + 0x32], ax
mov edx, 0x32
mov word [esp + 0x36], dx
mov ecx, 0x33
mov word [esp + 0x34], cx
mov edx, 0x4c
mov eax, 0x2e
mov word [esp + 0x38], ax
mov eax, edx
mov ecx, 0x44
mov word [esp + 0x3c], dx
mov word [esp + 0x3a], cx
mov dl, 0x72
xor ecx, ecx
mov byte [esp + 0x19], dl
mov byte [esp + 0x20], dl
mov word [esp + 0x3e], ax
mov al, 0x65
mov word [esp + 0x40], cx
mov cl, 0x61
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], al
mov byte [esp + 0x22], 0x54
mov byte [esp + 0x23], 0x68
mov byte [esp + 0x25], al
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], 0x64
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100012cd
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001261
sub eax, edx
sar eax, 1
mov ebp, eax
xor ecx, ecx
lea ebx, [ebp + 1]
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10002742
mov edi, eax
add esp, 4
test edi, edi
jne 0x100012ae
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.100027a7
add esp, 0x38
ret 0xc
push esi
push ebx
push edi
call fcn.10002669
add esp, 0xc
xor eax, eax
push eax
push eax
push edi
push section..text
push eax
push eax
mov word [edi + ebp*2], ax
call dword [esp + 0x28]
push esi
call fcn.100019f0
push esi
call fcn.1000265e
add esp, 8
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.100027a7
add esp, 0x38
ret 0xc
Function at 0x100019a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi]
cmp ecx, 5
ja 0x100019b0
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
mov edx, dword [ecx + eax - 5]
push ebx
mov bl, byte [ecx + eax - 1]
cmp edx, ecx
jb 0x100019c6
pop ebx
xor eax, eax
pop esi
ret
sub ecx, edx
add eax, edx
lea edx, [ecx - 5]
xor ecx, ecx
mov dword [esi], edx
test edx, edx
jbe 0x100019df
xor byte [ecx + eax], bl
inc ecx
inc bl
cmp ecx, dword [esi]
jb 0x100019d5
pop ebx
pop esi
ret

Function at 0x100019f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, ebx
lea edx, [eax + 2]
jmp 0x10001a00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001a00
sub eax, edx
sar eax, 1
lea eax, [ebx + eax*2]
mov ecx, eax
cmp eax, ebx
jbe 0x10001b57
lea esp, [esp]
cmp word [ecx], 0x5c
je 0x10001a2f
sub ecx, 2
cmp ecx, ebx
ja 0x10001a20
jmp 0x10001a32
lea eax, [ecx + 2]
cmp eax, ebx
jbe 0x10001b57
push esi
sub eax, ebx
push edi
sar eax, 1
mov edi, eax
lea eax, [edi + edi + 0x14]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10001b55
add edi, edi
push edi
push ebx
push esi
call fcn.100028c0
mov ecx, dword [0x1000a324]
mov dword [edi + esi], ecx
mov edx, dword [str.ge.jpg]
mov dword [edi + esi + 4], edx
mov ecx, dword [0x1000a32c]
mov dword [edi + esi + 8], ecx
mov edx, dword [0x1000a330]
mov dword [edi + esi + 0xc], edx
mov cl, byte [0x1000a334]
add esp, 0xc
mov byte [edi + esi + 0x10], cl
cmp word [esi], 0x22
mov eax, esi
jne 0x10001aa2
lea eax, [esi + 2]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001b55
push ebp
lea edx, [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x10001b00
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
push 0
lea eax, [esp + 0x1c]
push eax
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0
je 0x10001b46
lea ecx, [esp + 0x10]
push ecx
push edi
mov dword [esp + 0x18], ebp
call fcn.100019a0
add esp, 8
test eax, eax
je 0x10001b46
mov edx, dword [esp + 0x10]
push edx
push eax
call fcn.10002630
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10001b80
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
push ebx
push ebp
mov ebp, dword [edi + 4]
xor edx, edx
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 0xc], 0
cmp dx, word [eax + 6]
jae 0x10001c4d
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x10001bee
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x10001c33
mov ecx, dword [edi + 0x34]
mov edx, dword [esi - 4]
mov eax, dword [edi + 0x1c]
push ecx
push 4
push 0x1000
add edx, ebp
push ebx
push edx
call eax
add esp, 0x14
test eax, eax
je 0x10001c5f
mov eax, dword [esi - 4]
push ebx
add eax, ebp
push 0
push eax
mov dword [esi - 8], eax
call fcn.10002840
jmp 0x10001c30
mov ecx, dword [esi + 4]
add ecx, eax
cmp dword [esp + 0x18], ecx
jb 0x10001c57
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x1c]
push edx
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ebp
push eax
call ecx
add esp, 0x14
test eax, eax
je 0x10001c5f
mov eax, dword [esi + 4]
mov edx, dword [esi]
add eax, dword [esp + 0x14]
mov ebx, dword [esi - 4]
push edx
add ebx, ebp
push eax
push ebx
call fcn.100028c0
mov dword [esi - 8], ebx
add esp, 0xc
mov ecx, dword [edi]
mov eax, dword [esp + 0xc]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0xc], eax
jl 0x10001ba8
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10001d20
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
mov dword [esp + 0x18], edx
test esi, esi
jne 0x10001d64
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x10001d5d
mov esi, dword [eax + 0x20]
jmp 0x10001d64
test bl, bl
jns 0x10001d64
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 1
cmp si, word [eax + 6]
jae 0x10001e44
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x3c]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ebp
test edi, edi
jne 0x10001db9
mov ecx, dword [ebx]
test cl, 0x40
je 0x10001db2
mov edi, dword [eax + 0x20]
jmp 0x10001db9
test cl, cl
jns 0x10001db9
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x10001df2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x10001df2
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10001c70
test eax, eax
je 0x10001e65
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x10001e1e
mov eax, dword [ebx]
test eax, 0x2000000
je 0x10001e0b
test dword [esp + 0x20], 0x2000000
je 0x10001e0b
or dword [esp + 0x20], eax
jmp 0x10001e18
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x10001d94
lea ecx, [esp + 0x14]
mov eax, edi
mov dword [esp + 0x24], 1
call fcn.10001c70
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret