joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411354
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x411450
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040462c
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040462c
mov edi, eax
push edi
push 0
call sub.advapi32.dll_LookupAccountNameA
mov edx, dword [ebp - 8]
inc edx
mov eax, ebx
call fcn.004047b8
mov eax, dword [ebp - 4]
call fcn.00406b68
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x411433
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040462c
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x411416
mov eax, dword [ebx]
call fcn.0040462c
lea edx, [ebp - 0x14]
call fcn.00407618
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.004041dc
jmp 0x41141d
mov eax, ebx
call fcn.00404188
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41143a
mov eax, dword [ebp - 0xc]
call fcn.00402570
ret

Function at 0x4114ac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404188
test ebx, ebx
je 0x4114e5
push 0x400
lea eax, [esp + 4]
push eax
test ebx, ebx
jns 0x4114d6
call fcn.00403770
push ebx
call sub.user32.dll_GetWindowTextA
mov edx, esi
mov eax, esp
call fcn.00407618
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x416ac8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x416c5b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004028c4
mov eax, 0x1869f
call fcn.00402d4c
mov edx, dword [ebp - 8]
call fcn.00406c60
mov eax, dword [ebp - 4]
call fcn.0040442c
mov ebx, eax
test ebx, ebx
jle 0x416b33
mov esi, 1
lea eax, [ebp - 4]
call fcn.00404684
sub byte [eax + esi - 1], 0x32
inc esi
dec ebx
jne 0x416b22
lea eax, [ebp - 0x10]
call fcn.00404188
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 0x18]
call fcn.004106a4
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00404354
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404434
lea eax, [ebp - 4]
mov ecx, 2
mov edx, 1
call fcn.004046cc
cmp dword [ebp - 4], 0
jne 0x416b3b
mov eax, dword [ebp - 0x10]
call fcn.0040442c
mov edi, eax
cmp edi, 4
jle 0x416c38
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi - 2]
mov byte [ebp - 0xa], al
xor eax, eax
mov ebx, edi
test ebx, ebx
jle 0x416bc2
mov esi, 1
mov edx, edi
dec edx
cmp esi, edx
je 0x416bbe
mov edx, dword [ebp - 0x10]
add al, byte [edx + esi - 1]
inc esi
dec ebx
jne 0x416bb0
cmp al, byte [ebp - 0xa]
jne 0x416c38
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + edi - 1]
xor al, dl
mov byte [ebp - 9], al
mov ebx, edi
dec ebx
sub ebx, 2
jl 0x416c00
inc ebx
mov esi, 2
lea eax, [ebp - 0x10]
call fcn.00404684
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 9]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x416be6
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 1]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 2]
mov esi, eax
and esi, 0xff
add esi, 3
inc esi
and eax, 0xff
sub edi, eax
xor eax, eax
mov al, dl
sub edi, eax
sub edi, 4
mov eax, dword [ebp - 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.0040468c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416c62
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004041ac
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x416c6c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x416d39
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x416ca3
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00406dd8
mov esi, eax
push 0
push 0
xor edx, edx
mov eax, esi
call fcn.0040b274
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.00406e54
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.00406e54
cmp byte [ebp - 5], 0x4d
jne 0x416d16
cmp byte [ebp - 6], 0x5a
jne 0x416d16
push 0
push pe_nt_image_headers32
xor edx, edx
mov eax, esi
call fcn.0040b274
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.00406e54
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.00406e54
cmp byte [ebp - 5], 0x50
jne 0x416d16
cmp byte [ebp - 6], 0x45
jne 0x416d16
mov bl, 1
cmp dword [ebp - 4], 0
je 0x416d23
mov eax, esi
call fcn.00406eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416d40
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x416eec
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x416f70
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 0x18]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x416f52
mov ebx, dword [ebp - 8]
imul ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416f77
lea eax, [ebp - 0x18]
call fcn.00404188
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x41bba8
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x41bc33
mov ebx, 1
mov eax, esi
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.0040e108
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.00404684
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x41bc00
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.0040edd0
cmp ebp, 0xffffffff
je 0x41bc1f
mov eax, dword [edi]
call fcn.0040442c
cmp ebx, eax
jle 0x41bbc1
mov eax, dword [edi]
call fcn.0040442c
cmp ebx, eax
jle 0x41bc33
mov eax, dword [edi]
call fcn.0040442c
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41ca60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x41cc43
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x428cac], 0
jne 0x41cc11
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402d2c
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404354
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x41cc5c
call fcn.00404478
mov eax, dword [ebp - 0x18]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x41cb7a
lea eax, [ebp - 0x10]
mov ecx, 0x41cc68
mov edx, dword [ebp - 0x18]
call fcn.00404478
mov eax, dword [ebp - 0x10]
call fcn.00406f2c
test al, al
je 0x41cb2c
push dword [ebp - 0x10]
push 0x41cc78
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.0040e1e8
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x10]
call fcn.00406f50
lea eax, [ebp - 0x14]
mov ecx, 0x41cc88
mov edx, dword [ebp - 0x10]
call fcn.00404478
push 0
push 0
xor ecx, ecx
mov edx, 0x41cc9c
mov eax, dword [ebp - 0x14]
call fcn.0040b578
mov eax, dword [ebp - 0x14]
call fcn.00406f1c
test al, al
je 0x41cb6e
mov eax, dword [ebp - 0x10]
call fcn.0040b980
fstp qword [esi]
wait
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0040c2a4
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x41cab1
lea edx, [ebp - 0x60]
mov al, 1
call fcn.0040fed4
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00406b88
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x41cbc9
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x41cbb1
cmp dl, byte [ebp - 9]
je 0x41cc11
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.00404354
mov edx, dword [ebp - 0x64]
mov eax, 0x428cac
mov ecx, 0x41cca8
call fcn.00404478
mov eax, dword [0x428cac]
call fcn.00406f2c
test al, al
je 0x41cc11
mov eax, 0x428cac
mov edx, 0x41cc78
call fcn.00404434
cmp dword [0x428cac], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cc4a
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004041ac
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004041ac
ret
Function at 0x420414
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x4204a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d2c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x42048b
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4204a8
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x423f68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x424062
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x424078
call fcn.00415f8c
mov eax, dword [0x428e64]
cmp dword [eax], 0
jg 0x42403d
lea eax, [ebp - 0xc]
call fcn.0041dc1c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x4240a4
call fcn.00404478
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004072a4
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x428e08]
mov eax, dword [eax]
call fcn.00417590
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004044ec
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4240cc
call fcn.00404478
mov eax, dword [ebp - 0x1c]
call fcn.00415f8c
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor edx, edx
mov eax, 0x3e8
call fcn.0040ee08
mov eax, 0x4240e4
call fcn.00415f8c
push 0
push 0
push 2
mov eax, dword [0x428da0]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
mov eax, 0x424108
call fcn.00415f8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424069
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004041ac
ret
Function at 0x424fd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x425169
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0040fd50
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x416a08]
call fcn.004171ec
call fcn.00417960
mov dword [ebp - 0xc], eax
mov ebx, 0x46
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x425023
add ebx, 0x34
mov esi, 0x14
mov edi, 0x154
mov dword [ebp - 8], 0x12
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x429660]
push eax
push 0
mov edx, 0x425178
mov eax, 0x42517c
mov ecx, 0x50000000
call fcn.00405d8c
mov edx, dword [0x428ee0]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov dword [ebp - 8], 0xd
push 0x50000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x429660]
push eax
push 0
mov edx, 0x425184
xor ecx, ecx
xor eax, eax
call fcn.00405d34
mov edx, dword [0x428e20]
mov dword [edx], eax
mov ebx, 0x1a0
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x4250c2
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x2e
mov dword [ebp - 8], 0xd
push 0x40000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x429660]
push eax
push 0
mov edx, 0x425184
xor ecx, ecx
xor eax, eax
call fcn.00405d34
mov edx, dword [0x428dc0]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x428df0]
mov dword [edx], eax
push 0x425198
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x428ee0]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425170
lea eax, [ebp - 0x10]
call fcn.00404188
ret
Function at 0x425454
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x42563b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, 0x425654
call fcn.00410460
test eax, eax
jl 0x425492
neg eax
mov edx, dword [0x428e80]
mov dword [edx], eax
call sub.comctl32.dll_InitCommonControls
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x28
call fcn.00402d2c
mov dword [ebp - 0x50], 0x4252d8
mov eax, dword [0x429660]
mov dword [ebp - 0x44], eax
mov eax, dword [0x428d3c]
call fcn.0040462c
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x3c], eax
push 0x425660
mov eax, dword [0x429660]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], 8
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_RegisterClassA
mov esi, 0x1ec
mov edi, 0x6e
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, edi
mov eax, esi
call fcn.00411598
mov dword [ebp - 0xc], 0x2c80000
lea eax, [ebp - 0x58]
call fcn.0040fd50
mov ecx, dword [ebp - 0x58]
mov dl, 1
mov eax, dword [0x416a08]
call fcn.004171ec
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x425674
mov edx, 0x425698
mov eax, ebx
call fcn.0041785c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push edi
push 0
push 0
mov eax, dword [0x429660]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040462c
push eax
mov eax, dword [0x428d3c]
call fcn.0040462c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00405d34
mov edx, dword [0x428da0]
mov dword [edx], eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00417a58
mov eax, dword [ebp - 0x5c]
push eax
mov eax, ebx
call fcn.00417960
push eax
mov eax, ebx
call fcn.004179d8
mov edx, eax
pop ecx
pop eax
call fcn.004116d4
mov eax, dword [0x428da0]
cmp dword [eax], 0
je 0x4255f1
push 0
mov eax, dword [0x428da0]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4255de
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
cmp byte [0x428d44], 0
jne 0x4255f1
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x4255c3
push 1
mov eax, dword [0x428da0]
mov eax, dword [eax]
push eax
call sub.user32.dll_KillTimer
mov al, 1
call fcn.0041f48c
call fcn.0041f3bc
xor edx, edx
mov eax, 0x2b
call fcn.0041606c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425642
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004041ac
lea eax, [ebp - 0x10]
call fcn.00404188
ret
Function at 0x4258d0
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4258d8
xor eax, eax
push ebp
push 0x4259e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402820
lea eax, [ebp - 0x10]
call fcn.0041c8d4
push dword [ebp - 0x10]
push 0x4259f8
push 0x425a04
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040732c
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.004044ec
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x18]
call fcn.004101a0
push dword [ebp - 0x18]
push 0x425a10
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x1c]
push 0x425a38
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004044ec
push dword [ebp - 0xc]
push 0x425a48
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x20]
push 0x425a60
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004044ec
push 0
push dword [ebp - 8]
push 0x425a6c
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00406bc4
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x24]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4259eb
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004041ac
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x2c567838
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x5c765a8a
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x69442150
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov eax, str.sane.ds
mov ebp, esp
sub esp, 8
mov dword [section..bss], 1
call fcn.69441500
leave
mov eax, str.gphoto2.ds
jmp fcn.69441500

Function at 0x69442180
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
test byte [0x69445018], 8
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
jne 0x69442300
lea eax, [esi - 0x101]
cmp ax, 1
jbe 0x694421d0
cmp si, 0x104
je 0x694421d0
mov edx, 9
mov eax, 1
mov word [0x694480c8], dx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x69442343
lea edx, [ebx + 0xa8]
mov word [eax + 8], si
mov dword [eax], edx
mov edx, dword [ebx + 0xac]
mov dword [eax + 4], edx
mov edx, dword [ebx + 0xac]
mov dword [edx], eax
mov dword [ebx + 0xac], eax
mov eax, dword [0x69448010]
test eax, eax
je 0x69442330
mov edx, dword [0x6944800c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.user32.dll_PostMessageW
mov eax, dword [ebx + 0xb0]
sub esp, 0x10
test eax, eax
je 0x69442360
cmp eax, dword [0x69448010]
je 0x69442290
mov edx, dword [0x6944800c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.user32.dll_PostMessageW
sub esp, 0x10
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x694422cf
cmp eax, dword [ebx + 0xb0]
je 0x694422cf
cmp dword [0x69448010], eax
je 0x694422cf
mov edx, dword [0x6944800c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.user32.dll_PostMessageW
sub esp, 0x10
mov eax, dword [0x6944800c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.user32.dll_PostMessageW
sub esp, 0x10
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
movzx eax, si
mov dword [esp + 0xc], str.DG_CONTROL_DAT_NULL_MSG_i_n
mov dword [esp + 8], str.TWAIN_ControlNull
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x69445018
mov dword [esp], 3
call fcn.69441470
jmp 0x6944219b
mov eax, dword [ebx + 0xb0]
test eax, eax
jne 0x6944226b
jmp 0x69442290
mov eax, 2
mov word [0x694480c8], ax
mov eax, 1
jmp 0x694421bf
mov eax, dword [ebx + 0xb4]
test eax, eax
jne 0x694422a2
jmp 0x694422cf
Function at 0x69442510
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
test byte [0x69445018], 8
mov edi, dword [ebp + 0xc]
jne 0x694425e0
mov esi, dword [0x694480c0]
test esi, esi
je 0x6944254d
mov eax, dword [edi]
cmp eax, dword [esi + 4]
jne 0x69442547
jmp 0x69442609
cmp dword [ebx + 4], eax
je 0x69442570
mov esi, ebx
mov ebx, dword [esi]
test ebx, ebx
jne 0x69442540
mov eax, 3
mov edi, 1
mov word [0x694480c8], ax
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x402
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [ebx + 0xa4]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0x14
mov dword [esi], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
cmp di, 1
sbb eax, eax
not eax
and eax, 0xb
mov word [0x694480c8], ax
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.DG_CONTROL_DAT_IDENTITY_MSG_CLOSEDS_n
mov dword [esp + 8], str.TWAIN_CloseDS
mov dword [esp + 4], 0x69445018
mov dword [esp], 3
call fcn.69441470
jmp 0x69442529
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edi
mov ebx, esi
mov dword [esp + 0xc], 0x402
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [esi + 0xa4]
mov edi, eax
mov eax, dword [esi]
sub esp, 0x14
mov dword [0x694480c0], eax
jmp 0x694425a1