joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b040
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4750fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.0041bda0
add esp, 0xc
movsx ecx, byte [ebp + 8]
push ecx
push 0x469630
lea edx, [ebp - 0x110]
push edx
call fcn.0041bfd7
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x44b0a7
mov eax, 1
jmp 0x44b0a9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b731
mov esp, ebp
pop ebp
ret 4

Function at 0x44b220
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4750fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], ecx
mov al, byte [0x45c9fe]
mov byte [ebp - 0x218], al
push 0x103
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.0041bda0
add esp, 0xc
mov dl, byte [0x45c9ff]
mov byte [ebp - 0x110], dl
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.0041bda0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xffffffff
jne 0x44b2a5
or eax, 0xffffffff
jmp 0x44b40c
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
lea edx, [ebp - 0x228]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x44b2eb
mov edx, dword [ebp - 0x228]
mov byte [ebp + edx - 0x110], 0
cmp dword [ebp - 0x228], 1
ja 0x44b3dc
mov dword [ebp - 0x230], 0
mov byte [ebp - 0x22c], 0x43
mov byte [ebp - 0x22b], 0x3a
mov byte [ebp - 0x22a], 0x5c
mov byte [ebp - 0x229], 0
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
je 0x44b343
cmp dword [ebp - 0x234], 0
jne 0x44b34f
mov dword [ebp - 0x230], 1
jmp 0x44b36a
mov cl, byte [ebp - 0x22c]
add cl, 1
mov byte [ebp - 0x22c], cl
movsx edx, byte [ebp - 0x22c]
cmp edx, 0x5a
jl 0x44b31e
cmp dword [ebp - 0x230], 0
jne 0x44b378
jmp 0x44b3fd
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x44b3dc
movzx edx, byte [ebp - 0x22c]
push edx
mov ecx, dword [ebp - 0x238]
call fcn.0044b0e0
test eax, eax
jne 0x44b3c9
movzx eax, byte [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 0x238]
call fcn.0044b040
test eax, eax
jne 0x44b3dc
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
mov dword [ebp - 0x21c], eax
push 0x104
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
jne 0x44b2a5
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b731
mov esp, ebp
pop ebp
ret
Function at 0x44bab0
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov byte [ebp - 9], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x44bae9
jmp 0x44bb7a
mov edx, dword [ebp - 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x44bb00
jmp 0x44bb7a
mov eax, dword [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44bb17
jmp 0x44bb7a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x44bb2c
jmp 0x44bb7a
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44bb72
mov byte [ebp - 9], 1
xor edx, edx
jne 0x44bacb
cmp dword [ebp - 8], 0
je 0x44bb8a
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x44bb9a
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44bbb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x60], ecx
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.0041bda0
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
xor ecx, ecx
mov word [ebp - 0x28], cx
push 0x10
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0041bda0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x44bc33
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess22_failed__err:0x_x_n
push 0x47fcf0
call fcn.0043c100
add esp, 0xc
xor al, al
jmp 0x44bc55
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x44bca0
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4750fc]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x13c], ecx
mov byte [ebp - 0x130], 0
push 0x103
push 0
lea eax, [ebp - 0x12f]
push eax
call fcn.0041bda0
add esp, 0xc
lea ecx, [ebp - 0x138]
push ecx
call fcn.0044bc60
add esp, 4
lea edx, [ebp - 0x138]
push edx
call fcn.0044bc80
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x46b6d8
mov dword [ebp - 0x1c], 0x46b6dc
mov dword [ebp - 0x18], 0x46b6e0
mov dword [ebp - 0x14], 0x46b6e4
mov dword [ebp - 0x10], 0x46b6e8
mov dword [ebp - 0xc], 0x46b6ec
mov dword [ebp - 8], 0x46b6f0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [ebp + eax*4 - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s__s__02d
lea eax, [ebp - 0x130]
push eax
call fcn.0041bfd7
add esp, 0x14
lea ecx, [ebp - 0x130]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x44bd76
push 1
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0041b731
mov esp, ebp
pop ebp
ret 4
Function at 0x450c00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x4750fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xf0]
cmp dword [eax + 0x64], 0
jge 0x450c40
mov eax, 1
jmp 0x450e52
push 0
push str.SAMDomainsAccountUsersNames_
push 0
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ecx + 0x64]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + edx*4 + 0x30]
push ecx
call fcn.0043ea50
add esp, 0x10
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jne 0x450c98
push str.Cant_find_any_user_account_in_your_SAM_database
mov edx, dword [ebp - 0xf0]
add edx, 0x101
push edx
call fcn.0041d8b0
add esp, 8
mov eax, 1
jmp 0x450e52
push str._RID_____________Username______________Admin____Lock_____n
call fcn.0041dd11
add esp, 4
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xec]
push ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0xe8]
add eax, 4
push eax
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ecx + 0x64]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + edx*4 + 0x30]
push ecx
call fcn.0043f2b0
add esp, 0x14
test eax, eax
jle 0x450e50
mov edx, dword [ebp - 0xdc]
push edx
push 0x46aa60
push 0xb4
lea eax, [ebp - 0xd8]
push eax
call fcn.0041d9c9
add esp, 0x10
push 0x181
lea ecx, [ebp - 0xd8]
push ecx
push 0
mov edx, dword [ebp - 0xf0]
mov eax, dword [edx + 0x64]
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ecx + eax*4 + 0x30]
push edx
call fcn.00440380
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1f4
jne 0x450d5c
push 0x80
mov eax, dword [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0xf0]
add ecx, 0x80
push ecx
call fcn.0041da80
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
push 0x46aa88
push 0xb4
lea eax, [ebp - 0xd8]
push eax
call fcn.0041d9c9
add esp, 0x10
push 0x81
push 3
lea ecx, [ebp - 0xd8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0xf0]
mov eax, dword [edx + 0x64]
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ecx + eax*4 + 0x30]
push edx
call fcn.0043fc40
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x450dc9
lea eax, [ebp - 0xd8]
push eax
push str.Cannot_find_value___s__n
call fcn.0041dd11
add esp, 8
jmp 0x450ca5
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0xcc
jge 0x450df0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0xd8]
push ecx
push str.list_users:_Value___s__is_too_short__only__d_bytes__to_be_a_SAM_user_V_struct__n
call fcn.0041dd11
add esp, 0xc
jmp 0x450e10
push 0
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
add edx, 4
push edx
mov ecx, dword [ebp - 0xf0]
call fcn.0044ffe0
cmp dword [ebp - 8], 0
je 0x450e29
mov eax, dword [ebp - 8]
push eax
call fcn.0041baa5
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0xdc], 0
je 0x450e4b
mov ecx, dword [ebp - 0xdc]
push ecx
call fcn.0041baa5
add esp, 4
mov dword [ebp - 0xdc], 0
jmp 0x450ca5
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b731
mov esp, ebp
pop ebp
ret
Function at 0x451900
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x4750fc]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x451923
mov eax, 1
jmp 0x451ad2
mov eax, dword [ebp + 0xc]
push eax
call fcn.00434180
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00434130
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xcc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0xd0]
jle 0x451a04
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x1b8]
push eax
call fcn.004342a0
add esp, 8
test eax, eax
jne 0x4519cb
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x1b8]
push eax
call fcn.004341d0
add esp, 0xc
test eax, eax
jne 0x4519cb
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x1b8]
push edx
call fcn.00434350
add esp, 8
test eax, eax
jne 0x4519cb
mov dword [ebp - 0x1c0], 0
jmp 0x4519d5
mov dword [ebp - 0x1c0], 1
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
je 0x4519f5
mov eax, dword [ebp - 0x1bc]
jmp 0x451ad2
lea ecx, [ebp - 0x48]
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0xcc]
mov dword [ebp + 0x14], edx
mov dword [ebp - 4], 0
jmp 0x451a16
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x14]
jge 0x451a4e
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, 0x36
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0xc8], al
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, 0x5c
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx + 0xf8], al
jmp 0x451a0d
jmp 0x451a59
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xd0]
jge 0x451a7e
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0xc8], 0x36
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx + 0xf8], 0x5c
jmp 0x451a50
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x10
push ecx
call fcn.004342a0
add esp, 8
test eax, eax
jne 0x451ac2
mov edx, dword [ebp - 0xd0]
push edx
lea eax, [ebp - 0xc8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x10
push ecx
call fcn.004341d0
add esp, 0xc
test eax, eax
jne 0x451ac2
mov dword [ebp - 0x1c4], 0
jmp 0x451acc
mov dword [ebp - 0x1c4], 1
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041b731
mov esp, ebp
pop ebp
ret
Function at 0x41888e
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], ecx
push 0x20
pop ebp
xor eax, eax
mov edi, dword [esp]
test al, 1
jne 0x4188dc
lea eax, [edi + ebp]
mov esi, ebp
mov dword [esp], eax
push 2
push ebp
push edi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ebx, eax
xor ebp, ebp
mov al, 1
cmp ebx, 0xbfffffff
jbe 0x41889b
push esi
push edi
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
mov al, 1
jne 0x41889b
and ebx, 0x7fffffff
mov eax, ebx
jmp 0x4188de
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41fe10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x103
lea edx, [ebp - 0x18]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x41fe62
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x18]
cmp eax, 0x103
je 0x41fe83
test eax, eax
js 0x41fe6d
mov eax, dword [ebp - 0x14]
mov bl, 4
jmp 0x41fe76
xor ebx, ebx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov byte [esi], bl
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x10]
mov dword [ebp - 0x40], 0x407718
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x34], 0
push eax
call fcn.0041f4b0
add esp, 4
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
call fcn.0041f610
mov ecx, 7
int 0x29
ud2
Function at 0x4251a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ecx + 8]
mov esi, dword [ecx + 4]
xor ebx, ebx
mov eax, 0
mov dword [ebp - 0x14], edx
cmp edi, 3
jb 0x4251f0
movzx edx, byte [edi + esi - 2]
xor ebx, ebx
mov eax, edx
and al, 0xf0
cmp al, 0xa0
mov eax, 0
jne 0x4251f0
xor ebx, ebx
cmp byte [edi + esi - 3], 0xed
jne 0x4251f0
movzx ebx, byte [edi + esi - 1]
and edx, 0xf
mov al, 1
shl edx, 0x10
and ebx, 0x3f
shl ebx, 0xa
or ebx, edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], ecx
cmp edx, 3
jb 0x425237
mov ecx, dword [ebp - 0x14]
cmp byte [ecx], 0xed
jne 0x42523f
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx + 1]
mov dword [ebp - 0x18], ecx
and cl, 0xf0
cmp cl, 0xb0
setne cl
xor al, 1
or al, cl
jne 0x42523f
mov eax, dword [ebp - 0x14]
cmp edi, 3
movzx ecx, byte [eax + 2]
jae 0x4252b3
mov esi, dword [ebp - 0x10]
jmp 0x4252bc
test edx, edx
je 0x425315
mov ebx, dword [ebp - 0x14]
lea esi, [ebx + edx]
jmp 0x42525a
add ebx, 2
cmp eax, esi
cmovne eax, ebx
nop
cmp eax, esi
mov ebx, eax
je 0x425315
movzx ecx, byte [ebx]
lea eax, [ebx + 1]
test cl, cl
jns 0x425250
cmp cl, 0xe0
jb 0x425247
cmp cl, 0xed
jne 0x425292
cmp eax, esi
je 0x425315
lea eax, [ebx + 2]
cmp eax, esi
je 0x425315
cmp byte [ebx + 1], 0x9f
ja 0x42530e
add ebx, 3
mov eax, ebx
jmp 0x425250
add ebx, 2
cmp eax, esi
cmove ebx, eax
xor eax, eax
cmp ebx, esi
setne al
add eax, ebx
cmp cl, 0xf0
jb 0x425250
xor ecx, ecx
cmp eax, esi
setne cl
add eax, ecx
jmp 0x425250
mov esi, dword [ebp - 0x10]
add edi, 0xfffffffd
mov dword [esi + 8], edi
mov eax, dword [ebp - 0x18]
and ecx, 0x3f
shl eax, 6
mov dword [ebp - 0x18], eax
lea eax, [edx + 1]
mov edx, ecx
mov ecx, dword [esi]
sub ecx, edi
cmp ecx, eax
jb 0x425365
mov eax, dword [ebp - 0x18]
or ebx, edx
add dword [ebp - 0x14], 3
mov ecx, esi
and eax, 0x3c0
or ebx, eax
add ebx, 0x10000
mov edx, ebx
call fcn.00423ef0
mov edx, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [esi + 8]
add edx, 0xfffffffd
sub eax, edi
cmp eax, edx
jb 0x425381
mov eax, dword [esi + 4]
jmp 0x425323
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xc], 0
mov esi, dword [ebp - 0x10]
mov eax, dword [esi]
sub eax, edi
cmp eax, edx
jb 0x425341
mov eax, dword [ebp - 0x1c]
add eax, edi
push edx
push dword [ebp - 0x14]
push eax
mov ebx, edx
call fcn.00429620
add esp, 0xc
add edi, ebx
mov dword [esi + 8], edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, edi
mov ecx, esi
push 1
push 1
push dword [ebp + 8]
call fcn.004379e0
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
add esp, 0xc
mov eax, dword [esi + 4]
mov edi, dword [esi + 8]
mov dword [ebp - 0x1c], eax
jmp 0x425320
mov dword [ebp - 0x10], edx
mov edx, edi
mov ecx, esi
push 1
push 1
push eax
call fcn.004379e0
mov edx, dword [ebp - 0x10]
add esp, 0xc
jmp 0x4252d9
mov ebx, edx
mov edx, edi
mov ecx, esi
push 1
push 1
push ebx
call fcn.004379e0
mov edx, ebx
add esp, 0xc
mov edi, dword [esi + 8]
jmp 0x425309
Function at 0x4291b3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x4291f2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4291f2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4291f2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4291f2
cmp dword [ecx + 0x74], 0xe
jbe 0x4291f2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4305e2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43067f
push ebx
push esi
call fcn.004305ab
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004304f4
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43062c
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43067e
push edi
push eax
call fcn.004311e2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43064c
call fcn.0042f19f
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43067d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004304f4
add esp, 0x20
test eax, eax
jne 0x43066b
push edi
call fcn.0042f19f
jmp 0x430673
push ebx
call fcn.0042f19f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x431965
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x409f60
push 0x409f58
push 0x408bec
push 0x1e
call fcn.00431826
mov esi, eax
add esp, 0x10
test esi, esi
je 0x431999
push dword [ebp + 8]
mov ecx, esi
call dword [0x43c198]
call esi
jmp 0x43199f
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4319e3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x409f70
push 0x409f68
push 0x408c10
push 0x20
call fcn.00431826
mov esi, eax
add esp, 0x10
test esi, esi
je 0x431a1a
push dword [ebp + 8]
mov ecx, esi
call dword [0x43c198]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]
Function at 0x436de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x436e0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x436e0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x852370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x85238e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x87b074
push ecx
mov edi, eax
call fcn.00866198
mov esi, eax
add esp, 8
test esi, esi
jne 0x8523cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0086602e
push esi
call fcn.00865fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x855850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x8558ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x880720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x8558ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.008661e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x8558ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x880720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x85592a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00867082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x855957
mov word [eax], si
add eax, 2
push eax
call fcn.00867030
add esp, 4
jmp 0x855959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x8558ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x8558b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x855ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret