joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5de4ad
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov dword [ebp - 0x2c4], ecx
jmp 0x5f22a4
mov byte [ebp - 0x192], 0x62
jmp 0x7f8762
mov byte [ebp - 0x189], 0xf
jmp 0x7b0245
mov byte [ebp - 0x183], 4
mov byte [ebp - 0x182], 0xd8
mov byte [ebp - 0x181], 0x24
mov byte [ebp - 0x180], 0xf9
jmp 0x88e467
push eax
cbw
not ax
lea eax, [ebp - 0xc]
jmp 0x83e6bb
mov byte [ebp - 0x17a], 0x58
jmp 0x65395a
push ebp
btc ax, bx
bt ebp, 0xe
mov ebp, esp
inc ax
push 0xffffffffffffffff
push 0x4e456b
mov eax, dword fs:[0]
test ah, 0xaa
cmc
push eax
sub esp, 0x2c4
mov eax, dword [0x520628]
clc
test eax, esp
cmc
xor eax, ebp
jmp 0x6d7926
mov byte [ebp - 0x19d], 0xba
jmp 0x8173a5
mov byte [ebp - 0x19b], 0xc4
mov byte [ebp - 0x19a], 0xb9
mov byte [ebp - 0x199], 0xe4
jmp 0x82be87
mov dword [ebp - 0x2c8], edx
jmp 0x6ea44d
mov byte [ebp - 0x170], 0x3e
jmp 0x4240b6
mov byte [ebp - 0x184], 0x18
jmp 0x593e92
mov byte [ebp - 0x179], 0x13
jmp 0x684abb
mov byte [ebp - 0x17c], cl
mov byte [ebp - 0x17b], 0xb3
jmp 0x5d8d86
mov byte [ebp - 0x178], 0x63
jmp 0x757abe
mov byte [ebp - 0x185], 0x6e
jmp 0x636cc4
mov byte [ebp - 0x187], 0xea
jmp 0x7408b4
mov dword [ebp - 0x10], eax
jmp 0x7a66f8
call eax
add eax, 0x10
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 4], esi
mov bl, 0x37
mov al, 0xaf
mov dl, 0xac
setle cl
mov cl, 0x24
mov cl, 0x53
mov byte [ebp - 0x16a], bl
jmp 0x7e381a
call fcn.00460929
sub ecx, ecx
cmp esi, 0x735f07f2
sub esi, esi
cmp eax, esi
setbe cl
setne cl
stc
test edx, eax
cmp cx, 0x7d74
cmp ecx, esi
jne 0x8084e4
push 0x80004005
jmp 0x8084df
mov byte [ebp - 0x19f], cl
jmp 0x8173cd
mov byte [ebp - 0x186], 0xeb
jmp 0x694d7f
mov byte [ebp - 0x177], 0x1d
jmp 0x841666
mov byte [ebp - 0x196], 0x62
mov byte [ebp - 0x195], 0x24
mov byte [ebp - 0x194], al
mov byte [ebp - 0x193], 0x97
jmp 0x5671bd
push ebx
jmp 0x85f815
mov byte [ebp - 0x174], 0xc2
jmp 0x819ec8
mov byte [ebp - 0x188], 0xed
jmp 0x6c896d
mov byte [ebp - 0x169], bl
mov bl, 0xd1
jmp 0x8a856e
mov byte [ebp - 0x18e], 0xa6
mov byte [ebp - 0x18d], 0x6c
jmp 0x80d564
mov byte [ebp - 0x191], 0x12
jmp 0x846e57
call fcn.00407820
mov edx, dword [eax]
movsx ecx, ax
xchg ch, cl
mov ecx, 0x4a4214a9
mov ecx, eax
not ax
lahf
mov eax, dword [edx + 0xc]
jmp 0x6dbbb9
mov byte [ebp - 0x18c], dl
mov byte [ebp - 0x18b], 0xdc
mov byte [ebp - 0x18a], 0x82
jmp 0x56ffbd
mov byte [ebp - 0x19c], 0xc8
jmp 0x5f0c4d
mov byte [ebp - 0x19e], 0x1a
jmp 0x5e70b7
mov byte [ebp - 0x173], 0xc5
jmp 0x84ba7e
mov byte [ebp - 0x17d], 0x3d
jmp 0x67b7b9
mov byte [ebp - 0x198], 0x6d
mov byte [ebp - 0x197], 0x50
jmp 0x77edb9
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2cc], eax
jmp 0x533aa4
mov byte [ebp - 0x176], 0x39
mov byte [ebp - 0x175], 0x43
jmp 0x7a7d45
mov byte [ebp - 0x190], 0x7d
mov byte [ebp - 0x18f], 0xe8
jmp 0x7f306f
mov byte [ebp - 0x172], 0x7d
mov byte [ebp - 0x171], 0x59
jmp 0x62e671
push esi
push edi
jmp 0x59f526
mov byte [ebp - 0x17f], 0xef
mov byte [ebp - 0x17e], 0xf3
jmp 0x823d4a
mov byte [ebp - 0x1a0], 0xb
jmp 0x71d54e
Function at 0x65f430
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
push ebx
movsx ebx, bp
jmp loc.0041c992
push ebp
mov ebp, esp
push 0xfffffffffffffffe
sbb ax, sp
push 0x5f76e0
rcl eax, 0x88
push 0x4740a0
mov eax, dword fs:[0]
cmc
push eax
rcr ax, cl
sub esp, 8
xchg ah, al
movzx ax, cl
mov eax, 0x1e50
jmp 0x65f430
call fcn.00474d50
mov eax, dword [0x520628]
clc
test ax, 0x2116
xor dword [ebp - 8], eax
xor eax, ebp
jmp 0x83c1cf
mov dword [ebp - 0x1c], eax
jmp 0x5b5d24
Function at 0x6fde2b
Capabilities:
Authenticate hmac
Check for software breakpoints
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x23], 0x65
jmp 0x8644fc
push eax
cwde
lea esp, [esp - 0x8e0]
lahf
shr ax, cl
mov eax, dword [0x520628]
jmp 0x6a5e40
mov dword [ebp - 0x874], esi
mov byte [ebp - 0x24], 0x6b
jmp 0x5321fa
xor eax, ebp
test edx, eax
test bp, 0x5fed
mov dword [ebp - 0x14], eax
stc
push ebx
test esp, esi
xchg ebx, ebx
push esi
xor bh, 0x50
movzx ebx, sp
add bx, 0x7e3
push edi
add ebx, 0x52f150c2
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xadd bh, bl
rcl bx, 0xfe
mov eax, dword [ebp + 8]
btc ebx, 3
rcl ebx, cl
mov dword [ebp - 0x888], eax
movzx bx, ch
lea eax, [ebp - 0x38]
xor ebx, 0x6b31569a
rol ebx, 0x81
adc bx, bp
mov dword [ebp - 0x898], ecx
bts bx, sp
setns bl
push eax
rcl ecx, 0x8e
lea ecx, [ebp - 0x24]
mov bh, cl
sete bl
bsf bx, cx
sub esi, esi
mov ebx, 0x69
jmp 0x7e0f9d
push ebp
mov ebp, esp
add al, 0x83
bswap ax
push 0xffffffffffffffff
btr eax, ebx
btc ax, bp
xchg al, ah
push 0x4e4288
shr ax, 0x98
sbb ax, 0x4f6a
sbb eax, ebx
mov eax, dword fs:[0]
jmp 0x59d9b1
push ecx
mov dword [ebp - 0x890], edx
jmp 0x5f6984
mov byte [ebp - 0x22], 0x72
jmp loc.0043376a
Function at 0x79812e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x53f1eb
mov eax, 0x5a4d
clc
cmp word [ecx], ax
je 0x73733f
xor eax, eax
pop esi
sar ecx, 0xe8
dec cl
bts ecx, ebp
mov ecx, dword [ebp - 4]
jmp 0x87affd
mov eax, dword [ecx + 0x3c]
test ebp, 0x2df8569a
add eax, ecx
cmp dword [eax], 0x4550
jmp 0x8c09dc
je 0x53f1eb
test esi, esi
jmp 0x53f1d6
push ebp
btc ax, ax
mov ebp, esp
not ecx
lea esp, [esp - 0x120]
bsr eax, ebx
mov eax, dword [0x520628]
xor eax, ebp
test cl, al
xor ecx, 0x7bcf6910
mov dword [ebp - 4], eax
adc ecx, 0x35594e90
movsx cx, al
rol ecx, cl
mov ecx, dword [ebp + 8]
stc
push esi
bt si, si
xadd si, si
mov esi, dword [ebp + 0xc]
test bh, 0x6e
mov dword [ebp - 0x120], esi
test bl, bl
jmp 0x831d77
test ecx, ecx
jmp 0x763621
xor ecx, ebp
call fcn.0046e186
mov esp, ebp
pop ebp
ret
jne 0x53f1eb
mov edx, dword [eax + 0x78]
mov dword [ebp - 0x114], edx
jmp 0x42ea40
Function at 0x7a47e4
Capabilities:
Parse pe header

Disassembly:
mov byte [ebp - 0x10], 0x6c
jmp 0x6c0f62
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x6e
jmp 0x74cc98
mov byte [ebp - 0xe8], 0x4e
jmp 0x8d07ab
mov byte [ebp - 0x22], 0x33
jmp 0x5fb606
push esi
push edi
jmp 0x833135
mov byte [ebp - 0xe1], 0x56
jmp 0x8062b6
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x2e
jmp 0x691a00
mov byte [ebp - 0xe3], 0x61
jmp 0x76aa9b
mov byte [ebp - 0xd4], 0
jmp 0x834d5a
mov byte [ebp - 0x1c], 0
jmp 0x7fe593
mov byte [ebp - 0xd7], 0x69
jmp 0x7acd83
mov byte [ebp - 0x1f], 0x64
jmp 0x77cb8b
mov byte [ebp - 0xf], 0
jmp 0x7a7263
mov byte [ebp - 0xdb], 0x53
jmp 0x72afd5
mov byte [ebp - 0xda], bl
mov byte [ebp - 0xd9], 0x63
jmp 0x7ce858
mov dword [ebp - 4], eax
push ebx
jmp 0x5ee835
mov byte [ebp - 0x24], bl
jmp 0x7a896d
call fcn.0046e186
mov esp, ebp
mov ebp, ebp
bswap ebp
not ebp
pop ebp
jmp 0x4669c8
je 0x7c99e2
call 0x5cd29a
lea edx, [ebp - 0xe8]
jmp 0x857854
mov byte [ebp - 0xe2], 0x70
jmp 0x5f0483
test eax, eax
jmp 0x7652c6
mov byte [ebp - 0x1e], 0x6c
jmp 0x83c183
mov byte [ebp - 0xe6], 0x55
mov byte [ebp - 0xe5], 0x6e
jmp 0x7dbf5b
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x6c
jmp 0x7a6083
push ebp
mov ebp, esp
shr eax, 0x1c
sar al, 0x28
add eax, ecx
sub esp, 0x16c
cmp bp, 0x4f77
clc
mov eax, dword [0x520628]
xor eax, ebp
jmp 0x73f736
mov byte [ebp - 0x13], 0x2e
mov byte [ebp - 0x12], 0x64
jmp 0x7d4e6d
call edi
lea ecx, [ebp - 0x28]
mov bl, 0x65
xchg si, si
not si
push ecx
movzx esi, di
mov esi, eax
jmp 0x89b21e
mov byte [ebp - 0x23], 0x6c
jmp 0x5ebb27
mov byte [ebp - 0xd6], 0x6f
jmp 0x8b9ba7
mov byte [ebp - 0x17], 0x74
jmp 0x78ed20
jne 0x7783c5
pop edi
rcr esi, 0x9f
pop esi
clc
jmp 0x8aaea3
mov byte [ebp - 0xd8], 0x74
jmp 0x68d13d
mov byte [ebp - 0x11], 0x6c
jmp 0x5d5fd6
mov byte [ebp - 0xe4], 0x6d
jmp 0x6252f6
push esi
jmp 0x5e5a0d
mov byte [ebp - 0xdd], 0x4f
mov byte [ebp - 0xdc], 0x66
jmp 0x6ced80
call edi
test esi, esi
jmp 0x7c99dc
mov byte [ebp - 0xe0], 0x69
mov byte [ebp - 0xdf], bl
jmp 0x8253c8
mov byte [ebp - 0xde], 0x77
jmp 0x7f4ca5
call 0x757e5f
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x18], 0x6e
jmp 0x7b1ca9
call edi
mov dword [0x52be34], eax
clc
cmp dx, 0x4697
test eax, eax
jmp 0x44a58d
mov byte [ebp - 0x1d], 0x6c
jmp 0x67516f
push edx
jmp 0x7eafed
mov byte [ebp - 0x28], 0x6b
mov byte [ebp - 0x27], bl
jmp 0x5e2ee7
xor eax, eax
rcl ecx, cl
pop ebx
xchg cx, cx
shr cl, cl
mov ecx, dword [ebp - 4]
clc
xor ecx, ebp
jmp 0x7600d1
mov byte [ebp - 0xd5], 0x6e
jmp 0x65bfa6
mov byte [ebp - 0xe7], 0x74
jmp 0x78df2b
Function at 0x7aa59f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
sets dl
mov ebp, esp
btr ax, 0x39
xor al, 0xa5
xor eax, ebp
sub esp, 0x90
bsf ax, bx
shld eax, esp, 0xb3
mov eax, dword [0x520628]
cmp bl, dh
or dl, dl
sbb dx, cx
xor eax, ebp
btr edx, 0xb8
shr dl, 0x3f
mov dword [ebp - 4], eax
neg dh
shl edx, 0x77
sbb dx, 0x7626
push ebx
mov ebx, dword [ebp + 8]
shl edx, cl
push esi
btc edx, esi
sub edx, 0x602b21af
mov esi, ecx
btc edx, esp
sub ecx, ecx
push 0x7e
stc
cmovp edx, edi
xor eax, eax
push ecx
xchg dh, dh
mov dl, bh
lea edx, [ebp - 0x8a]
jmp 0x7b120c
push edx
jmp 0x7cd874
mov dword [ebp - 0x90], esi
mov word [ebp - 0xc], ax
mov dword [ebp - 0xa], eax
jmp loc.0042da3f
Function at 0x8d3a69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebx, 0x75
test edx, edx
mov byte [ebp - 0x9e], cl
cmp ebx, 0x3178757d
mov byte [ebp - 0x4f], al
mov byte [ebp - 0x4e], cl
btr cx, bp
mov ecx, 0x61
clc
mov byte [ebp - 0x4d], al
mov eax, 0x72
clc
cmp sp, 0x4b56
test edx, 0x33e07bb4
mov byte [ebp - 0x4a], dl
stc
mov byte [ebp - 0x3c], dl
cmp bx, 0x1c45
mov byte [ebp - 0x33], dl
jmp loc.00403460
push ebp
mov ebp, esp
shr ah, cl
push 0xffffffffffffffff
bt ax, si
push 0x4e4306
rcr ah, 0xa1
neg ah
mov eax, dword fs:[0]
clc
cmp bx, ax
cmc
push eax
xor ah, 0x3c
cwde
rcl al, 0xf8
lea esp, [esp - 0xe4]
sar al, cl
mov eax, dword [0x520628]
test bp, dx
xor eax, ebp
stc
cmp dx, 0x3b14
mov dword [ebp - 0x10], eax
cmp esp, ebp
test bp, di
push ebx
and bx, 0x110
sete bl
shl bh, cl
push esi
xor ebx, edi
rol bx, cl
bswap bx
push edi
dec edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
bsr ebx, eax
cmovg bx, sp
mov dword [ebp - 0xbc], eax
cmp sp, 0x5bdc
shr ebx, 0x3c
mov al, 0x33
mov dword [ebp - 0xb4], ecx
cmc
mov dword [ebp - 0xb8], edx
sar cl, 0x3a
mov dl, 0x20
btc bx, cx
mov cl, 0x4c
mov bh, 0xdc
add ebx, edi
mov al, 0x45
shr bh, 0xf
jmp 0x8c2952
Function at 0x4032d0
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040d3a0
mov eax, dword [0x43c1b4]
mov ecx, dword [0x43c124]
shr eax, 3
test eax, eax
jbe 0x403402
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403320
cmp dword [0x43c1b4], 0x959
jne 0x4033e4
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x820]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x1024]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402cfc
push 0x402d0c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004030f0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403320
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret
Function at 0x403cc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x1830
call fcn.0040d3a0
cmp dword [0x43c1b4], 0xc
push ebx
push ebp
push esi
push edi
jne 0x403d8f
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
lea eax, [esp + 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push 0
push 0
lea ecx, [esp + 0xc48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
push 0x402dbc
push 0x402dd8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x402df4
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0
lea eax, [esp + 0x1044]
push eax
push 0x402e28
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x402e30
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push 0
push 0
call fcn.00403e46
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.0040401a
fstp st(0)
add esp, 8
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x9458
jge 0x403dc1
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1044]
push ecx
call ebx
push 0
call ebp
inc esi
cmp esi, 0x14ee8
jl 0x403da3
mov edx, dword [0x42c6a4]
mov eax, dword [0x42c678]
mov dword [0x43c1b4], edx
mov dword [0x43dabc], eax
call fcn.00403510
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x408756
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42baa8]
jne 0x408760
repz ret
jmp fcn.0040a4c9
Function at 0x409bf0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404a50
and dword [ebp - 4], 0
cmp dword [0x42cf6c], 0
mov ebx, eax
jne 0x409ca1
push 0x4023c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409d52
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4023bc
push edi
call esi
test eax, eax
je 0x409d52
push eax
call fcn.004049de
mov dword [esp], 0x4023ac
push edi
mov dword [0x42cf6c], eax
call esi
push eax
call fcn.004049de
mov dword [esp], 0x402398
push edi
mov dword [0x42cf70], eax
call esi
push eax
call fcn.004049de
mov dword [esp], 0x40237c
push edi
mov dword [0x42cf74], eax
call esi
push eax
call fcn.004049de
pop ecx
mov dword [0x42cf7c], eax
test eax, eax
je 0x409ca1
push 0x402364
push edi
call esi
push eax
call fcn.004049de
pop ecx
mov dword [0x42cf78], eax
mov eax, dword [0x42cf78]
cmp eax, ebx
je 0x409cf9
cmp dword [0x42cf7c], ebx
je 0x409cf9
push eax
call fcn.00404a59
push dword [0x42cf7c]
mov esi, eax
call fcn.00404a59
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409cf9
test edi, edi
je 0x409cf9
call esi
test eax, eax
je 0x409cf0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409cf0
test byte [ebp - 0xc], 1
jne 0x409cf9
or dword [ebp + 0x10], 0x200000
jmp 0x409d32
mov eax, dword [0x42cf70]
cmp eax, ebx
je 0x409d32
push eax
call fcn.00404a59
pop ecx
test eax, eax
je 0x409d32
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409d32
mov eax, dword [0x42cf74]
cmp eax, ebx
je 0x409d32
push eax
call fcn.00404a59
pop ecx
test eax, eax
je 0x409d32
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42cf6c]
call fcn.00404a59
pop ecx
test eax, eax
je 0x409d52
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409d54
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x753370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x75338e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x77c074
push ecx
mov edi, eax
call fcn.00767198
mov esi, eax
add esp, 8
test esi, esi
jne 0x7533cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0076702e
push esi
call fcn.00766fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x756850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x7568ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x781720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x7568ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.007671e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x7568ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x781720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x75692a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00768082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x756957
mov word [eax], si
add eax, 2
push eax
call fcn.00768030
add esp, 4
jmp 0x756959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x7568ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x7568b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x756ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x757080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x7570c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x77c458
push ecx
call fcn.007671e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.007671e1
add esp, 0x10
jmp 0x7570d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0076720b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00766dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00757050
mov eax, dword [0x781728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x75713b
push esi
call fcn.00756fb0
add esp, 4
mov dword [0x781728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x75714c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00756ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x75a440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x75a4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x75a48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x75a471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x75a47e
add edx, ecx
cmp ebx, edx
jb 0x75a48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x75a467
xor ecx, ecx
jmp 0x75a4a2
test eax, eax
jne 0x75a492
xor ecx, ecx
jmp 0x75a4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0075a3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x75a8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x75a921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x75a946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x75a96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x75a993
push ecx
push esi
call fcn.0075a4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret