joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d890
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x597e80]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x48d8d0
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0048d1f0
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x48dc80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x597e80]
mov edi, dword [ebp + 8]
test eax, eax
je 0x48dd5c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x48dd71
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x48dd30
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x48dcc8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x48dcd8
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x48dd23
test edx, edx
jne 0x48dd16
test ecx, ecx
je 0x48dcc0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x48dd80
cmp eax, 8
je 0x48dcc0
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x48dcb2
call fcn.0048d2c0
mov eax, dword [0x597e80]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x48dca4
call fcn.0048d8f0
mov eax, dword [0x597e80]
jmp 0x48dca4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0048dbf0
cmp eax, 7
jne 0x48dd1b
mov eax, dword [0x597e80]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x48ddd3
mov edi, dword [eax + 0x30]
test edi, edi
js 0x48ddfe
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x48dddf
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0048d2c0
mov eax, dword [0x597e80]
jmp 0x48ddb1
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x48ddc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48ddc2
call fcn.0048d8f0
mov eax, dword [0x597e80]
jmp 0x48ddb8
Function at 0x48e060
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x597e80]
mov edi, dword [ebp + 8]
test eax, eax
je 0x48e0f4
mov esi, dword [eax + 0x30]
test esi, esi
js 0x48e110
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x48e130
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x48e0e8
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0048dbf0
cmp eax, 7
jne 0x48e1af
mov eax, dword [0x597e80]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x48e186
mov edx, dword [eax + 0x30]
test edx, edx
js 0x48e1a0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x48e160
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0048de10
jmp 0x48e0a5
call fcn.0048d2c0
mov eax, dword [0x597e80]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x48e080
lea esi, [esi]
call fcn.0048d8f0
mov eax, dword [0x597e80]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x48e08b
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x48e08e
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x48e0d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48e0d7
call fcn.0048d2c0
mov eax, dword [0x597e80]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x48e0c9
nop
lea esi, [esi]
call fcn.0048d8f0
mov eax, dword [0x597e80]
jmp 0x48e0c9
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x48e1c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x48e252
mov eax, dword [0x597e80]
test eax, eax
je 0x48e246
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x48e2c1
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x48e267
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0048de10
cmp eax, 7
jne 0x48e2df
mov eax, dword [0x597e80]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x48e2b2
mov edx, dword [eax + 0x30]
test edx, edx
js 0x48e2d0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x48e293
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0048d2c0
mov eax, dword [0x597e80]
jmp 0x48e1e2
mov dword [esp], edi
call fcn.0048dc80
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x48e1f7
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x48e235
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48e235
call fcn.0048d2c0
mov eax, dword [0x597e80]
jmp 0x48e220
call fcn.0048d8f0
mov eax, dword [0x597e80]
jmp 0x48e1ed
call fcn.0048d8f0
mov eax, dword [0x597e80]
jmp 0x48e22b
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x49b252
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
inc dword [eax + 4]
push 1
lea eax, [ebp - 4]
push eax
call fcn.0049a78b
add esp, 8
mov eax, dword [ebp - 4]
dec dword [eax + 4]
jne 0x49b28b
push dword [ebp - 4]
call fcn.004884ee
add esp, 4
cmp ebx, 0
jne 0x49b2cd
push dword [ebp - 4]
call fcn.0048670c
add esp, 4
mov ebx, eax
push 0x3ff
push ebx
call sub.msvcrt.dll__mkdir
add esp, 8
push ebx
call fcn.004889e4
add esp, 4
push dword [ebp - 4]
call fcn.0049aea4
add esp, 4
cmp eax, 2
sete al
movzx eax, al
jmp 0x49b3b2
mov edi, 0x52a080
push 0x530164
push dword [ebp - 4]
call fcn.0049ace0
add esp, 4
push eax
call fcn.00486014
add esp, 8
mov dword [ebp - 4], eax
jmp 0x49b3a0
push 0
push 0x530164
push dword [ebp - 4]
call fcn.00485fa0
add esp, 0xc
mov ebx, eax
add ebx, 1
push ebx
push 0
push dword [ebp - 4]
call fcn.00486062
add esp, 0xc
push eax
push edi
call fcn.00486014
add esp, 8
mov edi, eax
mov eax, dword [ebp - 4]
push dword [eax + 8]
push ebx
push dword [ebp - 4]
call fcn.00486062
add esp, 0xc
mov dword [ebp - 4], eax
push edi
call fcn.0049aea4
add esp, 4
cmp eax, 2
je 0x49b353
cmp eax, 0
je 0x49b355
mov eax, 0
jmp 0x49b3b2
jmp 0x49b3a0
push edi
call fcn.0049aa6e
add esp, 4
mov esi, eax
push esi
call fcn.0049aa6e
add esp, 4
push eax
call fcn.0048670c
add esp, 4
mov ebx, eax
push 0x3ff
push ebx
call sub.msvcrt.dll__mkdir
add esp, 8
push ebx
call fcn.004889e4
add esp, 4
push esi
call fcn.0049aea4
add esp, 4
cmp eax, 2
je 0x49b3a0
mov eax, 0
jmp 0x49b3b2
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x49b2f3
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b758
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
inc dword [eax + 4]
push 1
lea eax, [ebp - 4]
push eax
call fcn.0049a78b
add esp, 8
mov eax, dword [ebp - 4]
dec dword [eax + 4]
jne 0x49b790
push dword [ebp - 4]
call fcn.004884ee
add esp, 4
cmp ebx, 0
je 0x49b867
push dword [ebp - 4]
call fcn.0049b915
add esp, 4
mov esi, eax
cmp esi, 0
jne 0x49b7b5
mov eax, 0
jmp 0x49b8a2
push esi
call fcn.0049b973
add esp, 4
mov ebx, eax
push 0x530184
push ebx
call fcn.00485ec2
add esp, 8
cmp eax, 0
jne 0x49b7d8
jmp 0x49b85e
push 0x5301a4
push ebx
call fcn.00485ec2
add esp, 8
cmp eax, 0
sete al
movzx eax, al
cmp eax, 0
jne 0x49b80b
push 0x5301b4
push ebx
call fcn.00485ec2
add esp, 8
cmp eax, 0
sete al
movzx eax, al
cmp eax, 0
je 0x49b812
jmp 0x49b7b5
push ebx
push 0x530164
push dword [ebp - 4]
call fcn.00486014
add esp, 8
push eax
call fcn.00486014
add esp, 8
mov ebx, eax
push ebx
call fcn.0049aea4
add esp, 4
cmp eax, 1
je 0x49b843
cmp eax, 2
je 0x49b84e
jmp 0x49b859
push ebx
call fcn.0049b3b9
add esp, 4
jmp 0x49b859
push 1
push ebx
call fcn.0049b758
add esp, 8
jmp 0x49b7b5
push esi
call fcn.0049b98f
add esp, 4
push dword [ebp - 4]
call fcn.0048670c
add esp, 4
mov ebx, eax
push ebx
call sub.msvcrt.dll__rmdir
add esp, 4
push ebx
call fcn.004889e4
add esp, 4
push dword [ebp - 4]
call fcn.0049aea4
add esp, 4
cmp eax, 0
jne 0x49b89d
mov eax, 1
jmp 0x49b8a2
mov eax, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b5c3f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [0x5438c4]
cmp dword [eax + 8], 0
je 0x4b5c59
mov eax, dword [0x5438c4]
jmp 0x4b5d6b
push 0x5438c8
call fcn.0048670c
add esp, 4
mov esi, eax
push esi
call sub.msvcrt.dll_getenv
add esp, 4
push eax
call fcn.00485e18
add esp, 4
mov ebx, eax
push esi
call fcn.004889e4
add esp, 4
cmp dword [ebx + 8], 0
je 0x4b5cb0
inc dword [ebx + 4]
mov esi, ebx
mov eax, dword [0x5438c4]
dec dword [eax + 4]
jne 0x4b5ca3
push eax
call fcn.004884ee
add esp, 4
mov dword [0x5438c4], esi
mov eax, ebx
jmp 0x4b5d6b
mov ebx, dword [0x597e30]
push 0x5438e4
push ebx
call fcn.00486014
add esp, 8
push 0x543900
push eax
call fcn.00486014
add esp, 8
push eax
call fcn.0049aea4
add esp, 4
cmp eax, 1
jne 0x4b5d2d
push ebx
push 0x543914
call fcn.00486014
add esp, 8
push eax
call fcn.0048670c
add esp, 4
mov esi, eax
push esi
call fcn.004852a0
add esp, 4
push esi
call fcn.004889e4
add esp, 4
inc dword [ebx + 4]
mov esi, ebx
mov eax, dword [0x5438c4]
dec dword [eax + 4]
jne 0x4b5d23
push eax
call fcn.004884ee
add esp, 4
mov dword [0x5438c4], esi
mov eax, ebx
jmp 0x4b5d6b
push 0x543930
push ebx
call fcn.00486014
add esp, 8
push eax
call fcn.0049ace0
add esp, 4
mov ebx, eax
push 0x543944
push ebx
call fcn.00485ec2
add esp, 8
cmp eax, 0
jne 0x4b5d66
push 0x543964
call fcn.00488f20
add esp, 4
jmp 0x4b5cb6
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [eax]
xor edi, edi
pop ecx
mov al, 0xc1
add byte [eax], 0xd0
ror dword [ebx + ecx*4], cl
fmul dword [ebp - 0x10728aab]
or al, 0x52
mov ecx, ebx
push esi
push eax
and ecx, 0xad00ff
push edi
clc
xchg edi, eax
stosd dword es:[edi], eax
pop ebp
cld
call 0x3ff0f0
insb byte es:[edi], dx
lodsb al, byte [esi]
push ebp
or byte [edx + 0x50], dl
invalid

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x447c4477
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x6a3a167e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x4ca26f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4c9fca
sub edi, edi
add edi, 1
call fcn.004ca2b5
mov edx, 0xfa39d8ea
mov edi, 0x4a75e3ff
xor dword [esi], ecx
sub edx, 0x9514e40c
add edi, 1
dec edi
inc esi
add edx, edx
sub edx, edi
or edi, edx
cmp esi, eax
jne fcn.004ca26f
sub edi, 0xb5cd3683
mov edi, edi
ret
Function at 0x401070
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 0xc]
push edi
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
mov edi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4010e8
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x4010dc
mov edx, dword [0x653f44]
push 0x653c78
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x41168b
Capabilities:
Encode data using base64

Disassembly:
mov edi, 0xfa4cd184
mov edx, 0xf2abe2b1
shr byte [ebx - 0xd], 1
mov dl, 0x83
add dword [eax], ecx
cmp byte [edi - 0x7c], cl
dec ecx
and byte [ebx - 0x2b], bl
invalid
Function at 0x415ebd
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xa9341c6
sbb edi, eax
inc ecx
add esi, dword [ecx - 0x5c]
cmpsd dword [esi], dword es:[edi]
add bl, byte [eax - 0x49]
cli
lds ecx, [ecx - 0x3a]
stosd dword es:[edi], eax
arpl bx, di
xor ch, byte [esi + 0x47a9b64c]
invalid
sahf
inc eax
and dword [ebp + 0x6d4e9897], 0x68
push ebp
mov eax, dword [0x1268b238]
lodsb al, byte [esi]
dec edi
add edi, dword [ebx]
test eax, 0x781eede3
xor dword [ebx - 9], eax
fdiv dword [edx + 0x3b]
mov dl, 0x68
adc ch, byte [edi + ecx*2 - 0x1c56c4fd]
in eax, dx
push ds
js 0x415ed4
inc ebx
neg eax
jb 0x415ee3
cmp ebx, dword [edi + 0x40a872c9]
lahf
leave
jb 0x415e54
inc eax
xchg byte [eax - 0x7292653e], ah
jge 0x415ea7
or byte [eax + 0x3f6f8899], bh
aad 0xff
pop ecx
je 0x415e96
loopne 0x415e94
add ch, bh
xchg byte [ecx], bl
sub al, 0x14
lodsd eax, dword [esi]
jne 0x415f18
ja 0x415f3c
imul edi, dword [edx - 0x55], 0xffffffb2
loop 0x415f50
stosd dword es:[edi], eax
inc ebp
sbb ebx, dword [bx + di]
adc ah, byte [esi - 0x68cfec8c]
xchg edi, eax
out 0x29, eax
loop 0x415f55
mov edx, 0xa37c91f8
clc
xchg ecx, eax
jl 0x415e8a
mov dword [0x8069730c], eax
mov edx, 0xac818516
mov eax, dword [0xd6f17d90]
or al, 0x73
imul eax, dword [eax - 0x7ae945da], 0x90a1ac81
jge 0x415ee6
salc
lodsb al, byte [esi]
insd dword es:[edi], dx
cwde
sbb eax, 0x8cedbd2
ror dword [ecx], cl
popfd
jmp 0x32e95ac5
push cs
or al, 0x33
adc eax, 0x603005f6
in eax, dx
dec ebp
mov edi, 0xd51e818
sbb dword [esi + 0x34], edi
pop esi
mov dh, 0xa7
xchg byte [ebx + 0x67a96d5a], dl
ror dword [ebp + 0x26], 1
loopne 0x415edd
loop 0x415f9c
lodsd eax, dword [esi]
or esp, dword [ecx]
push ss
and dword [esi], edx
xor bh, byte [eax]
xor eax, 0xf2c905ff
shl edx, 0xa4
sbb eax, 0x3aa17406
mov dl, 0xa4
push edx
pushfd
dec edx
mov cl, 0xba
pushal
push 0x36e3e7ef
mov edx, 0xe7ef6860
jecxz 0x415f92
fbstp tbyte [edi]
shr dword [eax], 0xd8
push 0x7ce3ed23
push edi
imul edx, ebx, 0x529b80a5
stosd dword es:[edi], eax
push ebx
pop edx
pop esi
mov byte [ecx + 0x7d7b5666], ch
push eax
pop es
push 0x392e0842
xor dh, ah
mov dword [0xe1b2d6fe], eax
and ebx, ebp
test al, 0xf0
mov bl, 0xd0
mov ch, ch
stosd dword es:[edi], eax
inc edx
or al, byte [edx - 0x69953673]
leave
push 0xffffffffffffff96
dec eax
jae 0x415f55
ror dword [edx], 1
out 0xcd, al
mov cs, edx
arpl word [ecx - 0x60], si
int3

Function at 0x45d625
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0xc6
xchg ecx, esi
xchg esi, eax
rcl byte [edi], cl
leave
fcomp dword [ebx - 0x772e89f2]
xor dword [ecx], ebx
sub cl, al
lahf
adc al, 0x14
enter 0x4878, 0xffffffffffffffdd
salc
jo 0x45d62d
in eax, 0xc5
or eax, 0xace1f7b7
invalid
Function at 0x5fc0ad
Capabilities:
Encode data using xor

Disassembly:
jns 0x5fc066
sub eax, 0xc9b31d83
mov ecx, 0x8c005efd
out dx, al
invalid
jno 0x5fc008
mov cl, al
movsb byte es:[edi], byte [esi]
jno 0x5fc069
pop ebp
xor dword [ebp + ebx*2 + 0x21], ebp
dec esi
jl 0x5fc042
inc edx
sal byte ds:[ebp - 0x6b5d500d], 1
or esp, 0x92d1d144
and dword [edi + 0x45], edx
scasb al, byte es:[edi]
jno 0x5fc0df
cmc
mov dword [edx], ebp
dec ebp
popal
fidiv dword [esi - 0xa280a70]
invalid
lds ecx, [esi - 0x17]
faddp st(2)
adc edi, ebx
cmp dword [edi - 0x537e10e1], 0xbcfa720e
mov edi, 0xac81ef1f
push cs
jb 0x5fc0af
mov esp, 0x851dbe2e
cmpsb byte [esi], byte es:[edi]
sbb eax, 0x1d703d01
jb 0x5fc04a
mov edi, 0xac81ef1f
push cs
jb 0x5fc0af
out dx, eax
sub dword [esi + ecx + 0x2ebcfa72], 0xa6851dbe
mov esp, 0x851dbe2e
cmpsb byte [esi], byte es:[edi]
sbb eax, 0x1d703d01
jb 0x5fc04a
sbb eax, 0xca68872
dec ebp
cmpsb byte [esi], byte es:[edi]
or al, 0x4d
jl 0x5fc0a5
pop ss
push ebx
das
dec ebp
xor edx, dword [edi + 0x5d]
mov eax, 0x993c42f0
or al, 0x8c
jge 0x5fc0bf
mov al, byte [0x7e296181]
ret 0xb45d
mov ah, 0x60
inc eax
or ebx, ebx
mov cl, 0x9d
xor esp, 0xffffff81
push dword [0x6e71fed1]
jno 0x5fc0df
bound ecx, qword [ebx]
sub ebp, edx
iretd
Function at 0x401340
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40abbd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push ebp
push esi
push edi
mov esi, ecx
push sub.MFC42.DLL_CString::CString
push sub.MFC42.DLL_CString::CString_2
push 5
lea eax, [esi + 0x1f38]
push 4
push eax
mov dword [esp + 0x38], esi
call fcn.00409964
lea edi, [esi + 0x1f4c]
mov dword [esp + 0x230], 0
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
lea ebx, [esi + 0x1f50]
mov byte [esp + 0x230], 1
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x128]
mov byte [esp + 0x230], 2
push ecx
push 0xff
mov dword [esi], 0x40c7cc
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x1e]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x18]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x1e]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
mov eax, dword [esp + 0x26]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x44]
push str._02d_02d_04d__02d_02d_02d_03d.BMP
push ecx
call ebp
add esp, 0x24
lea edx, [esp + 0x128]
mov ecx, edi
push edx
call fcn.00409582
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x1e]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x1c]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x18]
and ecx, 0xffff
push eax
push ecx
mov eax, dword [esp + 0x22]
mov ecx, dword [esp + 0x26]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x44]
push str._02d_02d_04d__02d_02d_02d_03d.JPG
push edx
call ebp
add esp, 0x24
lea eax, [esp + 0x128]
mov ecx, ebx
push eax
call fcn.00409582
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_1
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [esi + 0x1f58], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x1f2c
mov dword [esi + 0x1f54], eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x240]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x23c]
add esp, 4
cmp eax, edi
mov dword [esi + 0x1f5c], eax
mov dword [esi + 0x1f60], ecx
mov dword [esi + 0x1f64], 0x3c
mov dword [esi + 8], edi
je 0x401523
push ecx
mov ecx, esi
call fcn.00403890
mov ecx, dword [esp + 0x228]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret 8
Function at 0x401560
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40ac04
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x40c7cc
mov ecx, dword [esi + 8]
mov dword [esp + 0x1c], 2
test ecx, ecx
je 0x4015a2
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 8], 0
mov eax, dword [esi + 0x1f4c]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edi, [esi + 0x1f4c]
push eax
call ebx
mov eax, dword [esi + 0x1f50]
lea ebp, [esi + 0x1f50]
push eax
call ebx
mov ecx, ebp
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
mov ecx, edi
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
push sub.MFC42.DLL_CString::CString
push 5
add esi, 0x1f38
push 4
push esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.00409870
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret